Suppressed menu entries in BIOS setup

BIOS/UEFI Modding BIOS Modding Guides and Problems
2

@tdarren - which Aero 15 do you have (like SA or XA etc)? I’ve unlocked these BIOS already, much more to do than unsuppress, but since you’re already that far you probably know (AMITSE mod + AMITSE/SetupData or AMIBCP + Setup = all required to unlock everything)
Main menus need unlocked at AMITSE, a few individual settings need access level changed to User or Super (VERY FEW, mainly at the hidden boot page), I can’t remember if anything needs unsuppressed at setup mainly I say this is edited to to text edits I make in AMIBCP
This is what I usually do >> Swapped Main & Advanced & Save/Exit, enable Chipset and both boot menus.

To directly answer your question above, so you know for this or other edits, that can be done a few ways, I explain and give example here. Yes, you are thinking correct, this is how, but do see both links below >> Variable 0xB equals 0x1 {12 06 0B 00 FF 00}
[SOLVED] How do I get hidden menus shown within IFS “Form Sets” (3)
[REQUEST]Need help for unlocking menus for ECS LIVA Core

Some BIOS break if you do the “Move outside” method, so you have to be careful, only test that if you can recover or you know other people have used on the BIOS you are doing (mainly MSI/Asrock break on this)

For AMITSE edits, see the advanced section at end of this guide, I show general method you need to use
OverPowered TONGFANG CyberPower Machrevo MACHENIKE - Unlocked BIOS Guide W/ Files

And here, is my notes from last Aero I did, don’t use these as they may not apply to your model or BIOS version, this just to show you example of info collected for these and stock before/edits made etc

4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15

BIOS Lock is enabled (No exit to shell on BIOS exit page) >> 0xB4D


@ Setup PE32 (IFR) -

Setup, FormId: 0x2710 {01 86 10 27 07 00}
Main ---------------------------- 0x2717 {0F 0F 09 00 02 00 01 00 00 00 FF FF 00 17 27} << Hidden
Advanced ------------------------ 0x2718 {0F 0F 1E 00 02 00 02 00 00 00 FF FF 00 18 27} << Hidden
Chipset ------------------------- 0x2719 {0F 0F 1F 00 02 00 03 00 00 00 FF FF 00 19 27} << Hidden
Security ------------------------ 0x271A {0F 0F 3A 00 02 00 04 00 00 00 FF FF 00 1A 27} << Hidden
Boot ---------------------------- 0x271B {0F 0F 20 00 02 00 05 00 00 00 FF FF 00 1B 27} << Hidden
Save & Exit --------------------- 0x271C {0F 0F 4D 00 02 00 06 00 00 00 FF FF 00 1C 27} << Hidden

Main ---------------------------- 0x2711 {01 86 11 27 09 00} << Actual visible in BIOS
Advanced ------------------------ 0x2712 {01 86 12 27 1E 00} << Actual visible in BIOS
Chipset ------------------------- 0x2713 {01 86 13 27 1F 00} << Actual visible in BIOS
Security ------------------------ 0x2714 {01 86 14 27 3A 00} << Actual visible in BIOS
Boot ---------------------------- 0x2715 {01 86 15 27 20 00} << Actual visible in BIOS - Not used, single one >> Boot ------ 0x27C5 {01 86 C5 27 20 00}
Save & Exit --------------------- 0x2716 {01 86 16 27 4D 00} << Actual visible in BIOS
All directly above = first at top in AMIBCP

@ AMITSE PE32 (Body) -

@0004FB50 -Blocked
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 17 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 18 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 19 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1A 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1B 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1C 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00


@000505A0 - All
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 17 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 18 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 19 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1A 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1B 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1C 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 11 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 12 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 13 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 14 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 15 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 16 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

@000507E0 - Blocked
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 17 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 18 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 19 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1A 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1B 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1C 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

"Notes" from other previous edit - Some individual settings, or submenus in newly revealed menus may need enabled via AMIBCP User/Super (Talking to myself, before some quick tests done by user)
This applied to “Boot” menu, confirmed and edited right after initial test. (All under fast boot)
Setup module unsuppress/un gray-out may be needed for some items as well. (not required)

Final comment in my notes >> Final - Swapped Main, Advanced, Save & Exit, enable Chipset + both boot menus


-------------------- Final Edits ------------------------

@4F450 - blocked
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 11 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 12 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 13 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1A 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 16 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

@000500B0 - blocked
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 11 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 12 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 13 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1A 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 16 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


3

Hi @Lost_N_BIOS

Sorry I never got back to you on this, I did see your reply at the time and it did help a lot but just didn’t get the chance to get back to you. So just giving you my thanks now!

