[Request] How to Access Locked/Hidden BIOS Menu Settings

Then we wait on programmer

@nichigo13 : Have you tried using FWUpdate for ME update?

@Lost_N_BIOS sorry for ghosting on this thread sir. Actually, I just landed my first ever job last month and lost all my time to do these stuffs . Now, I already have a usb programmer. but Iā€™m stucked since i canā€™t figure out where my bios chip is located. here is the pictures of my mobo https://imgur.com/a/Sw7jXt8. after finding out the bios chip, all i need is to flash the me.bin using CH341A Programmer software right? again iā€™m very sorry this took so long.


yes sir. but sadly intel fwupdate tool canā€™t even detect my me firmware ver. so i canā€™t update it

Hi there! I am currently trying to dig into a BIOS from a Chinese X99 motherboard.

Using the AMIBCP 5.02.0031 tool I can see that there are Memory Timings and overclocking options, but those options are not available from the BIOS UI.
Since I have never modded a BIOS on my own, and I donā€™t yet have a BIOS programmator, I donā€™t dare to do any changes on my own.

I would like to enable these options. Could anyone help me with that?

BIOS backup: http://www.miyconst.com/UploadedFiles/x99/x99-bios.zip
CPU Overclocking Feature: http://www.miyconst.com/UploadedFiles/x9ā€¦verclocking.png
RAM Timings Feature: http://www.miyconst.com/UploadedFiles/x99/memory-timings.png

The BIOS backup was taken with Intel ME System Tools v9.1 r7.

@nichigo13 - sorry for my delay this time! You are looking for a 8 leg chip, not six. Look under WiFi card and remove memory and look under there too.
It may be this one, but I canā€™t tell from your images

Maybe.jpg



@Miyconst - Please link me to this stock BIOS too if you can, and tell me what is the brand (I maybe already unlocked it)
Also, please do this with FPT >> FPTw.exe -bios -d biosreg.bin and send me that file. As soon as you make that dump, try to write it back and if you get error show me image >> FPTw.exe -bios -f biosreg.bin
^^ This is to test, if we need to unlock anything before you can flash back mod BIOS ^^

But, since IntelRCSetup is outside of main setup, mod BIOS may not be possible, Iā€™ve been working on this same/similar thing for several boards for a week now
Your only option may be to make changes you want in AMIBCP, then reflash the BIOS.

@Lost_N_BIOS Ah i see, itā€™s a 8 leg chip not 6 thatā€™s why i canā€™t find it god. I will give this a try again this weekend and get back to you asap. Btw, Thanks for the reply sir! Been waiting for this.

@Lost_N_BIOS thank you for the fast response!

I assume that FPTw.exe was a typo, and it supposed to be fpt.exe, if no, then shame on me :D.

Here are the results:

- Unloaded BIOS: http://www.miyconst.com/UploadedFiles/x9ā€¦aid/biosreg.zip
- Unload screenshot: http://www.miyconst.com/UploadedFiles/x9ā€¦unload-bios.jpg
- Reload first attempt screenshot: http://www.miyconst.com/UploadedFiles/x9ā€¦oad-bios-00.jpg
- Reload second attempt screenshot: http://www.miyconst.com/UploadedFiles/x9ā€¦oad-bios-01.jpg
- CPU-Z Motherboard screenshot: http://www.miyconst.com/UploadedFiles/x9ā€¦z-mainboard.jpg
- Photo of the motherboard: http://www.miyconst.com/UploadedFiles/x99/win-raid/photo.jpg

Unfortunately, after this operations, the motherboard does not start any more.
Seems like I would have to buy a programmator to revive it.
Do you know which of the motherboard chips is the BIOS chip?

@nichigo13 - Yes, let me know once you find out more info. So sorry for the delay, Iā€™m always behind here, and then stuff gets buried and lost

@Miyconst - Youā€™re welcome!

No, I meant FPTw (ie windows version, as I stated), if you used DOS version then thatā€™s OK too (And I see you did)
I canā€™t see all the image of your first ā€œreloadā€, need to see command you entered and the full write, otherwise no point in showing me image.
In this image, there should not have been any write, should have been data identical, unless maybe you rebooted or something between the dump and the write attempt (it should have looked like your ā€œSecond Attemptā€)
Looks like you could have wrote something wrong in ā€œFirst attemptā€ and I canā€™t see command given or what happened, so can only guess

Second command is definitely wrong, so the brick happened there for sure. Anyway, second attempt? Why is there a second anything, and why is it an ā€œAttemptā€?
In this image, the BIOS bricked because you wrote BIOS region file (8MB) as Full BIOS (16MB), so now your chip contains two 8MB BIOS regions and no first half of the BIOS.
This happened because the -bios switch was left out of the command and you used BIOS region file as source file instead of full BIOS as your command indicated. Nothing you can do now except get a flash programmer and program back in your original full dumped BIOS

Is it Jshinga board? If yes, what model?

