[Solved - BIOS Unlock] ASUS VivoBook F510UA/X510UAR

BIOS/UEFI Modding BIOS Modding Requests
21

@Lost_N_BIOS

I’m sorry I didn’t reply earlier, but I was away for a few days and had no internet access.

What I did was the following: locate CNFG entry inside NVRAM in my dumped bios, extracted body, edited with HxD at offset DD (this is not counting header, as it already was clipped out), and inserted in the original dump with UEFITool.

This NVAR entry is not included in stock bios (I don’t know why), so you won’t find it in stock 309 (ps: I’m using v308, as v309 has stability problems)

I am editing the entry showing in the picture attached in this post.

Thank you for your time, really.

Untitled.png

22

Update: I flashed a stock v308 to reset all the NVRAM variables (which they were according to UEFITool), the CNFG module didn’t appear and the bt utility didn’t work (it gave the same error message as before).

In the meanwhile, I’m searching and asking for a ASUS S510 bios dump, as those are the same laptops but with the backlit keyboard enabled.

23

Stock BIOS wont contain many necessary things inside NVRAM, so that is not a good thing to do you mentioned, it’s not resetting NVRAM but erasing important data (Settings, board specific details like serial, MAC ID etc).
I suggest you reprogram/flash your original BIOS with fully populated NVRAM volume, also, often actual onboard BIOS contains two NVRAM volumes at the top (Stock never does)
Did you check your BIOS (not stock one downloaded, or one that has been programmed or FPT’d with stock region, but actual dump from board before anything is done), for second NVRAM volume at top? Check there and see if CNFG entry too.
Is your BIOS dump in post #12, a dump before you did anything BIOS related at all? If not, can you please send me your first original backup before doing anything BIOS related.

On your CNFG body edit, this change was from FF to DD right before byte that is “06” and 8 bytes after a “F8” correct? if yes, then that looks like proper location to me

DD-CNFG.png



If you extracted entire NVRAM volume (Body), that only removes the main header, each entry also has it’s own header too that you’d need to count past in your edit (With header in place DD location = ED)

CNFG-Header-NoHeader.png



I have dumps from users of the following, and could get others probably, but I need to know full exact model you are looking for
ASUS VivoBook S15 S510UNR
Asus VivoBook S15 S510UF-X510UF AS301

24

@Lost_N_BIOS

The vanilla bios dump (unmodified one) is attached in this post. The one on post #12 was not edited, but was dumped after trying to use the bt app, so it may have messed with some NVAR entries.

Although this dump also has the CNFG entry, I can’t seem to find another NVRAM volume.

I changed the value from FF to 7C exactly were you mentioned: before that byte that is 06.

I don’t know exactly which model has a backlit keyboard enabled. Both are supposed to come with this type of keyboard (in reality, all S15/S510 should have a backlit keyboard).

Thanks

EDIT: Dumped the bios after editing the mentioned value and it was reset to FF. Probably there is a configuration elsewhere that is replacing it? I really don’t know that much in order to establish this

25

It’s normal, some BIOS (less often than usual) contain only one NVRAM volume at top (There is always a stock one inside main BIOS volume too, but this contains only stock entries and no CNFG nor many of the other usual entries)

So you changed the one I circled, before 06? If yes, that is correct one. How did you then flash that BIOS in? If AFU, what /switches did you add or what boxes did you check if GUI? If FPT or programmer, it should have locked in as programmed.
How you flash/program this in is going to determine if it sticks or not.

I checked the user dump I have from S15 S510UF-X510UF AS301 (The other ASUS VivoBook S15 S510UNR, does not have CNFG.)
The S510UF-X510UF one has FF before 06 there to in it’s CNFG, it’s user @Leeonard - maybe he can tell us if he has working backlight on his keyboard or not.
I noticed his CNFG has a lot more data, several lines populated at top (00-30)

26

I flashed the bios using FPT (with rewrite option). Doing a dump after flashing reveals that this setting is being modified, but then, after a reboot, it goes back to the original value (FF).

If that S15 doesn’t have that 7C instead of FF, I really don’t know anymore. Maybe this setting is being stored elsewhere in the NVRAM? Because I see no reason for the asus bios utility to work (bt). Also, if this is the case, this is relatively new, as people with ASUS laptops with Hasswell processors do use this utility to enable the backlight.

I will contact asus technical support and see if they can lend a hand on the matter, as I understand that the process for enabling the backlight with bt utility also came from them.

Regarding the unlocking of the bios posted by fv1872 on post #10, did you have time to take a look into it? I mean, I could really try it myself, I have no trouble editing with HxD and all that, the issue is that I didn’t quite understand the process hehe :slight_smile:

I really appreciate all your time spent on this topic, thanks.

