I posted about this about half a year ago but got no replies, so I’m trying my luck again. I want to unlock my laptop’s BIOS, which has some hidden advanced options available.
https://www.acer.com/ac/en/US/content/su…roduct/7213?b=1
I am running the latest BIOS available, version 1.22 (Acer supported a gaming laptop for 2 years… sad).
I don’t have a flasher, but am ready to get one if needed.
Thanks for any help in advance.
@brian105 - Sorry I missed your previous post about this, you should have bumped your thread then too! 
Flash programmer may or may not be needed, sometimes we can get past the locks without it 
This BIOS, once unlocked, will give you some options this time!! And this one I can unlock too!
Please do below and let me know what error you get on step #2 - DO NOT send me file from #1 yet, you can actually toss it out, or rename to .old, after you do step #2, because we will create a new once at next step when we unlock things to get past the error at step #2
If you have already modified the BIOS in ANY way, you will need to re-flash it back to factory defaults using factory method (NOT FPT)!!!
Additionally, please remove all BIOS passwords, disable secure boot, and disable TPM or Encryption if you have enabled. Do this before moving on to below
If you do not have Intel ME drivers installed, install them now from your system driver download page, then start over here after reboot.
Check your BIOS’ main page and see if ME FW version is shown. If not then > DOWNLOAD HWINFO64 HERE <
Once HWINFO is open, look at the large window on the left side, expand motherboard, and find the ME area.
Inside that section is the ME Firmware version. Take note of the version. (ie. write it down or get a screenshot)
Once you have that, go to the thread linked below, and in the section “C.2” find and download the matching ME System Tools Package for your system.
(ie if ME FW version = 10.x get V10 package, if 9.0-9.1 get V9.1 package, if 9.5 or above get V9.5 package etc)
> DOWNLOAD " ME System Tools " packages HERE <
Once downloaded, inside you will find Flash Programming Tool folder, and then inside that a Windows or Win/Win32 folder (NOT x64).
Highlight that Win/Win32 folder, then hold shift and press right click. Choose “open command window here” (Not power shell! >> * See Registry file below *).
If you get an error, reply to this post with a screenshot of it, OR write down the EXACT command entered and the EXACT error given.
((If “open command window here” does not appear, look for the “Simple Registry Edit” below…))
Step #1
Now you should be at the command prompt.
You are going to BACKUP the factory un-modified firmware, so type the following command:
Command: " FPTw.exe -bios -d biosreg.bin "
>> Attach the saved "biosreg.bin ", placed into a compressed ZIP/RAR file, to your next post!!! <<
Step #2
Right after you do that, try to write back the BIOS Region dump and see if you get any error(s).
Command: " FPTw.exe -bios -f biosreg.bin "
^^ This step is important! Don’t forget! ^^
If you get an error, reply to this post with a screenshot of it, OR write down the EXACT command entered and the EXACT error given.
Here is a SIMPLE REGISTRY EDIT that adds “Open command window here as Administrator” to the right click menu, instead of Power Shell
Double-click downloaded file to install. Reboot after install may be required
> CLICK HERE TO DOWNLOAD CMD PROMPT REGISTRY ENTRY <
If the windows method above does NOT work for you…
Then you may have to copy all contents from the Flash Programming Tool \ DOS folder to the root of a Bootable USB disk and do the dump from DOS
( DOS command: " FPT.exe -bios -d biosreg.bin " )
Additionally, please remove all BIOS passwords, disable secure boot, and disable TPM or Encryption if you have enabled. Do this before moving on to below
If you do not have Intel ME drivers installed, install them now from your system driver download page, then start over here after reboot.
Check your BIOS’ main page and see if ME FW version is shown. If not then > DOWNLOAD HWINFO64 HERE <
Once HWINFO is open, look at the large window on the left side, expand motherboard, and find the ME area.
Inside that section is the ME Firmware version. Take note of the version. (ie. write it down or get a screenshot)
Once you have that, go to the thread linked below, and in the section “C.2” find and download the matching ME System Tools Package for your system.
