Hello guys, I’ve tried to unlock it myself but it wont unlock.
Can someone unlock/or help me learn how to unlock spread spectrum?
Also potentially unlocking all the CBS menus.
This is a quote from my original post-
“Hello everyone, I’m seeking some assistance with unlocking some bios settings.
I am using AMIBCP 5.02.0031 to open up a bios dump I did for version 5603. I dumped the bios using flashrom.
When I change Spread Spectrum to “Supervisor” or “User” and flash the bios using Flashrom, it doesnt unlock any of the menus. I even attempted to set “Stop Fan” to Supervisor/User and that didn’t work either. Any suggestions?
Image for reference.”
@xlegacygt - Please upload images for me of ALL CBS and CBS/Submenus you can see now, so I can see ALL settings in CBS you can see.
I assume this is your board, correct? https://www.asus.com/Motherboards/ROG-STRIX-X470-F-GAMING/
Please reflash stock BIOS using EZ Flash, then dump BIOS again with flashrom for me, that way I am working on clean unedited BIOS, thanks
And yes, I will give you examples of how to unlock these items 
Once we confirm which method works (ie unsuppress only, or unsuppress + Access Level - User/Super on top of being unsuppressed)
Hey! Thank you so much for the help.
I am not sure how to extract CBS images so for now I will skip that and focus on the Spread Spectrum, are you able to explain the extraction of CBS?
Here is the bios, its not modified and the newest version. I do have some things configured like my fan curves and ram overclock but I dont think the back up of the bios includes those settings?
https://www.dropbox.com/s/1bo8l209f4k7u1f/Bios.zip?dl=0
Yes that is my motherboard you linked.
@xlegacygt - CBS images, take with a camera while you look at them in the BIOS, if you can’t screenshot to USB via F12 hotkey
I am on limited internet, so I do not want to download the above package.
Please reflash stock BIOS using EZ Flash, then dump BIOS again with flashrom for me, that way I am working on clean unedited BIOS, thanks - Send me only this
^^ In this, you can go ahead and make any changes you want INSIDE the BIOS GUI itself before you save and then dump with flashrom, these will remain as you set them (If that is how you meant you are changing them), but do not edit the BIOS editing tools
Ohhh, I completely misunderstood the CBS part lol.
The bios I zipped up for you is a 100% clean unedited file flashed with EZ Flash and dumped with flashrom, I only changed options within the bios GUI.
-------------------
@Lost_N_BIOS here is the screenshots of the CBS menu. No sub menus currently.
https://imgur.com/a/AZEZ5hp
Thanks, OK, I will grab that BIOS. And yes, any changes you made within the BIOS will remain
Please max compress/zip the images above, then upload to free file host, thanks!
@Lost_N_BIOS let me know what file hosting website is best for you. (I googled the ones below.)
EDIT: Changed to google drive.
CBS images zipped up- https://drive.google.com/file/d/1OAlTkHh…iew?usp=sharing
Same Bios as above- https://drive.google.com/file/d/1xVjMfWU…iew?usp=sharing
EDIT: Added alternative links.
CBS images zipped up- https://www18.zippyshare.com/v/963dUIS8/file.html
Same Bios as above- https://www18.zippyshare.com/v/fpNmvZ2z/file.html
Please put all in single zip, the above are fail for me (virus often at zippy, so I avoid) and your google links require sign in so I can’t download those either 
http://tinyupload.com/ << Best for me, when working to upload too, I think it may be OK right now
https://uploadfiles.io/
Thanks, and it’s OK Now, please wait, I will make you three BIOS to test at first a bout a single setting (Spread Spectrum) and one in CBS, then you test and tell me which way works, then I can do rest in CBS, or show you method etc.
Exciting!
You did realize this BIOS has two images in it correct? I mean, top and bottom are two different BIOS images, one top for certain CPU’s and bottom for other CPU’s, so depending on your CPU which area you edit when doing manual edits (unsure if current leaked AMIBCP can see/edit both)
I do all edits manually though, so this does not matter to me about AMIBCP I will show you the way, to do it manually, if Access Level edit is required for these AND AMIBCP fails to do it properly.
To check about that, I will send you follow-up test if we find Access Level is required, editing with AMIBCP, so we can see if it does it correctly or not, if not then I will show you how to make that edit manually too.
