[REQUEST] HP Spectre x360 15-df0013dx (4WW36UA) BIOS ADVANCED SETTINGS UNLOCK AMI Aptio V

Hi, I have been at this for over a week now trying different methods and following various guides but I still have not been able to find a solution to my problem. I work on my laptop under low-level lighting scenarios most of the time but the backlight on the keyboard of my laptop goes off after about 15 seconds of no usage and doesn’t turn back on until after I’ve already pressed a key which is super annoying because I have no idea what key I’m pressing to turn the keyboard back on and then have to deal with whatever that keypress caused which in the case of backspace or escape can wreak havoc on my workflow. I spotted on the BIOS simulator on HP’s website for my line of notebook (http://csrsml.itcs.hp.com/Media/97AE6F1A…B001E/Main.html) the setting for KEYBOARD BACKLIGHT TIMEOUT under the “Configuration” tab. I was hoping to unlock this setting in my BIOS or somehow change it to never but I also was hoping to unlock all of the advanced or hidden settings in my BIOS to further mod/adapt my notebook to my specific needs. I have both the stock BIOS that came with the laptop (F.28) as well as the updated version which is already flashed on to my computer (F.31) as well as their signature files. I also have the previous versions but it’s worth noting that I cannot flash any of the ones previous to the one that came on my laptop when shipped using HP’s flash tools. All of the BIOS are available through the BIOS section on the drivers page for my notebook on HP’s website when unzipped from the exe using 7zip (the 08518 files) (https://support.hp.com/us-en/drivers/sel…/model/24514904). I was also able to dump my BIOS using FPTw64 from the Intel CSME System Tools v12 r18 and can send that to whoever thinks they can help me out. I was able to take off the BIOS Lock using the guide from @Lost_N_BIOS (thank you btw) but I still get error 167 when trying to flash the dumped BIOS using FPTw64. It may be worth noting that I am able to open the BIOS with AMIBCP64, UEFITool, and MMTool. Ty in advance for any help you can give me with this.
Link to stock BIOS F.28 & F.31: https://1drv.ms/u/s!Ak_oOO-tWpwpqCIYqsE0MfJIRXcn?e=FPYIMN
Edit: I forgot I snapped pictures of all of the screens from my BIOS in case it was needed. I’ll attach those now.

1CC63CA8-9788-42F5-B570-5FF67CC4DACA.jpeg

AD4B9C1E-4A0A-45E2-9600-0114D7DF5D5B.jpeg

45072731-B267-4A76-ACC1-643987053562.jpeg

0401DA25-661F-45F8-8BED-B066F695FD39.jpeg

37D2C882-7EE0-477B-A73E-20D57A4EFD7D.jpeg

748F1D14-73E2-4112-9BEF-B8AAEA48BE81.jpeg

This BIOS contains two roms, which I cannot extract in any manner from the stock EXE or the exe you get after running that exe, using 7zip (even all the right click options).
However, I can extract either rom through the actual BIOS packaging utility that made this BIOS exe package (AMIUCP program). So I don’t need the files, but I do need you to tell me for sure which is your BIOS, and how do you know?
8518
8519

Since you’ve already sent me FPT dump, I will check that it’s 8518, but I’m sure you’re right anyway

Please try writing back the FPT dump and show me the error you get >> FPTw.exe -bios -f biosreg.bin

* Edit - KEYBOARD BACKLIGHT Timeout is removed from your current BIOS options (not even hidden from you, but removed from the possible options in that area)

No-KEYBOARD BACKLIGHT.png



I can add it back maybe, but may have to remove/replace one of the options shown above at that page, which do you not care about that I can replace with the KEYBOARD BACKLIGHT option?
I can make one of the ones you can’t currently see visible too, and replace it instead, that way you aren’t loosing anything. I may be able to simply add the setting back in, but that’s much harder and will take me longer, so if possible it would be great if you’d be OK with replacing something instead.

Or! I may be able to just set it to never or some large value etc by default, I’ll have to dig around in BIOS a bit more first before I can see what all options are possible for it, or if it’s been fully removed and only the strings for it are left in BIOS.

If it’s not possible with this BIOS, maybe on some older BIOS it would be? Can you tell in the online thing you checked, what version was being used for the image and or if it was even for this particular model?

