[Request] How to Access Locked/Hidden BIOS Menu Settings

Unfortunately bugged BIOS is common problem for many brands or series BIOS, sometimes if it’s important fix and many complaints it will get corrected quickly, but something like this I doubt will ever be fixed. I am not sure the cause or how to fix, sorry.

Yes, sorry for the terminology I used there. Right click, extract as is the sub-guid you have highlighted, do your edits, and then right click same position and replace as-is. Main thing is to always extract and replace at the exact same position, and to always extract/replace I the same manner (As-is or body).
Sometimes you may extract body only, to preserve the header from getting overwritten or changed, I don’t think it’s always a problem if you attention to it being there and don’t change it. I always do extract body/replace body when doing microcodes, in those cases you also must always check to ensure the entire footer remains as well, some BIOS have one there and some do not.

HPET can be made visible in this BIOS in the PCH section, but since you’ve already tested changing that setting it wont matter if you can see/change it in person in the BIOS GUI or not, it will be same outcome.

Thanks for the prompt reply! I really didn’t do much with the bios, due to racking my brain trying to figure out the hidden menus. I used every tool I could possibly think of and, like you said it would come down to using text or hex. As far as the menus that are present, they are Main thru exit. there isn’t a whole lot of setting per tab. Pretty basic. I did try updating the cpu microcodes as you mentioned with the ubu tool. I tried the 2018-04-10, seemed to flash fine and all, but when I open mmt it still shows the original microcode info. I will try the exe files that you included. I also don have a flash programmer for recovery, which is another reason I really haven’t tried too much editing. Other than that, I haven’t done any other mods other than a cpu upgrade as I cant’ find much available for this laptop. And thanks again for you time and the microcodes. I’ll try flashing it in a little later today and let you kmow how it turned out.

Yes @mikeshutte I think they did that on accident really, and never fixed/don’t care. I thought maybe on purpose to prevent easy modding, but they don’t have that same issue on many of their other BIOS, so this is probably error and they never cared to fix it.

So main-exit exactly in the order I showed above? I think maybe I found place to change, but not 100% sure, I’ll have to look at it more tonight. And since you do not have flash programmer yet may be best to wait until you do (Order now, CH341A flash programmer is only $3, and SOIC8 text clip cable $2.50)

What is mmt tool that you see microcode with? And what is the “original” microcode shown version and date? Sometimes windows loads it’s own over what the BIOS has, but this is a recent thing due to all the spectre/meltdown stuff, so if that is the case and newer is available via windows vs what’s in the BIOS then windows one would be loaded.
For a check/verification, you can also check current microcode with AIDA64 in the motherboard >> CPUID section. And with HWInfo64, shown in the main CPU-z-like window that opens initially, at the middle area few sections below core count in section uCU


Ok, so I will drop the idea of disabling HPET on this system. But still we can attempt to get the BIOS unlocked using the other method. Can you please tell me how I should use the other method to proceed with unlocking some/all of the settings?

Yes, I don’t think we can fix it, unless by digging around in the internet you can find someone explaining why some BIOS are bugged on this setting, then maybe I can fix. I will check on the other BIOS menus for you shortly.

@akm - does this unlock menu root entries? If yes, I’ll show you how tonight
https://www.sendspace.com/file/njuwzu

OMG! Looks like it is all unlocked and HPET can be disabled. Just flashed the BIOS and could only do a quick check. A lot of Menus and settings are there. HPET is disabled as I changed the setting. Thanks a lot! You are a genius!!

I will describe in detail later. Got to be leaving.

Sweet! So, yes, details please on how many root menus are shown, wanting to know if I got them all before showing you the way to do that in case there is anymore needed to be added.
That is the only changes I made, aimed at root menu exposure. I used the BIOS you sent in folder named BIOS with HPET disabled (9/4/18-11.31pm), and from quick glance I noticed you had two root menu’s enabled in AMIBCP and several subsections/settings set to user too.

