[Request] Gigabyte Aero 15 OLED BIOS unlocked

Bios FB03 renmod :

0x3E532 Setting: Flash Protection Range Registers (FPRR), Variable: 0x6DD {05 91 8B 12 8C 12 5F 07 17 00 DD 06 10 10 00 01 00}
0x3E543 Option: Disabled, Value: 0x0 {09 07 04 00 30 00 00}
0x3E54A Option: Enabled, Value: 0x1 {09 07 03 00 00 00 01}
0x3E551 Default: 8 Bit, Value: 0x0 {5B 06 00 00 00 00}
0x3E557 End of Options {29 02}

0x4AAB3 Setting: BIOS Lock, Variable: 0x17 {05 91 CD 0B CE 0B 6A 0C 17 00 17 00 10 10 00 01 00}
0x4AAC4 Default: 8 Bit, Value: 0x1 {5B 06 00 00 00 01}
0x4AACA Option: Disabled, Value: 0x0 (default MFG) {09 07 04 00 20 00 00}
0x4AAD1 Option: Enabled, Value: 0x1 {09 07 03 00 00 00 01}
0x4AAD8 End of Options {29 02}

Your variables to patch into “Setup” GUID EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9 :

Flash Protection Range Registers (FPRR), Variable: 0x6DD
BIOS Lock, Variable: 0x17


Here is RU method - Go to section 2.2 and make bootable USB with RU program, then read 2.3-2.5

http://forum.notebookreview.com/threads/…-issues.812372/

What you need to change is the following >> BIOS Lock, VarStoreInfo (VarOffset/VarName): 0x6DD and 0x17

In “Setup” GUID EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9 …

Go to offset 0x6DD and change the 01 to 00 (This is at line 6D0 >> out to line 0D = 6DD)
Go to the offset 0x17 and change the 01 to 0x00 (This is at line 10 >> out to line 07 = 17)

If you are unsure, show me image and I will confirm for you, don’t change anything if you are not sure!

After that you can backup your bios and use a patch posted above.
If you are not sure I will make for you , write me !!!

P.S. these variables are differents into bios versions and can be to 0x1202 or 0x1207 - 00xB48 or 0xBDD, so it’s important extract the EFI IFR and search the
names “Bios lock” and “FPRR” to be sure on offset hex address of them …

Let me know
Regards

Search into "Setup" GUID EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9 about Bios lock and FPRR variables …


Bios FB05 Dixonism :

0x44152 Setting: Flash Protection Range Registers (FPRR), Variable: 0x1207 {05 91 D5 10 D6 10 21 07 01 00 07 12 10 10 00 01 00}
0x44163 Option: Disabled, Value: 0x0 {09 07 04 00 30 00 00}
0x4416A Option: Enabled, Value: 0x1 {09 07 03 00 00 00 01}
0x44171 End of Options {29 02}

0x5057E Setting: BIOS Lock, Variable: 0xB4D {05 91 98 0A 99 0A 23 0C 01 00 4D 0B 10 10 00 01 00}
0x5058F Default: 8 Bit, Value: 0x1 {5B 06 00 00 00 01}
0x50595 Option: Disabled, Value: 0x0 (default MFG) {09 07 04 00 20 00 00}
0x5059C Option: Enabled, Value: 0x1 {09 07 03 00 00 00 01}
0x505A3 End of Options {29 02}


Bios FB08 - FB09 aoi :

0x40621 One Of: Flash Protection Range Registers (FPRR), VarStoreInfo (VarOffset/VarName): 0x1202, VarStore: 0x1, QuestionId: 0x726, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 E1 10 E2 10 26 07 01 00 02 12 10 10 00 01 00}
0x40632 One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 04 00 30 00 00}
0x40639 One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
0x40640 End One Of {29 02}

0x4C86C One Of: BIOS Lock, VarStoreInfo (VarOffset/VarName): 0xB48, VarStore: 0x1, QuestionId: 0xC11, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 9C 0A 9D 0A 11 0C 01 00 48 0B 10 10 00 01 00}
0x4C87D Default: DefaultId: 0x0, Value (8 bit): 0x1 {5B 06 00 00 00 01}
0x4C883 One Of Option: Disabled, Value (8 bit): 0x0 (default MFG) {09 07 04 00 20 00 00}
0x4C88A One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
0x4C891 End One Of {29 02}


Bios FB03 renmod :

0x3E532 Setting: Flash Protection Range Registers (FPRR), Variable: 0x6DD {05 91 8B 12 8C 12 5F 07 17 00 DD 06 10 10 00 01 00}
0x3E543 Option: Disabled, Value: 0x0 {09 07 04 00 30 00 00}
0x3E54A Option: Enabled, Value: 0x1 {09 07 03 00 00 00 01}
0x3E551 Default: 8 Bit, Value: 0x0 {5B 06 00 00 00 00}
0x3E557 End of Options {29 02}

0x4AAB3 Setting: BIOS Lock, Variable: 0x17 {05 91 CD 0B CE 0B 6A 0C 17 00 17 00 10 10 00 01 00}
0x4AAC4 Default: 8 Bit, Value: 0x1 {5B 06 00 00 00 01}
0x4AACA Option: Disabled, Value: 0x0 (default MFG) {09 07 04 00 20 00 00}
0x4AAD1 Option: Enabled, Value: 0x1 {09 07 03 00 00 00 01}
0x4AAD8 End of Options {29 02}

I hope this will help anyone to understand and made right thing :wink:

@BDMaster

following your instructions and will report back!

much thanks!