I’ve since sold my Aero 15 and have got a Razer Blade Pro 17 (2019) instead and am looking to unlock the BIOS on this laptop as well to unlock the options etc. It uses the same Aptio setup as the Aero 15, have you had any experience unlocking Razer BIOSes or perhaps could point me to where to start? I’m hoping I could broadly follow the same process as the Aero 15, though I expect there are some differences between the two BIOS.

Thanks!

4

@tdarren - OK, you’re welcome and well hopefully you like the new system better anyway Yes, I’ve unlocked some Razer BIOS too, can you link me to your stock BIOS download page?
And if so, or not, lets start here -

If you have already modified the BIOS in ANY way, you will need to re-flash it back to factory defaults using factory method (NOT FPT)!!!

If you do not have Intel ME drivers installed, install them now from your system driver download page, then start over here after reboot.
Check your BIOS’ main page and see if ME FW version is shown. If not then > DOWNLOAD HWINFO64 HERE <

Once HWINFO is open, look at the large window on the left side, expand motherboard, and find the ME area.
Inside that section is the ME Firmware version. Take note of the version. (ie. write it down or get a screenshot)

Once you have that, go to the thread linked below, and in the section “C.2” find and download the matching ME System Tools Package for your system.
(ie if ME FW version = 10.x get V10 package, if 9.0-9.1 get V9.1 package, if 9.5 or above get V9.5 package etc)
> DOWNLOAD " ME System Tools " packages HERE <

Once downloaded, inside you will find Flash Programming Tool folder, and then inside that a Windows or Win/Win32 folder (NOT x64).
Highlight that Win/Win32 folder, then hold shift and press right click. Choose “open command window here” (Not power shell! >> * See Registry file below *).

If you get an error, reply to this post with a screenshot of it, OR write down the EXACT command entered and the EXACT error given.

((If “open command window here” does not appear, look for the “Simple Registry Edit” below…))

Now you should be at the command prompt.
You are going to BACKUP the factory un-modified firmware, so type the following command:
Command: " FPTw.exe -bios -d biosreg.bin "

>> Attach the saved "biosreg.bin ", placed into a compressed ZIP/RAR file, to your next post!!! <<

Right after you do that, try to write back the BIOS Region dump and see if you get any error(s).
Command: " FPTw.exe -bios -f biosreg.bin "
^^ This step is important! Don’t forget! ^^

If you get an error, reply to this post with a screenshot of it, OR write down the EXACT command entered and the EXACT error given.

Here is a SIMPLE REGISTRY EDIT that adds “Open command window here as Administrator” to the right click menu, instead of Power Shell
Double-click downloaded file to install. Reboot after install may be required
> CLICK HERE TO DOWNLOAD CMD PROMPT REGISTRY ENTRY <

If the windows method above does NOT work for you…
Then you may have to copy all contents from the Flash Programming Tool \ DOS folder to the root of a Bootable USB disk and do the dump from DOS
( DOS command: " FPT.exe -bios -d biosreg.bin " )

5

@Lost_N_BIOS

Thanks, stock BIOS download page can be found here: http://drivers.razersupport.com//index.p…2929.1578516518

It’s the RazerUpdater utility, which does the work of downloading and updating the BIOS firmware.

I’ve dumped my BIOS using FPT and have attached it to this post (biosreg.zip). I got no errors when writing back the dump using the “FPTw.exe -bios -f biosreg.bin” command, which is good.

Hopefully that’s all okay, let me know if you need me to do anything else or if you need any more information.

Thanks, Darren

biosreg.zip (4.3 MB)

6

@tdarren - That razer page never loads for me Tried multiple browsers, and a proxy too So there’s no BIOS download there anyway?? All I wanted is the stock BIOS itself, can you grab out of this utilities folder or temp folder while using the app?
Ohh! Finally got it to load in another proxy, I only see the BIOS updater “Guide” = PDF, no download, unless it’s the tool at bottom of that list? If so, I can’t download from proxy, so I can’t grab it. It probably wouldn’t run for me anyway, and if so certainly wouldn’t grab the BIOS we want after it scanned by system

Good no errors writing back with FPT, this means we can flash in mod BIOS without issue
Please zip for me images of ALL your BIOS, all sections, all root areas so I can see up/down if needed to see all submenus for example in advanced if you have to scroll up/down to see all without going in a submenu, do that and take two images.
Show me every page, in every section, ALL Settings/pages etc. This way I can see what you see, so I don’t miss anything that’s hidden from you in an already visibel menu.

