[Request] Asus UX481FL Laptop Bios Unlock

While I wait, here are pics of my bios security settings.

Bios_Screenshots.zip (4.53 MB)

See edit above, sorry I missed that all along!!

This is what 16-18 and 6DA are inside setup So, set these all back to how they were, or just reload optimal BIOS defaults, whatever is easier for you, then make the edits as mentioned in my edit above Then we should make progress finally!

PEP Graphics, VarStoreInfo (VarOffset/VarName): 0x16, VarStore: 0x1, QuestionId: 0x42, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 EB 00 EC 00 42 00 01 00 16 00 10 10 00 01 00}
0x1FBC6 One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
0x1FBCD One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 30 00 01}

PEP SATA, VarStoreInfo (VarOffset/VarName): 0x17, VarStore: 0x1, QuestionId: 0x45, Size: 1, Min: 0x0, Max 0x3, Step: 0x0 {05 91 F1 00 F2 00 45 00 01 00 17 00 10 10 00 03 00}
0x1FC29 Default: DefaultId: 0x0, Value (8 bit): 0x0 {5B 06 00 00 00 00}
0x1FC2F One Of Option: No Constraint, Value (8 bit): 0x0 {09 07 F5 00 00 00 00}
0x1FC36 One Of Option: Adapter D0/F1, Value (8 bit): 0x1 (default MFG) {09 07 F3 00 20 00 01}
0x1FC3D One Of Option: Adapter D3, Value (8 bit): 0x3 {09 07 F4 00 00 00 03}

PEP UART, VarStoreInfo (VarOffset/VarName): 0x18, VarStore: 0x1, QuestionId: 0x48, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 FA 00 FB 00 48 00 01 00 18 00 10 10 00 01 00}
0x1FCB9 One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
0x1FCC0 One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 30 00 01}

Prefetchable Memory, VarStoreInfo (VarOffset/VarName): 0x6DA, VarStore: 0x1, QuestionId: 0xCCA, Size: 2, Min: 0x1, Max 0x14, Step: 0x1 {07 94 98 00 99 00 CA 0C 01 00 DA 06 10 11 01 00 14 00 01 00}
0x427CA Default: DefaultId: 0x0, Value (16 bit): 0xA {5B 07 00 00 01 0A 00}
0x427D1 Default: DefaultId: 0x1, Value (16 bit): 0xA {5B 07 01 00 01 0A 00} << Now, I can see why we seen 0A there

VarStore: 0x1 << This = Setup
VarStore: 0x17 <<< This = PCHSetup, where the stuff we need to change is located in this BIOS, not usual location, so I didn’t notice it until trying to figure out why we seen 0A @ 6DA

I changed setup back to default. What am I supposed to change in PCHSetup? The same variables (0016, 0017, 0018, and 06DA)?

RU_PCHSetup.zip (20.9 KB)

RU_reverted_settings.zip (10.7 KB)

Yes, same variables, just in PCHSetup, if any are 01, change them to 00 - So, 16, 17 and, rest (18/6DA) are already 00
Probably, really the only one you need to change is 17, this is normally what we disable, I just gave you 16 and 18 just in case, and 6DA to check because it will cause error 28 if set, once BIOS Lock is disabled (17)

Once done, reboot, make new BIOS region dump with new name, and then try to write it back, this time should = success

Still error 167. Tried sleep bug as well.

RU_PchSetup.zip (19.4 KB)

Wow! Sometimes it can only be removed by editing a BIOS module, then programming back in, so this model is one to add to that pile sadly
You need CH341A + SCOI8 test clip with cable, let me know if you need linked examples on ebay.

One last thing we can try >> CPUSetup @ GUID >> B08F97FF-E6E8-4193-A997-5E9E9B0ADB32
Set BIOS Guard 0xDB >> Set 00

@Lost_N_BIOS [[File:Screenshot (8).png|none|auto]]

biosregnew.zip (3.67 MB)

Screenshot (8).png

Sweet! Now, send me this final biosregnew, make sure it’s dumped new after you unlocked BIOS guard
Then, tonight I will have you unlocked BIOS, unless I can get it done here in next half hour.

Here you go. Thanks for all you help!

newbiosreg.zip (3.67 MB)

You’re welcome!
I\m just glad we did not give up, or you’d have to wait weeks longer, if you even talked yourself into getting programmer setup (it’s cheap, everyone should have a set!)

@RogueDragon - Please run >> MEINFOWin.exe -verbose
From the ME System tools package, and show me the end of this report (in image, not text)
We’re checking to see Measured and Verified Boot, on the Left/FPF side, do you see either enabled on Left/FPF side?

Well, this BIOS is a bit oddly laid out, so may take a few different sets of BIOS test before we get a final unlock, but don’t worry as you can see I don’t give up easily, and can usually best a BIOS menu up and down so should be all good once we wrap it up

[[File:Screenshot (9).png|none|auto]]

Screenshot (9).png

Please see my edit above

Hmm, this does not look like I expected, but I’ve not seen v14 report output so maybe this is normal for V14
Please try this one and show me >> MEINFOwin.exe -fwsts (This report, on V11-12, looks like above, so wonder what it looks like here on V14) I will have to send PM to plutomaniac and wait on this before we do anything, in case Boot Guard is enabled at FPF

Unless! See if you can dump ME FW, then I can check directly if you can dump it, from Flash Programming Tool folder >> Win32 >> FPTw.exe -me -d ME.bin
Send me this file, if created

Here is the screenshot of -fwsts and the ME.bin

me_&_fwsts.zip (1.95 MB)

Sweet, now I can check directly… Of course, after I’ve already sent PM to plutomaniac too, I work too fast sometimes
See, fwsts looks same as verbose, how strange!! Must be some bug with that MEINFOWin version!

I don’t mind

plutomaniac -Please check that ME FW at #34 when you have time, thanks! It has tons of errors in MEA, and it will not open in FITc, even if I cut off top, or add line of zeros to beginning, or cut off end/padding.
Not sure if that is broken ME FW, and maybe that’s why verbose output looks wrong, but we only needed to check FPF Measure/Verified status, there was no reported ME related issues here
* Edit - Never mind on MEA errors, latest MEA OK But, FITc from r3 package still no go here I see r4 package, trying now, if/when I can download it… = Same/same, can’t open file
AND, I also see same, cannot open if I try to open 14.0.0.1061_CON_LP_BA_PRD_RGN.bin from the repo too, so must be some bug with FITc I guess?

so what do i need to do?

Wait, sorry, we have to know ME Side Boot Guard Status before we do anything here menu-wise. I have to leave in few minutes anyway, so nothing can be done right now no matter what. I’ll be back in about 8 hours

No worries, take your time.