20MB to see BIOS images for two seconds? Nothing on you, but people really need to stop using 2-5K images online just to show someone something (or resize images before sharing etc)
Resized or resampled, these images only needed to be a few 100KB at best
Ohh, I see, movie of each too… But why… Ohh well, luckily I am not on dial up
Same size still, same quality, kess than 1MB, that was all I needed >> http://s000.tinyupload.com/index.php?fil…308574182777056

I did forget to mention using the exe to retrieve the bios, sorry about that. I knew it was 8518 because msinfo32.exe revealed the BaseBoard Product number to be 8518.
Here is the error copy/pasted from cmd.exe run as administrator:

fpt error 167.jpg


If you have to get rid of one of them to make it visible then get rid of the Fan Always On option but leave it defaulted to Disabled please or if you can just set it to never or 24 hours that would be perfect. Whichever is easiest. However I cannot seem to find the option in any previous bios either which is the strange part.
I got the bios simulator sml from http://partnersml.itcs.hp.com/Media/97AE…9D8242B001E.zip
You can also access it in-browser by going to http://csrsml.itcs.hp.com/ and selecting Laptops and Hybrids under Product Category, HP Spectre x360 Home Notebook PCs under Product family, HP Spectre 15-df0000 x360 Convertible PC under Product series, and finally Simulator (BIOS) under Media Selection and Additional Resources or simply by going to this link.

BIOS Simulator.png


As you can see the bios listed is something I can’t find anywhere else, B.07T50. Not sure what to make of it.

Ahh, dreaded PRR/FPRR, sometimes this can be gone around without flash programmer, other times you have to have programmer to remove that lock in the onboard BIOS, then if used as base BIOS moving forward it wont be there anymore until you flash stock again.
One way around this possibly without programmer is S3 sleep bug. Please put system to sleep (S3, not hibernate) for one minute, wake it up and do not reboot, try to FPT flash.
Do you get same error, if yes OK, this bug is not in your BIOS and you’ll need to use flash programmer, unless we can disable via grub / setup_var (not likely, but we can try)

Check this guide, it’s for something else, so you can skip most of it about getting the variable, but do try to change the BIOS settings as mentioned and you’ll need to follow the second link example to setup your USB Stick since your BIOS does not have Exit to shell / Boot to EFI on the exit page
[GUIDE] Grub Fix Intel FPT Error 280 or 368 - BIOS Lock Asus/Other Mod BIOS Flash
Alt boot to grub when no boot to EFI on exit page - [Help needed] Hidden Advanced menu Bios HP Z1 J52_0274.BIN (2)

FPRR variable to edit >> 0x10D6

At grub prompt type the following and show me total screen (What you type, plus output)
setup_var 0x10D6 0x0

This is already disabled by default in your setup options and AMITSE/SetupData, I didn’t have time to check in NVRAM yet (probably disabled there too, but I’ll have to check and confirm)
If it’s disabled in all three already (ie setup_var will tell you it’s already 0x0), then it’s a BIOS module itself holding the lock and we can only remove via edit.

On the setting, there is a never option, so if I can add it back in then I’ll use that. Since it’s removed from both AMITSE/SetupData and setup, it may not be possible though.
What you see is probably generic info, and not specific to this model, or was only in early or ES BIOS possibly (that version name sounds like ES BIOS)
Normally, this kind of setting for the control you want to change would have a variable in setup too, that could be changed in the same way I mention above, but it’s not there so no variable to give you

Maybe we can find in the EC FW once you have flash programmer. But in the meantime I’ll see what I can do!

Because my system offers modern standby, S3 state is disabled. Microsoft says a full OS reinstall would be required to switch it. Is that necessarily true?
Also, I forgot to mention in my original post but one of my other main goals in unlocking BIOS was to enable secure erase. Is that possible with my motherboard?
I already have disabled BIOS Lock using your guide so I still have the flash drive made and know how to boot from it so I will try to change that variable right now.
Also, I should be receiving the programmer tomorrow so I can do whatever needs being done with it tomorrow.
Edit: Just successfully booted to grub and it seems that the FPRR variable was already 0x0.