You may be able to use F12 to screenshot to USB. If not, use camera and if you can set to smaller images before you take them. I don’t need to see 2-6K images, 800px wide or 100kb each or so is more than enough.
If you can’t do that with camera, please resize them for me before you put into zip or rar (with max compression please)

Nice, looks like you can already see “Chipset” section! Correct? Looks like much LESS needs edited here, at least it doesn’t look like any main menus are hiding from you (advanced or chipset)
Rest inside those is all easy to edit if you can already see them

7

@Lost_N_BIOS Whenever Razer issues a BIOS update, they package the BIOS firmware into a Razer Updater tool, which does the job of installing the BIOS and they release an update to the Razer Updater tool every time there is a BIOS update. I’ve run the app and it self extracts into “C:\Program Files (x86)\Razer\Update Tool”.

That folder contains “FlashAFUWin.bat” which is what the Razer Updater app calls/executes when it updates the BIOS. That “FlashAFUWin.bat” batch file just runs the “AFUWINx64.EXE Dana17_2_0104.bin /p /b /n” command to update the BIOS. I believe what you’re looking for is the “Dana17_2_0104.bin” file which is the stock 1.04 version of my BIOS.

I’ve attached all of my screenshots of my BIOS, all sections/pages. This is attached to this post (BiosScreenshots.zip).

I’ve also zipped a “BIOS Image” folder, which is a copy of everything in the “C:\Program Files (x86)\Razer\Update Tool” folder and includes the “Dana17_2_0104.bin” file. Due to the size of the zip file, I’ve put this on my OneDrive and you can download it from https://1drv.ms/u/s!Apqcet2BuryT5zfbYa-9_DDOCFFK?e=n10Nr4

Also I just want to correct my earlier post, the stock BIOS download page for my Razer system is actually https://support.razer.com/articles/1592008851

I hope that’s all okay, let me know if you have any questions or if you need me to provide you with anything else.

Thanks, Darren

BiosScreenshots.zip (557 KB)

8

@Lost_N_BIOS Just want to follow up on this thread, I’ve been looking at my Setup IFR (following your How-2-Rip-It-Open-Yourself guide) a little bit.

The main thing that I notice different to when I was doing this with my previous Gigabyte Aero 15 is that the suppression is done differently (QuestionId instead of Variable), for example:

1
2
3
4
5
6
7
8
9
 
0x30DB4 		Suppress If {0A 82}
0x30DB6 			QuestionId: 0x3FD equals value 0x0 {12 86 FD 03 00 00}
0x30DBC 				Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
0x30DC0 				8 Bit Unsigned Int: 0x1 {42 03 01}
0x30DC3 				Less Than {33 02}
0x30DC5 				And {15 02}
0x30DC7 			End {29 02}
0x30DC9 			Ref: OverClocking Performance Menu, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x12, FormId: 0x2794 {0F 0F 9B 13 9C 13 12 00 00 00 FF FF 00 94 27}
0x30DD8 		End If {29 02}
 


A couple of questions regarding the above:

Where we have "QuestionId: 0x3FD equals value 0x0", Is this is referring to another option set in the BIOS, as doing a search for QuestionId: 0x3FD, I find the following "RD MODE Support" option?

1
2
3
4
5
6
7
8
 
0x3CB32 		Suppress If {0A 82}
0x3CB34 			QuestionId: 0x3FD equals value 0x0 {12 06 FD 03 00 00}
0x3CB3A 			One Of: RD MODE Support, VarStoreInfo (VarOffset/VarName): 0x12FD, VarStore: 0x1, QuestionId: 0x3FD, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 A4 18 A5 18 FD 03 01 00 FD 12 10 10 00 01 00}
0x3CB4B 				Default: DefaultId: 0x0, Value (8 bit): 0x0 {5B 06 00 00 00 00}
0x3CB51 				One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
0x3CB58 				One Of Option: Enabled, Value (8 bit): 0x1 (default MFG) {09 07 03 00 20 00 01}
0x3CB5F 			End One Of {29 02}
0x3CB61 		End If {29 02}
 


Am I correct in saying that "RD MODE Support" has to be "Disabled" for 0x3FD to equal 0x0, which seems to be the default anyway?

