[Request] How to Access Locked/Hidden BIOS Menu Settings

If you get new error in FPT after 368/similar (BIOS Lock) is removed, tell me the new error and I may be able to help you around that one too.

OK, if I can figure it out I’ll swap in ACPI for Driver Health, but for now I can’t seem to figure it out Maybe a few more days looking at it and I’ll figure it all out. I understand how he did it, and assumed I’d be able to do it too based on what all he explained, but I can’t find the right strings in AMITSESetup module.
I just need more time looking it over I’m sure (hopefully), usually I can figure things out after giving it a few attempts, so I’ll keep looking

Ok, sure. Thanks!


i can write guide in my native language (russian), someone need to translate to english (with google translate :slight_smile:

That would be great @Mov_AX_0xDEAD Really appreciate it! When you have time, no rush, I know writing guide can take some in-depth time to show all steps good sometimes

Hello everyone, I spent a lot of time on the internet looking for a solution to unlock the bios advanced menu to a Aspire one d255e . therefore, someone who can have a solution ,
here you have everything,

http://rgho.st/8965RGjxb

Please forgive me for trouble and I wish you a good day

Hello here,
I need your help to unlock my uefi bios with “Click Bios” Interface.
I succefully dumped, edited and flash my bios with INTEL FPT & UEFITool.

I have changed the boot screen with success :slight_smile:
But now i want to unlock OverClocking feature !

For that, i extract Setup from uefi and get IFR but when i changed the HEXA code and flash the chip nothing change :x i think i don’t know how to completly remove lock.

Can you help me ?

here is my bios file : https://drive.google.com/open?id=1SJ88Th…zATEuYTaTq497pv
IFR : https://drive.google.com/file/d/1fmtFtee…iew?usp=sharing

Thank’s in advance :S :slight_smile:

Which BIOS is yours PAV70D2 or PAV70D3?

I cannot download from that site, so I download stock BIOS from Acer AOD255E, this is correct one right?
https://global-download.acer.com/GDFiles…er_3.16_A_A.zip

Do you have flash programmer (Hardware) in case of bad flash?

@yop038 - What is it exactly that you meant to edit in setup module you extracted? You don’t have to explain how to do this, I already know, I only want to know what exactly you edited already and how you made the changes so I can tell you if it’s correct.
I can do these edits for you. Is this “BIOS File” above your edited BIOS, or only your dumped BIOS before you edited? Same for IFR, is this the original output IFR, or after you made changes (So modified setup module IFR)?

If this is your edited BIOS file, please upload your original unedited dump, that way I’m not working on top of any changes you made that may not be correctly done.

And, what all do you want unlocked, if not the same as your answer to above question. Just “Overclocking Section”?
What does your BIOS look like now, for the Memory/CPU sections that you can change settings in, maybe add a zip with a few images please and thanks

Hi Lost_N_BIOS, thank’s for your help :slight_smile:

The bios file is the original dump from FPT without any modification.
If you can unlock all feature, it okay ^^ why not

actually all section are hidden, i only have Hardware Monitor. i will take pictures of the bios after work.

i tried to change

0x3B041 Suppress If {0A 82}
0x3B043 True {46 02}
0x3B045 Ref: Overclocking, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x9, FormId: 0x2719 {0F 0F 77 00 78 00 09 00 00 00 FF FF 00 19 27}
0x3B054 Ref: M-Flash, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0xA, FormId: 0x271A {0F 0F 79 00 7A 00 0A 00 00 00 FF FF 00 1A 27}
0x3B063 End If {29 02}

to

0x3B041 Suppress If {0A 82}
0x3B043 False {47 02}
0x3B045 Ref: Overclocking, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x9, FormId: 0x2719 {0F 0F 77 00 78 00 09 00 00 00 FF FF 00 19 27}
0x3B054 Ref: M-Flash, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0xA, FormId: 0x271A { }
0x3B063 End If {29 02}

but nothing changed

Hey @yop038 you’re welcome and thanks for the answers!

