[Request] Gigabyte Aero 17 HDR XD Bios Unlock

BIOS/UEFI Modding BIOS Modding Requests
1

I am new to this game and recently got my new Aero 17. I want to unlock the Bios and undervolt. I will try to read all information/tutorials so that I can slowly move on step by step.

1.
This is the relevant BIOS: BIOS FB02 & EC F003 https://www.gigabyte.com/Laptop/AERO-17-…support-dl-bios (direct DL link: https://download.gigabyte.com/FileList/B…b02-ec-f003.zip )

2.
How to start?

I understand that the following is required first:

Source: [Request] Gigabyte AORUS 15G BIOS unlocked
***********************************************************************************************



Edit by Fernando: Thread title customized

2

biosreg.zip

Checklist:

- I have not yet modified my bios
- I have not yet set a bios password
- ME FW Version 15.0.30.1669 is installed (see bios screenshot below)
- I downloaded the following ME System Tools: CSME System Tools v15.0 r8 - (2021-05-16)
For systems running CSME v15.0 https://mega.nz/file/7F1C3CoK#H1aqYH4qiy…ot9v55c2COaucZ4
- I have successfully extracted biosreg.bin (see above)

more to come

3

Please make some Bios Menu Tabs Photos to show me your Bios, i haven’t this laptop …
I will explain how to unlock the Eeprom , modifying the variables into NVRAM by RU shell !ù
Use this tool run it as Admin and upload the result file :

https://www.mediafire.com/file/4s2lp3ig8…ools20h.7z/file

Let me know
Regards

4

Is this your stock bios page :

https://www.gigabyte.com/Laptop/AORUS-15…support-dl-bios

You sent the 17G , i need the result file to know your bios version friend …
Regards

5

Thank you, BDMaster! I will look into this tomorrow and reply to your questions. It is already after midnight and I need to get some sleep first :slight_smile:

(I believe that I cannot reply to PMs because I am a new user. I also had to remove all links.)

You are correct that I have the Aero 17 (not the 15 inch model). The model is brand new. I would guess that the first deliveries just went out.

6

Ok fine , so you’re it…
Regards

7



This is my bios screen.

Moreover, I extracted biosreg.bin as explained above.

Here it is: https://www.mediafire.com/file/4ck7krpp3…iosreg.zip/file

8

Gigabyte Aorus 17G YB - XB - WB - KB - SB (VB) (Intel 11th Gen) Tiz-Mod

your is as above , here you go :

https://www.mediafire.com/file/67sp1kh9w…iz-Mod.rar/file

Flash by fpt (fptw.exe -f biosregmod.bin -bios)
Please if possible to get some Bios Menu Tabs Photos to see if all is unlocked …
let me know
Regards

9

Thank you very much, BDMaster!!

As a next step, I want to do the following:

1.
Determine how I can restore my original bios if anything goes wrong and I am unable to boot.

2.
Disable secure boot / enable legacy support: There seems to be no bios option to achieve this. I could only try “Delete all Secure Boot variables” although it was mentioned somewhere in this forum that such step should be unnecessary.

3.
Try to flash the original unmodded bios via fptw. This does not work. I get Error 167: Protected Range Registers are currently set by BIOS, preventing flash access. Apparently, I will have to follow these instructions [Request] Gigabyte AORUS 15G BIOS unlocked and these http://forum.notebookreview.com/threads/…-issues.812372/ (Section 2)

4.
Try to flash the bios kindly modded by you. I understand that this bios is suitable for my Aero 17 although it is based on an Aorus bios because - apparently - both laptops use a very similar bios.

5.
Try to understand how to mod the bios myself ( OverPowered TONGFANG CyberPower Machrevo MACHENIKE - Unlocked BIOS Guide W/ Files ).

10

Ok friend,
i can share all knowledments , i am an ethical modder :wink:
You have to make a Full firmware dump using fpt command

fptw.exe -d spi

You have got into result file.
To recovery your bios depends on Gigabyte, if have dual bios or recovery button or switch, i have to find news on line …
Alternative is an SPI Programmer CH341a + Pomona clip.