Can you tell me what this bit means?

1
2
3
4
 
0x30DBC 				Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
0x30DC0 				8 Bit Unsigned Int: 0x1 {42 03 01}
0x30DC3 				Less Than {33 02}
0x30DC5 				And {15 02}
 


Seems to be saying that 0xE11 has to be less than 1 as well?

How do you quickly unsuppress all of the options in all of the menus as it seems to me like it's a lot of work going through all of these if statements and making sure that they don't suppress? How do you go about this or is there no quick method?

Apologies for the barrage of questions, just keen to learn a bit how to go about doing these modifications myself.

Appreciate all of your help!

Thanks, Darren
9

@tdarren - Thanks for BIOS images, once I know result from below test I will unlock rest of BIOS for you
Yes, Dana17_2_0104.bin, would be what I wanted when I asked for the stock BIOS, thanks I’ll grab that if I can download from there today

There is no quick way, other than move the setting outside of the suppression. That is OK on some BIOS, others it can brick the BIOS, or cause non-BIOS entry instantly (can still boot to DOS and recover here).
So due to possibility of brick, it’s best to null suppression instead usually, unless you have BIOS switches on board or flash programmer in hand with backup made and checked by someone to be OK in advance.

To move something outside of suppression you simply move the target to be above/before “suppress if”, or below the “end if” Example below

Suppress If {0A 82}
QuestionId: 0x3FD equals value 0x0 {12 86 FD 03 00 00}
Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
8 Bit Unsigned Int: 0x1 {42 03 01}
Less Than {33 02}
And {15 02}
End {29 02}
Ref: OverClocking Performance Menu, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x12, FormId: 0x2794 {0F 0F 9B 13 9C 13 12 00 00 00 FF FF 00 94 27}
End If {29 02}

Change to this (Most ideal way)
Suppress If {0A 82}
QuestionId: 0x3FD equals value 0x0 {12 86 FD 03 00 00}
Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
8 Bit Unsigned Int: 0x1 {42 03 01}
Less Than {33 02}
And {15 02}
End {29 02}
End If {29 02}
Ref: OverClocking Performance Menu, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x12, FormId: 0x2794 {0F 0F 9B 13 9C 13 12 00 00 00 FF FF 00 94 27}

Or
Ref: OverClocking Performance Menu, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x12, FormId: 0x2794 {0F 0F 9B 13 9C 13 12 00 00 00 FF FF 00 94 27}
Suppress If {0A 82}
QuestionId: 0x3FD equals value 0x0 {12 86 FD 03 00 00}
Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
8 Bit Unsigned Int: 0x1 {42 03 01}
Less Than {33 02}
And {15 02}
End {29 02}
End If {29 02}

But, both of those carry the risks I mentioned above, in some BIOS, and only way to know if your BIOS would be OK with that, or brick, or cause non-BIOS entry, would be direct test (so big risk if no programmer in hand)

Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
8 Bit Unsigned Int: 0x1 {42 03 01}
Less Than {33 02}
And {15 02}

^^ This, is looking for value stored here - And it’s saying to suppress if 0x01 or less than (ie 0x00 >> so anything really above 01 such as 02 or 09 etc should be OK, or FF as well)
Numeric: en-US, VarStoreInfo (VarOffset/VarName): 0x921, VarStore: 0x1, QuestionId: 0xE11, Size: 1, Min: 0x0, Max 0xFF, Step: 0x0 {07 91 00 00 00 00 11 0E 01 00 21 09 00 10 00 FF 00}

“QuestionID” value is stored in AMITSE/SetupData at the question ID in little endian (so 11 0E here) + 52 bytes and byte 51/51 hold fail safe/optimal values (ie one part of what you would change if editing with AMIBCP) - example of this shown here, see last part of post + Image

Applied/current value are stored in NVRAM areas, in given VarStore at the given VarOffset in that areas NVRAM BODY. NVRAM editing is a bit more complicated to explain, I need to write a guide about it, but I’ve tried to explain briefly a few places linked below
NVRAM edit explained - Determine configurable aperture size from BIOS file
Setup and NVRAM editing here as well - [Help] Unlock advanced menu on 2019 Acer Predator Helios 300 PH315-52 (5)