(ie if ME FW version = 10.x get V10 package, if 9.0-9.1 get V9.1 package, if 9.5 or above get V9.5 package etc)
> DOWNLOAD " ME System Tools " packages HERE <
Once downloaded, inside you will find Flash Programming Tool folder, and then inside that a Windows or Win/Win32 folder (NOT x64).
Highlight that Win/Win32 folder, then hold shift and press right click. Choose “open command window here” (Not power shell! >> * See Registry file below *).
If you get an error, reply to this post with a screenshot of it, OR write down the EXACT command entered and the EXACT error given.
((If “open command window here” does not appear, look for the “Simple Registry Edit” below…))
Step #1
Now you should be at the command prompt.
You are going to BACKUP the factory un-modified firmware, so type the following command:
Command: " FPTw.exe -bios -d biosreg.bin "
>> Attach the saved "biosreg.bin ", placed into a compressed ZIP/RAR file, to your next post!!! <<
Step #2
Right after you do that, try to write back the BIOS Region dump and see if you get any error(s).
Command: " FPTw.exe -bios -f biosreg.bin "
^^ This step is important! Don’t forget! ^^
If you get an error, reply to this post with a screenshot of it, OR write down the EXACT command entered and the EXACT error given.
Here is a SIMPLE REGISTRY EDIT that adds “Open command window here as Administrator” to the right click menu, instead of Power Shell
Double-click downloaded file to install. Reboot after install may be required
> CLICK HERE TO DOWNLOAD CMD PROMPT REGISTRY ENTRY <
If the windows method above does NOT work for you…
Then you may have to copy all contents from the Flash Programming Tool \ DOS folder to the root of a Bootable USB disk and do the dump from DOS
( DOS command: " FPT.exe -bios -d biosreg.bin " )
Thanks. The error I got when trying to write the BIOS was, "Error 368: Failed to disable write protection for the BIOS space. FPT Operation Failed."
@brian105 - Thanks! Now, please download the following package, and run the command below from each versions folder that directly contains it’s exe.
Once done, copy the entire folder somewhere, delete everything but any created vars.txt and then repackage this and send to me, this way all created vars.txt remain in place in the folders of the version that created them.
http://s000.tinyupload.com/index.php?fil…212104496994806
H2OUVE.exe -gv vars.txt
http://s000.tinyupload.com/index.php?fil…293783107048205
Here you go. There should be a vars.txt in each folder.
@brian105 - Thanks, please drop this file into H20UVE_100.00.16.08 folder and then run the following command from that folders location >> H2OUVE.exe -sv varsM.txt
There will be long list of success/fail, this is normal and expected, reboot once it’s done. We are writing to [03D] and [016], if both = success then error at #2 should be gone, unless there is a lock inside a module aside from the settings themselves locking things down
After reboot, do FPT step #1-2 again using new name if you did not delete the previously created file. #2 should pass, if so send me file created at this time using step #1. If #2 still fails, tell me error #
http://s000.tinyupload.com/index.php?fil…349872079358016
Sadly, there’s a new error:
GbE Region does not exist.
Error 316: Protected Range Registers are currently set by BIOS, preventing flash access.
Please contact the target system BIOS vendor for an option to disable Protected Range Registers.
FPT Operation Failed.
@brian105 - Sorry, I forgot to mention GbE region does not exist is normal, but error 316 is unexpected here, you may need flash programmer 
When you were flashing back edited vars, did 03D and 016 both say success?
Please run this command with FPT and show me image of the entire output >> FPTw.exe -i
Yes, both 03D and 016 were set successfully. Here is the output of the command:
Intel (R) Flash Programming Tool. Version: 11.8.77.3665
Copyright (c) 2007 - 2019, Intel Corporation. All rights reserved.