Very interesting about the HPET! So, the one that is working, is it the one in PCH-IO section? If yes, I wonder why disabling that while still hidden had no effect?

@mikeshutte - same fix method now for you too, only we do this one blind without being able to see AMIBCP entries in full. Please test and let me know which if any are missing from the list mentioned on previous page
https://www.sendspace.com/file/4lg2i4


Seems everything is in there. All the root menus are visible, including the Intel ICC Clock settings and ACPI settings in Advanced Menu. All the internal settings and sub-Menus are also there and they behave the way I want.

I am very interested in learning how you have exposed the root menus in this BIOS mod. Actually, I was asking the same thing previously for the other laptop too. You said that if you used the other method, one or two settings would be visible and for the rest you would have to force the USER access. Out of curiosity and excitement from the complete unlocking of this BIOS, I still want to try flashing a mod for the other laptop which has the menus exposed in the same way as you did here. Perhaps the ACPI settings and the Intel ICC Clock settings may get visible using this method.



Yes, I disabled HPET in PCH-IO section. No idea why it didn’t get disabled while hidden.

This BIOS had many “User” settings already applied by you, that is why I made sure to mention it was the BIOS you already pre-modified with AMIBCP.
That’s likely why you see many things, and why they act how you wanted them for many as well, since you already attempted to set those initially like you had in the other BIOS.

For your second thought there, both methods were required on the Clevo BIOS, this unlock followed by all the User set settings in AMIBCP (And 47 02 on chipset).
Same probably applies to the Samsung too, without anything set to User in AMIBCP, only root menu would be shown and maybe sparse few sub-sections or settings visible at first until User is set in AMIBCP.

Here is where that mod is made, for this particular BIOS >> Open BIOS in EUFITool, find “Setup” GUID, expand and extract as-is the PE32 module.
This is usually in some section of the setup, sometimes PE32, other times the Sub-GUID, and sometimes best done with MMTool Setup-Uncompressed dump (IFR outputs often extended that way too). Then comes knowledge from all previous BIOS editing experience.
Sometimes, if you have your count correct, and direction, you can do search for your string via hex and find it, but this is not always the case and sometimes there may be more than one matching string (that do not apply) so it can be misleading to look/find via search.
You have to learn to recognize the BIOS menu sections in hex by appearance, and how to count out what you might expect in the area once found based on menus shown in AMIBCP & IFR output from surrounding sections in the setup module (Often similar, but not always same)
And factor into that count what the actual BIOS already shows for visible sections. That’s why I always ask to show me or tell me what all sections you already see and want to see images of the ones that have double in AMIBCP.
All that in order to know which are which, and which are visible/hidden, so you can put together estimated 01 00 01 00 01 string to look for based on what you already know. It’s not always an easy block of all zeros and then all 01’s like you’ll see in this one.

00 = disabled
01 = enabled/visible to user

Your BIOS image showed 5 visible sections and AMIBCP menu section count = 11. So we wanted to find 5 x 01 + 6 x 00
Due to AMIBCP layout, your BIOS images, and IFR I knew we were going backwards, well menu string would be disabled/00 up front and the enabled/01 ones at the end.
Based on all that, we need to find the following string - 00 00 00 00 00 00 01 01 01 01 01 - and change all 00’s to 01

Magic_String-Menu-Enable.png



The more often you do this mod the easier it will be for you to recognize where it should be and then make educated guess on if it will enable or not.
Sometimes you need this + AMIBCP for certain sections, sometimes you need both of those + 46 02 to 47 02 I showed you too.

Thanks! This post of yours is very informative and explains things very well. It has cleared some of my basic doubts about the other methods.

I actually carried out the whole process as per the example that you have shown and am through with it now. The only tricky thing could be to figure out the right string that needs to be searched and changed, when using this method on a different system. But I think I will be able to figure that out.

Can you please also create a screenshot example of 46 02 to 47 07 method as well to make it more clear?