However, the above is just for informational purposes, since you asked, I would do this edit as you see below, to Null the “suppress if” and unsuppress Overclock Performance Menu

Suppress If {0A 82}
0x30DB6 QuestionId: 0x3FD equals value 0x0 {12 86 FD 03 00 00} Change 00 to FF
0x30DBC Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
0x30DC0 8 Bit Unsigned Int: 0x1 {42 03 01} << Change to FF
0x30DC3 Less Than {33 02} << Change to 16 02 (OR)
0x30DC5 And {15 02}
0x30DC7 End {29 02}
0x30DC9 Ref: OverClocking Performance Menu, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x12, FormId: 0x2794 {0F 0F 9B 13 9C 13 12 00 00 00 FF FF 00 94 27}

^^ If that fails, you will have to test one of the “move” methods, or leave this as original and directly change QuestionId: 0xE11 stored values in AMITSE/SetupData to FF FF, or any value above 00 or 01
And Change NVRAM stored value to same for VarOffset/VarName): 0x921 in all NVRAM areas (usually 1/2 at top + one in main BIOS DXE volume near AMITSE - called defaults or STDDefaults)

All this may be avoided by simply setting Access Level in AMIBCP to User or Supervisor once this parent menu is visible to you, or nothing may need changed once parent menu is visible to you.
So this would be looked into after any main menu section reveal… Which in this case we do not have to do. Did you test changing ONLY this submenu access level to User or Supervisor at the root of Advanced?
If you haven’t tested, lets do that as first test here, test each of these BIOS, can you now see OverClocking Performance Menu, and if so, which one?
This will tell us, probably for “most” hidden submenus and or settings, if we have to unsuppress or if Access Level change may get “most” things visible.
http://s000.tinyupload.com/index.php?fil…769277142643917

10

@Lost_N_BIOS

Thanks for your reply and for the clear instructions. I’ve tested both BIOS images that you attached, unfortunately both BIOS images “biosregOverclockMenuAMITSDS.bin” and “biosregOverclockMenuAMITSDU.bin” did not reveal the “OverClocking Performance Menu” in the “Advanced” page of the BIOS. Checked twice for each and flashed more than once as well.

Just so you know, this is what I did:

1. Run command "FPTw.exe -bios -f biosregOverclockMenuAMITSDS.bin"
2. Rebooted and checked Advanced page on my BIOS, did not see OverClocking menu

1. Run command "FPTw.exe -bios -f biosregOverclockMenuAMITSDU.bin"
2. Rebooted and checked Advanced page on my BIOS, did not see OverClocking menu

Repeated the above steps twice just to make sure.

Thanks again for your help. Let me know if you need me to do any further tests or if there’s anything else you’d like me to do.

Thanks, Darren

11

Maybe you need to [Load Setup defualts] in bios settings ->Save&EXIT to update the nvram .

12

@Lost_N_BIOS



Thanks for your suggestion @jhsvip

Unfortunately that also has not worked, I cannot see Overclocking menu when flashing both biosregOverclockMenuAMITSDS.bin and biosregOverclockMenuAMITSDU.bin. Restoring Defaults/User Defaults did not reveal the menu.

Not sure where to go from here to be honest, guessing we’re going to have to move settings outside of suppressions rather than simply changing access levels in AMIBCP?

13

@tdarren - Then this means you have to unsuppress via hex as outlined above, instead of Access Level change, at least this means Access Level change alone will not reveal it (you may still need to add that on top of setup edit unsuppress, but test that by itself first)

I would unsuppress it as mentioned toward the end of my reply, do you need me to do that? This >>
Suppress If {0A 82}
0x30DB6 QuestionId: 0x3FD equals value 0x0 {12 86 FD 03 00 00} Change 00 to FF
0x30DBC Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
0x30DC0 8 Bit Unsigned Int: 0x1 {42 03 01} << Change to FF
0x30DC3 Less Than {33 02} << Change to 16 02 (OR)
0x30DC5 And {15 02}
0x30DC7 End {29 02}
0x30DC9 Ref: OverClocking Performance Menu, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x12, FormId: 0x2794 {0F 0F 9B 13 9C 13 12 00 00 00 FF FF 00 94 27}

Make those changes, test by itself, then do Access Level Edit on top of those and re-test if unsuppress alone does not work

