[Tool Guide] AMI Setup - IFR Extractor AMISetupWriter

HI i have extracted backup.bin and cant find bios lock code can you help me find these codes? I upload backup bios for Asusk53sk with working Lan.

amisetup.png

backup.rar (998 KB)

@Kameaman

This is an old Sandy Bridge/Cougar Point bios and partial backup only, like orginal Asus update files, it doesn’t have the Intel ME FW image, but i believe it doesn’t contain any bios lock variables.

- Optional method
Run Intel ME FW 6/7 tools package: Intel (Converged Security) Management Engine: Drivers, Firmware and Tools
https://mega.nz/folder/qdVAyDSB#FLCPaDVIsPYiy2TAUjD7RQ
Try the 6 tool or the 7, it doesn’t do any flash/damage to the system.

Intel FPTtool in CMD Admin windows, FPTw.exe -dumplock (Displays bios access regions)

- Another method is trying to write it back
After the correct tool identified that worked, do a full backup, " FPTw.exe -d spi.bin "

Now dump the bios region
Command: " FPTw.exe -d biosreg.bin "
try to write back the BIOS Region dump and see if you get any error(s). (NOW this is user own risk only)
Command: " FPTw.exe -bios -f biosreg.bin "

it says
Lock Settings:
Host Cpu Master: 00 00 FF FF
Me Region Master: 00 00 FF FF
Gbe Region Master: 18 01 FF FF

Im just looking solution how to update me region to stock, without dekompositing my laptop :smiley:
After i dumped whole spiflash in uefitool it say full acces to regions but when im trying to update Bios region in MS-Dos its write protected

Provide information from FPTw64.exe -i and better ask here: Intel (Converged Security) Management Engine: Drivers, Firmware and Tools

Hello SoniX and everyone.
I’m studying day by day how to recover my hacked ASUS notebook (Vivobook Pro N752VX - 6th generation Skylake).
The collective involved, used a UBU set of tools newer than the 1.7x.
Curiously, they left their “burglar tools” in my OneDrive.
I share the zip file for analysis.
(Probably an act of mercy, to address me toward the solution).
The modded bios is of course “locked”, so this article is very useful. :pray:
Actually, my ASUS is an hybrid ASUS/Dell and the firmware flashing is part of a bigger project/attack related to the world of cryptominers, that I frequented for a couple of week trusting too much Github (owned by Microsoft but even a lab for any whithehat/blackhat interesting, advanced and dangerous project) where I downloaded tools to mine and enhance the performance of CPU. It was only to learn about that world. But I paid it a lot.
A bunch of drivers loaded at boot with fake MS root certificates, possibly heritage of the dismiss TechNet world or PKI partners somewhere in the East, a speculative execution attack through opportune Microcode alteration, a QEMU virtual machine (using reactOS features in a hidden partition??) and a fake AV positives generator with some real classic trojans and crypto mining engines.
Wonderful and maybe not very accurate. Sadly (for them), LINUX “compliance” is “0” and it advice me about firmware bugs at boot and that’s all.
Even Windows 11 Dev Builds run smoothly with the suggested AMD/Intel/MS mitigations for the side channel dump recollection, IPfilterX, Netlimiter and a defensive approach.
Thank you for your time. I’m happy to be here and if I can’t work it out I’ll be back to you :wink:
UBU 1.817

OK, just un update.
First of all, the malware that uses SoniX, Fernando and all the precious software created by several team members at “overclockers inn” and all around the world, is less sensitive and disruptive if you install the Chinese version of a Win11 DEV Build.
This for the fortunate reason that the main processes (as explorer.exe) has got their own name in Chinese. I bet the collectives won’t study some Chinese while recollecting Crypto Coins from controlled or “slaved” devices.
Therefore, waiting for AMD or Intel to find a f…ing solution to break up the Meltdown//Spectre and all their aggressive nephews bad influences, spreading all their malicious powder on gamers expansive CPUs, I prepared, on a “cylinder/partition” cleaned USB keys, all the software my hacked ASUS identity messed up with a Win 11 Dev Chinese edition with no network connections.
From winrar to AMI, a cleaned UBU, Intel binaries editors, the Ultra Sandisk key contains all I need to get rid of their messed up UBU 1.817 one.
I have to work on it with calm, serenity and of course logging and back upping (as I’m doing from several weeks) any action I do and any file “left” on their hidden malicious partitions. I’m filing a MSRC report to check if at MS, Intel and AMD they feel ready to prepare antidotes (with no use of Hyper-V virtual layers and other performance disruptor tools) to avoid the Microcode doping involving our innocent CPUs.
I’m White hat now. Missions changes in this turbulent times.

Thank you Ferny and thank you Sonix and your bunch! :grin::raised_hands:

Stefy

Hello I have faced Setvarvariable security violation message when trying to amisetupwriter .
Have you got any idea?

Are you a gamer or a miner?
Asking this, because the second option is the riskier about the low-level hacking possibility you offer to external agents.
If you were able to unlock the BIOS and make intervention of it, please discard this answer.
If not, try multiple versions of AMI extractors.
Suppose you already used Ultimate Boot CD to force a BIOS reset and then try back again.
If not, try it.
Then go back to 1.5.1.
Anyway, ASUS BIOS and ASUS support on their BIOS versions is extremely poor to be “kind”.
Hope you’ll get it, one way or the other.
Keep us informed!

S.

in this guide here: GitHub - BoringBoredom/UEFI-Editor: Aptio V UEFI Editor: an alternative to AMIBCP
it says to extract “above 4g” PE32 image which I am doing. But when I try to extract it with the “ifrextractor 1.5.1” it doesn’t work. I have tried using uefitool 0.28, 0.21.5 and the latest version but none of them work.

I’m using h87m-pro

motherboard site along with bios .cap file
any help would be appreciated! :smiley:

I’m trying to modify BIOS of my Asus H7604JV laptop.
You can find origin.bin (Origin BIOS) in google drive : H7604JV BIOS – Google Drive

I extracted three files from orign.bin by using UEFITool.
However, when I use ifrextractor, I got “No IFR data found”

Any advices?

@jack.toptal
Welcome to the Win-Raid Forum!
Sice it doesn’t make much sense to start several threads within different Forum Categories about the same topic, I have merged your post into this already existing thread and hope, that you will get support here.

1 Like