[REQUEST] HP Pavilion x360 14 BIOS unlock(ba109tx)

Hey everyone,

I’m looking into adjusting the frequency and power limits of my CPU but I will need the advanced menu in my BIOS to do so.

Manufacturer: HP
Model Number: ba109tx
BIOS: Insyde H20 F.55
BIOS Type: UEFI
Download Link: here
(ps. I extracted 2 .bin files, and I am not sure which one my BIOS is)

If there are any files needed, please inform me.
Thanks everyone in advance for your help!

@Lost_N_BIOS could you have a look please?

Do you have flash programmer, such as CH341A? If not, order a set, you need CH341A + SOCI8 / SOP8 test clip with cable.
To know which BIOS you system uses, it may tell you when you run the stock BIOS flash process, sometime during that you should see which one is from your system
Otherwise, we’ll have to look at BIOS dump to be able to tell. You may be able to see it in windows system info, or CPU-z motherboard tab. Look for the extracted ID of course, or in system info it may show as Family ID

When you run stock BIOS flash, does it reboot to do the actual flash? If yes, then programmer needed for sure, unless the guys over at BIOS-mods.com forum can help you.
I can unlock this, but in case it’s internally signed BIOS, best you have programmer in hand and backup made in advance, ready to recover

Here, do this, tell me what error you get at #2, upload file from #1. Then also do 2nd below spoiler

If you have already modified the BIOS in ANY way, you will need to re-flash it back to factory defaults using factory method (NOT FPT)!!!
Additionally, please remove all BIOS passwords, disable secure boot, and disable TPM or Encryption if you have enabled. Do this before moving on to below


If you do not have Intel ME drivers installed, install them now from your system driver download page, then start over here after reboot.
Check your BIOS’ main page and see if ME FW version is shown. If not then > DOWNLOAD HWINFO64 HERE <

Once HWINFO is open, look at the large window on the left side, expand motherboard, and find the ME area.
Inside that section is the ME Firmware version. Take note of the version. (ie. write it down or get a screenshot)

Once you have that, go to the thread linked below, and in the section “C.2” find and download the matching ME System Tools Package for your system.
(ie if ME FW version = 10.x get V10 package, if 9.0-9.1 get V9.1 package, if 9.5 or above get V9.5 package etc)
> DOWNLOAD " ME System Tools " packages HERE <

Once downloaded, inside you will find Flash Programming Tool folder, and then inside that a Windows or Win/Win32 folder (NOT x64).
Highlight that Win/Win32 folder, then hold shift and press right click. Choose “open command window here” (Not power shell! >> * See Registry file below *).

If you get an error, reply to this post with a screenshot of it, OR write down the EXACT command entered and the EXACT error given.

((If “open command window here” does not appear, look for the “Simple Registry Edit” below…))

Step #1

Now you should be at the command prompt.
You are going to BACKUP the factory un-modified firmware, so type the following command:
Command: " FPTw.exe -bios -d biosreg.bin "

>> Attach the saved "biosreg.bin ", placed into a compressed ZIP/RAR file, to your next post!!! <<

Step #2

Right after you do that, try to write back the BIOS Region dump and see if you get any error(s).
Command: " FPTw.exe -bios -f biosreg.bin "
^^ This step is important! Don’t forget! ^^

If you get an error, reply to this post with a screenshot of it, OR write down the EXACT command entered and the EXACT error given.

Here is a SIMPLE REGISTRY EDIT that adds “Open command window here as Administrator” to the right click menu, instead of Power Shell
Double-click downloaded file to install. Reboot after install may be required
> CLICK HERE TO DOWNLOAD CMD PROMPT REGISTRY ENTRY <

If the windows method above does NOT work for you…
Then you may have to copy all contents from the Flash Programming Tool \ DOS folder to the root of a Bootable USB disk and do the dump from DOS
( DOS command: " FPT.exe -bios -d biosreg.bin " )


H20UVE package to get vars -
Please download the following package, and run the command below from each versions folder that directly contains it’s exe.
Before doing this, make sure you have secure boot disabled in BIOS, any BIOS password removed, and TPM/Encryption disabled.
Once done, copy the entire folder somewhere, delete everything but any created vars.txt and then repackage this and send to me.
This way all created vars.txt remain in place in the folders of the version that created them.
There may be errors, not all may work, ignore and carry on as outlined
http://s000.tinyupload.com/index.php?fil…212104496994806
https://www.sendspace.com/file/8v98ya
https://ufile.io/v70gxiwk

H2OUVE.exe -gv vars.txt

Hey, the BIOS version seems to be the Insyde F.55 from what I can see in the system information.
Here’s a screenshot, let me get back to you after doing #1 and #2.

ps. do you have any idea how often hp bioses are internally signed?