I definitely did not know that, interesting! I used AMIBCP 5.02.0031 to change the items to supervisor but they did not show up in the bios.
I have the 3800X.
@xlegacygt - Show me image of your BIOS at root level of Ai Tweaker, top to bottom, make two images if you have to scroll
Also, look on Main page, can you see “Access Level” and if yes, it shows Administer, correct?
* Edit - Never mind the image, don’t need it and it wont help!
I assumed you’d notice that, but I guess you would only see if searching and using UEFITool.
I don’t know which applies to your CPU, that would take some individual tests of editing one area and not the other, I’ll just edit both so it’s OK
@Lost_N_BIOS here are the images. It does show Administrator in "main."
https://ufile.io/fn91s6nb
Edit: I wouldnt have noticed because I’m still learning, lol. Its a lot to take in.
---------------------
@Lost_N_BIOS is this why I see 2 options inside of “setup_extr” for “SB Clock Spread Spectrum?”
“One Of: SB Clock Spread Spectrum, VarStoreInfo (VarOffset/VarName): 0x48, VarStore: 0x31, QuestionId: 0x151, Size: 1, Min: 0x0, Max 0xFF, Step: 0x0 {05 91 95 01 96 01 51 01 31 00 48 00 10 10 00 FF 00}”
"One Of: SB Clock Spread Spectrum, VarStoreInfo (VarOffset/VarName): 0xD4, VarStore: 0x1, QuestionId: 0xB8, Size: 1, Min: 0x0, Max 0xFF, Step: 0x0 {05 91 95 01 96 01 B8 00 01 00 D4 00 10 10 00 FF 00}"
Edit: It also provided me 2 body.bin files, body.bin and body_1.bin when using UBU to extract IFR.
@xlegacygt - No, there is several SB Clock Spread Spectrum settings in there, one is hidden and only one is the one you want. This is not what I meant about upper/lower BIOS images, and two setups and or other modules.
Search this GUID and you will find both Setup modules, one at top image (upper) and one at bottom image (lower) >> 899407D7-99FE-43D8-9A21-79EC328CAC21
Both of those, you generate IFR from, and that is what you’ll be editing. The SB Spread Spectrum that is the one you want to edit / make visible is the one that has D.O.C.P setting directly above it (ie (VarOffset/VarName): 0x48).
Sorry, I can’t comment on using UBU for any of this, it’s not used here nor should be. Use UEFITool to extract what you want to make IFR’s from.
UBU’s extraction is for another purpose, and I don’t use so I can’t tell you what the files you asked about are, only that you should not use this for BIOS editing, less confusion if you do the extract yourself directly.
Always extract and replace same way, if you extract As-Is, replace As-Is, if you extract BODY, replace BODY 
Yes, BIOS editing can be tricky, especially if easy to use GUI based tools do not work and you have to use other methods.
All edits I will do here involve use or UEFITool 51.0 for extracting the modules, and UEFITool 25.0 for insertion back once edited, but all can be done with 25.0 if you wanted
Then any hex editor (I use hex editor NEO)
This is what is suppressing SB Clock Spread Spectrum (if User or Super), and they doubled it up for no reason trying to make sure (as if one wasn’t going to work)
This is from “Setup PE32” module GUID - 899407D7-99FE-43D8-9A21-79EC328CAC21 - Extracted as-is, then IFR generated to see readable info using Universal IFR extractor then you can use this info to hex edit
Suppress If {0A 82}
0x426E6 64 Bit Unsigned Int: 0x1 {45 8A 01 00 00 00 00 00 00 00} << Target/cause of suppression
0x426F0 64 Bit Unsigned Int: 0x1 {45 0A 01 00 00 00 00 00 00 00} << Target/cause of suppression
0x426FA Equal {2F 02}
0x426FC 64 Bit Unsigned Int: 0x1 {45 0A 01 00 00 00 00 00 00 00} << Target/cause of suppression