CF19DD56-DC7E-4682-A2FD-6D541F0B7543.jpeg


Still getting the same error when trying to flash with FPT :frowning:

As I suspected, the FPRR lock is in the BIOS module only and not in NVRAM either, I assumed you’d see 0x0 already since that is what I see in setup and AMITSE/Setupdata
What is “modern standby”? I see OS/S4 enabled in BIOS, under “Enable Hibernation” option (not sleep), maybe this is what they meant. An clean OS install wouldn’t disable this, nor enable it if the BIOS default was disabled, only BIOS edit or change setting in BIOS etc would change that.
I’ve never heard of OS having to be reinstalled to change sleep mode, but I hate Win10 so could have missed that. Did they elaborate, how do you change it on the clean OS install, sounds fishy to me, this is a BIOS thing
S3 should be able to be enabled by BIOS edit or setup_var too, let me check what it’s set to now and give you the variable. I can’t find it in this BIOS, so it must be the above setting disabled maybe = S3 enabled, or not sure. Clean OS install wouldn’t change anything though

At least you’ll have programmer soon, then you will be in charge of the BIOS

Secure Erase, maybe if SPD write is enabled, otherwise I’m not sure what BIOS option allows this if any, usually this is a chipset thing some allow it and some do not.
Your BIOS does have these options, you can try to change via setup_var and test, but you may need AMT enabled ME FW first.

Secure Erase mode, VarStoreInfo (VarOffset/VarName): 0x52A
One Of Option: Simulated, Value (8 bit): 0x0 (default) {09 07 10 15 10 00 00}
One Of Option: Real, Value (8 bit): 0x1 {09 07 11 15 00 00 01}

Force Secure Erase, VarStoreInfo (VarOffset/VarName): 0x52B
One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 04 00 10 00 00}
One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}

And here’s the SPD Write one, this may only apply to actual memory (Set to false to allow)
SPD Write Disable, VarStoreInfo (VarOffset/VarName): 0x10D4
One Of Option: TRUE, Value (8 bit): 0x1 (default) {09 07 74 03 30 00 01}
One Of Option: FALSE, Value (8 bit): 0x0 {09 07 73 03 00 00 00}

According to Microsoft’s website, "In the S0 low-power idle mode of the working state, also referred to as Modern Standby, the system remains partially running. During Modern Standby, the system can stay up-to-date whenever a suitable network is available and also wake when real-time action is required, such as OS maintenance. Modern Standby wakes significantly faster than S1-S3."
It then states "Modern Standby is only available on some SoC systems. When it’s supported, the system does not support S1-S3."
Further, the Modern Standby link contains the following, "You cannot switch between S3 and Modern Standby by changing a setting in the BIOS. Switching the power model is not supported in Windows without a complete OS re-install."
And the last thing i forgot to mention was I wanted eDrive support enabled (if possible). I know about all the pitfalls of hardware encryption but I have a drive capable of it (not the one i’m currently using) and i want to activate it using bitlocker hardware encryption. I believe it needs the EFI_STORAGE_SECURITY_COMMAND_PROTOCOL defined. I’ll message when the programmer arrives but if you could send instructions on what to do with it when it does I’d appreciate that. I’ve never worked with one of these so it should be fun :slight_smile:
Thanks again.

I have the programmer

@davidbarrettnyc - All I mentioned above is the only Sleep/Hibernate/standby stuff in your BIOS, so not much we can do anyway. But thank you for the info, seems you would need to do a clean install, or at least windows repair possibly, if you had an S3 setting we could enable directly.

I know nothing about eDrive, what it is, or what kind of edits you need for that, or if it’s even possible. So yes, if you know what edits need done, please link me to it and I will have a look and let you know if that’s something I can do.

Make a dump with programmer an send to me. Please tell me your chip ID and what software version you use too, in case I need to have you use different and do it again.

I was actually going to ask you what software you suggested as this is my first time doing this.
i used flashrom on a bootable Ubuntu 16.04 usb stick. Sending the dumped bios in a pm.

