[Problem] Modding Setup or AMITSE results in blank setup utility

[David112x]

As the title suggests, after using UEFI Editor to edit the BIOS Setup to show hidden settings, modding it all into a dump of my laptop’s BIOS… well this is what the BIOS setup looked like after flashing the modded image:

And here’s how it’s supposed to look (don’t mind the BIOS outputting to my external monitor, I was doing other stuff when I took this photo):

HPVictus.zip

That zip file includes all of the dumps + mods.

A lot of the files in there are related to me trying to mod HP_BBUpdate, making sure the Startup AP data padding file was good (that’s why there’s so many modded BIOS images), then there’s the actual Setup mods that I tried inside “Files\SetupMods”

(Also, if I used a modded BIOS image that had basically no mods other than the patched HP_BBUpdate and PrjPei, it would work fine)

So, does anyone have any ideas as to what could be the problem?

[MeatWar]

Too many “Unlocks” variables touched…???
You know that this is an HP bios and usually not a “pure” AMI bios standard… it is based on AMI only.

[Sweet_Kitten]

Sure modding amitse results in blank setup too?
This is usually the case when modding Section_PE32_image_Setup using the editor. Manual edits must work fine.

[David112x]

I have no idea how to do manual edits, I’m pretty new to this and yeah I’m not sure that modding AMITSE results in a blank setup, I tried another mod, changelog looks like this

========== Section_PE32_image_Setup_Setup.sct ==========

Unsuppressed 0x242F8
Unsuppressed 0x2430D
Unsuppressed 0x24322
Unsuppressed 0x244B2
Unsuppressed 0x24539
Unsuppressed 0x254CD
Unsuppressed 0x25502
Unsuppressed 0x2553E
Unsuppressed 0x2556F
Unsuppressed 0x255F9
Unsuppressed 0x25661
Unsuppressed 0x256C6
Unsuppressed 0x25778
Unsuppressed 0x2848B



========== Section_Freeform_subtype_GUID_setupdata_setupdata_AMITSESetupData_body.bin ==========

Secure Boot | QuestionId 0x28BC: Access Level 21 -> 05

(This is what the “TestGMod.bin” modded image has)
Even that didn’t work so I guess it’s just when modding Setup.

[Sweet_Kitten]

@David112x

I have no idea how to do manual edits

You have the offsets. Just change Question type {12} or {14} → to False {47}. UEFI Editor doesn’t unsupress this way, so yes, I think this is the issue.

Also, we could try patching with SREP. My friends and I recently discovered a trick how to use the program and unlock more AMI devices. That’d be nice to try the trick on HP. I’m curious if it’ll work as good as for NUC X15. Also, if @Outsyde still has their laptop, this would be good news.

[David112x]

SREP huh… using Smokeless UMAF/SuppresssIFPatcher.efi?

If that’s it, well isn’t that temporary? I want a more permanent solution so yeah

And as for doing it manually, are there any guides? because I have no idea how to do that even with the required info

Edit: wait I forgot SREP had a patch function

[Sweet_Kitten]

@David112x

well isn’t that temporary? I want a more permanent solution so yeah

You right, it’s a temporary solution. I don’t ask to give up on your plan to flash a mod, but rather test srep just for fun. You see, there is no boot guard in Victus 8A3E board, so you patch BBUPDATE driver and there’s no more protection. However, lots of HP laptops do have BG, and I want to check if srep can unlock them bios.

Since only you appeared at the right time with the right device, I’m trying not to miss the opportunity. If you’re not up to, it’s fine.

@David112x

And as for doing it manually, are there any guides?

I can do it for you.
I didn’t expect you doing it. Moreover, I didn’t publish the right version of the patcher yet.


As for Setup patches, look at the following example

@BDMaster

0x4F14A Suppress If {0A 82}
0x4F14C True {46 02} >> 46 to 47 False
0x4F14E One Of: High Precision Timer, VarStoreInfo (VarOffset/VarName): 0xA1B, VarStore: 0x1, QuestionId: 0x877, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 AB 10 AC 10 77 08 01 00 1B 0A 10 10 00 01 00}
0x4F15F One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
0x4F166 One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 30 00 01}
0x4F16D End One Of {29 02}
0x4F16F End If {29 02}

Basically, change any byte after “Suppress If” to byte 47. This will remove the suppression from nested items.

[David112x]

Well I wouldn’t mind testing SREP, that’s fine, also by BG I’m guessing you mean Intel Boot Guard which would make sense since my laptop has an AMD CPU (I specifically avoided Intel ones when I was getting mine).

If you want you can try doing it for me but I’ll do it myself later, maybe tonight or tomorrow.