If that fails, then I would next test this next (move method, only test if you have programmer) >>

Suppress If {0A 82}
QuestionId: 0x3FD equals value 0x0 {12 86 FD 03 00 00}
Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
8 Bit Unsigned Int: 0x1 {42 03 01}
Less Than {33 02}
And {15 02}
End {29 02}
End If {29 02}
Ref: OverClocking Performance Menu, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x12, FormId: 0x2794 {0F 0F 9B 13 9C 13 12 00 00 00 FF FF 00 94 27}

If you have flash programmer to recover, make a backup, let me check, then you can test move outside of suppression edit first if you want, since that is an easier/cleaner type of edit.
This may very well be OK on your BIOS, it is on MANY BIOS, but some it will break it, and no way to know in advance. Up to you, if you want to test like this first without programmer, let me know and I can make you edit like this too.
If you need me to make any of these edits for you let me know

14

@Lost_N_BIOS Yes your edit worked, nulling the suppression worked and it revealed the Overclocking Menu, no additional Access Level change was needed.

The only thing now is that within the Overclocking Menu, I can only see “Memory”, and then within the “Memory” menu, I can only see “Memory profile” and the only option available to me for this is “Default profile”. Looks like most of it is suppressed :frowning: Good news is that I now know that I can use the nulling method to unspress these sub-menus and options, a shame it is a bit tedious.

I’m happy to get a programmer if it is a quicker way to remove all of the suppressions, as I don’t have one yet, never used one before either, are they simple enough to use? I’ve disassembled boards on laptops before (re-pasted, etc) so I’m comfortable in doing that - though I might need some help in actually locating the BIOS on the MB when/if it comes to it.

Thanks again, Darren

Edit: Just seen the various guides around the forum about programmers, looks simple enough (probbaly should have looked before asking the question!) Do you think the move outside method is less tedious than the nulling method or does it not really make any difference? Just want a quicker or the simplest way to unlock the BIOS options really but if the nulling method is the only way, then I’ll have to put the time in to make all of the edits. Could take weeks by the looks of it.

15

@tdarren - Nice

Now that you can see inside there, you can test Access Level changes to the missing settings first to see if it makes them visible. Pick one setting or submenu only, change it to User or Super, then test, once it becomes visible then you can do same to all the rest that is missing at once in larger edit (Saves time this way, test one item first, then do all at once)
If neither User/Super makes something visible inside there, then yes, you will have to do similar unsuppression edits to each item. If when looking at IFR and you see some missing setting that does not have suppression above it at all, then that would be one that could be made visible with Access Level edit only, not all may be suppressed and hidden.

Programmer would only help if you had to recover from brick, unless you mean by quicker testing instead of null the suppression move items outside the suppression << If you meant that, then yes, it’s best to have this and backup made before you test this kind of edit in case is bricks.
Yes, they are easy to use, we have a good image guide here too - [GUIDE] Flash BIOS with CH341A programmer
For sure, I can help you locate BIOS if you open it up, show me some images

To me, editing either way is easy, both can be tedious to someone that doesn’t do it all the time. But really, either way, it’s going to be tedious edits for anyone not familiar with doing them all day long, lots of back-n-forth looking at IFR/hex etc.
And, moving outside suppression may be more confusing than nulling suppression for some not familiar with hex editing because you have to cut/paste to move and that must be done exact vs putting FF on a byte to null the other way.

Did you see the RD MODE Support setting that the above suppression is referring to? Make this setting visible by nulling that suppress IF, then test enable/disable of this setting and see what shows up.
This sounds like Research/Dev mode to me, and setting 01/Enabled may make all settings suppressed by (Suppress If {0A 82} >> QuestionId: 0x3FD equals value 0x0 {12 06 FD 03 00 00}) visible = x122 instances
Easy one I see to check, after enable this and reboot, do you then see “System Agent” inside Chipset, or not? It’s suppressed by this value only

Suppress If {0A 82}
QuestionId: 0x3FD equals value 0x0 {12 06 FD 03 00 00} << << FF that - Then this setting will be visible at root of Chipset, then you can test as mentioned above, this may gain you 122 settings, or at least cut out 122 instances of nulling needed (since you can bypass nulling this line anywhere, when you have this enabled/01)
One Of: RD MODE Support, VarStoreInfo (VarOffset/VarName): 0x12FD, VarStore: 0x1, QuestionId: 0x3FD, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 A4 18 A5 18 FD 03 01 00 FD 12 10 10 00 01 00}
Default: DefaultId: 0x0, Value (8 bit): 0x0 {5B 06 00 00 00 00}
One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
One Of Option: Enabled, Value (8 bit): 0x1 (default MFG) {09 07 03 00 20 00 01}

This wont help with the overclocking area, I see it has a lot of varying suppressions, those would be best bypassed by just going through them IFR/Hex side by side and null each as you go.
I can do all these edits for you if you want?

