Wow! I never seen output like that from H2OUVE, I would have told you to not reboot and dump again to let me check, lucky for you it was OK 
It shouldn’t have auto-reboot on you either!
In that edit, we only changed one variable (Flash Protection Range Registers (FPRR) = 0x6D1), in one GUID - 4570B7F1-ADE8-4943-8DC3-406472842384 @ two entries “029 - Custom” and “068 - PCHSetup” >> Both Index 029 + 068 >> set successfully!
I still would have had you dump vars again and send to me to check after seeing that output above, then if necessary we’d write back stock one with other version, then again try to write in the edit.
If that did same thing, then I’d narrow it down to the exact GUID and try again.
However, looks like it’s all OK, so lucky for you! I guess maybe it does output like that on certain models and not others?
To answer you, yes all in BIOS, nothing hardcoded into hardware. We can change any setting like this, except where you see a fail that would need flash programmer or other method, and many can be done in grub/setup_var instead too (more ideal for most)
So, now we’re all set I think! Please send me new biosreg.bin dump and we’ll do the menu edit.
guid is piece of garbage !
Thanks mate was laughing out loud love your style 
here it is - buddy after all of that you are welcome : come to France i will buy you couples of champagne’s bottles !
i dont know where are you from : but anyway you are welcome at my home !
BTW mate how are doing of your life ? what is your core work ?
Keep cool m8 i haven’t flash my bios yet wanna go backward not problem at all
Iam a lucky guy and i know it !
----------------------
https://filebin.net/m4kuct5edeg76pn3/biosreg.bin?t=nkknaoqw
@saltinbank - What do you mean GUID is garbage??? Thanks, good to hear I’ve got you laughing, better than sweating bullets I suppose 
Yes, I’d stop by for some champagne if I was anywhere close, but alas I’ll probably never be over on that side of our blue ball 
Of course you haven’t flashed your BIOS yet, I haven’t sent you a mod BIOS to flash… So there we are
Yes, that was lucky, sorry I didn’t mention to dump vars again and the wait without rebooting! I usually remember to tell users that
Here’s your mod BIOS, flash via >> FPTw.exe -bios -f biosregmod.bin
http://s000.tinyupload.com/index.php?fil…554157684637195
OMG ! YOU ARE A KING LOST LOVE YOU MY MAN !!! IT WORKS FLAWLESSLY !
- God bless you, your family your wife your kids your friends !
- incredible unlocked features : crazy amount of debug stuff and overclocking features (maybe 100+ features unlocked) SO NICE !
- I cant switch off Hybrid gpus aka SG in Intel Agent ! FIX MY HDMI ISSUE i was working on and not fixing it for months !!!
- Keypad is now active on start thanks to the option …
- I Hate OEM like Acer not giving full control (debug stuff locked ok i understand they dont want to misleading people and frying their laptop).
- Bios is so better with all these options : i have full control of the cpu and the gpu so much granularity for fine tuning and o/c !!
- I will paste with metal liquid the beast now for sure !
- i dont like GUID because they were invented to trace people on the internet : Microsoft start it with WIN98 and i dont like leaving traces all over the internet !
- IF i desactivate TPM (trust plateform) and manage to Remove ME (management engine) via a raspery pie that are NSA backdoor in the system : WIl the system hang on ? or it wil Be locked up ? Can a laptop work normally without them ?
- if you visit EUROPE and come to FRANCE : my house is your house ! It will be a pleasure to show you Paris !
You are a Bios Engineer ? you are doing this for long time ? You are working for Intel or Oem ? Have you learn by yourself ?? i wanna know !
Which country are you from buddy ? USA ? What are doing of your life iam so curious i know !
Two more requests and iam gone Can you tell me if you know some documentation about HynsideH20’s bios features for OEM
Iam kind of lost ill know a lot of feature but want to understand all of them ? there some PDF or Guide for tech/engineer People working for OEM ?
Then, i want to learn by myself could you please give me a full version of guide maybe you made or someone have done to understand the HEX’ modification you have done on the bios dump ?
I know it is not an easy task (eazy peazy for you i know you are talented and skilled) for a noob like me but i want to learn ?
Which software you used ?
The guide you forwarded me to is sufficient ? or there so other task to manage ?
they are lot of flaws and side channel attack for insyde bios …
https://www.insyde.com/security-pledge
The fact is a new flaw discovered called PlunderVolt
https://wccftech.com/intel-cpu-plundervo…e-manipulation/
iam sure OEM will release a new Bios for it ASAP ! i want to learn because i dont want to bother you with new bios mod next time
if havent tried yet all the options in the overclocking tab : maybe i can stop undervolting by my self !