Reading HSFSTS register… Flash Descriptor: Valid
— Flash Devices Found —
W25Q64FV ID:0xEF4017 Size: 8192KB (65536Kb)
— Flash Image Information –
Signature: VALID
Number of Flash Components: 1
Component 1 - 8192KB (65536Kb)
Regions:
DESC - Base: 0x00000000, Limit: 0x00000FFF
BIOS - Base: 0x00200000, Limit: 0x007FFFFF
CSME - Base: 0x00001000, Limit: 0x001FFFFF
GbE - Not present
PDR - Not present
EC - Not present
Master Region Access:
CPU/BIOS - ID: 0x00, Read: 0x00B, Write: 0x00A
ME - ID: 0x00, Read: 0x00D, Write: 0x00C
GbE - ID: 0x00, Read: 0x009, Write: 0x008
EC - ID: 0x00, Read: 0xFFF, Write: 0xFFF
Total Accessible SPI Memory: 8192KB, Total Installed SPI Memory: 8192KB
FPT Operation Successful.
@brian105 - Thanks!
OK, looks like we can get around this via direct volume flash instead of entire BIOS region flash!
Please send me your newly created BIOSreg.bin file from AFTER the mod vars flash in.
@brian105 - Thanks, now run this command and send me this created file, and test flashing it back as outlined below too (should be success)
FPTw.exe -a 0x252000 -l 0x2EF000 -d DXEvol2.bin << Read
FPTw.exe -a 0x252000 -l 0x2EF000 -f DXEvol2.bin << Write
If you can write this back, then we can do BIOS unlock without programmer
It gives the same error as before, unfortunately:
Error 316: Protected Range Registers are currently set by BIOS, preventing flash access.
Please contact the target system BIOS vendor for an option to disable Protected Range Registers.
FPT Operation Failed.
Forgot to add the file: http://s000.tinyupload.com/index.php?fil…116588136532267
Bummer! Lets confirm the mod vars went back in properly before we confirm flash programmer is needed, please do this with H20UVE_100.00.16.08 and send me the file >> H2OUVE.exe -gv varsnewaftermod.txt
Also, lets dig deeper into that volume and see if it helps, just to be sure, please test this, if write passes send me the created file
FPTw.exe -a 0x252078 -l 0x2D7FE6 -d DXEvol2VI.bin << Read
FPTw.exe -a 0x252078 -l 0x2D7FE6 -f DXEvol2VI.bin << Write
If both changed areas are set how I changed them in vars, and the above fails too, then you will need flash programmer to unlock BIOS menu here.
Same error… sucks. Which programmer should I get? (preferably on Amazon)
Here’s the file: http://s000.tinyupload.com/index.php?fil…357449181011499
Sorry to see! Were is the varsnewaftermod.txt, need to see this
Before I give you suggested flash programmer links for Amazon, open the bottom up and find the BIOS and give me the BIOS chip ID, so we can be sure you don’t also need 1.8V adapter before you order.
* Edit - I bet here explains the memory limit, by chipset, see post #30, I bet it’s something similar to this no matter what your chipset is - https://www.techpowerup.com/forums/threa…f.267734/page-2
Sorry, forgot to attach that file: http://s000.tinyupload.com/index.php?fil…722589052223879
I’ll see what the BIOS chip is soon.
OK, thanks! Also, see my edit above in case you missed it
I checked, and the vars changes are in there (BIOS Lock and FPRR - Flash Protected Range Registers) disabled x2 areas of BIOS settings. So this FPRR lock you’re still hitting is a lock within a module and would need edited out/bypassed, it’s not a BIOS setting.
* Edit - @brian105 - Here is what you need generally $10
https://www.amazon.com/VKLSVAN-Socket-Ad…r/dp/B08CDCPPTZ
And here is kits with the 1.8v adapter, so only $4 more, you could go ahead and grab one of these kits and not have to worry about checking chip ID until you’re ready to dump the chip
https://www.amazon.com/Organizer-EEPROM-…r/dp/B07V2M5MVH
https://www.amazon.com/AiTrip-EEPROM-Pro…r/dp/B07VNVVXW6
Thanks! I ordered the ACEIRMC set, should be here within 5 days.
@brian105 - Good deal! Sorry I could not help to find a way around the locks without programmer, some boards this is just the only way you can do it.
I will try to find and bypass the lock in the BIOS itself, that way you wont have to use programmer in future (unless you reflash stock, or non-modified BIOS without the lock removed)
Sometimes I can find, sometimes not, but I will check and see it I can locate it