0x42706 64 Bit Unsigned Int: 0x1 {45 0A 01 00 00 00 00 00 00 00} << Target/cause of suppression
0x42710 Equal {2F 02}
0x42712 Or {16 02}
0x42714 End {29 02}
0x42716 Suppress If {0A 82}
0x42718 64 Bit Unsigned Int: 0x0 {45 8A 00 00 00 00 00 00 00 00} << Target/cause of suppression
0x42722 64 Bit Unsigned Int: 0x0 {45 0A 00 00 00 00 00 00 00 00} << Target/cause of suppression
0x4272C Equal {2F 02}
0x4272E End {29 02}
0x42730 One Of: SB Clock Spread Spectrum, VarStoreInfo (VarOffset/VarName): 0x48, VarStore: 0x31, QuestionId: 0x151, Size: 1, Min: 0x0, Max 0xFF, Step: 0x0 {05 91 95 01 96 01 51 01 31 00 48 00 10 10 00 FF 00} << Search this string on extracted PE32 module, then you find above items/data to edit right before it
0x42741 One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
0x42748 One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
0x4274F One Of Option: Auto, Value (8 bit): 0xFF (default) {09 07 05 00 10 00 FF}
We shall Null this by doing what you see below >> and this will = BIOS Set (Setup edit ONLY) in the three BIOS below, other two are AMITSE/SetupData Access Level User/Super changes (manual of what AMIBCP Does) on top of SetO
If this + all three BIOS fail, then that means this method to Null this does not work on this BIOS, and we have to use other method to get around this suppression (move setting above “Suppress If” so it’s not within the “Suppress If” constraints)
Suppress If {0A 82}
0x426E6 64 Bit Unsigned Int: 0x1 {45 8A FF 00 00 00 00 00 00 00} << Target/Nulled
0x426F0 64 Bit Unsigned Int: 0x1 {45 0A FF 00 00 00 00 00 00 00} << Target/Nulled
0x426FA Equal {2F 02}
0x426FC 64 Bit Unsigned Int: 0x1 {45 0A FF 00 00 00 00 00 00 00} << Target/Nulled
0x42706 64 Bit Unsigned Int: 0x1 {45 0A FF 00 00 00 00 00 00 00} << Target/Nulled
0x42710 Equal {2F 02}
0x42712 Or {16 02}
0x42714 End {29 02}
0x42716 Suppress If {0A 82}
0x42718 64 Bit Unsigned Int: 0x0 {45 8A FF 00 00 00 00 00 00 00} << Target/Nulled
0x42722 64 Bit Unsigned Int: 0x0 {45 0A FF 00 00 00 00 00 00 00} << Target/Nulled
0x4272C Equal {2F 02}
0x4272E End {29 02}
0x42730 One Of: SB Clock Spread Spectrum, VarStoreInfo (VarOffset/VarName): 0x48, VarStore: 0x31, QuestionId: 0x151, Size: 1, Min: 0x0, Max 0xFF, Step: 0x0 {05 91 95 01 96 01 51 01 31 00 48 00 10 10 00 FF 00}
0x42741 One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
0x42748 One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
0x4274F One Of Option: Auto, Value (8 bit): 0xFF (default) {09 07 05 00 10 00 FF}
CBS items are suppressed similarly, but in a different way to suppress, one example below
This is from CBS PE32 Module @ GUID - 3E7788CA-2BFC-4FCE-8122-5176CA492D9F - Make IFR and then you can see info to use to hex edit >>
Suppress If {0A 82}
0xB70D QuestionId: 0xF equals value 0x1 {12 86 0F 00 01 00} << Target/cause of suppression
0xB713 Not {17 02}
0xB715 QuestionId: 0xF equals value 0x2 {12 06 0F 00 02 00} << Target/cause of suppression
0xB71B Not {17 02}
0xB71D And {15 02}
0xB71F QuestionId: 0xF equals value 0x3 {12 06 0F 00 03 00} << Target/cause of suppression
0xB725 Not {17 02}
0xB727 And {15 02}
0xB729 End {29 02}
0xB72B One Of: PCIe ARI Support, VarStoreInfo (VarOffset/VarName): 0xF3, VarStore: 0x5000, QuestionId: 0x7, Size: 1, Min: 0x0, Max 0xF, Step: 0x0 {05 91 11 02 12 02 07 00 00 50 F3 00 10 10 00 0F 00}
0xB73C One Of Option: Disable, Value (8 bit): 0x0 {09 07 17 00 00 00 00}
0xB743 One Of Option: Enable, Value (8 bit): 0x1 {09 07 16 00 00 00 01}
0xB74A One Of Option: Auto, Value (8 bit): 0xF (default) {09 07 0F 00 10 00 0F}
We edit to bypass suppression similar to first example above
Suppress If {0A 82}