Ren

@BDMaster

read through the RU documentation, disabled secure boot and able to boot into RU. A couple of things to note, the RU screen is very small about the size of a credit card it’s at the top left corner - I can move about the menus however it’s small to where some of the text like GUID is cut off- is there anyway to get it to load in fullscreen mode? - another thing i noticed while I am booted into RU the computer will randomly reboot - laptop gets pretty warm on bottom, wonder if temps are causing the reboot while booted into RU ? (this does not happen in windows as temps are stable)I know RU is beta and that it could have bugs - should I try a certain version? ( I am using the latest - 5.27.0388 BETA)

@BDMaster

Hi, thank you for posting the instructions on how to unlock the bios. I’m just following the steps like renmod. I just wanted to confirm first if the two variables that appear on the images I upload on this post are the ones I have to change, just to be sure.
Following your instructions, you say that the 0x6DD variable has to be changed to 00 from 01, but in my case its value is 0A without touching it, which I think is strange. My BIOS version is also FB03.
Could you confirm that the variables of the images are the correct ones? Thank you :slight_smile:

20210503204940.png

20210503204846.png

Hi @latorware , saw your name in the Gigabyte forums, I believe you too have the new Aero 15 Question for you, how do you move along the bytes and get to 0600 range? I tried Ctrl+page up/down but it doesn’t seem to do anything - I only see the first page starting with 0000 down to 00F0 - am I missing something?

20210503125409.jpg

Oh and for people looking to undervolt their 10th gen Intel CPUs, read this first:

https://www.reddit.com/r/XMG_gg/comments…_lake_10th_gen/

TLDR is that Comet Lake, apparently all 10th gen Comet Lake CPUs, do not undervolt well. About half as well as their 9th gen counterparts, sometimes less. There is very little info out there on the 10870h, but given that it’s a lower-binned 10875h I’d expect undervolting to be even harder than the 10875h experiments in that thread. I’ve finally been able to go a couple days with -74 core and -70 cache, -40 iGPU without running into shutdowns at idle or when closing the lid. Cinebench R23 giving me 9833 on the multi core test, which is almost 700 points higher than my initial pre-Throttlestop benchmarks. Temps still do run pretty high but they are not throttling nearly as often, and performance is nearly 10% better.

Just be careful undervolting these new 10th gen Aeros, maybe you’ll get lucky and get a high-binned CPU but most people aren’t.

Hi @renmod , yes you’te correct I have the new Aero 15 XC (rtx 3070). It’s strange that you cannot move with Ctrl+page up because I have not had any problem. Maybe it’s because your keyboard is not the english version and has some keys in different positions? (Ru receives inputs as if the keyboard is the english version) Maybe try plugging in an external keyboard. And by the way, just like you in my case Ru also takes only a small portion of my screen, but I think that’s because of our screens being 4k, and Ru software having a much lower resolution.

Hi friend, i wrote 0x01 to 0x00, but your is 0xA at 0x6DD offset so it’s wrong for you !!!
Don’t change 0x0A !!!

May be you have a Bios Password or Shift key set …

@latorware

For the Gigabyte Aero 17 HDR XC Bios version FB03

0x273F8 Form Set: Setup [7B59104A-C00D-4158-87FF-F04D6396A915], but you have to go into the largest "Setup"

with GUID - EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9 - !!!

0x4AAD3 One Of: BIOS Lock, VarStoreInfo (VarOffset/VarName): 0x17, VarStore: 0x17, QuestionId: 0xC6A, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 CD 0B CE 0B 6A 0C 17 00 17 00 10 10 00 01 00}
0x4AAE4 Default: DefaultId: 0x0, Value (8 bit): 0x1 {5B 06 00 00 00 01}
0x4AAEA One Of Option: Disabled, Value (8 bit): 0x0 (default MFG) {09 07 04 00 20 00 00}
0x4AAF1 One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
0x4AAF8 End One Of {29 02}

0x3E552 One Of: Flash Protection Range Registers (FPRR), VarStoreInfo (VarOffset/VarName): 0x6DD, VarStore: 0x17, QuestionId: 0x75F, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 8B 12 8C 12 5F 07 17 00 DD 06 10 10 00 01 00}
0x3E563 One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 04 00 30 00 00}
0x3E56A One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
0x3E571 Default: DefaultId: 0x0, Value (8 bit): 0x0 {5B 06 00 00 00 00}
0x3E577 End One Of {29 02}