Thanks in advance :stuck_out_tongue:

bios ver.png

And from the last time I updated the BIOS, I’m fairly certain it rebooted to flash it. I sent you a link in PM to a programmer I found, could you just check to make sure it’s the correct one before I purchase it? Thanks!

Hey, here is the result from #1 and #2.

error for #2.png



Can I know if I can enable Intel SGX or I must leave it disabled? I had it disabled when I did this.

I will now try the 2nd one and update you.

biosreg.rar (3.74 MB)

Hey, I managed to do the second thing, I am not sure if I did it correctly though, I did it like the first one, shift right clicked the folders and opened command prompt and inserted that command. Hopefully that’s correct :stuck_out_tongue: anyways here is the result. Thanks

H20UVE-Get2.rar (92.3 KB)

Please flash this vars package back by dropping the file linked below into HOUVE 100.00.16.08 folder and running this command >> H2OUVE.exe -sv varsM.txt
http://s000.tinyupload.com/index.php?fil…523345050291647

There will be a list of success/fail, then reboot. Once you’ve rebooted, delete previously created biosreg.bin and do FPT spoiler step #1-2 again using new file name (such as biosregnew.bin)
Do you still get error at #2 after this? If yes, what error? If yes, also show me image of this output >> FPTw.exe -i

Also, if yes, run these two commands again and tell me if you still get error at #2
1. FPTw.exe -a 0x332078 -l 0x28011F -d vol1new.bin
2. FPTw.exe -a 0x332078 -l 0x28011F -f vol1new.bin << *Edit - Fixed

Sorry, I don’t know what Intel SGX is, so I assume you can do whatever you want with that, otherwise I’d be aware of what it is
If you think it’s something you should have disabled here, then leave it disabled until we are done

Hey, thanks for the reply.

At the FPT Spoiler second step, I get the error

GbE Region does not exist.

Error 316: Protected Range Registers are currently set by BIOS, preventing flash access.
Please contact the target system BIOS vendor for an option to disable Protected Range Registers.
FPT Operation Failed.




Output of this is

Intel (R) Flash Programming Tool. Version: 11.8.79.3722
Copyright (c) 2007 - 2019, Intel Corporation. All rights reserved.

Reading HSFSTS register… Flash Descriptor: Valid

— Flash Devices Found —
W25Q64FV ID:0xEF4017 Size: 8192KB (65536Kb)

— Flash Image Information –
Signature: VALID
Number of Flash Components: 1
Component 1 - 8192KB (65536Kb)
Regions:
DESC - Base: 0x00000000, Limit: 0x00000FFF
BIOS - Base: 0x00200000, Limit: 0x007FFFFF
CSME - Base: 0x00001000, Limit: 0x001FFFFF
GbE - Not present
PDR - Not present
EC - Not present
Master Region Access:
CPU/BIOS - ID: 0x00, Read: 0x00B, Write: 0x00A
ME - ID: 0x00, Read: 0x00D, Write: 0x00C
GbE - ID: 0x00, Read: 0xFFF, Write: 0xFFF
EC - ID: 0x00, Read: 0xFFF, Write: 0xFFF

Total Accessible SPI Memory: 8192KB, Total Installed SPI Memory: 8192KB

FPT Operation Successful.




The error I get at 2 is

[vol1new.bin] file already exists
Do you want to overwrite file? Y/<N> or q to quit :


Thanks!