And learning these skills i could help others like you MASTER
HAVE A HAPPY X-MAS MATE ! AND THANK YOU SO MUCH YOU ARE THE ONE !
@saltinbank - Thank you! 
Great to hear all went smoothly
Haha, thanks, I appreciate all that love! 
OMG!! So sorry, I always forget! DO NOT try to enable/disable/switch any graphics adapter to be main, secondary etc. you can change graphics settings liike memory amounts or stuff like that, but don’t try to enable this or disable that.
Otherwise you will end up with black screen and only way to recover is by blind flash or flash programmer.
UUID is what you mean, not GUID Now, I see what you mean though. You can always change your UUID, or zero it out even if you want
Some systems are OK with ME FW disabled, others it may mess up stuff like memory overclocking (timings, settings in general etc) same for CPU. Some also makes fan run at 100% always.
So, up to you to disable, but if you want it disabled I can do for you properly (ie with Intel tools, not ME Cleaner type apps). If you do flash in a ME disabled FW, the only way you can put back enabled on is with programmer or if FD is unlocked (which I think we unlocked in your BIOS already since you were using programmer)
Thanks, yes, if I am ever in Paris I will let you know and stop by for a visit! No, I am just an avid overclocker and PC user, all self taught over the years.
Sorry, not sure what you are asking about for Insyde BIOS stuff. I don’t have any PDF’s that explain stuff like this
I hate Insyde BIOS in general, so I haven’t written any guides about modifications for this. On the other thread you were in before, I gave info on these kinds of edits, best ways I could explain them.
I used IDA assembly/disassembly tool, UEFITool 51 and 25, and hex editor
Thanks, and Happy Holidays to you and your family, and I wish you all a Happy New Year as well
I’ve been following with thread with a mix or awe and disappointment.
Awed by the lengths you’ve all gone to in order to unlock the bios of this laptop, and disappointed at how complicated it all is for someone like me who has never attempted to unlock and flash a bios.
I know it’s a big ask, but can any of you put a document together explaining how to get this done, the tools required, etc.??
I tried to follow your conversation but it’s really hard to make sense of it when you’re a total newbie at this.
I’ll keep following this thread anyways, hoping to learn something along the way. Maybe when the warranty expires I’ll just take my chances.
@Valantur - yes, sometimes it’s complicated, especially if you do not have flash programmer.
It’s not a big risk to do this, and we’ve sorted out all that’s needed to do it now for users without flash programmer.
Here’s what you need to do, all shored up in a few steps
1. See post #97, download that package and run the command given there but only from the H20UVE_100.00.16.08 version folder, and then upload the vars.txt created for me to edit.
2. I will send you edited vars.txt back, and give you the command to use to program it back.
Next step, you must wait, until I send you back the edited vars
3. After you program back in the edited vars I send you. Then you do as you see in spoiler below, and send me the created biosreg.bin file so I can edit it.
Go to this thread and in the section “C.2” download the V12 ME System Tools Package
Intel Management Engine: Drivers, Firmware & System Tools
Once downloaded, inside you will find Flash Programming Tool folder, and inside that a Win32 folder.
Select that Win folder, hold shift and press right click, choose open command window here (Not power shell).
At the command prompt type the following command and send me the created file to modify >> FPTw.exe -bios -d biosreg.bin
If you are stuck on Win10 and cannot easily get command prompt, and method I mentioned above does not work for you, here is some links that should help
Or, copy all contents from the Flash Programming Tool \ DOS folder to the root of a USB Bootable disk and do the dump from DOS (FPT.exe -bios -d biosreg.bin)
https://www.windowscentral.com/how-add-c…creators-update
https://www.windowscentral.com/add-open-…menu-windows-10
https://www.laptopmag.com/articles/open-…ator-privileges
Or here is simply registry edit that adds “Open command window here as Administrator” to the right click menu
Double-click to install, reboot after install may be required
http://s000.tinyupload.com/index.php?fil…134606820377175
@Lost_N_BIOS So am I right that flash programmer is not needed to unlock the bios? All can be done purely by software method
15 bsod on the night , bricking that shit all night
on my laptop press on button for 15 Sec or do alt+f10 and you can retrieve default bios eazy peazy
I have fucked up speedstep feature, upped PL1/2 Limit to 100W, enabled AES and SGX not present by default
Locked this 9750H to 4.1ghz all the time ( C1E & EIST, Cstates, Speedstep and speedshift, PROCHOT, and BD PROCHOT)
Turbo is disabled so processor will always (even 100% under load @ 4.1ghz) and the best is :
VID was 1.255 V with turbo …
I can run it fully stable @ 1.021V @4.1 ghz OMG - 200mV (holly shit intel features sux) !
