…you can try to activate XMP without bios unlock.
Could please point me to the right direction?
Sorry, I can’t. An unusual compression is used in the BIOS. This prevents the AMIBCP program from working correctly.
One part can be extracted just fine and the second one not. It resulted in incomplete IFR outuput. There is a table, but no text in it.
IFR.zip (264.9 KB)
So I’m not able to obtain values of XMP setting. It needs some utility that could save EFI drivers already unpacked into memory. I’ll ask @AARCH64_EL3 about this.
Really appreciate, I’m a C and Python developer, if there is something that I can do ask me.
I wait for your input
I finally backup my current BIOS (I hope!!!) using Universal BIOS Backup Toolkit 2.0.
LENOVO-M42KT39A.rom
SHA256: 2ccfc4ec6d286dd9ad109607ea4c3c57944acd233e32fa128b3b0cdcaf60ee08
Attached here
Don’t know. I don’t even have an understanding of how the idea can be realized.
Thanks, I’ll check if there will be difference.
1 Like
It actually worked. Here’s how to enable XMP.
“setup_var_cv SaSetup 0x18D 0x1 0x2” Enables XMP profile 1
“setup_var_cv SaSetup 0x18D 0x1 0x3” Enables profile 2
“setup_var_cv SaSetup 0x18D 0x1 0x4” Enables profile 3
1 Like
Hi thanks for your help.
I enabled XMP profile 2 and now my PC won’t boot (many beeps at power on), in which way can i reset the option?
Try to pull out cmos battery and power cycle 2-3 times.
Thanks now it works again!
I have now some questions, could you please help me again? 
-
XMP profile 1 works and XMP profile 2 doesn’t, is it worth to try XMP profile 3?
-
Below there are Windows and CPU-Z info without and with XMP profile 1 enabled:
NO XMP
WITH XMP profile 1
As you can see with XMP enabled the DRAM Frequency is 1729 MHz (Windows double it, so 3467 MHz), is it normal that Mem. Controller Freq. indicated by CPU-Z is lower with XMP activated than without it?
-
What was your approach to find the right VarStore, VarOffset and Value? I mean which approaches and tools did you use? SaSetup is far away by xmp string
I’m a developer and I would like to learn the method in order to help someone here on the forum in the future -
Do you think that with you approach is it possible to enable Advance menu directly in the BIOS?
Finally I want to thank you again, if you have a forum, webpage, project where I can contribute with a donation I will do
For the people that want to try this hack in the future, as soon as you write the command you may receive this error on unmatched GUID:
On my system all is fine so don’t worry about this!
I think it’s not normal. If it remained 1064, you’d get beautiful 3600 MHz of ram speed.
Maybe ram sticks are not good enough to work at 3600. Try profile 2 with only one stick installed.
Is this topic clear?
Not with this approach.
I don’t accept donations.
Blockquote 1. 4. Do you think that with you approach is it possible to enable Advance menu directly in the BIOS?
Maybe, if GRUB/RU would let you write it.
The original adv has been used in the current adv, but has been suppressed. We only need to use GRUB/RU to change its conditions to make it appear in the BIOS. Just like some Asus computers.
They are 2 Corsair Vengeance LPX 3600 modules, I thought it is a good RAM. With XMP profile 2 it didn’t work, was the problem the amount of modules? I’ll try.
I imagine that if with profile 2 there was a problem the profile 3 is “forbidden”, isn’t it?
Yes (more or less) but I didn’t find any info on why XMP is related to SaSetup variable. Could you please add some info?
Will it be possible with SREP and the help of @AARCH64_EL3?
Thanks again
Could please point me to the right direction? Any example?
It’s a good ram. I was curious about if modules are mixed.
First, check CPUZ SPD tab if there are that many profiles.
The XMP setting refers to VarStoreId 5. VarStore which has ID = 5 is SaSetup.
To be honest, I don’t know. I tried different ways on my PC with no result.
On the motherboard there are only 2 slots of 4, alternate, the missing ones are not soldered
I’m following the guide you linked but I can’t find FPT Tool v11, my Intel ME version is 16.0. In which way we can dump a BIOS with this ME version? I previously used Universal BIOS Backup ToolKit 2.0.exe but this tool is not mentioned anywhere (this is why initially I can’t dump my BIOS)
Ok I followed the guide present at this link on GitHub because the guide present at the link you posted is confusionary (for me), some tools are missing and it is not clear if it is a full guide or if some parts excluded some others.
