[SOLVED] How to unlock BIOS options of rebranded TONGFANG chassis systems?




Is it possible OP has secured the bios somehow outside the CMOS area maybe in the EC area, some secure lock? What I don’t understand is if I have take a full dump of the Bios with a programmer make changes with AMIBCP and flash it back those changes should take place. Something else on the motherboard is preventing the change to be seen. I can enable/disable features with AMIBCP that are stock unhidden in the bios then flash the image back to the chip and I see the changes. I don’t think the secure feature is in the Bios has to be somewhere else no?

I did not know you could have a separate EC chip that you can read/write to with a programmer, maybe only in this device? Is it possible there is some secure control in that area preventing the changes to the cmos?

Friday I am getting a new OP I think what I am going to do is reset the Nvram, pull the cmos battery out also, read a new image then make changes unhiding menus, then flash the clean image back to see if that does anything.

@nimaim - Takes time, please be patient, I am working on this as time permits, I have to try and still help all the other threads too and have been behind all week since the Holidays

@pcfr33k - AMIBCP can only change certain things “Sometimes” and it may not be able to make visible certain things due to other non-AMIBCP settings.
Did you test changing an actual applied value/setting and then that setting confirmed to not be changed? Such as, change some settings value from Enabled to disabled as optimal default, then program or flash that in, and see the changed setting not applied?
If yes, then BIOS may not be setup to use what AMIBCP changes (NVRAM), in that case make change in Setup IFR/hex instead then and see if setting applied in windows and or BIOS.

I’m not sure what “Secure” feature you are talking about? If flash or program goes fine without error, then BIOS is applied as given to app/programmer, nothing stopped from being put in there unless you see some error

No worries at all, take your time @Lost_N_BIOS. We appreciate your time and help.

I’m surprised BCP doesn’t read the setup Hii itself but I guess that means I can ignore using BCP. Last time I tried to unhide settings like your proposing was back in the EFI days before UEFI where the changes were made in the Setup by pushing the extra menu’s on the stack but that was a long time ago.

RTC CMOS offset 0x7A should do something with menu’s when set to one but I don’t know what. Full menu’s may possibly be activated by “ManufacturerMode” (AMITSE) but don’t know how that’s achieved.

@CPL0 , can you elaborate at all on the ManufacturerMode edits? I don’t see this method anywhere online. Willing to try any new methods of unlocking this weekend.

@nimaim that was a subroutine @ 0x51430 that LNB might or might not have found interesting. No edits were made.

Did anyone running the 105 BIOS mentioned in post 10 try the Setup_Body.efi ?

Don’t know if this will help. Mechrevo Z2 also uses this same chasis with exactly the same hardware specification as overpowered LP-2. And Z2’s bios can be flashed directly onto OP LP2’s. In the latest bios for Z2, two new options are revealed: “OTP Power Level” and “Q-Key function”, both in the current Advanced menu. I guess the manufacturer unhide those two previously hidden options. Maybe comparing this bios with overpowered’s bios can be enlightening for unhiding menus.

Here’s the link to Z2’s latest bios and ec: https://mega.nz/#!quZnQAgB!fJNyxn4zm87Ta…UB0MJLrKiAOOvX4

BTW, the disable internal graphics option as mentioned by Lost_N_BIOS is huge for hackintoshing this laptop.

@Johnazz Regarding BIOS ver 105, those two functions do not exist.

Since no one seems interested in the modified setup.efi I will leave this in LNB’s capable hands. Sorry I haven’t been any help and thanks for the info on BCP, I will just ignore that app for now.

@CPL0 I can try the modified setup.efi. But I know nothing about modding bios and don’t know how should I try it.

@CPL0 , sorry I was not around this weekend after I posted. I have the same question as above. What do I do with your modified setup efi? Until now I’ve just been changing things in BCP, reflashing with FPT and seeing if the changes stick. I’ve also tried to locate the “enable” strings where they’re supposed to be and no luck.

Let me know how to use this and I will test. I’ve backed up my bios and ec using a CH341A already no worries there.

@CLP0 - I’m not sure about that manufacturing mode either, I’ve never seen anyone discuss using this on AMI BIOS. No need to ignore AMIBCP, it’s very useful, just not in all situations or for all type of changes needed to be made in many instances.