After that, as you find time, please create that guide of FIT Table correction and Microcode update. It would be very helpful.

You’re welcome! And thank you too, I’m glad to hear it’s detailed enough to be consumable by someone not familiar with editing BIOS like that, I felt like maybe I was explaining too much or missing something etc so I kept writing more

Yes, that is the tricky part at first, figuring out what string to look for based on the menus already shown, what’s actually possible choices etc. I find it’s often easier/quicker to look for that area of the file manually, rather than trying to figure out a string to search for w/ search/find.
That area always looks similar, you’ll see that kind of structure/layout right above the string location almost always.

Sorry, I thought I showed you the 46 02 to 47 02, here is a little guide on it for another purpose post #128 @ #3 - Accessing Locked BIOS Menu Settings (9)
To see how that works, use your other board stock BIOS, extract setup GUID 899407D7-99FE-43D8-9A21-79EC328CAC21 as-is, get IFR, search for form: Chipset and get the hex ID string (01 86 05 04 1E 00).
While you are there in IFR, look next line or two down you will see >> Suppress If {0A 82} True {46 02} << That is what we change, to false 47 02
Find the chipset ID hex string in the extracted GUID.ffs file via search, right after that will be your 46 02 (3rd byte following ID)

And yes, I will try to find time to make FIT correction guide soon, and will include how I update microcode for this BIOS too.

Perfect! Thanks!

Been a little busy, so just had a chance to do some things on here. I just tried flashing the microcodes for the cpu. I actually is now showing an older update for the code. I have included pictures of the microcode info with both AMIBCP, before and after, and with MMT tool before and after. I tried the exe file first and it said cant flash the same bios, so i flashed with afuwingui.exe. Also MMt tool used is MMT V5.2.0.24 patched. I have also included a picture of my bios menus.I forgot to add, the microcodes highlighted in blue are the ones that where/are installed. The 2011/07/14 were before I flashed, and the 2009/11/02 are after.

AMIBCPv4.50After.jpg

AMIBCPv4.50Before.jpg

Bios Menus.jpg

MMT5.2.0.24PatchedAfter.jpg

MMT5.2.0.24PatchedBefore.jpg

@mikeshutte - I posted new BIOS for you on post #167 above, did you see that? Sorry, your images are confusing to me, due to layout and your description of what’s going on etc. I gotcha now!
I see what you mean about microcodes though, stop now and wait, let me fix.

On the exe same version, I can fix the same version stuff. Do you need that before you flash the version above, or is that the one you already flashed? Asking due to no new menus shown correct, or is that from the first BIOS I posted for you?
Anyway, you can go ahead with the menu unlock test on above BIOS at 167 if you want, but I need to fix the microcode offsets, so you can wait on that if you want.

*Edit - all fixed on the microcodes, that is only changes here
https://nofile.io/f/kUOzQ7Y1ymc/n5050a05M6.zip

Work on menu next as time permits. Hopefully we can get you more menus added than just the Intel one!

Ohh, and EXE should work now too, disabled the version check and disabled compare to current BIOS check

@Lost_N_BIOS As you explained the 00 to 01 method for unlocking root Menus, I was just trying to analyze the the string in the Stock BIOS and its Mods for the other laptop. I found a lack in consistency in the strings across the BIOSes for this laptop. Can you please help me understand the differences that I see? Let me elaborate first:

As per AMIBCP, there are six Menus in the Stock BIOS. So, the string should be: 01 01 00 01 01 01. I checked it in the extracted PE32 module, and found the existence. I have marked it under Green box in the first screenshot. You can see that in the highlighted row, after the string all bytes are zero. Now if I look at the PE32 module of the First Modded BIOS 05.01 which had HPET enabled, there is a 01 right after the string as you can see in the second screenshot. Do you know why there is an extra 01? Perhaps you tried to enable the “Recovery” Menu?