I dpn’t know what are you doing, but if you have tried to flash the original unmodded bios (i hope your biosreg.bin) and you got error 167
it means you have not unlocked the Eeprom so you cannot reflash back the bios mod …

The modifies for your bios is here :



Gygabyte Aorus 17G FB02


PchSetup [4570B7F1-ADE8-4943-8DC3-406472842384], {24 1F F1 B7 70 45 E8 AD 43 49 8D C3 40 64 72 84 23 84 17 00 EC 06 50 63 68 53 65 74 75 70 00}

0x45F85 One Of: Flash Protection Range Registers (FPRR), VarStoreInfo (VarOffset/VarName): 0x683, VarStore: 0x6, QuestionId: 0x9B1, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 19 16 1A 16 B1 09 06 00 83 06 10 10 00 01 00}
0x45F96 One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 04 00 30 00 00}
0x45F9D One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
0x45FA4 End One Of {29 02}


0x514BC One Of: BIOS Lock, VarStoreInfo (VarOffset/VarName): 0x1C, VarStore: 0x6, QuestionId: 0xDE4, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 85 16 4D 10 E4 0D 06 00 1C 00 10 10 00 01 00}
0x514CD One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
0x514D4 One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 30 00 01}
0x514DB End One Of {29 02}


FPRR : 0x6DD

BIOS Lock : 0x1C

From 0x01 to 0x00


Setup, FormId: 0x2710 {01 86 10 27 07 00}

Main, FormId: 0x2717 {0F 0F 09 00 02 00 01 00 00 00 FF FF 00 17 27}
Advanced, FormId: 0x2718 {0F 0F 1E 00 02 00 02 00 00 00 FF FF 00 18 27}
Chipset, FormId: 0x2719 {0F 0F 1F 00 02 00 03 00 00 00 FF FF 00 19 27}
Security, FormId: 0x271A {0F 0F 3B 00 02 00 04 00 00 00 FF FF 00 1A 27}
Boot, FormId: 0x271B {0F 0F 20 00 02 00 05 00 00 00 FF FF 00 1B 27}
Save & Exit, FormId: 0x271C {0F 0F 4E 00 02 00 06 00 00 00 FF FF 00 1C 27}


0x27C65 Form: Main, FormId: 0x2711 {01 86 11 27 09 00}
0x2844C Form: Main, FormId: 0x2717 {01 86 17 27 09 00}
0x27D91 Form: Advanced, FormId: 0x2712 {01 86 12 27 1E 00}
0x28701 Form: Advanced, FormId: 0x2718 {01 86 18 27 1E 00}
0x28138 Form: Chipset, FormId: 0x2713 {01 86 13 27 1F 00}
0x357F8 Form: Chipset, FormId: 0x2719 {01 86 19 27 1F 00}
0x28162 Form: Security, FormId: 0x2714 {01 86 14 27 3B 00}
0x4DAF4 Form: Security, FormId: 0x271A {01 86 1A 27 3B 00}
0x282A8 Form: Boot, FormId: 0x2715 {01 86 15 27 20 00}
0x4E024 Form: Boot, FormId: 0x271B {01 86 1B 27 20 00}
0x4E31F Form: Boot, FormId: 0x27D5 {01 86 D5 27 20 00}
0x2839A Form: Save & Exit, FormId: 0x2716 {01 86 16 27 4E 00}
0x4E367 Form: Save & Exit, FormId: 0x271C {01 86 1C 27 4E 00}



@4FFA0 - all form list
4A10597B0DC0584187FFF04D6396A91517270000000000000000000000000000
4A10597B0DC0584187FFF04D6396A91518270000000000000000000000000000
4A10597B0DC0584187FFF04D6396A91519270000000000000000000000000000
4A10597B0DC0584187FFF04D6396A9151A270000000000000000000000000000
4A10597B0DC0584187FFF04D6396A9151B270000000000000000000000000000
4A10597B0DC0584187FFF04D6396A9151C270000000000000000000000000000
4A10597B0DC0584187FFF04D6396A91511270000000000000000000000000000
4A10597B0DC0584187FFF04D6396A91512270000000000000000000000000000
4A10597B0DC0584187FFF04D6396A91513270000000000000000000000000000
4A10597B0DC0584187FFF04D6396A91514270000000000000000000000000000
4A10597B0DC0584187FFF04D6396A91515270000000000000000000000000000
4A10597B0DC0584187FFF04D6396A91516270000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000

@50250 - Setup
4A10597B0DC0584187FFF04D6396A91510270000000000000000000000000000 >> Setup

@502F0 - block list, short ID’s + footer
4A10597B0DC0584187FFF04D6396A91517270000000000000000000000000000
4A10597B0DC0584187FFF04D6396A91518270000000000000000000000000000
4A10597B0DC0584187FFF04D6396A91519270000000000000000000000000000
4A10597B0DC0584187FFF04D6396A9151A270000000000000000000000000000
4A10597B0DC0584187FFF04D6396A9151B270000000000000000000000000000
4A10597B0DC0584187FFF04D6396A9151C270000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000