By the way I report here the process and at the end I have a question.
With ifrextractor.exe I got 2 files (“0” and “1”), the “0” file seems totally unuseful (full of Invalid) while “1” is good. I attach here the “1” extracted with ifrextractor.exe and the one “elaborated” with “IFR-Formatter.js”.
In the first one there is this piece of “code” related to XMP:
0xACBB7: OneOf Prompt: "Memory profile", Help: "Select DIMM timing profile. The below values start with the currently running values and don't auto populate.", QuestionFlags: 0x14, QuestionId: 0x276C, VarStoreId: 0x5, VarOffset: 0x18D, Flags: 0x10, Size: 8, Min: 0x0, Max: 0x6, Step: 0x0 { 05 91 54 08 55 08 6C 27 05 00 8D 01 14 10 00 06 00 }
0xACBC8: OneOfOption Option: "Default SPD Profile" Value: 0, Default, MfgDefault { 09 07 56 08 30 00 00 }
0xACBCF: OneOfOption Option: "Custom Profile" Value: 1 { 09 07 5A 08 00 00 01 }
0xACBD6: SuppressIf { 0A 82 }
0xACBD8: Get VarStoreId: 0x5, VarStoreInfo: 0x2, VarStoreType: 0x0 { 2B 87 05 00 02 00 00 }
0xACBDF: Uint64 Value: 0x1 { 45 0A 01 00 00 00 00 00 00 00 }
0xACBE9: BitwiseAnd { 35 02 }
0xACBEB: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACBF5: Equal { 2F 02 }
0xACBF7: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACC01: Uint64 Value: 0x1 { 45 0A 01 00 00 00 00 00 00 00 }
0xACC0B: Conditional { 50 02 }
0xACC0D: End { 29 02 }
0xACC0F: OneOfOption Option: "XMP Profile 1" Value: 2 { 09 07 57 08 00 00 02 }
0xACC16: End { 29 02 }
0xACC18: SuppressIf { 0A 82 }
0xACC1A: Get VarStoreId: 0x5, VarStoreInfo: 0x2, VarStoreType: 0x0 { 2B 87 05 00 02 00 00 }
0xACC21: Uint64 Value: 0x2 { 45 0A 02 00 00 00 00 00 00 00 }
0xACC2B: BitwiseAnd { 35 02 }
0xACC2D: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACC37: Equal { 2F 02 }
0xACC39: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACC43: Uint64 Value: 0x1 { 45 0A 01 00 00 00 00 00 00 00 }
0xACC4D: Conditional { 50 02 }
0xACC4F: End { 29 02 }
0xACC51: OneOfOption Option: "XMP Profile 2" Value: 3 { 09 07 58 08 00 00 03 }
0xACC58: End { 29 02 }
0xACC5A: SuppressIf { 0A 82 }
0xACC5C: Get VarStoreId: 0x5, VarStoreInfo: 0x2, VarStoreType: 0x0 { 2B 87 05 00 02 00 00 }
0xACC63: Uint64 Value: 0x4 { 45 0A 04 00 00 00 00 00 00 00 }
0xACC6D: BitwiseAnd { 35 02 }
0xACC6F: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACC79: Equal { 2F 02 }
0xACC7B: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACC85: Uint64 Value: 0x1 { 45 0A 01 00 00 00 00 00 00 00 }
0xACC8F: Conditional { 50 02 }
0xACC91: End { 29 02 }
0xACC93: OneOfOption Option: "XMP Profile 3" Value: 4 { 09 07 59 08 00 00 04 }
0xACC9A: End { 29 02 }
0xACC9C: SuppressIf { 0A 82 }
0xACC9E: Get VarStoreId: 0x5, VarStoreInfo: 0x2, VarStoreType: 0x0 { 2B 87 05 00 02 00 00 }
0xACCA5: Uint64 Value: 0x8 { 45 0A 08 00 00 00 00 00 00 00 }
0xACCAF: BitwiseAnd { 35 02 }
0xACCB1: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACCBB: Equal { 2F 02 }
0xACCBD: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACCC7: Uint64 Value: 0x1 { 45 0A 01 00 00 00 00 00 00 00 }
0xACCD1: Conditional { 50 02 }
0xACCD3: End { 29 02 }
0xACCD5: OneOfOption Option: "XMP User Profile 4" Value: 5 { 09 07 5B 08 00 00 05 }
0xACCDC: End { 29 02 }