Further, if we look at the PE32 module of the Second Modded BIOS 05.01 which had HPET disabled, the original string is not there and there are two sets of extra 01. If you see the third screenshot, the string which is there in place of the original string has all 01’s. Also, there are two extra 01’s to the right of the string (second byte onwards). Any idea how they came there? Did you put 01 there for some reason?

I couldn’t say, we’ve done too many mods, too many versions, too many attempts at this or that, for me to be able to tell you what and why between three BIOS versions out of 100 we messed with in this thread.
You’re addition of HPET enabled/disabled further adds to the confusion when even trying to think of an answer for you. That is a very shorter string, keep in mind (always) use “find all” on your search if you are using search, there may be may matches the shorter the string and not all will be the menu

To add to your confusion, yes, sometimes I tried to enable recovery for you, few times, remember, so that add to the possibilities or not here.
And, AMIBCP is not always all menus in question either, you have to compare IFR from setup and any other IFR you can get within that GUID and sometimes check uncompressed MMTool setup too, it’s IFR sometimes has additional menus. Once you are sure of all, then count/figure for the string can begin.

I checked my initial notes on this 501 round and original string is 01 01 00 01 01 01, and yes I did try to enable recovery, a few times as mentioned, with a few methods, same for security I think with this 010100010101000101
I think that may be where the ones further on the right out there making you wonder .

If you want it all known, you must start over from stock BIOS, then any/all changes made you will know, if you keep track of them meticulously. I try to sometimes, but for this mod there was two BIOS each time and many versions we tested so notes are lacking after initial changes.
I think my attempts at recovery and security explain that. Look at a stock BIOS, then put it back on the ones you know aren’t enabling menus right now.

Add to the mess, it looks like my notes say chipset only needed 46 02 to 47 02, so you may be able to put that 01 back to 00 for chipset?
All stuff for you to test, if you are bored and want to waste time playing around. Be careful though, this is a laptop, recovery from a bad flash can leave you having to take it all apart to fix

Ok, that is fair enough.

I was doing this analysis for my understanding. I have not yet made any changes there.


Exactly. This string 010100010101000101 is what is confusing me. Before the two 01’s in the end of the string, there is a 00 as well. Not sure why this 00 in between.

Yes, as mentioned sometimes in there my goal was finding and enabling recovery and security, so sometimes 00’s were places I was skipping over.
Just remember, not every file I posted was meant to be a used file, some were only so we could test/find this or that, and some things we tried many ways and never got, those may have been left in as we moved along due to either trying something else in a rush and forgetting to go back, or wanting to change direction etc.
Put it all back to stock and enable only those you want.

@mikeshutte - here is new BIOS again, sorry for the menu mix-up. This may still have missing Intel, if so let me now, I went in other direction, and think I still get Intel too, but trying to also get the other menus this time around since only one last time
Microcodes double checked, with MMTool and MC Extractor, everything looks good. If it still does not update them properly (I did not change anything on this just now) I will make new tonight with your main MC up top, it was easier to put at end due to offset rules.

https://www.sendspace.com/file/ymw0v4
http://s000.tinyupload.com/index.php?fil…168919974885497 << New link - added 4/24/2020

Right click download button and save as or open in new tab, pop-ups here wanting credit card info etc, ignore and get file only.

Scrap above, use this one, hopefully EXE will work, but if not I guess we can give up on that. Microcodes fixed and includes menu change attempt again too
https://www.sendspace.com/file/31xncu

I think you have it figured out!!! Cpu microcode is now showing revision 2Eh, and all bios menus are available. The Intel tab is still empty, but other than that, now showing additional main, advanced, chipset, boot, and security. All with additional settings with-in their respective tabs.

Sweet man! Did the EXE work too? Now, those empty tabs! That might be a pain, but I will try.

So, all the other tabs, have at least some visible settings and sub-sections/sub-menus, like I know there is always a lot of sub-sections in advanced section. It sucks we can’t open this properly with AMIBCP.
I’ll look through “Intel” section tonight and see what settings are there, and if there is anything I can do to enable them, if not we can disable that menu again.