@50900 - block list, long ID’s + footer
4A10597B0DC0584187FFF04D6396A915172700000000000000000000000000000000000000000000
4A10597B0DC0584187FFF04D6396A915182700000000000000000000000000000000000000000000
4A10597B0DC0584187FFF04D6396A915192700000000000000000000000000000000000000000000
4A10597B0DC0584187FFF04D6396A9151A2700000000000000000000000000000000000000000000
4A10597B0DC0584187FFF04D6396A9151B2700000000000000000000000000000000000000000000
4A10597B0DC0584187FFF04D6396A9151C2700000000000000000000000000000000000000000000
00000000000000000000000000000000000000000000000000000000000000000000000000000000

>>>>>>>> After Modifies >>>>>>>

Visible:
Form: Main, FormId: 0x2711 << swap 0x2717 (swapped into locked list)
Form: Advanced, FormId: 0x2712 << swap 0x2718 (swapped into locked list)
Form: Chipset, FormId: 0x2713 << swap 0x2719 (swapped into locked list)
Form: Security, FormId: 0x2714 << leave visible
Form: Boot, FormId: 0x2715 << leave visible
Form: Save & Exit, FormId: 0x2716 << swap 0x271C (swapped into locked list)

Hidden:
Form: Main, FormId: 0x2717 >> swap 0x2711 (swapped into locked list)
Form: Advanced, FormId: 0x2718 >> swap 0x2712 (swapped into locked list)
Form: Chipset, FormId: 0x2719 >> swap 0x2713 (swapped into locked list)
Form: Security, FormId: 0x271A << leave hidden
Form: Boot, FormId: 0x271B << swap 0x2716 (swapped into locked list)
Form: Save & Exit, FormId: 0x271C << unblock

@502F0 - block list, short ID’s + footer
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 17 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 << 11 27 Swap
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 18 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 << 12 27 Swap
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 19 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 << 13 27 Swap
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1A 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >> Blocked
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1B 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 << 16 27 Swap
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >> Unblocked
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

@50900 - block list, long ID’s + footer
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 17 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 << 11 27 Swap
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 18 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 << 12 27 Swap
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 19 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 << 13 27 Swap
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1A 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >> Blocked
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1B 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 << 16 27 Swap
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >> Unblocked
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


Patch :

O:50300:1127
O:50320:1227
O:50340:1327
O:50380:1627
O:50390:000000000000000000000000000000000000
O:50910:1127
O:50938:1227
O:50960:1327
O:509B0:1627
O:509C8:000000000000000000000000000000000000




I think you have not unlocked the right variable …

PchSetup [4570B7F1-ADE8-4943-8DC3-406472842384], {24 1F F1 B7 70 45 E8 AD 43 49 8D C3 40 64 72 84 23 84 17 00 EC 06 50 63 68 53 65 74 75 70 00}

0x45F85 One Of: Flash Protection Range Registers (FPRR), VarStoreInfo (VarOffset/VarName): 0x683, VarStore: 0x6, QuestionId: 0x9B1, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 19 16 1A 16 B1 09 06 00 83 06 10 10 00 01 00}
0x45F96 One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 04 00 30 00 00}
0x45F9D One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
0x45FA4 End One Of {29 02}


0x514BC One Of: BIOS Lock, VarStoreInfo (VarOffset/VarName): 0x1C, VarStore: 0x6, QuestionId: 0xDE4, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 85 16 4D 10 E4 0D 06 00 1C 00 10 10 00 01 00}
0x514CD One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
0x514D4 One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 30 00 01}
0x514DB End One Of {29 02}


FPRR : 0x683

BIOS Lock : 0x1C

From 0x01 to 0x00


As you can see here your FPRR : 0x683 is not 0x6DD and Bios lock is 0x1C not 0x17 !!!
If you modified the wrong variable then make again on 0x1C amd upload use the tool again and upload the result file for me to prepare the bios mod :

https://www.mediafire.com/file/4s2lp3ig8…ools20h.7z/file

Here is a tool to extract modules and IFR from AMI bios file :

https://www.mediafire.com/file/l2s5rg5xv…ractor.rar/file

Let me know
Regards

11

Thank you again, BDMaster!

I will digest all of the most helpful information received from you.

Moreover, you are absolutely right. I did not yet unlock the BIOS (see my 2nd post as regards the status of my journey).

I did not timely realize that I shouldn’t have uploaded the biosreg.bin prior to unlocking the bios. Apologies!

I will now have to figure out how to disable secure boot on this laptop (probably I have to delete the variables) and then create a Rufus Boot stick with RU. This will take some time.

