Heyo,
I have been trying to get the hidden menus for my Zenbook but I’ve hit a roadblock. I’ve tried to open bios stock with AMIBCP to see there is no setup module. I’ve done some scouting and FPF side does not have verified boot and boot guard enabled yay. I got the variable needed to unlock bios lock with BIOS Lock Asus guide, info on ME and done a backup of current latest bios with FPTw.exe . I’ve attached everything i’ve done and should need.
attachment
Just for reference, this thread seems similiar to my situation: ux461fn
@curpy - Nice you’ve done your homework and prepared for stuff in advance here, good work 
It’s also great to see you already checked for boot guard enabled at left/FPF side, are you 100% sure? If yes, OK, we carry on 
<< Ahh, I see you included report, so 100% confirmed, nice
Lets unlock BIOS lock and ensure FPRR is also disabled then make a new FPT dump with those disabled. Follow this guide, start at step #6, I’ve done 1-5 for you below
[GUIDE] Grub Fix Intel FPT Error 280 or 368 - BIOS Lock Asus/Other Mod BIOS Flash
Rename .efi to >> Shell.efi
BIOS Lock variable to disable >> 0x8E2
FPRR variable to ensure disabled >> 0xEE6
So, at grub prompt, you will type the following, one line at a time, enter between each (Case sensitive)
setup_var 0x8E2 0x0
setup_var 0xEE6 0x0
Then reboot and make a new FPT BIOS region dump, with new name, so you don’t mix it up with previous one. >> FPTw.exe -bios -d biosregnew.bin
Then attempt to write it back, if success send me the new BIOS region file, if error show me the error >> FPTw.exe -bios -f biosregnew.bin
With the above, please also include for me one screenshot of your BIOS from all pages (main, advanced, boot, save and ecit etc), so I can see which menus you have visible now and their current contents
Please resize these images before you zip them up (max compress too please) 800px wide is plenty for what I need to see, thanks.
Ohh, on AMIBCP, you must not be using correct version, no issues opening here w/ 5.02.0023 or 5.02.0031, or even much older 5.01.0014 and even older incorrect version 4.55 opens it fine too (4.55 is for Aptio IV, this is Aptio V BIOS)
Send me a PM about this
Hi Lost_N_Bios,
Thank you so much for reaching out! Understood, I’ll get bios menu screenshots and new FPT bios dump in by tomorrow.
The AMIBCP part, I am very sure I have a version above 5.01.0014 and used it on the stock bios cap provided. Maybe I’m looking at revealing hidden menus wrong. Thanks for the PM about it tho 
.
I’m curious to what the FPRR variable does also?
Looking forward to seeing this bios’s juicy bits hehe.
You’re welcome! Maybe I misunderstood you about AMIBCP? You said no setup, so I assumed you meant no “Setup Config” tab and it wasn’t loading out BIOS properly so setup config was not show on far left, so you couldn’t see the menus branched out in order to look around?
FPRR is Flash Protected Range Registers, it’s like BIOS lock but locks down certain regions of the BIOS when enabled. It looks disabled in setup, but could still be enabled at NVRAM or AMITSE/Setupdata, I didn’t check, best to just disable while in grub, if you see it’s already 0x0 when you type that in then you know it’s already disabled
Ah, I’ll include a photo of what I see in AMIBCP tomorrow. I think this maybe my misunderstanding. As for FPRR, got it!
@Lost_N_BIOS , the steps given worked flawlessly.
I had no errors switching variable states and FPRR is disabled default on this model. The dump and flash had no errors either, just no GbE warning. AMIBCP is as you say. I’ve attached biosregnew.bin and screenshots in the zip.
bios2.zip (5.15 MB)
@curpy - thanks, I will unlock BIOS for you shortly Good to see you had no issues too
There may be 1-2 test BIOS I need you to flash and test before I do full unlock, I’ll let you know.
Got it!
@curpy - Here you go, if first fails to show you new Advanced/Chipset, then flash in second
http://s000.tinyupload.com/index.php?fil…366277798919100
*** WARNING - To ANYONE with laptop and unlocked BIOS!!! ***
DO NOT try to enable this graphics card or disable that card, switch cards etc. Otherwise you will end up with no display output (ie black screen) and no way to recover except by blind flash or with flash programmer.