I canā€™t see BIOS chip in that image, maybe itā€™s under SB Heatsink, or covered by CPU heatsink/fan? Or, maybe itā€™s the one up by top right of memory slot? Could also be on back of board, youā€™ll have to show me better images, of the board without anything on it (and remove SB heatsink too).
Please put those images in a max compressed archive, thanks. Ohh, wait!! Maybe I see it, what is the chip ID of the chip directly below the debug LED?
If this is the BIOS, you need flash programmer like CH341A + SOIC8 test clip with cable

@Lost_N_BIOS thanks again for the detailed explanation and shame on me :grin:.

The motherboard does not specify itā€™s model, thatā€™s why I canā€™t provide it.
I will make better pictures later tonight.

The good news are:

- It seems to be possible to flush BIOS with fpt tool.
- I have successfully briked a motherboard for the first time, of course.
- The chip under the debug LED is the BIOS, or at least I believe so. Its part number is Winbond 250128JVSQ 185, and Google says that itā€™s a 128M-bit flash.
- My CH341A programmator is already on itā€™s way.

Did the biosreg.bin dump provide any lights on how to unlock the missing BIOS menu items?

@Miyconst - Itā€™s OK, it happens, but not too often. FPT is always risky, so you have to be careful and exact.

Yes, FD is unlocked, but for now we are still not sure if any BIOS/SMI locks, but maybe from your ā€œFirst Attemptā€ we know none is in place (canā€™t be sure though, since I canā€™t see the command you used there)

Yes, W25Q128JV would be the correct ID for that chip, for flashing with programmer you need to use this tool for that chip >> https://github.com/nofeletru/UsbAsp-flash/releases/

I didnā€™t check about unlocking BIOS menu yet, I was waiting to see if we needed to unlock BIOS/SMI lock first. Ohh, no, I canā€™t do the IntelRCSetup unlock yet, still waiting on someone to get back to me with results from test edit I sent them (originally planned method to do that wasnā€™t working out, but I may have found solution)
So, thatā€™s still unknown for right now, possibly not. However, you can make any changes you want there with AMIBCP and flash it in.

Anything hidden in the ā€œSetupā€ section I can unlock for you no problem

@Lost_N_BIOS ,

Here is the full recording of how I bricked the motherboard using FPT: http://www.miyconst.com/UploadedFiles/x9ā€¦os-to-brick.mp4
And here is another motherboard photo with nothing but CPU installed: http://www.miyconst.com/UploadedFiles/x9ā€¦photo-clean.jpg

Please let me know if you need any specific area of the motherboard more detailed.

I donā€™t need to see video of how you bricked it, I told you how and what happened at post #328
I still canā€™t tell 100% what that chip is under debug LED, but I think itā€™s BIOS as we already discussed

Hi Sir @Lost_N_BIOS , Iā€™d like to ask if i do need to erase the chip before flashing the me firmware? or its not necessary since theyā€™re on different region? Iā€™ve been looking for guides on flashing me firmware but i cant find any. want to know this before proceeding with the flash.

sadly, I didnā€™t managed to get my usb programmer work properly. Iā€™ve believed iā€™m connecting it to the right pins. (red wire should be on the pin 1 , and the pin 1 in the bios chip is the one with dot)
but still, usb programmer led indicator turns off when i connect the soic clip to the bios chip. no idea why

@Lost_N_BIOS hi again! I have finally got my BIOS programmer and revived the motherboard. Do you have any progress with unlocking the BIOS settings?

I have tried to set XE Ratio Limit settings via AMIBCP tool and flash updated BIOS - it works, but the CPU multiplier does not change.
There is an extra setting "Overclocking Lock" with Enabled/Disabled options, I tried both.

Also, when flushing BIOS with FPT tool, it shows a red line "Could not communicate with the HECI", but still proceeds and does writings.

@Lost_N_BIOS Hi, continuing from our discussion on PM, let me summarize some of the points of discussion until now:


I lately got a new Dell Inspiron 15 laptop (P75002) that has Insyde H2O BIOS. My objective is to completely unlock the Dell BIOS and get access to all settings, especially HPET and CPU Power Saving settings.

I downloaded the latest BIOS from the Dell website and have shared it here.

I also have a dump of the BIOS that I got using Universal BIOS Backup Toolkit a few months back, if I recall correctly. You can download it from here.