27

@noreplyse - But, you said BT tool didn’t work for you either. Maybe your replacement board does not have the correct traces or resistors to enable this? Hopefully @Leeonard will reply and let us know if he has working backlit keyboard or not, if not then we know that’s not a good BIOS to compare with.
On all the threads you seen discussing the BT tool, did anyone post a “Working BIOS with backlight enabled”? If yes, try to find again and download that one so we can compare, can be any model, then we’ll see if CNFG in NVRAM is correct or not.

You’re welcome, and yes, I can unlock this BIOS, sorry I forgot you wanted and have been getting behind lately! Which BIOS here do you want me to use? I didn’t look back, and probably already have your backup, just unsure which one to use, but it needs to be a FPT BIOS Region backup.

28

@Lost_N_BIOS

I doubt there is a change in the circuit, or that the components necessary are not soldered on, specially as it would make no sense to solder only the connector and none of the components necessary to drive the backlight.

There are some bios dumps with working keyboard backlight, but all of them are of older computers and most are enabled using the BT utility, which is why I now doubt if the setting controlling the backlight is the same, as it would have worked for me. I will leave attached a dump I found which is suppose to have working backlit keyboard, but this one doesn’t seem to have the CNFG entry. If you want, I can upload more dumps if you think they are of any use.

Don’t worry about it! There is no rush. You can use the dump on post #24, which is the original dumo with v308 made with FPT.

29

Hello!, i am sorry to say, but I have no phisical backlit keyboard, so I don’t know if this is enabled or not in BIOS/NVRAM

30

@noreplyse - It may have been cheaper for them to leave the connector attached (Added) in some models and still yet not add other stuff, due to how production runs are made, you can’t be sure.
But yes, I do agree in general with your thoughts, one would think if they didn’t take them out of the assembly line before the connector is added why would that later before smaller items added in.

Thanks for dump, but we need one at least with CNFG in it, if we’re still thinking that’s the control/saved location. Do you know if they G74 users were using the BT Config utility, with success or not? If yes, and it worked to correct, then this is not stored in CNFG, at least not the one we’ve been looking at.
I’ll check that dump

And thanks, I’ll use BIOS #24 to unlock a BIOS for you

* Edit - I was inspecting bt.exe and I see it can also write to MNFG, test writing 7C to DD there and see what happens? And I can now confirm this is stored in BIOS only, not some other chip, this exe is for writing back to BIOS rom only.
I say this because on some BT discussion threads before I saw a few people trying to convince someone this isn’t stored in the BIOS (it is)

I also just remembered, I have a G74SW and C90S here, I can test and see if I can figure anything out with those! Both have backlit keyboards I believe

Thanks @Leeonard - I’ll stop tagging you now, last one to tell you thanks for stopping back in to answer

31

Leeonard, it’s ok. I thought that your computer had it. Sorry for tagging you

@Lost_N_BIOS Please don’t hate me, but the backlight now works! Well, sort of. So, remember I said that I had macOS installed on this laptop along with Windows? Well, after booting for the first time to mac, I now have a semi-functional keyboard backlight. At this time, I don’t really know how it is activated on macos, but when I found out I will comment on the matter, as maybe someone would like to know.

As for the semi-functional part, this is because it doesn’t light up when booting up (when posting, after os begins to load) as it does in all other ASUS laptops, it doesn’t get recognized in Windows (after reinstalling multiple times the ATK package) and I can’t control it with the fn keys on Windows nor on macOS. Also, if I close the lid on Windows, the keyboard doesn’t light up again. The same happens if I turn off the machine. BUT, if I boot into mac and restart into Windows, then the backlight stays on. This is really weard, at least for me and the knowledge I have.

This happend some hours ago and didn’t have enough time to dig into, so if I found something I will let you know.

EDIT: I really don’t know that much of this low-level-computer-stuff, but what I’m thinking right now is that, in order to make macOS work fine with your PC you need to extract ACPI tables from AIDA64 or similar, patch them and inject them with a bootloader. This I didn’t do as other person made the hard work of doing this for his/her ASUS S510-BQ414T and I used the same ACPI tables, as the machine is practically the same, except for this one having an Optimus chip and a dedicated NVIDIA GPU, which is not loaded on macOS as it doesn’t support it.

Anyways, what I wanted to say is that, maybe what is missing is some sort of declaration (or similar, if it even exists (?)) on this BIOS’ ACPI table, which is, hopefully, easily fixable.

32

@noreplyse - please see my last post, in case you missed anything I was editing in, thanks. Can you please add an image of your BIOS “Boot” and “Save & Exit” page for me.

That’s weird OS type would matter on this? I assumed only FN keys could affect it, since it should be enabled (if enabled) even when you are on DOS or in the BIOS etc. Good it’s working now, some at least!

ACPI tables I don’t know about editing, but there is several users here that do know about this. Maybe if you make a new thread with ACPI help request in the title, and maybe keyboard LED functions etc, someone with knowledge on that could help.
If no one jumps in there, I’ll try to think of who all I know here that knows about that and tag them in that thread.

