[Tool] SmokelessRuntimeEFIPatcher (SREP)

[AkizukiKaguya]

@Sweet_Kitten

I think you should add an additional byte before the FormSetId.

I also found this issue, But somehow the original one is also missing.

So i was thinking how this can work lol
(Sorry for i dont know how to use the quote correctly)

So finally, the correct struct will be like this ?

# Type  Size    String ID   String ID   Question ID                     Form ID     Question Id    Form GUID
#               of name     of desc
# 0F    0F      BE 1A       E5 1A       02 00       00 00 FF FF 00      03  E1      29 02          0A8212861A000000120619000000160212061600010016022902198212860D000300
# 0F    21      BE 1A       E5 1A       02 00       00 00 FF FF 00      99  00      01 00          9E76D4C6487F2A4D98E987ADCCF35CCC290229022902290229022902290229022902
# 0F    21      BE 1A       E5 1A       02 00       00 00 FF FF 00      01  00      01 D2          4CFD01432B8145B9CD380EDEEF508129022902290229022902290229022902290200

EDIT: I did a try with this config:

Op Patch
Pattern
0F0FBE1AE51A02000000FFFF0003E129020A8212861A000000120619000000160212061600010016022902198212860D000300
0F21BE1AE51A02000000FFFF00010001D24CFD01432B8145B9CD380EDEEF508129022902290229022902290229022902290200

The BIOS crashed when i clicked the General Settings, the parent menu of the Network Boot Settings lol

EDIT: Another try with:

Op Patch
Pattern
0F0FBE1AE51A02000000FFFF0003E129020A8212861A000000120619000000160212061600010016022902198212860D000300
0F21BE1AE51A02000000FFFF0099000100D24CFD01432B8145B9CD380EDEEF5081290229022902290229022902290229022902

Somehow its still crash when i click the Network Boot Settings.

# Type  Size    String ID   String ID   Question ID                     Form ID    Question Id     Form GUID
#               of name     of desc
# 0F    0F      BE 1A       E5 1A       02 00       00 00 FF FF 00      03 E1      29 02           0A8212861A000000120619000000160212061600010016022902198212860D000300
# 0F    21      BE 1A       E5 1A       02 00       00 00 FF FF 00      99 00      01 00           9E76D4C6487F2A4D98E987ADCCF35CCC290229022902290229022902290229022902
# 0F    21      BE 1A       E5 1A       02 00       00 00 FF FF 00      01 00      01 00           D24CFD01432B8145B9CD380EDEEF5081290229022902290229022902290229022902
# 0F    21      BE 1A       E5 1A       02 00       00 00 FF FF 00      99 00      01 00           D24CFD01432B8145B9CD380EDEEF5081290229022902290229022902290229022902

EDIT: Finally, Thank you ! I’ve understanded how to modify it correctly, By this:

Op Patch
Pattern
0F0FBE1AE51A02000000FFFF0003E129020A8212861A000000120619000000160212061600010016022902198212860D000300
0F21BE1AE51A02000000FFFF0001000100D24CFD01432B8145B9CD380EDEEF5081290229022902290229022902290229022902

The Network Boot Settings will open the menu of Performance Tunning.
Again, Thank you !


Edit by Fernando: Thread title customized

[Sweet_Kitten]

@Sweet_Kitten

Good intel that it works for you. I’m going to figure out why it didn’t back then for me.

I investigated my attempt inserting REF3 in Setup back in 2023. And as the srep dev said, patching loaded module is tricky…

@AARCH64_EL3

Patching already loaded module is tricky.

…

I was working in a way to patch loaded IFR, but I lost intrest as I don’t needed it…

Somehow certain IFR opcodes cannot be altered in Setup by srep, but certain can be, i.e. Questions, Statements, Operators (ifs, end ifs and etc.). I already knew that, but it took a lot of time to realize that it was the reason for my fail in the past.

Finally, I’ve managed to add a link to some other FormSet, by srep patch on a generic Clevo laptop.

[AkizukiKaguya]

@Sweet_Kitten

Finally, I’ve managed to add a link to some other FormSet, by srep patch on a generic Clevo laptop.

Is this means like replace menu direct to another menu ? Can you share how ?

And btw, Do you know how to extract H2OFormBrowserDxe data, its all of string piece in non-hex mode. Someone says some menu were hidden inside H2OFormBrowserDxe, I want to check out by my self.

EDIT: Another question, If the Advanced menu has been removed from the BIOS Image, Is there a way to load a advanced menu by outside file or its impossible to unlock then ? Thank you.

[Sweet_Kitten]

@AkizukiKaguya

Is this means like replace menu direct to another menu ?

I mean the following

Advanced Chipset Control refs to form 0x1 in Power tab. Basically, this is the same as what you did.

@AkizukiKaguya

And btw, Do you know how to extract H2OFormBrowserDxe data, its all of string piece in non-hex mode.

There’s no IFR data in this module. You can’t extraxt what doesn’t exist.

Perhaps, you're looking for this array

@AkizukiKaguya

Is there a way to load a advanced menu by outside file or its impossible to unlock then ?

By the file you mean bios image file? If so, you can’t simply take IFR from other bios and insert into yours.
Setup module means very little. What matters is efi variables. In order for the new features to work, other bios modules have to support them.

[AkizukiKaguya]

@Sweet_Kitten

Advanced Chipset Control refs to form 0x1 in Power tab. Basically, this is the same as what you did.

Ah, I see, Replace ref struct to submenu if i think correctly ?

@Sweet_Kitten

There’s no IFR data in this module. You can’t extraxt what doesn’t exist.

Yes, I don’t know if this array defines if the menu should be appear, By my search on internet it should be, But how them got the menu name ?

@Sweet_Kitten

By the file you mean bios image file? If so, you can’t simply take IFR from other bios and insert into yours.
Setup module means very little. What matters is efi variables. In order for the new features to work, other bios modules have to support them.

Which means if advanced was deleted, There is no way to adjust CPU, unlock configs ?

[Sweet_Kitten]

@AkizukiKaguya

I don’t know if this array defines if the menu should be appear, By my search on internet it should be, But how them got the menu name ?

It does define which formset should appear. See SREP-Patches/Configs/Acer/Lenovo Metro Display Engine_Insyde_BiosUnlock.cfg at master · Maxinator500/SREP-Patches · GitHub
The bios tab name gets retrieved from the formset ifr data.

@AkizukiKaguya

if advanced was deleted, There is no way to adjust CPU, unlock configs ?

I think yes.

[AkizukiKaguya]

@Sweet_Kitten

The bios tab name gets retrieved from the formset ifr data.

Are there any tools to check ?

@Sweet_Kitten

I think yes.

That is bad, Well anyway thank you for your patience and reply.

[Sweet_Kitten]

@AkizukiKaguya

Are there any tools to check ?

Don’t know. I use the method of sharp seeing.

[AkizukiKaguya]

@Sweet_Kitten

Don’t know. I use the method of sharp seeing.

kk, Thank you for your information !