You can change graphics related settings, like changing memory sizes, or core speeds etc, just don’t try to disable one card or change which is main etc.
Additionally, be very careful when trying to undervolt CPU, you can leave BIOS unbootable due to CPU voltage too low (Sometimes even 0.05 is too much)
@Lost_N_BIOS Advanced and chipset are showing! This is great! ASPM was giving me a hassle in Linux, with this I can resolve or improve my experience. I’m just curious, is it worth replacing Intel’s efi gopdriver and such with newer releases? I’m curious to how you unlocked these options too.
@curpy - Thanks for quick test and report back Did you have to use M2, or did M1 get it first time?
Do you boot UEFI or Legacy? If you do not boot UEFI with CSM disabled, then you would not even use GOP if it was updated, but really if you are not having graphical issues either way you probably would not see any change from updating GOP
Unlock is done this way, if you use M1 - if M2 was required let me know and I will add in the changes that one has on top of these
Extract modules with UEFITool 51-57 NE Alpha, or regular UEFITool 25 (used for re-insertion, do not use newer)
Edits done with hex editor, any will do, but I use Hex Editor Neo
Univeral IFR Extractor v0.7 used to parse Setup PE32 into human readable text, to gather below information.
Setup PE32 As-Is >>
Form Set partial to grab menu ID’s in AMITSE - 4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15
Form: Setup, FormId: 0x2710 {01 86 10 27 06 00}
Suppress If {0A 82}
True {46 02}
Ref: Main, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x1, FormId: 0x2711 {0F 0F 08 00 02 00 01 00 00 00 FF FF 00 11 27}
Suppress If {0A 82}
True {46 02} << Make False (47 02)
Ref: Advanced, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x2, FormId: 0x2712 {0F 0F 1E 00 02 00 02 00 00 00 FF FF 00 12 27}
Suppress If {0A 82}
True {46 02} << Make False (47 02)
Ref: Chipset, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x3, FormId: 0x2713 {0F 0F 1F 00 02 00 03 00 00 00 FF FF 00 13 27}
Suppress If {0A 82}
True {46 02}
Ref: Security, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x4, FormId: 0x2714 {0F 0F 3A 00 02 00 04 00 00 00 FF FF 00 14 27}
Suppress If {0A 82}
True {46 02} << Make False (47 02) - No room, skip
Ref: Boot, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x5, FormId: 0x2715 {0F 0F 20 00 02 00 05 00 00 00 FF FF 00 15 27}
Suppress If {0A 82}
True {46 02} << Make False (47 02) - No need/room, skip, or swap (if swap, change to 47 02)
Ref: Save & Exit, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0xB, FormId: 0x271B {0F 0F 4D 00 02 00 0B 00 00 00 FF FF 00 1B 27}
Hidden Menus ^^
Visible Menus >>>
-------------------------------------------
Ref: , VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x6, FormId: 0x2716 {0F 0F 16 27 02 00 06 00 00 00 FF FF 00 16 27} = (Main)
Ref: Advanced, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x7, FormId: 0x2717 {0F 0F 1E 00 02 00 07 00 00 00 FF FF 00 17 27}
Ref: Boot, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x8, FormId: 0x2718 {0F 0F 20 00 02 00 08 00 00 00 FF FF 00 18 27}
Ref: Security, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x9, FormId: 0x2719 {0F 0F 3A 00 02 00 09 00 00 00 FF FF 00 19 27}
Ref: Save & Exit, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0xA, FormId: 0x271A {0F 0F 4D 00 02 00 0A 00 00 00 FF FF 00 1A 27}
Unsuppress Fast Boot >>
Gray Out If {19 82}
QuestionId: 0xBFC equals value 0x1 {12 06 FC 0B 01 00} << Change to FF
Suppress If {0A 82}
QuestionId: 0x2809 equals value 0x1 {12 06 09 28 01 00} << Change to FF
One Of: Fast Boot, VarStoreInfo (VarOffset/VarName): 0xF35, VarStore: 0x1, QuestionId: 0xBCD, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 23 00 24 00 CD 0B 01 00 35 0F 10 10 00 01 00}
Default: DefaultId: 0x0, Value (8 bit): 0x0 {5B 06 00 00 00 00}
One Of Option: Disabled, Value (8 bit): 0x0 (default MFG) {09 07 64 12 20 00 00}
One Of Option: Enabled, Value (8 bit): 0x1 {09 07 E6 14 00 00 01}
-------------------------------------
AMITSE PE32 BODY >>
@22E8 - Short Visible List
16 27 17 27 18 27 19 27 1A 27 FF FF FF FF FF FF << Add 2nd Advanced + Chipset menu ID’s, remove 4x FF
@31290 - Long Blocked List
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 11 27 00 00 07 10 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 12 27 00 00 08 10 00 00 << Remove, 0-Fill