16

@Lost_N_BIOS Thanks! I’ll give it a go and will report back my findings. Yes did see that RD Mode support earlier on, I’ll definitely give that a try because like you say, a lot of the If statements are referring to it.

I am a programmer by occupation, just not with straight up hex! But it does help me more quickly understand some of this stuff.

----------------------------


@Lost_N_BIOS

Changing access level on the missing settings inside the overclocking menu didn’t have any effect. But that’s fine because when I unsuppressed the RD Mode Support option and changed it to Enabled, it had a dramatic effect (in a good way).

As far as I can tell, everything inside overclocking menu is now visible when enabling this option, an absolute ton of other menus/options have also been revealed. I’ve zipped up screenshots of all main menus (Main, Advanced, Chipset etc.) and everything in the overclocking menu so you can see the difference (attached to this post).

I do also see System Agent in Chipset.

Question is, can I now see everything possible? I get that some menus may be purposely hidden/suppressed because of hardware limitations so happy for them to remain that way if that is the case.

The other thing I want to do is update CPU Microcode, but I should be able to use UBU for that? [Tool Guide+News] “UEFI BIOS Updater” (UBU)

Appreciate your help and thanks again,
Darren

Bios Screenshots RD MODE.zip (2.97 MB)

17

@tdarren - Once you play around in hex/BIOS for a while you will start keeping more and more of it in mind and be able to more quickly move through edits, which I’m sure you know being a programmer

Great to hear it, I thought that was some kind of R/D mode switch, probably in their case they meant for it to be called “Razer Dev Mode” I will check your images, vs what’s possible, and see if you have anything missing.

UBU may or may not update microcode safely, sometimes there is issue with microcode edit specifically, so I always do that manually (same as everything else too ).
If you want, dump your BIOS region with FPT again so I have new/current one, and send to me I can update them for you. If you’d rather do it with UBU let me know and I will check and see if UBU does it properly for this BIOS.
Actually, I went ahead and checked this now and it’s OK, at least with UBU_v1_76_2_3, if you have CPU with 806xx CPUID you will need to replace those individually or edit UBU MCUpdate.txt to make sure those remain and get updated (it removes those and leaved only updated 906xx uCodes)
“R” (UEFIReplace) Method = FIT Table poorly edited, but OK. BIOS May be broken and may brick board, due to padding file removed above microcode volume. It could be OK but only test and possible brick would let you know either way, I advise you do not use this method!
“A” (MMtool) Method = leaves 3x old 906Ex (B/C/D) microcode in place, adds the 4x new >> BIOS looks OK, not broken due to uCode edit - Not ideal BIOS to use here either, if you have 906E (B/C/D) because old left in place, so new may or may not be used.

I advise you to update these manually, or let me do for you. If you do it, be sure to fix FIT table once you are done and be sure padding file is left in place above/below both ucode and FIT modules.

I will check images vs possible tonight when I have more time. If you want me to update microcodes for you post a new BIOSreg dump from FPT

@tdarren - * Edit - I checked the images, what parts of the BIOS you uploaded (can’t see it all), and looks like everything is there in the areas you showed
Except, I see CSM Submenu is missing from Boot page, but you now know how to make it visible Same goes for Command Rate Support in Memory at bottom, you can make it visible now too Or, due to it’s help text, I think maybe it will be appear when you set CMD Rate 1 (NM Mode = 1)

*** WARNING - To ANYONE with laptop and unlocked BIOS!!! ***
DO NOT try to enable this graphics card or disable that card, switch cards etc. Otherwise you will end up with no display output (ie black screen) and no way to recover except by blind flash or with flash programmer.
You can change graphics related settings, like changing memory sizes, or core speeds etc, just don’t try to disable one card or change which is main etc.
Additionally, be very careful when trying to undervolt CPU, you can leave BIOS unbootable due to CPU voltage too low (Sometimes even 0.05 is too much)

18

Hi @Lost_N_BIOS ,

Thanks for replying, I’m just in the middle of updating CPU microcode manually and once done will ask you to check it. Currently working out the FIT table and how it is structured etc.

