[REQUEST] HP Laptop 15s-gr0009au InsydeH2O BIOS unlock help needed

BIOS/UEFI Modding BIOS Modding Requests
1

Hi! I’m trying to unlock as many advanced settings as possible on my BIOS and hopefully also learn new things on the way :smile: . I don’t have a programmer and most likely won’t be having anytime soon which has restricted me to resort to mod what is already there. :frowning_face:

Details:

Things I’ve tried until now (with NO success):

  1. Using a modified grub shell to write Setup varstore [GitHub - datasone/grub-mod-setup_var: A modified grub allowing tweaking hidden BIOS settings.]

    grub_error1
    grub_error14000×3000 2.33 MB

    grub_error2
    grub_error24000×3000 2.68 MB

  2. Using RU.efi to write Setup varstore [https://ruexe.blogspot.com/]
    RU_error

  3. Using Insyde’s H2OUVE tool (tried multiple versions) to write Setup varstore [https://reddit.com/l6d4mi]

    h2ouve_error1
    h2ouve_error11077×592 54.5 KB

    h2ouve_error2
    h2ouve_error2983×326 13.7 KB

From what I’ve learnt it seems like Setup varstore specifically is write protected, and also the BIOS is RSA signed. Other varstores of interest are AmdSetup (has CBS stuff) and AMD_PBS_SETUP (has PBS stuff) which CAN be modified normally with H2OUVE. Also there is NO specific Advanced menu under SetupUtility section as seen from IFR extracts, but there are a lot of different advanced menus as shown by H2OUVE Tool when loaded with dumped bios.
IFR_menus

BIOS
BIOS4000×3000 2.41 MB

SKU_menus
SKU_menus1920×1032 89.9 KB

I’ve also successfully flipped a bit in AMD_PBS_SETUP varstore which disabled S3 sleep state, so I know atleast this thing works :smile:

Is there anything else I can try? I would really love to have this BIOS unlocked. Also can I somehow flash a modded bios through HP’s flash utility? Is there any switch to allow writing to Setup varstore? Or just anything which might help in this case? If anything else is needed please request. Replies are appreciated how trivial may it be :slight_smile:

All pictures and files are in this google drive folder: BIOS – Google Drive

TLDR: HP Insyde BIOS Setup varstore is write protected, how to modify bios without any use of programmer.

EDIT: HP Developers Portal | Secure BIOS with HP Sure Admin and CMSL - (Upd 2/9/2021) possibly documentation relating to this

1 Like
2

The issue on HP bioses 2016 up is well briefed in the forum as it has no successful mods reports done due to HP security RSA/Smart Guard etc… even with an SPI programmer. Just do a search on the forum…

EDIT: …humm by your approach with the methods and tools used, seems to me that is was probably already of your acknowledgement. Good luck.

3

Oh no, that’s sad to hear :frowning:
Referencing this post [REQUEST] RSA Signed BIOS Unlock - HP Pavilion 14-v066br. , maybe @Sweet_Kitten can give some more info?

4

Quick update: Managed to activate “Manufacturing Programming Mode” which unlocked the ability to edit “Setup” varstore :slight_smile: Okay, after fiddling with it seems like there’s no error when updating bits but changes are not getting saved (A symptom i’ve heard quite often or maybe MPM specific quirk?)

5

How you can flip bit in AMD CBS? I have an Elitebook but I can’t acess my bios in H2OUVE, I don’t know to use it too.

6

How you can flip bit in AMD CBS? I have an Elitebook but I can’t acess my bios in H2OUVE, I don’t know to use it too.

I’ve linked the tools, please try reading the documentations and trying out things yourself. Goodluck :wink:

7

If anyone is interested…

IFRExtractor-RS might help

2023_04_23_21.16.43_edit
2023_04_23_21.16.43_edit720×323 101 KB

You can try using SREP for unlocking. Just create a proper config.
If you find the BIOS file doesn’t have SetupUtilityApp DXE driver, at current state of development, I suggest attempting to replace it with the UiApp, as the form browser type of this BIOS looks simmilar to a suitable one found previously.

1 Like
8

Wow! Splendid, thanks for the leads <3

9

Hi, do you happen to have any documented case of patching with this tool? Actually, I’m having a hard time understanding the patching part :slight_smile: … representing the bytes to patch.

10

Hi.
Don’t know the best way to answer.
There is a repository of 3 pre-made configs that are confirmed working. I’ve also seen some sonfig from community for Acer Nitro 515 series, which is also working. Tho it is only 4 configs available, they are suitable for a wide range of devices. You can find many responses on the forum.

As for the patching. It requires code disassembly. Luckily, I know which place in code to look. For the BIOS like yours, it is one out of two.

1. The first place to look is Setup Utility module.

You should locate a subroutine matching the one below.
If in your case it’d look like on the left side, proceed to the 2-nd possible place.

Screenshot_19
Screenshot_191410×722 153 KB

I took the picture from the following posting.

Another picture on what to do with this thing.


2. The second place to look is ODMDxeDriver module. It's explained here: https://winraid.level1techs.com/t/mod-bios-insyde-an517-52/93906/2
and further in the thread.
1 Like