That looks like a correct mod, however both of those options (Overclocking/M-Flash) have same VarOffset/VarName 0xFFFF (?) and incorrect Varstore too. Seems like they’ve FFF’d the correct ID’s out, and or maybe that is just reference link and other are needs enabled too at actual VarOffset/VarName location.
I will look at the BIOS and see if I can figure it out for you. Yes, images of the BIOS, as many as you want to include would be great, and if you can either reseize them or set your camera in advanced not to take 5-10MB single images , then put all images into a zip or 7zip package

I checked the IFR now in your link, and I think I’m correct above about the FFF’d out correct info, I see this at Form: Advanced (All same VarOffset/VarName) and invalid Varstore ID 0x0, I’m they did this to break BIOS capability to change via grub or easily modify the BIOS.

Ref: OverClocking Performance Menu, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x19, FormId: 0x27AD {0F 0F 92 16 93 16 19 00 00 00 FF FF 00 AD 27}
0x3B534 Ref: Intel ICC, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x1A, FormId: 0x27C0 {0F 0F 84 17 84 17 1A 00 00 00 FF FF 00 C0 27}
0x3B543 Suppress If {0A 82}
0x3B545 QuestionId: 0xE1C equals value in list (0xFFFF) {14 08 1C 0E 01 00 FF FF}
0x3B54D Ref: , VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x1B, FormId: 0x2712 {0F 0F 02 00 02 00 1B 00 00 00 FF FF 00 12 27}
0x3B55C End If {29 02}
0x3B55E Suppress If {0A 82}
0x3B560 QuestionId: 0xEE5 equals value in list (0xFFFF) {14 08 E5 0E 01 00 FF FF}
0x3B568 Ref: Driver Health, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x1C, FormId: 0x27C1 {0F 0F 64 00 65 00 1C 00 00 00 FF FF 00 C1 27}
0x3B577 End If {29 02}
0x3B579 Ref: OffBoard SATA Controller Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x1D, FormId: 0x27C8 {0F 0F 74 19 75 19 1D 00 00 00 FF FF 00 C8 27}
0x3B588 Ref: ACPI Settings, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x1E, FormId: 0x27CC {0F 0F B4 17 5E 04 1E 00 00 00 FF FF 00 CC 27}
0x3B597 Ref: SMART Settings, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x1F, FormId: 0x27E8 {0F 0F 5A 19 5B 19 1F 00 00 00 FF FF 00 E8 27}
0x3B5A6 Ref: NCT6685D Super IO Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x20, FormId: 0x27F2 {0F 0F FD 03 FE 03 20 00 00 00 FF FF 00 F2 27}
0x3B5B5 Ref: Hardware Monitor, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x21, FormId: 0x27F7 {0F 0F 1C 04 1D 04 21 00 00 00 FF FF 00 F7 27}
0x3B5C4 Ref: PCI Subsystem Settings, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x22, FormId: 0x283A {0F 0F 84 18 8A 18 22 00 00 00 FF FF 00 3A 28}
0x3B5D3 Ref: Network Stack Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x23, FormId: 0x283F {0F 0F 0E 19 0F 19 23 00 00 00 FF FF 00 3F 28}
0x3B5E2 Ref: CSM Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x24, FormId: 0x2841 {0F 0F 70 16 71 16 24 00 00 00 FF FF 00 41 28}
0x3B5F1 Ref: SDIO Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x25, FormId: 0x2844 {0F 0F 98 19 99 19 25 00 00 00 FF FF 00 44 28}
0x3B600 Ref: USB Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x26, FormId: 0x2864 {0F 0F 6A 00 6B 00 26 00 00 00 FF FF 00 64 28}


Quick example that does not have this crap done to it, see valid VarOffset/VarName and VarStore values…
One Of: Hardware Prefetcher, VarStoreInfo (VarOffset/VarName): 0x596, VarStore: 0x1, QuestionId: 0x57, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 43 05 44 05 57 00 01 00 96 05 10 10 00 01 00}
0x3BF90 One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
0x3BF97 One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 30 00 01}
0x3BF9E End One Of {29 02}
0x3BFA0 One Of: Adjacent Cache Line Prefetch, VarStoreInfo (VarOffset/VarName): 0x597, VarStore: 0x1, QuestionId: 0x58, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 45 05 46 05 58 00 01 00 97 05 10 10 00 01 00}
0x3BFB1 One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
0x3BFB8 One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 30 00 01}
0x3BFBF End One Of {29 02}