0xACCDE: SuppressIf { 0A 82 }
0xACCE0: Get VarStoreId: 0x5, VarStoreInfo: 0x2, VarStoreType: 0x0 { 2B 87 05 00 02 00 00 }
0xACCE7: Uint64 Value: 0x10 { 45 0A 10 00 00 00 00 00 00 00 }
0xACCF1: BitwiseAnd { 35 02 }
0xACCF3: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACCFD: Equal { 2F 02 }
0xACCFF: Uint64 Value: 0x0 { 45 0A 00 00 00 00 00 00 00 00 }
0xACD09: Uint64 Value: 0x1 { 45 0A 01 00 00 00 00 00 00 00 }
0xACD13: Conditional { 50 02 }
0xACD15: End { 29 02 }
0xACD17: OneOfOption Option: "XMP User Profile 5" Value: 6 { 09 07 5C 08 00 00 06 }
0xACD1E: End { 29 02 }
0xACD20: End { 29 02 }
0xACD22: GrayOutIf { 19 82 }
0xACD24: EqIdValList QuestionId: 0x276C, Values: [0, 1, 5, 6] { 14 8E 6C 27 04 00 00 00 01 00 05 00 06 00 }
0xACD32: EqIdVal QuestionId: 0xC3, Value: 0x1 { 12 06 C3 00 01 00 }
0xACD38: Or { 16 02 }
0xACD3A: End { 29 02 }
The first line is this:
0xACBB7: OneOf Prompt: "Memory profile", Help: "Select DIMM timing profile. The below values start with the currently running values and don't auto populate.", QuestionFlags: 0x14, QuestionId: 0x276C, VarStoreId: 0x5, VarOffset: 0x18D, Flags: 0x10, Size: 8, Min: 0x0, Max: 0x6, Step: 0x0 { 05 91 54 08 55 08 6C 27 05 00 8D 01 14 10 00 06 00 }
where I see this info:
VarStoreId: 0x5, VarOffset: 0x18D, Flags: 0x10, Size: 8
I suppose that Size is expressed in bit but we pass it in byte with the command setup_var_cv.
Now if I search for VarStoreId: 0x5 I find this line:
0xA8FC6: VarStore Guid: 72C5E28C-7783-43A1-8767-FAD73FCCAFA4, VarStoreId: 0x5, Size: 0x4A7, Name: "SaSetup" { 24 1E 8C E2 C5 72 83 77 A1 43 87 67 FA D7 3F CC AF A4 05 00 A7 04 53 61 53 65 74 75 70 00 }
so SaSetup is declared here but its Size is 0x4A7. It may be confusing because if I understood well it is the total size.
For a newbie like me it is better to use “IFR-Formatter.js” and search for “VarStore: SaSetup | VarOffset: 0x18D” (with values from the previous output data) where the output is this one:
Memory Overclocking Menu
Memory profile | VarStore: SaSetup | VarOffset: 0x18D | Size: 0x1
Default SPD Profile: 0x0
Custom Profile: 0x1
XMP Profile 1: 0x2
XMP Profile 2: 0x3
XMP Profile 3: 0x4
XMP User Profile 4: 0x5
XMP User Profile 5: 0x6
I hope that this will be useful for someone.
So my question now is:
with this approach I can change some other features without corrupt motherboard? If I understand better the use of setup_var_cv command changes only the current values that are maintained by the battery, it’s almost impossible to damage the motherboard or corrput the BIOS itself, isn’t it?
Indeed.
You can change other features, but very little of CPU features since it’s alder lake platform.
Not a 100% agreed. This is your backup. Those stores are part of the NVRAM- “NV” here meaning NonVolatile- which is part of the bios region of your firmware (=“bios”) and stored in the SPI Chip, same place as firmware with its bios code:
There are examples of both behaviours:
- Resetteable via removing the battery (“CMOS- reset”)
- Salvageable only via programmer
So you can’t corrupt the bios code, but you might put in values in the area where the bios (ans OS) stores its values which may put the machine (temporarily) in a bricked state.