I’m following this tutorial: [GUIDE] AMI INTEL CPU Microcode Update Guide

Ill get back to you a little later or when I’ve managed to get the FIT table sorted with my updates so you can check.

Thanks again, Darren

---------

Edit

Ok, I’ve now finished my edits for updating the Microcode for my CPU platform, which is 906EA (i7-9750H), please see the attached BIOS region dump with my edits applied.

biosreg_mod.bin is before I updated any Microcode
biosreg_mod_newMC.bin is after I updated the Microcode for my CPU platform

Steps taken:

1. I downloaded this Microcode from here -> https://github.com/platomav/CPUMicrocode…RD_711B4326.bin
2. Following the tutorial that I linked to above, extracted body of Microcodes (GUID ‘17088572-377F-44EF-8F4E-B09FFF46A070’)
3. Opened extracted body in Hex Editor, found that beginning of the old MC for my CPU platform and the end of the old MC for my CPU platform, selected this entire block.
4. Opened new CPU microcode downloaded in Step 1 above in Hex Editor, pressed CTRL + A to select all, copied it and then pasted it over my old MC in the extracted body and added additional bytes to accommodate the new MC.
5. As per the following advice in that tutorial, I then removed ‘FF’ values at the end of the microcode body to match the size of original microcode body



6. Saved my hex edits of Microcode Body and then replaced body back into the BIOS region GUID ‘17088572-377F-44EF-8F4E-B09FFF46A070’
7. After reading your post Help adding CPU Microcode to Dell 7060 BIOS?, I used UEFITool NE Alpha version 51 or above to get the header address of each MC and noted down each one.
8. Opened entire BIOS region dump in Hex Editor, searched and found where FIT appears, then proceeded to update the 7 hex lines with the header addresses that I noted down, making sure I placed them in backwards. (e.g - FF CD 02 B0 became B0 02 CD FF)
9. Saved my BIOS region dump after updating FIT table. Reopened in UEFITool to check all okay.

Once I did all of this once, I then did it again to make sure I got the same results, which I did. So I’m confident I’ve made all of the edits correctly to update the Microcode. Please check this for me and let me know if I have successfully updated my CPU microcode manually and if it’s okay to flash?

Thanks, Darren

biosreg_mod.zip (4.29 MB)

biosreg_mod_newMC.zip (4.29 MB)

19

@tdarren - I wrote FIT guide, but it needs updated (There is much easier way now) not sure if you’ve seen - [GUIDE] Update CPU Microcode + Fix FIT Using UEFITool / Hex
Ahh, I see, you found my recent discussion about this much needed update to guide that I haven’t had time to do yet, nice!

You didn’t use old UEFITools linked there in that guide did you? You should use version 25 (not 25.1, or not any older either) for insertions.
I ask because on rebuild you lost a critical module at end of BIOS in PEI Volume. In the parser tab, check side by side, you see missing “Non-UEFI Found in pad-file” on your mod BIOS, this needs to remain in place
Usually, if you do not edit that volume at all, it shouldn’t be touched, this is why I asked if you used that very old version of UEFITool mentioned in the guide, if so it may have cause this

* Edit - Yes, this must be the issue, I redid your mod using your mod ucode body, and version 25, replaced body and this file remains as it should (of course FIT needs fixed again after that )
But anyway, this must be due to you using the old version mentioned in that guide (unless you did or used something else not mentioned above)

Other than that is looks good, FIT is done correctly and padding files remain in place above/below FIT/uCocde - But >> DO NOT FLASH THAT BIOS Due to above is critical to function ^^

20

@Lost_N_BIOS Good spot! Good thing I asked you to check it for me.

I was using version 0.26 for insertions, but I’ve now re-done the ucode update using 0.25 as you suggested and it seems to have worked correctly now as I can see the “parsePadFileBody: non-UEFI data found in pad-file” message when opening the rebuilt image in UEFITools NE.

Just as a precaution, would you be able to check the BIOS region dump I have attached which includes my microcode updates using UEFITools version 0.25?

Let me know if all is good and okay to flash now.

Many thanks for your help,
Darren

biosreg_mod_newMC_v2.zip (4.29 MB)

21

@tdarren - Looks good now