[David112x]

Okay well, I tried it and it worked, though thanks to HP and it’s horrible BIOS Setup Utility, I don’t think getting any of the unlocked pages to show up without UiApp.efi is going to be possible, I already tried that before and it didn’t work with UiApp, so I have less hopes of it working with the built in BIOS Setup Utility, so I guess now I’ll just have to use UiApp for configuring hidden settings, like I’ve always done, except that this time I don’t have to use SuppressIfPatcher.efi, to make things easier on myself, I’ll just copy UiApp.efi from my USB drive over to my NVMe’s EFI partition, that way I don’t need the USB drive anymore.

I also faced some difficulties while flashing (even though I made sure that the clip was making good contact by trying different positions till I got a good dump, save the dump, save it’s CRC32 checksum, then read the chip 2 more times, if I got a bad checksum, find another position, then try again for a total of 3 times, if those 3 times matched the checksum from the good dump, then I’d assume that I was good to go.

I never had a situation in which I got a good dump, then a bad one, then a good one with a checksum different from the previous good one and the way I check them is using UEFITool 0.28 for inconsistencies, since it’ll tell me if any volumes in the image can’t be read, which is usually a good indicator and so far has proven to be reliable.

Now the only thing that’s left is to get rid of the need for UiApp.efi, aka make “IBV Advanced” show up.

The idea was that Security gets replaced by another Security page with more options, then the hidden “Advanced” page (which is empty) gets replaced by “IBV Advanced” and replacing the Exit page with the “Save & Exit” one and that’d be it

So, Main stays the same, Security page gets replaced by another one with more options, “invisible” Advanced gets replaced by IBV Advanced (and hopefully made visible in the tabs), Exit gets replaced with “Save & Exit”

========== Section_PE32_image_AMITSE_AMITSE.sct ==========
Advanced | FormId 0x2719 -> IBV Advanced | FormId 0x2712
Security | FormId 0x271A -> Security | FormId 0x2714
Exit | FormId 0x271C -> Save & Exit | FormId 0x2716

Something like that.

[Sweet_Kitten]

@David112x

Main stays the same, Security page gets replaced by another one with more options, “invisible” Advanced gets replaced by IBV Advanced (and hopefully made visible in the tabs), Exit gets replaced with “Save & Exit”

Here’s an archive with 2 mods based on your preferences.
HPVictus15_F.24_GoodMod+AMITSE.bin has BB_Update and AMITSE patched, and
HPVictus15_F.24_GoodMod+AMITSE+Setup.bin is everything the same but with settings I guessed you want unsuppressed (legacy support, usb controls).
If it works, CBS and PBS should be available as well, from the IBV Advanced.

Also, the archive with srep: HP 8A3E.zip.
I aim testing the program intentionally overcomplicated way, so I put it step by step.

1. Disable secure boot. 2. Unpack the archive to a flash drive and boot from it.
2. Efi shell will try to add SREP to “boot order”.
3. Check if status message indicates that a new driver entry added successfully.
4. If everything up to this step went well, try rebooting your laptop and entering bios. Now it shouldn’t enter instantly. Expect SREP running first. After this, IBV Advanced should become available.
5. Unplug the usb and delete the entrys (optional).

I understand that the laptop’ BBS Popup has an option to enter bios, which makes the editing of driver order meaningless. I just want to make sure nothing triggers variable lock.

[David112x]

By the way, would it be possible to add CSM to the BIOS? there’s a setting for it but it does nothing when enabled (except for a few changes in POST and Secure Boot being greyed out along with the options to load and/or clear the secure boot keys):

[David112x]

Tested the SREP mod and… woah.

Honestly quite incredible, that aside I’m surprised you were able to get this to work the way it does, is this how the modded images you sent also look like?

Edit: Is the order supposed to be like that? I was hoping for something like:

1. Main
2. Configuration
3. IBV Advanced
4. Security
5. Boot Options
6. Save & Exit

[Sweet_Kitten]

@David112x

By the way, would it be possible to add CSM to the BIOS?

Idk. You tell me there’s a setting for it, which does nothing. I don’t know how to make it what it is supposed to.

@David112x

is this how the modded images you sent also look like?

Yes.
And the order is supposed to be as this. It must be pre-defined somewhere, not sure where. Never tried to change it.

Thanks for the test.

[David112x]

I was just asking if it was possible to add CSM to it, I mean I searched through other posts and apparently if the option is there then it might be possible but I wanted to get confirmation, it’s fine.

And hey, no problem, thanks for the mods, though I gotta ask, where did you learn how to mod AMITSE like that? Are there any guides that you think I might be interested in?

As for the order of the tabs well I’m thinking that it might be in reverse, so in the BIOS setup utility the “Main” tab might be the first one but in AMITSE itself it’s the last one, I dunno I’m just trying to come up with something as to why the order cane out the way it did, oh well, thanks anyway.

[Sweet_Kitten]

@David112x

where did you learn how to mod AMITSE like that?