For anyone that wants to try CLP0’s setup EFI in a BIOS here is rebuilt BIOS using that, it’s inserted into BIOS intel_CFL_GK5CN6Z_ESI_BIOS_N.1.05_EC_1.35.09_20181101 attached at post #5
http://s000.tinyupload.com/index.php?fil…498378537157924

I’m almost caught up, well some, so maybe tonight will have time to check this out in assembly and maybe make some progress.

Thanks for the Z2 info @Johnazz - I will check that out, maybe that BIOS is more editing friendly (Nope, basically same BIOS) So once unlock found for the other it can be applied same way to this BIOS

Thanks, I’m guessing once we figure out unlocking one menu/option, most others will fall in line and also unlock via same method.

What should I be seeing with @CPL0 's modded efi bios?



Yes, I guess both the BIOS are supplied by TongFang who produced the GK5CN6Z chassis. There’s a couple of different brands who used this chassis so I guess all their BIOSes are essentially the same. What’s interesting about the latest version of Z2’s bios is that it has two extra options that’s not present in all other BIOSes: "OTP Power Level" and "Q-Key function", both in the Advanced menu. @CLP0 says these two are newly added to this version of bios. Maybe looking into how they added this to the bios will be helpful?

Although the BIOSes are certainly helpful, I don’t think looking at those values specifically will do much … the problem is not enabling options in visible menus. That advanced menu (0x2712) is already unlocked. As far as I understand it, the problem is unlocking options in menus that are hidden, e.g. the second Advanced menu (0x2718), where all the “fun” options reside.

I’m not sure on the @CLP0 edit, I think he did mod to try and enable hidden menus, but he’d have to reply to let us know for certain what he changed.
And yes, I agree, enable/disable settings is no problem at all, even if setting is hidden it can be changed or made visible, it’s making the hidden main menu entries visible is an issue in this BIOS.

Can you guys download this package, run 32 and 64 bit command from each version folder. Leave all NVRAM.txt in place so if any work and give full valid settings you’ll know which worked. Upload package back for me once done, if any are valid
Take a look, if all NVRAM.txt basically empty, no need to reup for me - http://s000.tinyupload.com/index.php?fil…392729693150670



In other words the settings in the second hidden Advanced Menu have been moved the the first unhidden Advanced menu where they should now be visible. If not then something strange going on that I have not seen before. The suppressed "if 0 not equal to 0" haven’t been touched so those will still be suppressed and the other menus have not been added since we don’t know if it works yet.

@pcfr33k Most laptops these days are muxless meaning if you disable integrated graphics then you’ll end up with a blank screen, if muxed then okay, if not sure then might be an idea to jot down the restore defaults sequence since you would need to enter it without a display if ending up with a blank screen.

@CPL0 , gottcha! Thanks for the explanation, I will flash it later today with FPT … and yes it’s definitely muxless so I wasn’t too hopeful toggling that in the BIOS as there is no physical (hardware) switch for it.

@Lost_N_BIOS , as I reported before, I had no luck running those commands from any version folder … either got a “ERROR: 4 - Retrieving HII Database” or “ERROR: 4 - BIOS not compatible”. NVRAM file was empty every time. I’m hoping @pcfr33k or @Johnazz or someone else with this laptop has better luck dumping NVRAM for you.




Can the Nvram be dumped from an EFI shell? I created a flash boot which has an EFI shell that I can use to modify the bios or maybe dump the nvram, I just don’t know the command to dump it then save it.

Yea, I hate dumping anything from Windows since it usually never works … I saw there is an SCELNX_64 floating around for Linux, but I don’t think this supports APTIO V.

Unfortunately, I think SCE, especially v5, is Windows only. Other tools may exist to dump it though, hopefully.

@nimaim - Switch it to muxed setting for the graphics, if you want to play with that, should be there I think but I didn’t check when I wrote this comment
Sorry about that with the SCEWin, I forgot we already tested that in PM’s I have a copy of NVRAM from stock BIOS and from your dumped BIOS, that’s not a problem, getting proper legible readout from it is and that tool is the only one I know that works for these type of BIOS.
It mainly gives you the settings enabled/disabled etc which I can also see from IFR’s, but I wanted to see if maybe menu control was possibly in there on these too, it’s not usually but wanted to check just in case.