No more Vdroping ! no more fluctuation ! rocks solid !
76C ! with fan maxed out !
Thanks Lost i know all you said is right but i dont care iam an Enthusiast overclocker : messing up with all the options now availabled !
Plus i overvolted pci express (PEG link) to 75W to 100W and now my RTX 2060 mobile is able to reach 2200 mhz (960 stock / 1260 boost) and 16 GBS gddr6 14 stock !
Vrm and pci can handle link
I need 3 days learning all the options of this shitty bios BTW iam on it
I blow stock RTX 2060 desktop ! and eat all the 2070MQ and 2070 mobile so far my laptop was bought for 14000 bucks and even Mac Book pro @ 5000 bucks (I7 9850H or even I9 9950K) can reach it on benchmark because of their throttling under very high load !
WR : super pi 1M 8Sec : best 9750H do it in 8.55Secs !
@Hyppo - Yes, we resolved issue and found solution to flash this model without flash programmer
Dump vars with H2OUVE version mentioned above, then edit FPRR variable (and BIOS Lock if enabled, but wasn’t here) in two locations and flash back edited vars, then dump BIOS with FPT, edit whatever you want, flash it back
@saltinbank - Keep tweaking, you will get it all stable without BSOD
So, do you need further edit to reveal AES and SGX, or did you do it with AMIBCP? If AMIBCP didn’t work, then they probably just need unsuppressed with a setup module edit.
We can make visible
So you have the World Record now for Super Pi? Just for this model or for all laptops, or what?
Hello @Lost_N_BIOS
Would you be so kindly to help me out with unlocking my Acer BIOS too?
I’ve got PH317-53 which is using same BIOS as PH315-52 mentioned here.
I’ve got simple programmer, app and clip so I could use it if this is really unavoidable.
But I would prefer software method to dump and reflash my bios, just looking for best possible unlock to get proper control.
@mikolaj612 - you missed some steps, I don’t need your biosregion dump yet, and you can toss that file out too so there’s not mix-ups later.
Please re-read post #107
@Lost
Dont worry SGX AND AES are fully customized with this one (bios) i went to professional edition for WIN10x64 and Bitlocker is now active …
SGX is disabled …
Thank you buddy i saw lot of people needs you we stay in touch and year the WR is on this mobile plateform …
HWBOT is verifying all the details meanwhile
Take care i will come back to see further details or maybe chat with you on other topics ! Thank you for you support take care buddy !
One big issue with this laptop is locked PL because bios settings is overwritten by OS and PredatorSense as I understand it
8 sec of superpi falls in short period before switch to PL1 so can’t reflect it
1260 in Cinebench R15 is good but average, my Lenovo Y540 gets 1270 in first run and I saw above 1300 in some YouTube reviews but anyway the main thing is that these 1260 must be stable all the time. Run Cinebench r15 in loop for about 20 times and check whether it’s on the same level?
Here is how to do it
http://forum.notebookreview.com/threads/…-output.815101/
You can also try better memory frequency for benchmarking, mine can run DDR4-3200 CL22 or DDR4-3000 CL17
@Hyppo : i know all of that score ares looped cinebench session for 30 mins …
My kingston DDR4 memory stick are locked to 133 mhz aka 2666 mhz no luck here no XMP profiles on it : cant overclock them further !
Look at my starting scores but you are right mate i have won 200pts in cinebench …
My i7 was a mid tier not an excellent performer due to throttling (as i say my laptop is the cheapest on the market so i dont care)…
Windows for me is a crap : usefull to play games cuz nvidia driver are excellent on it …
Actual WR: 
All of the rest my Debian parrot OS for hacking and pentesting :
For sure your Lenovo is better, the fact this mod is usefull under linux (not PSense availabled) and now it got PL1/2 upped to 100W, i can disable SG (hybrid gpu) so i can output the HDMI (my tv basically) … before it was impossible or need to use plenty of buggy open source softwares …
Under linux The UEfi bios manages all the sitting i need ( trip point, PL limit, undervolting, B-D PROCHOT and PROCHOT itself) …
I need performance to brute force password with HAshcat or Pyrit, to run massive DDOS attack, Have lot of DataBases running at once … Iam a pentester …
And for this task my predator is excellent at …
Nope lenovo definitely is not better) I have both Y540 and PH315-52 and can compare however some things yes lenovo does better
So do you want to say that when you set PL1 to 100w in bios this limit is really used by Linux? Can you try the same in windows, maybe I do smth wrong?