12

Ok friend, you’re wolcome and i will help you everytime you want … i want only remember the Bigger Modder i have knonw here and we are waitng for his return,
as all credits for this mod are for “Lost_N_BIOS” !!!
Regards

13

A strange thing has happened. (For the record, I did not yet flash anything and I did not yet use RU or attempted to unlock the bios.) I merely disabled "security device". Then I deleted all secure boot variables. Subsequently, I could enable legacy OS and did so. Then I restarted the machine and now I cannot even get into the bios. Only the keyboard lights up. Nothing else…doh!

14

Update:

1.
The good thing is that the laptop is not bricked. It seems that the problem has happened to others as well: http://forum.notebookreview.com/threads/…-update.822350/ and https://www.reddit.com/r/gigabyte/commen…e_black_screen/

If you press the power button and if you hammer F2, it is possible to somehow trigger a Bios reset and then the laptop works again.

2.
The bad thing is that the laptop turns “black” again as soon as I enable Legacy OS. In other words, it appears that I firstly need to solve this problem before I can boot a USB stick with RU.

15

You have to reflash back the original Bios , as you changed the variable 0x17 and 0x6DD, they are envolved into IC control and Keybord ,

You can clear CMOS , remove all AC , Battery, on motherboard battery , and erase the NVRAM / CMOS ,then boot into bios and load default better settings and
save.
You will lost all modifies , but it will reload as normal, then uste this tool run it as Admin and upload the result file here :

https://www.mediafire.com/file/4s2lp3ig8…ools20h.7z/file

Let me know
Regardsd

16

Thanks, BDMaster. To clarify: I did NOT flash anything. I tried to flash the unmodified biosreg. But this did not work because my original BIOS is still locked. My problem results from flaws in the original bios.

I need to figure out a way to enable legacy boot in the original bios settings (without breaking anything) before I can continue. This is because I understand that RU cannot be booted via UEFI. And without RU I cannot unlock my original bios.

17

I made some progress:

1.
I managed to boot RU. For this purpose, I only deleted the security variables in the original bios screen but did not enable Legacy OS boot. With normal UEFI boot, RU initially did not work/boot via USB stick. However, I attached a Lexar card reader, inserted a SDcard prepared with RU and then it booted.

2.
Within RU, I used ALT+C to find the bios variable PCHSetup and changed 0x1C from 0x01 to 0x00. Hopefully, this was the bios flashing lock.

3.
Booted to windows. With FPTW -bios -d biosregunlocked.bin I hopefully saved a dump of the now unlocked (but otherwise unmodified) bios. I save the dump on a SDCard as a backup.

4.
With fptw.exe -f biosregunlocked.bin -bios I flashed back the still unmodified (except for the flash unlock) bios. This worked! In other words, the bios was really unlocked and I did not get Error 167

5.
With fptw.exe -f biosregmod.bin -bios I flashed the modified bios that BDMaster prepared for me. Thank you again so much, BDMaster!

6.
This is how it looks now …



7.
If I enable overclocking in Advanced / Overclock Performance Menu, XTU works. XTU is factory-installed on this laptop but undervolting was initially disabled. Thanks to the Bios Mod it now works. Hurra!

18

Wow , many thanks , this is a real Tutorial to show as example !
many thanks for your report friend …
Regards

19

I have now installed the latest Gigabyte Bios FB07 ( https://download.gigabyte.com/FileList/B…b14e8991ef0bca2 ) which means all mods are gone and, moreover, the bios is “locked” again.

I am not entirely sure “where” to unlock the bios. Do I have to go to line 10 0x1C and replace 01 with 00? Or is it another line in respect of the new bios?



https://abload.de/img/comp_img_20211121_18324j49.jpg

Many thanks!

EDIT (to remember what I did):

I deleted security variables in the new bios.
I pressed F12 for the boot manager
I booted RU with a card reader.
I pressed ALT + C and then searched the variable PCHSetup
I zeroed out line 0x1C
I saved the change with CTRL + W
I quit RU with ALT + Q
I entered into the bios again with F2 and restored the original security variables.
Thereafter, I could boot again into Windows.
I opened a command prompt with Admin rights and went to the directory where I saved the FPTW program.
I saved the unmodified bios with FPTW -bios -d newbiosregunlocked.bin
As a precaution, I flashed back the still unmodified bios with fptw.exe -f new biosregunlocked.bin -bios
Because this worked (i.e. I did not get error 167) it appears that the prior unlock of the bios with RU was successful.

20

The is the dump of the new unmodified bios:


https://www.mediafire.com/file/ufp6b7whs…locked.bin/file

Now, I opened WinHex and want to patch the bios. But I am bit lost…

Ok. It seems that it is much easier using UEFI Tool 26 and the new version A59: https://github.com/LongSoft/UEFITool/releases (as explained here: OverPowered TONGFANG CyberPower Machrevo MACHENIKE - Unlocked BIOS Guide W/ Files )