I’ll see what I can do. This is half a motherboard correct, out of a mini-tower type system? So probably tough to find a similar board from them to compare and snag BIOS info from
Please download this package and run the first two commands in the text file (one each for 32/64) from within each versions folders (Don’t run any of the “After edit, write etc”)
https://www.sendspace.com/file/yuoaw2

If you can get NVRAM.txt file with contents in it from any, upload the file for me to check, thanks

Do you have hardware flash programmer for recovery from bad BIOS flash? If not, order one now just in case, it’s very cheap on ebay (CH341A = $2.50 + SOIC8 test clip cable = $3.50ish)

here is the nvram, i’m buying the flash programmer in case of failure ^^

nvram : https://drive.google.com/open?id=15t6NFc…l1QwdrPCnTmnRpp

https://www.amazon.fr/TECNOIOT-CH341A-Pr…keywords=CH341A

https://www.amazon.fr/WINGONEER-EEPROM-c…keywords=CH341A

it’s okay ?

Thanks, I will check NVRAM.text, and yes, those are what you need for BIOS recovery but VERY expensive. On ebay it’s $2.50 for the programmer and $3.59 for the text clip/cables.
Maybe you can find EZP2010 on there cheaper than both of those above combined/ If you’re not wanting to wait on China shipping is reason for paying more.

*Edit - that helps! M-Flash Form ID = 271A, Overclocking Form ID = 2719, Overclocking Performance Menu/ OC Feature - ID=27AD / Offset=66F, OC Explore Mode - ID=27F9/Offset=FAD, Memory Overclock Menu - ID=27B2/Offset=7DA
And I think we can edit some NVRAM entries to include the missing options, but for that we should wait for programmer to arrive just in case it’s a fail. Lots to adjust in there, and possibly use to fix setup too.

Do you have the memory options shown in the NVRAM? Look around in there and see, the NVRAM.txt I mean, then think of BIOS, do you have those? Waiting on your images too, once you have time of course, I’m heading out now, will be back tonight

My X99 Strix mobo do not have option to select bootting GPU. I just looked AMIBCP and there is not hidden menu in my knowledge.

Can it be still modified? At least that mobo use static PCIe port to do that?


VarStoreInfo= 0xFFFF, VarStore=0x0 means submenu/form, they dont need store something.
Advanced is menu without variables, only links to other menus.


i think nothing changed because you try to modify "level 0" menu (Setup), this menu is special and often require additionally modifying some bytes/bits outside IFR binary

Thanks @Mov_AX_0xDEAD I see now too. Yess, I found some things that need edited in AMIBCP and in setup IFR too
Form: OverClocking Performance Menu, FormId: 0x27AD {01 86 AD 27 92 16}
Form: Overclocking, FormId: 0x2719 {01 86 19 27 77 00}

Lots to unlock in there really, waiting on images of current BIOS before looking any deeper, so I can see what is currently visible in unmodified BIOS

I think many of these can be either enabled via BIOS edit, or much easier via NVRAM edit and re-up with SCEWin

@raun0 - not sure where you meant to post that? Also not sure what your trying to modify, or why?
I agree, could not find selectable graphics first boot device. Probably due to no onboard graphics output ports and only PCIE slots, so no choices could be made anyway, there is only one option PCIE



I try to select PCIe slot 4 to be the boot device. I am running virtual host on machine and first two PCIe 16x slot is for graphics cards for virtual clients.

GA-X99-UD4 mobo with same chip has a select menu by slot ( slot 1 - 4 ).

Asus would have to help with that, since this settings are not in the BIOS to be uncovered. Have to probably pick another board for that particular project.
We can try to check NVRAM - download this package and run the first two commands in the text file (one each for 32/64) from within each versions folders (Don’t run any of the “After edit, write etc”)
https://www.sendspace.com/file/yuoaw2

If you can get NVRAM.txt file with contents in it from any, upload the file for me to check, thanks