Can definitely unlock your entire BIOS, I’m digging into that now, and wanted to let you know for sure I know method for this BIOS style, so soon you will have fully unlocked BIOS

* Edit - @noreplyse - On the ACPI tables thing, do you always use MAC OS right now? If not, you could put back stock BIOS region or stock ACPI tables etc, then test and see if this is what’s causing the backlight issue.
I would do this anyway, even if you use MAC all the time, just for a test, then you will know for sure if the MAC ACPI edits caused the issue directly or not.
Then, if they do, maybe you could have someone else do the edit instead, or use some other method.

What is that edit for anyway? I’ve only see MSR 0xE2 needing unlocked for MAC to work, and that’s easily done various ways without touching any ACPI tables.

Here is unlocked BIOS, please compare with AMIBCP if you’re familiar with that, and see if you can notice any missing settings or subsections in new advanced and chipset.
If anything is missing let me know and I can further enable.
*File removed at user request (Since it was direct dump), unlock was successful, if anyone needs unlock please provide your own dumped BIOS region via FPT

33

@Lost_N_BIOS thank you very much for unlocking the bios. It works perfectly! I have found no hidden setting in AMIBCP, but I’ll let you know if I do.

Regarding the keyboard’s backlight issue:

Booting up mac with custom DSDT/SSDT is something done “in the fly”, in the sense that there is no replacement of original DSDT/SSDT tables on BIOS, but it is done just after posting and before loading the os (via a bootloader that “presents” these custom tables to mac). Removing this custom tables (or hot fixes) from the bootloader disables (upon many other things) the keyboard’s backlight.

In mac I have no way of controlling the backlight level, it just boots up with the minimum level (01 in hex as appears inside of an NVAR entry). This, however, may be a compatibility issue within my installation.

These edits are used in order to fix some issues related to power states (S3, S4 and S5), CPU P/C states, GPU framebuffer bugs, I2C/SPI device enumerations, etc. These are almost never necessary to have a working, bootable installation, but it is recommended in order to fix the previous mentioned errors.

Upon some inspection of some of these DSDT/SSDT tables, I came to the conclusion (that could be wrong, of course) that this capability (backlit keyboard) is not being defined or enumerated (don’t know the appropriate term) in the BIOS, but maybe mac is trying to send commands to the EC (embedded controller) in order to adjust the keyboard’s backlight brightness as it thinks this system has it. As this is sort-of working inside mac, I think that the EC does have the appropriate firmware to drive this backlight, but for some reason it is not “telling” the bios that this current configuration may be present.

I could not find any bootloader or other utility to load custom DSDT/SSDT tables into Windows, so I cannot further investigate that thought.

Because of this, I see only three ways to fix this:
1- Modify the EC firmware (even if it is an issue related to this, which I doubt it is), but that will turn really ugly really fast, and most certainty brick my laptop (though I have a CH341 programmer).
2- Modify the DSDT/SSDT tables inside BIOS to show this type of keyboard is present, but I really don’t know if it’s possible or where it’s stored, as any google search brings up DSDT/SSDT modifications for mac on a bootloader level.
3- Just hardwire the backlight circuit to turn on when the LCD panel is turned on and call it a day.

PS: The ASUS model that definitely has a backlit keyboard is the X510UQR, as I took the tables from this system (https://github.com/nguyentrucxinh/ASUS-V…0UQR-Hackintosh). I will leave attached a stock bios for this machine (while I search for a dump) with v301 and one for my machine (X510UAR, also stock) with v301 as well.

EDIT: Found how to edit DSDT/SSDT on BIOS level. Will probably try that and share the results.

X510UAR_v301.zip (4.34 MB)

X510UQR_v301.zip (4.37 MB)

34

Finally, I made it work. The ONLY thing it needed was to set the byte on offset DD to 7E (NOT 7C) on practically every place CNFG appeared. This is because it appears in an NVAR entry, but is replaced after a reboot, which suggests that there is other (or multiple) CNFG entries that are being loaded, probably to be checked against this NVAR entry, and replacing it after seeing that there is a difference.

I came to this conclusion after analyzing a dump from an ASUS X510UQR (which has a backlit keyboard) and noting that the value written at this offset was 7E, not 7C, and was written on several GPNV entries.

For anyone interested, what I did was: extracted the NVRAM volume with UEFITool v0.26 (right click -> Extract as is), used HxD, searched for CNFG (there should be only one entry) and wrote 7E at offset DD (not counting header!). Then, extracted the padding volume under the whole NVRAM container (making it the second padding volume inside this dump), searched for CNFG and repeated the process only for the entries that had a body not filled with FF. In my case, there was like 12 entries to edit. Maybe only one of them was necessary, but I didn’t feel like testing all of them separately.