So is you get 0x0A you are into different GUID … you have to find this one "EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9" = Setup

@BDMaster @latorware figured it out it was scrlLK button -had to press it once to enable :slight_smile: going to proceed with finding the correct places and checking what values are set per previous instructions

@BDMaster

per your instructions I was able to find these offsets

" Go to offset 0x6DD and change the 01 to 00 (This is at line 6D0 >> out to line 0D = 6DD) the default value at 6DD appears to be 0A instead of 01
Go to the offset 0x17 and change the 01 to 0x00 (This is at line 10 >> out to line 07 = 17)" default value looks correct here showing 01


I have not made any changes yet - took screenshots of each to show the default(factory) value to confirm these look correct before making any changes.

1.jpg

2.jpg

3.jpg

4.jpg

No there isn’t the right value 0x01 only for variable 0x17 = 0x01 then on 0x6DD = 0x0A is wrong so as i wrote before …
So is you get 0x0A you are into different GUID … you have to find this one “EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9” = Setup
You have to go into the largest “Setup” with GUID - EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9 - !!!
Let me know
Regards

@BDMaster

there is only one “setup” option in UEFI variable list ( see screenshot) - It appears to have the GUID you mention starting EC87D643-EBA4-4BB5 however the rest of the GUID is cutoff - is this not the correct UEFI variable? I don’t see any other setup other than SetupMode, SetupCpufeatures but these are clearly different - let me know if I am doing something wrong here


5.jpg

Ok we have to try using AMI SCEWin …
Please use this tool to get a vars backup then upload it for me …

https://www.mediafire.com/file/806rvhptz…SCEWin.rar/file

https://www.mediafire.com/file/ljgdjkor2…IN-NoWr.7z/file

Look into for commands and upload the result …
let me know

Here you go :

https://we.tl/t-wqavMCbFuJ

Regards

On RU shell try to find "PchSetup" GUID

0x27728 Var Store: 0x17[1772] (PchSetup) {24 1F F1 B7 70 45 E8 AD 43 49 8D C3 40 64 72 84 23 84 17 00 EC 06 50 63 68 53 65 74 75 70 00}

F1 B7 70 45 E8 AD 43 49 8D C3 40 64 72 84 23 84 >> F1B77045E8AD43498DC3406472842384 >> F1B77045-E8AD-4349-8DC3-406472842384

F1B77045-E8AD-4349- (little endian) 8DC3-406472842384 (big endian) >> 4570B7F1-ADE8-4943-8DC3-406472842384

GUID: 4570B7F1-ADE8-4943-8DC3-406472842384

Look under this one and let me know please !!!

There is this one to set too to 0x00 (Bios Guard) :

0x2A46D Setting: BIOS Guard, Variable: 0xDB {05 91 B4 04 B6 04 F3 00 11 00 DB 00 10 10 00 01 00}
0x2A47E Option: Disabled, Value: 0x0 {09 07 90 00 30 00 00}
0x2A485 Option: Enabled, Value: 0x1 {09 07 8F 00 00 00 01}
0x2A48C End of Options {29 02}

Change this one first, then reboot and change the ones above

BIOS Guard, VarStoreInfo (VarOffset/VarName): 0xDB << Located in CpuSetup - B08F97FF-E6E8-4193-A997-5E9E9B0ADB32

So these are the step :

1. Boot into RU Shell
2. Find GUID B08F97FF-E6E8-4193-A997-5E9E9B0ADB32 - CpuSetup
3. Change variable 0xDB from 0x01 to 0x00
4. Find GUID 4570B7F1-ADE8-4943-8DC3-406472842384 PchSetup
5. Change bariables Flash Protection Range Registers (FPRR) 0x6DD form 0x01 to 0x00 and BIOS Lock 0x17 from 0x01 to 0x00

then reboot and try to make a biosreg.bin file and reflash again to check the errors, if all is gone well you have bypassed the locks.

Commands to backup and reflash :

Fptw64.exe -d biosreg.bin -bios

Fptw64.exe -f biosreg.bin -bios

Then we can use AMI SCEWin too.

Make so ,

1. Hit ALT+C to expand the Config menu, then select UEFI variable.
2. Then go to PCHSetup (4570B7F1-ADE8-4943-8DC3-406472842384) via up/down arrow keys.
3. Then make change about the variables.
4. Then CTRL+W to save
5. Then ALT+Q to exit
6. Then reboot, go back into RU and check to be sure what you changed was saved.
7. Then FPT bios backup (like biosreg.bin) and send me the file.

Let me know
Regards

@BDMaster

per instructions I went to CPUSetup and PCHsetup and took screen shots of current factory values (no changes made yet) for variables 0xDB, 0x6DD, 0x17 - it appears DB and DD values are 00 - see screenshots 0x17 shows value 01 - let me know how else to proceed.

00DB.jpg

06DD.jpg


017.jpg

Ok you have to change only 0x17 set to 0x00 !