You’re welcome! You didn’t happen to take note of the success/fail list did you?
If not, please run that once more, and take an image of the complete output list, or copy/paste like you did for FPT -i above
Then reboot, and run FPT commands again below, w/ corrected #2 command

Sorry, I made a mistake on that second set of FPT commands, please do this for #2 (edited above now)
1. FPTw.exe -a 0x332078 -l 0x28011F -d vol1new2.bin
2. FPTw.exe -a 0x332078 -l 0x28011F -f vol1new2.bin


Now Parsing File From varsM.txt.
Succeed to read varsM.txt file.
Variable Index[001]: Set failed!
Variable Index[002]: Set failed!
Variable Index[003]: Set failed!
Variable Index[004]: Set failed!
Variable Index[005]: Set failed!
Variable Index[006]: Set failed!
Variable Index[007]: Set failed!
Variable Index[008]: Set failed!
Variable Index[009]: Set successfully!
Variable Index[00a]: Set successfully!
Variable Index[00b]: Set successfully!
Variable Index[00c]: Set successfully!
Variable Index[00d]: Set successfully!
Variable Index[00e]: Set successfully!
Variable Index[00f]: Set successfully!
Variable Index[010]: Set failed!
Variable Index[011]: Set failed!
Variable Index[012]: Set successfully!
Variable Index[013]: Set failed!
Variable Index[014]: Set successfully!
Variable Index[015]: Set successfully!
Variable Index[016]: Set successfully!
Variable Index[017]: Set successfully!
Variable Index[018]: Set successfully!
Variable Index[019]: Set failed!
Variable Index[01a]: Set failed!
Variable Index[01b]: Set successfully!
Variable Index[01c]: Set failed!
Variable Index[01d]: Set failed!
Variable Index[01e]: Set successfully!
Variable Index[01f]: Set successfully!
Variable Index[020]: Set successfully!
Variable Index[021]: Set successfully!
Variable Index[022]: Set successfully!
Variable Index[023]: Set successfully!
Variable Index[024]: Set successfully!
Variable Index[025]: Set successfully!
Variable Index[026]: Set successfully!
Variable Index[027]: Set successfully!
Variable Index[028]: Set failed!
Variable Index[029]: Set successfully!
Variable Index[02a]: Set successfully!
Variable Index[02b]: Set successfully!
Variable Index[02c]: Set successfully!
Variable Index[02d]: Set successfully!
Variable Index[02e]: Set successfully!
Variable Index[02f]: Set successfully!
Variable Index[030]: Set successfully!
Variable Index[031]: Set successfully!
Variable Index[032]: Set successfully!
Variable Index[033]: Set failed!
Variable Index[034]: Set successfully!
Variable Index[035]: Set failed!
Variable Index[036]: Set successfully!
Variable Index[037]: Set successfully!
Variable Index[038]: Set failed!
Variable Index[039]: Set failed!
Variable Index[03a]: Set successfully!
Variable Index[03b]: Set successfully!
Variable Index[03c]: Set successfully!
Variable Index[03d]: Set successfully!
Variable Index[03e]: Set successfully!
Variable Index[03f]: Set successfully!
Variable Index[040]: Set successfully!
Variable Index[041]: Set failed!
Variable Index[042]: Set successfully!
Variable Index[043]: Set successfully!
Variable Index[044]: Set failed!
Variable Index[045]: Set successfully!
Variable Index[046]: Set successfully!
Variable Index[047]: Set successfully!
Variable Index[048]: Set successfully!
Variable Index[049]: Set successfully!
Variable Index[04a]: Set successfully!
Variable Index[04b]: Set successfully!
Variable Index[04c]: Set successfully!
Variable Index[04d]: Set successfully!
Variable Index[04e]: Set successfully!
Variable Index[04f]: Set successfully!
Variable Index[050]: Set failed!
Variable Index[051]: Set successfully!
Variable Index[052]: Set successfully!
Variable Index[053]: Set successfully!
Variable Index[054]: Set successfully!
Variable Index[055]: Set successfully!
Variable Index[056]: Set successfully!
Variable Index[057]: Set successfully!
Variable Index[058]: Set successfully!
Variable Index[059]: Set failed!
Variable Index[05a]: Set successfully!
Variable Index[05b]: Set successfully!
Variable Index[05c]: Set successfully!
Variable Index[05d]: Set successfully!
Variable Index[05e]: Set successfully!
Variable Index[05f]: Set successfully!
Variable Index[060]: Set successfully!
Variable Index[061]: Set successfully!



[quote="Lost_N_BIOS, post:10, topic:35949"] FPTw.exe -a 0x332078 -l 0x28011F -f vol1new2.bin [/quote]
For the second command, I get
Intel (R) Flash Programming Tool. Version: 11.8.79.3722
Copyright (c) 2007 - 2019, Intel Corporation. All rights reserved.