I have the flash programmer (not tested yet) but not the SOIC8 clip. I have placed order for the clip and awaiting its delivery.

I tried the BIOS dump method using the flashrom utlity as you suggested. The process failed. I have shared a screenshot, and also the screenshots of the different menus in BIOS settings here.

I primarily need to switch HPET Off permanently, disable all CPU power saving settings, disable clock spread spectrum, disable hard drive power savings, disable PCI & PCI clocks power savings and disable memory scrambler. You asked me the exact settings that I want modified.disabled, but in order to tell that I need a list of all the settings that are hidden in the Insyde BIOS. If it is possible for you to extract a listing of the names of all settings that are there hidden/locked in the Insyde BIOS, I can precisely tell you which ones I want disabled or changed.



You sent me a package to be run to extract vars.txt files. I have shared the extracted vars files as per your described instructions here.

Thanks!

@Miyconst - So sorry! I lost your post until now!! Do you still need help? Great to hear you were able to revive your board

@akm - Thanks for moving this to thread, and summarizing it all again above, that really helps!
Here is IFR text output of all possible settings, hidden or visible, we can change any of these directly without a BIOS mod using vars or RU method - http://s000.tinyupload.com/index.php?filā€¦632935810157318



Hi @Lost_N_BIOS ! I no longer need any help with the original BIOS, but today I have got mine Huananzhi X99-F8D motherboard, itā€™s a dual socket LGA 2011-3 motherboard. It also has locked memory timings option. Do you think you could help with unlocking it?

@Miyconst - OK, sorry again that I missed your reply before!

On the Huananzhi X99-F8D - Not sure, send me link to download the stock BIOS package, then also do below

If you have already modified the BIOS in ANY way, you will need to re-flash it back to factory defaults using factory method (NOT FPT)!!!
Additionally, please remove all BIOS passwords, disable secure boot, and disable TPM or Encryption if you have enabled. Do this before moving on to below


If you do not have Intel ME drivers installed, install them now from your system driver download page, then start over here after reboot.
Check your BIOSā€™ main page and see if ME FW version is shown. If not then > DOWNLOAD HWINFO64 HERE <

Once HWINFO is open, look at the large window on the left side, expand motherboard, and find the ME area.
Inside that section is the ME Firmware version. Take note of the version. (ie. write it down or get a screenshot)

Once you have that, go to the thread linked below, and in the section ā€œC.2ā€ find and download the matching ME System Tools Package for your system.
(ie if ME FW version = 10.x get V10 package, if 9.0-9.1 get V9.1 package, if 9.5 or above get V9.5 package etc)
> DOWNLOAD " ME System Tools " packages HERE <

Once downloaded, inside you will find Flash Programming Tool folder, and then inside that a Windows or Win/Win32 folder (NOT x64).
Highlight that Win/Win32 folder, then hold shift and press right click. Choose ā€œopen command window hereā€ (Not power shell! >> * See Registry file below *).

If you get an error, reply to this post with a screenshot of it, OR write down the EXACT command entered and the EXACT error given.

((If ā€œopen command window hereā€ does not appear, look for the ā€œSimple Registry Editā€ belowā€¦))

Step #1

Now you should be at the command prompt.
You are going to BACKUP the factory un-modified firmware, so type the following command:
Command: " FPTw.exe -bios -d biosreg.bin "

>> Attach the saved "biosreg.bin ", placed into a compressed ZIP/RAR file, to your next post!!! <<

Step #2

Right after you do that, try to write back the BIOS Region dump and see if you get any error(s).
Command: " FPTw.exe -bios -f biosreg.bin "
^^ This step is important! Donā€™t forget! ^^

If you get an error, reply to this post with a screenshot of it, OR write down the EXACT command entered and the EXACT error given.

Here is a SIMPLE REGISTRY EDIT that adds ā€œOpen command window here as Administratorā€ to the right click menu, instead of Power Shell
Double-click downloaded file to install. Reboot after install may be required
> CLICK HERE TO DOWNLOAD CMD PROMPT REGISTRY ENTRY <

If the windows method above does NOT work for youā€¦
Then you may have to copy all contents from the Flash Programming Tool \ DOS folder to the root of a Bootable USB disk and do the dump from DOS
( DOS command: " FPT.exe -bios -d biosreg.bin " )



Unfortunately, the BIOS is locked on this motherboard, and I canā€™t use FPT to read/write it. I can use AfuWin/AfuDos or CH341a programmer. What would be better?
AfuWin creates a BIOS backup which is just 8MB in size, while the BIOS chip is 16MB, thus I am not sure if this one will be useful.