I have a cheap irulu Walknbook 2 (model# w1004). I was trying to solve some bad behavior with the system and disabled XHCI support in the BIOS setup utility and enable USB OTG. That appears to have been a bad move as USB is not nonfunctional.
I can force the BIOS to a boot menu if I hold vol+ and vol- while it boots but I can’t navigate without a keyboard.
The hardware platform is Bay Trail.
I can use Windows via the touchscreen and on screen keyboard. I used EasyUSB to config it to boot to the shell and it has a block IO driver for the microSD card. I can get the shell to run startup.nsh.
I used that to do a dmpstore and capture the variables but it looks like all I can see are the runtime variables (all the boot services variables are hidden from me).
I can probably fix the boot order via running dmpstore through startup.nsh.
I’m hoping someone might know if there is any magic from Insyde that can be run via the shell to cause it to set defaults. Does anyone know of anything? Does anyone know about hacking Insyde’s NVRAM area if I can find the SPI chip, pull it, and grab an image of it?
Since you can boot from the sd card at an EFI shell, why not run a utility to either dump or flash the entire BIOS again? Do you have a clean BIOS or at least a working one? If you do, and since your system is BYT, you can use Intel’s Flash Programming Tool with command fpt -d bios.bin -bios or fpt -f bios_fix.bin -bios to dump or flash the BIOS respectively. It has both EFI and EFI64 variants so you can give it a try. Now that I think about it, you can do the same via Windows as well if you like. The parameter “-bios” will only dump/flash the BIOS region which is not locked by the Intel Flash Descriptor, provided that (hopefully) the OEM hasn’t implemented any BIOS protective ranges or whatever they are called. If you want the entire SPI image dump, try without “-bios” but it may fail because of the usually locked FD previously mentioned.
I’ll give the Intel utility a try. I can’t find an image to try at all.
If this were Aptio, I would have tried deleting the Setup variable but it seems Insyde hides all the boot services variables at the end of BDS (even through the shell is still technically in boot services).
I’m concerned they have the flash part set to read only at the end of BDS as well 
I’ll check out the Intel utility to see what I can do.
I’m more familiar with the innards of the EDK2 and Aptio so this locking down variable services from the shell is new to me (and quite annoying).
Hopefully the Intel utility will be able to write an image as well if I can reverse engineer Insyde’s NVRAM storage system and correct the USB setting I changed.