Reading HSFSTS register... Flash Descriptor: Valid

--- Flash Devices Found ---
W25Q64FV ID:0xEF4017 Size: 8192KB (65536Kb)

GbE Region does not exist.

- Reading Flash [0x0333000] 4KB of 4KB - 100 percent complete.

- Reading Flash [0x05B2197] 2556KB of 2556KB - 100 percent complete.

- Reading Flash [0x05B3000] 4KB of 4KB - 100 percent complete.
- Verifying Flash [0x05B2197] 2560KB of 2560KB - 100 percent complete.
RESULT: The data is identical.

FPT Operation Successful.


The file from the first command vol1new2.bin is attached, thanks

vol1new2.rar (2.5 MB)

@9vul14 - We disable BIOS lock and FPRR in 23 + 47, and both flashed in the changes as noted below, so you should now be able to do new #1 dump and pass with that file at #2
Variable Index[023]: Set successfully!
Variable Index[047]: Set successfully!

Ahh, you did, great!!

Ahh! Sorry, I should have had you dump the entire volume for this, not the sub-volume, I forgot it’s size may change on edit
Please do this now, and send me the file from #1 (#2 should still pass, please test it to confirm)

1. FPTw.exe -a 0x332000 -l 0x2EC000 -d Mainvol1.bin
1. FPTw.exe -a 0x332000 -l 0x2EC000 -f Mainvol1.bin

Here is the result from the first one.

Second one’s result is in spoiler

Intel (R) Flash Programming Tool. Version: 11.8.79.3722
Copyright (c) 2007 - 2019, Intel Corporation. All rights reserved.

Reading HSFSTS register… Flash Descriptor: Valid

— Flash Devices Found —
W25Q64FV ID:0xEF4017 Size: 8192KB (65536Kb)

GbE Region does not exist.

- Reading Flash [0x061E000] 2992KB of 2992KB - 100 percent complete.
- Verifying Flash [0x061E000] 2992KB of 2992KB - 100 percent complete.
RESULT: The data is identical.

FPT Operation Successful.


Thanks

Mainvol1.rar (2.51 MB)

@9vul14 - Great to see, so yes, no programmer is needed here to flash in mod BIOS!
Now, just to get it unlocked!! I am not 100% sure on this edit, so it may take a few tries, sorry Insyde is not my thing
Flash this back via step #2, and let me know, if you can see this option inside >> Advanced >> OverClocking Performance Menu >> Overclock Feature << If you can’t see that let me know and I will make visible, this unlocked several submenus inside the overclock performance menu
https://ufile.io/10fec2up

Sorry @Lost_N_BIOS , what command do I use? haha I’m quite a noob sorry

Sorry, I assumed you’d know
FPTw.exe -a 0x332000 -l 0x2EC000 -f Mainvol1M1.bin

Hey, I tried the command, however as I restarted and tried going into the BIOS it flashed the original BIOS back restoring it. When I try the command now again, it gives me Error 368 Failed to disable write protection for BIOS space.
@Lost_N_BIOS

Are you sure you seen it “recovering or reflashing BIOS”? Sounds like it, since BIOS lock is now enabled again. So, this means HP’s SureStart will recover the stock BIOS as I mentioned it might in PM, and no mod is possible here (menu-wise)
We can however change any BIOS setting you need to change, hidden or visible ones. We can do that same way we disabled the BIOS Lock and FPRR initially to get past error 368/280 and use FPT >> Via modifying vars

What BIOS setting do you want to change?

Well, not having the menu sucks but thanks for trying
For now can I edit the PL1 and PL2 to 40 and 44 Watts respectively?
Do you know what else would be available to edit in the BIOS, eg. voltage, core multiplier etc? Thanks

Yes, this is due to HP’s genius invention SureStart OEM’s like HP/Dell etc are terrible, and their BIOS is even worse to make to be something enjoyable.
At least it’s good for what it was meant to do I suppose?!

PL1 and PL2 are currently disabled, so you’d need to enable those + change the value of #1 (16bit) and #2 (32bit)
I cannot tell how those are entered and or stored without you being able to enabled, then change away from default in the BIOS, so I can’t properly advise on how to set those away from default.
I can tell you how to enable them, but changing the values set is a totally different beast. But this, likely moot point, since this is almost certainly EC FW controlled as most laptops are, so changing any of this will be ignored most likely.

Here is all the settings you can change
https://ufile.io/lzq5jrpe