0xB70D QuestionId: 0xF equals value 0x1 {12 86 0F 00 FF 00} << Target/Nulled
0xB713 Not {17 02}
0xB715 QuestionId: 0xF equals value 0x2 {12 06 0F 00 FF 00} << Target/Nulled
0xB71B Not {17 02}
0xB71D And {15 02}
0xB71F QuestionId: 0xF equals value 0x3 {12 06 0F 00 FF 00} << Target/Nulled
0xB725 Not {17 02}
0xB727 And {15 02}
0xB729 End {29 02}
0xB72B One Of: PCIe ARI Support, VarStoreInfo (VarOffset/VarName): 0xF3, VarStore: 0x5000, QuestionId: 0x7, Size: 1, Min: 0x0, Max 0xF, Step: 0x0 {05 91 11 02 12 02 07 00 00 50 F3 00 10 10 00 0F 00}
0xB73C One Of Option: Disable, Value (8 bit): 0x0 {09 07 17 00 00 00 00}
0xB743 One Of Option: Enable, Value (8 bit): 0x1 {09 07 16 00 00 00 01}
0xB74A One Of Option: Auto, Value (8 bit): 0xF (default) {09 07 0F 00 10 00 0F}
Here, please test in the following order, and let me know which BIOS shows you “SB Clock spread spectrum” Stop flashing once you see it, no need to test further
Also, you should now see the setting above in CBS, please confirm too, then if yes, I will do rest in CBS, unless you want to?
1. SetO
2. SetAMITSDU
3. SetAMITSDS
https://ufile.io/n6qemavx
Also, I checked, and for Access Level Changes, AMIBCP only edits one image (The upper area, so if that does not apply to your CPU then AMIBCP changes would not work for you if needed, and you’d have to do edits manually to the lower area instead)
Manual changes to Access Level without using AMIBCP are done in AMITSE >> B1DA0ADF-4F77-4070-A88E-BFFE1C60529A >> AMITSE/Setupdata >> This is actual target you edit >> SubGUID >> FE612B72-203C-47B1-8560-A66D946EB371
Then, changes are made how I give in this example, see last par of the post at bottom of #4, and check the image to see about Access Level - [Request]Maximus XI Hero - Unlock AMIBCP
For this BIOS, you make the edit on two AMITSE/Setupdata modules, to cover all bases for all CPU’s (Same for all edits done here, since you are not sure which area applies to your CPU type)
@Lost_N_BIOS beautiful, thank you for all the information. Of course its a lot to process but I will compare your edits with stock edits and learn of it.
The first bios you posted did not unlock Spread Spectrum but the 2nd one did. "SetAMITSDU"
As far as the CBS menu I see you messed with "PCIe ARI Support" but this option was already unlocked with the screen shots I provided you.
Couple questions.
-Did you end up modding the upper image? If so, this would mean I can use AMIBCP 5.02.0031 to set "user" or "supervisor?"
-When using UEFITool to look through the bios, how do you determine what PE32/module image you need to extract to make proper edits too? There is a lot of PE32 images.
-Also, how do you determine what part of the hex is actually causing the suppression? How do you look at "0x426E6 64 Bit Unsigned Int: 0x1 {45 8A FF 00 00 00 00 00 00 00} << Target/Nulled" and 0xB70D QuestionId: 0xF equals value 0x1 {12 86 0F 00 FF 00} << Target/Nulled and determine that hex is causing it?
If you dont mind unlocking the rest of the CBS I would be beyond grateful, I do want to do my own edits but I need proper tools in case I brick my board.
@xlegacygt - Ahh yes! Sorry about that, on CBS, I thought it was missing, didn’t see it below but I see it now!
This may mean the CBS I mentioned and edited isn’t the one your BIOS is using too, there is three. I will have to check them all more closely, if you want me to to the CBS mods too.
I modified both upper and lower, this is what I always do unless user is already sure which applies to their BIOS, otherwise you’d have to do some test with edit to only one then the other, to figure out which applies to your CPU.