As for eDrive, it’s just an Encrypted Drive. Microsoft’s requirements are as follows:
• The drive must be in an uninitialized state.
• The drive must be in a security inactive state.
• The computer must be UEFI 2.3.1 land have the EFI_STORAGE_SECURITY_COMMAND_PROTOCOL defined. (This protocol is used to allow programs running in the EFI boot services environment to send security protocol commands to the drive).
• The computer must have the Compatibility Support Module (CSM) disabled in UEFI.
• The computer must always boot natively from UEFI.
• The drive must be attached to non-RAID controllers to function properly.
I don’t think the first two have anything to do with the BIOS but the third one is most important. I’m pretty sure the following ones are already taken care of.

I would have suggested windows general CH341A software, using 1.30 or 1.34 - http://s000.tinyupload.com/index.php?fil…257455007472602
But, I also need to know your exact chip ID in case further advice is required, like some chips need other than exact ID used or writes always fail, some may need other software than the one above or dumps/writes both can fail etc.

This >> I have no idea about, how to check, change etc >> The computer must be UEFI 2.3.1 land have the EFI_STORAGE_SECURITY_COMMAND_PROTOCOL defined. (This protocol is used to allow programs running in the EFI boot services environment to send security protocol commands to the drive).

CSM can be disabled in the BIOS, if your BIOS has this setting << I checked, this is in BIOS and can be enabled/disabled, can you already see this?
* Edit - actually, I see this in the help info, for a setting you already have visible on “Boot Options” page >> “Legacy Support” = When Legacy Support is enabled, BIOS will load Compatibility Support Module (CSM) to support Legacy OS such as Windows 7, Windows Vista, Windows XP and DOS.
When Legacy Support is disabled, BIOS will boot in UEFI Mode without CSM to support newer OS such as Windows 8.System might be unable to boot into operating system after changing this setting.

YOu didn’t send dump in PM

I found 3 possible BIOS chips.
Here’s what it says on each accompanied by a picture of each:

winbond
25Q128JVSQ
1828

5483733C-BE57-4349-8E53-E5D08C936880.jpeg



GigaDevice
HH1849
25Q80CSIG
E87009

2DCF0224-837B-4D88-9DB7-5F240D9F7B62.jpeg



winbond
25X20CLIG
1827
6814
CS200ZZ

746D32FF-F10F-4B75-AC56-CEF65052250D.jpeg



I will attempt to dump each of them this evening.

Hello. Any news on this please? I’m struggling with the same problem. Thanks!

@davidbarrettnyc >> This one is the BIOS >> W25Q128JV
And you need to use ASProgrammer 1.41 for that - https://github.com/nofeletru/UsbAsp-flash/releases/

@GunterO - What problem are you having? Order CH341A + SOIC8 test clip with cable if you don’t have already, you need this to dump BIOS and write back mod (Still untested if mod BIOS bricks on this model or not)

Hello, there is a driver fix/workaround available for the keyboard light issue, so no BIOS fix needed, for now :slight_smile:
https://h30434.www3.hp.com/t5/Notebook-H…t/false#M542366

EDIT: Direct link to the fix/workaround: https://www.detack.de/_docs/media/hp_light.zip

@davidbarrettnyc ^^ Thanks @GunterO

Hi
Can you re-post the link for this driver ?
It does not appear on the one you posted,: https://h30434.www3.hp.com/t5/Notebook-H…t/false#M542366
All i get is the German version of the HP store.
This wold be so helpfull.
Thanks in advance

@Meg1st - This link works for me, takes me directly to the forums where they show how to fix, one post above is the link for download (that’s linked below now too, and on post #14 page one here)

1
 
https://h30434.www3.hp.com/t5/Notebook-Hardware-and-Upgrade-Questions/adjust-keyboard-backlight-timeout-hp-15-da0031nr/m-p/7321128/highlight/false#M542366
 


IF that is not loading for you, then download second link from post #14, I also checked it and it's still alive too
https://www.detack.de/_docs/media/hp_light.zip

This worked perfectly for me 
I called the HP care services and the tech used this file to fix my problem over the phone.

He was in Tunisia and i’m in Canada and i was very happy with the service he gave me.


By the way, the technician was aware of this problem and he too could not understand why this simple thing has been left off the new series of Spectres.

He also told me that they will probably issue a fix soon.

Great to hear you were able to get it sorted out @Meg1st