Regarding the temperatures, you can get significant drop maybe by 10-15C after repaste with good conventional paste like kryonaut, pk-3 etc.
But going to LM is more arguable coz it gives just more 3-4C drop on cpu only and no change on gpu
For memory you don’t need Xmp profile you can set multiplier and timings manually however of coz modules itself must be capable to do it, if you have standard green Hynix or Kingston sticks then I don’t know how good they are
@saltinbank can you please list all settings you changed in bios I will try them too)
you right under windows PSENSE is overighting PLL cuz it works with XTU …
two options you set basic trip points in the bios to set then fan accordingly of the temperature you want and delete PSENSE in windows (the hard way)
Or you relaunch XTU software up and up PLL accordingly as you set earlier in your bios : il will overide and you can verify your result also in QUICKCPU : cool software (i used on windows to back the speed down to 1.5ghz) when iam doing some writting or web surfing and i dont need all the power of the cpu iddling (beacause i have disabled all energy features now it doesnt throtlle so i do it manually with speed shift feature)
look at it ! cool software far better that Throttlestop (dont kneed it any more this one also because BD prochot and prochot are disabled in the bios)
https://www.coderbag.com/product/quickcpu?fw=up
always use turbo mode : it unlock via hardmod no softmod REAL value (90W for the GFX and 80W+ for the cpu)!
Max power for me is 81W under XTU not 100W power security i think kick in (dont know why i have disabled all and set very high trip point and temps)…
But no more thermal and power throttling under CPU remains at 4ghz all the run before was going down to 3.2 ghz and max 60W
i think 80W is the sweetspot : u cant reach more wattage (i think there is a power circuitry protection kick in)
i have changed so many settings but to sum up and stay focus on overclocking tweaks :
- PEG LINK pci express i have upped the voltage draw 75W > 100W to give more juice to my Discrete GFX …
Give me more stability @ 2ghz + for my rtx 2060 under peak charge …
- Bi directional PROCHOT and PROCHOT disabled
- left enabled, thermal Alert and have tweaked all my TRIPPOINTS to 110C celsius (75/95 before)
WIth this two i have NO MORE " thermal throttling" in XTU software in Windows !
- Disable C1E and C-states : it disable turbo mode (but i dont care) but give better endurance et better 4K ops with my SSD NVME !
Cstates arent good for SSD at all : should disable this …
So know the processor is locked (to 3.97 ghz or 4040 mhz) depending of your BLCK wich vary with boards and OEM manufacturer !
For the cpu :
Topic found on the net for a 7700K (some options are not available for our predator dont worry if you dont find all)
-PTID support : disabled
- SGX : disabled (too many flaws)
- PECI : disabled
-AES : enabled cuz i used bitlocker
- FLCK frequency for early power on : 1 GHZ
-Race to Halt : disabled
-Voltage optimisation : disabled
-HDC control : disabled
- Energy efficient P-STATE : disabled
-Plateform Power limit PL1 : 100000
- Power limit 1 time windows 1
- Plateform power limit 2 : 100000
- core ratio override 1/2/3/4/5/6 :43
- energy efficient turbo : disabled
- CPU CSTATES : off
-CFG LOCK CPU : disabled
- overclocking features : enabled
- WDT enable : enabled
- XTU interface : enabled
- RSR : disabled
- Core max oc ratio 41
- Core voltage mode overide (-195mv)
BLCK MENU : ICC OC watchdog enable (if not XTU ask you to reboot for changing vcore)
- BLCK MENU : clock frequency : set what you want !
using throttlestop to manually set cache ratio, static mode with lower voltage like 1.040mv can help with temps !
Ps: plateform power limit 3 and 4 can be set to override enabled and left at 0(auto) they can also be set to match PL1 and PL2 and thus i didnt saw any improvements BTW !
Sorry mate @Lost_N_BIOS -B
Here’s a proper files taken from both apps :
https://www37.zippyshare.com/v/MjHhAD0u/file.html