SuperMicro SYS-5018D-FN4T (X10SDV-TLN4F) BIOS Unlock

I have been having some difficulties with unlocking new BIOS options on a SuperMicro SYS-5018D-FN4T (X10SDV-TLN4F) system. In the past I have been able to show hidden options, however this particular BIOS has all options with (Show=Yes) and I have been unable to show any of the hidden settings in the regular BIOS menu and the related settings under IntelRC.

I would like to request some help, if interested, please assist by unlocking all BIOS options and menus that available. Possibly, I would also hear any advice on what I might be missing?

Additional drive link with screenshots and BIOS files:
https://drive.google.com/drive/u/0/folders/1PpxyLkW47CwCRKKv_FpRg-_cEkQjDyyz

Thank you, this is a fine community.

Where do you see this? AMIBCP? No surprise here…
Doesnt work as you think in modern AMI APTIO V core bioses, the changes will not reflect in other modules in bios.

@MeatWar you are correct, I have been using AMIBCP 5.02.0031, which is somewhat successful, I can modify the defaults of parameters that are already present in the BIOS. I will check out the UEFI Editor procedure this evening, I think this could take a few glasses of whiskey to get through, but seems very interesting and an enjoyable step forward. My last bios mod was for an Aptio4 which was pretty easy to navigate.

Lucky for me, the firmware on this system can be flashed from the BMC while the system is powered off and so I have a lot of flexibility.

Thanks for the feedback, if you are interested, I will update this thread with my results.

Yes… it worked as you remember but in Aptio IV bioses… not now on recent V bioses and theres no recent leaked AMI tools around for a long time by now…
Also do NOT change the default values for each string, it breaks the bios, we usually only change the string access/visibility.
Good luck, any questions post on the related tools linked.

When a BIOS lock offset is not returned, does that indicate that the BIOS is not locked?

image

Yes and no, it could have other locks across the regions/fdesc of the SPI and/or OEM specific.
MEinfo tool and FPT tool also gives info.

That was equal parts reasonable and complex. I know I am just scratching the surface, I was able to populate the UEFI Editor, which was a pretty enjoyable experience, though my firmware holds many many instances of the strings I was searching for and attempting to extract. This gives me a reason to learn more about the structure of the BIOS file and why so many instances of AMITSE, setupdata, and setupbin exist and under somewhat different strings.

I was able to get a view on the conditions when a particular bios menu item is locked and from what I can tell, the traditional BIOS menu is rather open by default. So likely, I will not need to modify this particular section of the BIOS.

However, I was aiming to get access to the menu items shown under IntelRC, which from what I can tell may be held elsewhere, possibly not a part of the setup menu at all. Very interesting, here is an example of what I was seeing. The IntelRC section contains a lot of interesting PCI-E and CPU configurations which I would like to poke at, like AtomicOPs, Turbo settings, power management, all of which appears to not be a child of the traditional setup section in the BIOS.

Thanks MeatWar, it’s been fun so far.

IMHO it can be done easily if BIOS re-flashing on the motherboard is not a difficult task.

See the following mod example.

Consider this module as untouched.

PE.zip

This one was edited.

modPE.zip

It took changing only 1 byte. Do hex comparison to find the diff.
Any form can be added as a new page on the top bar, including those that outside of 899407D7-… setup module.

1 Like

This does seem like something I can do, what was the approach or tools used to find the specific address where these bits would be flipped?

It’s okay if I am asking a dumb question, I will continue to read about this from content that is already on the forum, but this method sounds interesting and safe to attempt on my system.

This box is very flexible and can be reflashed without any restrictions, pretty much an idiot proof box for learning these kind of things.

I will add that IntelRC can be accessed even without BIOS reflashing. With UMAF tool, presumably. Or with SREP and a special config file for it, but making it to work is complex.

You already have the setup_extr.txt which was generated from the 899… module. There should be another one with its own unique number for IntelRC.
You can find it in a BIOS file loaded in UEFI Tool by related strings (OverClocking, Setup Warning). It is possible to extract another .txt using the IFR Extractor.

In AMITSE there are 2 or 3 arrays placed nearby one to another that can be found by searching for the “4a 10 59 7b 0d c0 58 41 87 ff f0 4d 63 96 a9 15 10 27” sequence. The arrays represent lists of forms (like Advanced) to be shown/ignored during final procession.

Each consists of 20h-sized blocks.

The first F bytes contain form set GUID.

For IntelRC it will be the following.

The second F bytes should contain an ID of desired form. If not populated, the parent form will be shown.

If edits done correct, you'll get something like this.

200420142955

The UAMF Tool was surprisingly quick and easy, it granted access to all hidden settings, including IntelRC. Thanks again, I think that will be enough for me.