I learnt from one posting. OverPowered TONGFANG CyberPower Machrevo MACHENIKE - Unlocked BIOS Guide W/ Files
I don’t know which guides could be helpful. Try searching for something specific.

@David112x

As for the order of the tabs well I’m thinking that it might be in reverse, so in the BIOS setup utility the “Main” tab might be the first one but in AMITSE itself it’s the last one

If you add AMD CBS menu as a tab, what position do you think it’ll have? It’s outside of the Setup module.
The order can be related to Form Id value.

[David112x]

I was looking at your mod (specifically the SREP one) and I noticed this:

4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 18 27

Specifically the “18 27”, because I had the idea of searching that set of numbers in the extracted Setup IFRs and found that the last two bytes, 18 27 point to some data that is part of the Form ID:

0x27DF5: 	Form FormId: 0x2718, Title: "Main" { 01 86 18 27 50 04 }

So with this in mind, I guess I could make my own mods?

Well - back to the order, opening a BIOS image from my laptop in AMIBCP shows up like this:

Now it may not look like much, but notice the way the Forms are ordered here, IBV Advanced, Security and Save & Exit all come before the Forms that the HP BIOS originally came with, following this order, if IBV Advanced, Security and Save & Exit were to be added and displayed, in the BIOS Setup Utility’s tabs, IBV Advanced should be first, then Security, then Save & Exit and finally all of the following Forms that the BIOS originally had, Main, Advanced (which doesn’t even show up), Security, Configuration, Boot Options and lastly, Exit.

I still don’t know where the order is defined in the BIOS, but I know that AMIBCP should be getting it from the same place that the BIOS does when setting up the Setup Utility (aka just the built in Form Browser), thought this might’ve been worth sharing, but I think you already knew this.

If I were to add the AMD CBS menu as a tab, I have no idea where it would go but it’ll probably be the last tab? not sure, but you could look at UiApp.efi from UMAF_BETA.zip or UniversalAMDFormBrowser, since that manages to put a page called “Front Page” before anything else, could check the Form IDs to see if that’s relevant when it comes to ordering (which it most likely is):

Either the Form ID is taken into account when sorting, or the bytes used to reference the Form ID are.

[Sweet_Kitten]

@David112x

18 27 point to some data that is part of the Form ID:
So with this in mind, I guess I could make my own mods?

Anyone can do so.

@David112x

I still don’t know where the order is defined in the BIOS, but I know that AMIBCP should be getting it from the same place

The order is the same indeed.
But I don’t think AMIBCP is getting the tabs layout from the same place. I can change what’s shown in AMIBCP, but this won’t affect the order.

@David112x

If I were to add the AMD CBS menu as a tab, I have no idea where it would go but it’ll probably be the last tab?

Yes, it’d go as the last tab. It’d have the highest form id among the others, 0x7000. Front Page probably has 0x1. Don’t remember exactly.

[David112x]

Sorry I’m reviving an old thread but I have some news.

Let’s just say I might’ve lost my sanity and decided I should try to remove the HP branding from my laptop’s BIOS UI by replacing the AMITSE driver with a suitable replacement and… here we are.

The suitable replacement comes from an ASRock Rack X470D4U2-2T, BIOS version 4.10, released 8/12/2021.

The way I tested this was simple, instead of modding the new AMITSE driver right into the BIOS image, I just modify it so it includes the necessary setup pages, boot up UEFI Shell, load the new AMITSE driver with UEFI Shell and then launch UiApp.efi (from Smokeless_UMAF, I don’t know if any newer builds of UiApp.efi would work for testing).

I think you get the idea.

Now, the reason why there’s a blue background as well as a bunch of missing strings (such as “Aptio Setup - AMI”) is because this driver isn’t meant to be loaded this way, if I load the stock HP AMITSE driver like this then launch UiApp.efi, it’ll also face the exact same issues with missing strings and whatnot.

Bonus points for being able to have the setup objects just like I wanted them to be.

Again, why did I do this? no clue, I just thought it might’ve been funny to try this.

[David112x]

Well, the mod is done, I can’t help but find this insane.

This is actually cursed and the fact that it just works is even more baffling.

[David112x]

As it turns out, this only worked because of the AMITSESetup variable having a size of 0x51 somehow, which I guess is because of me messing around, experimenting with several AMITSE drivers, one of them must’ve expanded the variable from 0x41 to 0x51, because in the defaults, the variable is defined as having a size of 0x51.

This means that if I am to reset the CMOS or all BIOS settings to their defaults, it’d be normal for me to get a “Enter Password” prompt if I try going to boot menu, but what’s weird is that it doesn’t apply whenever I go to the BIOS setup.

I’m looking into writing a custom driver that’ll take care of resetting the CMOS exactly like how the HP AMITSE would, except that the AMITSESetup variable would have the missing bits and the size set to what the ASRock AMITSE expects.

Edit for the mods: Should this all be moved to a new thread?