So, still not clear here which applies to your CPU, direct upper only and lower only test would be required. If you want me to make you two BIOS so you can test that I will.
SetO = Setup only edits
SetAMISDU = Setup + Access Level Edit to AMITSE/SetupData (both upper/lower), so AMIBCP may or may not work for you, after you do the setup edit.
You can test, use SetO and do AMIBCP edit SB Clock Spread Spectrum to User, if it does not show then your edits only need done to the lower area of the BIOS and would need manual edit only for Access Level Changes to be applied
If it shows, then you only need to edit the upper area of the BIOS, and can use AMIBCP for Access Level changes or default changes etc
In UEFITool you expand Setup or AMITSE for what we’re discussing, and there you extract it’s PE32 (for AMITSE you are not editing it’s PE32 right now though, but the subGUID below it (AMITSE/SetupData)
I gave the GUID’s for all above, search via GUID with UEFITool and it will show you at the bottom, upper and lower, click each to go directly to the location.
You tell what is suppressed by the IFR output, you can tell what is the part to edit by what I bolded below, sorry I didn’t make that as clear above
0x426E6 64 Bit Unsigned Int: 0x1 {45 8A 01 00 00 00 00 00 00 00} << Target/cause of suppression
0xB71F QuestionId: 0xF equals value 0x3 {12 06 0F 00 03 00} << Target/cause of suppression
I just know from experience which is what, but you can see by how it’s coded usually, suppress is = 0x0xx, and then the code string you find that 0x0xx and FF it
Yes, tonight when I have time, I will unlock the rest of CBS (properly this time 
)
I will include the before/after CBS file too so you can see what was edited and how.
@Lost_N_BIOS you’re awesome thank you.
Question, what is AMITSE exactly? I noticed you mentioned setup and AMITSE.
Is AMITSE just for access level of “user”, “supervisor?”
----------------------------------
@Lost_N_BIOS I know I may be overthinking a lot of things but do you mind checking out my image of my hex edit to ensure I’m doing it correctly?
Steps taken:
1- Used UEFITool to search for “899407D7-99FE-43D8-9A21-79EC328CAC21” I was also able to find it by just searching Spread Spectrum within UEFITool and they both provided "899407D7-99FE-43D8-9A21-79EC328CAC21."
2- I took the “top” PE32 image section and only extracted that file “as is” within "899407D7-99FE-43D8-9A21-79EC328CAC21."
3- I used Universal IFR Extractor on the PE32 image section.
4- I searched Spread Spectrum and found the section with "Suppress If."
5- I made the hex edits which I provided images for here. https://ufile.io/gvy71cyz
@xlegacygt - You’re welcome, and thank you! [cool
AMITSE (AMI Text Setup Environment) This is what we often edit to do major menu changes, such as add/remove main sections.
The AMITSE/SetupData (subGUID in this case) is where the settings fail-safe/optimal and Access Level values are stored (along with other data and layout info)
You do not edit AMITSE for the stuff you were asking about here, only AMITSE/SetupData, per the link I gave you above at end of post #16 - Follow link, read bottom of that post and see the image, for how to do Access Level edit manually
To use your Top Only Setup edit as tester, to see if your CPU uses upper section of the BIOS, you will also have to do the AMIBCP edit on top of that.
Then if this does not show, your CPU used bottom area of the BIOS instead, then both edits there would need done manually @ Setup PE32 and @ AMITSE/SetupData
Yes, your hex edit image shows a correct edit You can double check your work after you save it, by generating a post-edit IFR with new mod file name, then look at the same are and be sure your edits are as intended
The edit’s are correct, but just letting you know this is easy way to check.
* Edit - ON CBS, after further checking your image vs the three possible CBS files, this is your BIOS CBS and it’s in the lower section only, so that may be the area of the BIOS user per your CPU
8E38A88A-C267-4131-A8CD-C0BC80A24CB5
If you want to edit yourself, you need to know this >> 47 02 (TRUE) >> Edit to 46 02 (False)
I see right towards the top, several submenus suppressed via 47 02, then some other stuff suppressed in ways we’ve already discussed.
But, if you get stuck, or still just want me to do it, let me know