After editing all, I just replaced the extracted volumes inside UEFITool (right click -> Replace as is).

Note: It isn’t necessary to edit all the GPNV entries, as not all of them included the computer’s SN (which are entries that clearly aren’t used, as if they were to replace the NVAR entry then this one would also not have the SN stored in it).

About the previous post: don’t pay attention to it. The only thing I find weird is why booting up macos caused the backlight to turn on. But whatever, it works now!

Really, thanks Lost_N_BIOS for the hard work, helping me out and unlocking the bios (which was the original purpose of this topic). I learned a lot in the process. Also thanks to the person I took the dump from, that I can’t find right now

If a moderator could mark this thread as solved that will be awesome.

35

Hello, I was just wondering how you flashed the modded bios. I also have Mac OS on my Vivobook F510UA and have tried using AFUDos and Intel FPT to flash the bios. I have Unlocked Intel Flash Descriptor R/W access as well.

36

Also, excuse my ignorance, but I do not have Windows on this system. I am not sure if that is necessary?

37

@alerscone Does the FPT tool give you any error? That should work perfectly on a DOS bootable usb. I am not sure how to make one in macos, but you could do that. Remember to use the FPT with the same version of your Intel ME.

Also, remember that, if you have macos then flashing a dumped bios will mess up your NVRAM entries and probably brick some settings in the os (especcially related to AppStore/iMessage) and SN

38

Yeah, it gives me an error about GbE region not existing.

39

@noreplyse - You’re welcome! And as mentioned, if you do end up finding anything you see in AMIBCP, that’s missing in the actual BIOS let me know.
You should be able to edit original post and mark as solved if you want. If you cannot, let me know and I will edit it for you

So if BIOS is not touched, and DSDT/SSDT done outside the BIOS, how does the backlight function outside of MAC, such as in BIOS, or in windows? Can it then be controlled via FN key normally, or not?
It would be interesting to see know what happens in windows, hopefully you have dual boot setup (I think you mentioned?) For windows, I would like to see it all tested stock, I mean without any of this DSDT/SSDT or ACPI stuff, since none of that needs edited to run a windows system.
Unlocked BIOS is fine, I just mean stock as is none of your bootloader for MAC fix stuff

Thanks for explanation on how/why do this for MAC. I’ve never used MAC like this, but I have tested a few installs on various boards and modified many BIOS to unlock CFG lock (MSR 0xE2)

And yes, this could have always been controlled via EC, and that may even be what BT writes to for some/all models? Hard to know without a working/non-working dump
#1 - yes, if it can be figured out, this would be way to fix, if it’s controlled there. And yes, you can back it up first, then test write any changes, recovery always possible with the programmer.
#2 - I’m not familiar with DSDT/SSDT tables, but I could look at this file and see if I can figure it out. And, maybe I could get someone else here to look too, I think I know a few that might be able to help.
#3 - Sounds good too, if it is easy to do and wouldn’t look bad inside there. I wrote it all out earlier but didn’t have a chance to reply, now it’s all Null, leaving in place for some unknown reason

That’s great you found it and got it working from other working dump! I knew once we had one we could confirm working we could solve this.
With the BT.exe tool, I originally saw some other value to fix this too, and then a few people corrected many users across various threads to say the correct value was 7C instead of whatever the other suggested fix was.
I do not remember what the other value was they were telling people it needed to be changed to 7C from in the original BT directions, but from what you found it sounds like it possibly varies from model to model.

@alerscone - GbE warning is normal and expected, especially if there is no GbE in this BIOS (Intel Gigabit) or whatever your source file is.
If there is GbE in the BIOS as a whole, it’s still normal to see that, if you are dumping, editing, and then reflashing the BIOS region only and not the entire BIOS.

FPTw.exe -bios -d biosreg.bin << This dumps the BIOS region only
FPTw.exe -bios -f modfilename.bin << This flash the BIOS region only

Since you have unlocked FD now, dump the entire BIOS via >> FPTw.exe -d bios.bin << Then you will find GbE region above ME region probably, if not then this board does not have GbE and the error can be ignored.
Reflash mod BIOS via >> FPTw.exe -f modbios.bin (Be sure to unlock FD in this BIOS as well or it will get locked again). For this, even with unlocked FD, I am not sure, but you may still need to unlock “BIOS Lock” to flash. If you do, you’ll get error 368 in FPT and here’s my guide to fix that

Do not use the unlocked BIOS above, you will loose your serial, UUID, etc. That is for noreplyse only, if you want unlocked BIOS send me your BIOS region dump from FPT, or entire BIOS dumped via programmer or FPT.

40

@Lost_N_BIOS Thank you for letting me know before attempting to further flash this. Here is the copy of my dumped bios.

DUMP.BIN.zip (5.65 MB)