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 13 27 00 00 09 10 00 00 << Remove, 0-Fill
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 15 27 00 00 0A 10 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 14 27 00 00 0B 10 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1B 27 00 00 0C 10 00 00
@56B20 - All Possible
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 11 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1B 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 << Change to 12 27 = Advanced
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 16 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 17 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 18 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 19 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1A 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 << Copy/paste any string here, change to 13 27 = Chipset, remove 0-String
@56C80 - Blocked
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 11 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1B 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
@F8740 - Blocked - FF out Form ID
00 41 B8 43 27 00 00 66 41 3B C0 0F 84 46 01 00 - PEG Port Configuration
00 41 B8 F2 27 00 00 66 41 3B C0 0F 84 36 01 00 - Demo Board
00 41 B8 12 27 00 00 66 41 3B C0 0F 84 26 01 00 - ADV << FF out ADV Menu ID
00 41 B8 13 27 00 00 66 41 3B C0 0F 84 16 01 00 - Chipset << FF out Chipset menu ID
00 41 B8 15 27 00 00 66 41 3B C0 0F 84 06 01 00 - Boot
00 41 B8 9D 27 00 00 66 41 3B C0 0F 84 F6 00 00 - Realsense 3D Camera
------------------------- >> Actual Edit >> ---------------------
Add 2nd Advanced + Chipset & Unhide Fast Boot in original Boot (Null Suppression, see above for edit)
@22E8 - Short Visible List
12 27 13 27 16 27 17 27 18 27 19 27 1A 27 FF FF
@31290 - Long Blocked List
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 11 27 00 00 07 10 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 15 27 00 00 0A 10 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 14 27 00 00 0B 10 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1B 27 00 00 0C 10 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
@56B20 - All Possible
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 11 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 12 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 13 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 16 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 17 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 18 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 19 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1A 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
@56C80 - Blocked
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 11 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
4A 10 59 7B 0D C0 58 41 87 FF F0 4D 63 96 A9 15 1B 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
@F8740 - Blocked - FF out Form ID
00 41 B8 43 27 00 00 66 41 3B C0 0F 84 46 01 00 - PEG Port Configuration
00 41 B8 F2 27 00 00 66 41 3B C0 0F 84 36 01 00 - Demo Board
00 41 B8 FF FF 00 00 66 41 3B C0 0F 84 26 01 00 - ADV
00 41 B8 FF FF 00 00 66 41 3B C0 0F 84 16 01 00 - Chipset
00 41 B8 15 27 00 00 66 41 3B C0 0F 84 06 01 00 - Boot
00 41 B8 9D 27 00 00 66 41 3B C0 0F 84 F6 00 00 - Realsense 3D Camera
M1 worked first test. I do boot UEFI without CSM but I’m not having any graphical issues. I’ve got native aspm enabled, enabled some acpi interfaces and disabled Intel dptf. Honestly never expected Linux to be this good with bios mod. Is M1 consider ok to use or do any final edits have to be done?
Again, thanks so much @Lost_N_BIOS.
------------------------
Oh, and is there any resources to better understand some of these settings? Google hasn’t revealed much. I don’t touch them just to make sure I don’t brick.
@curpy - You’re welcome! And thanks for the info. No, nothing wrong, or needs added to M1. I only asked for future reference in case anyone else needs edit on this model, so I know if the additional changes from M1 to M2 were necessary or not.
Google is about the best thing I can advise for you if you are unsure on what some settings do.
Hey @Lost_N_Bios, I’m back :p. I noticed I was getting an intel ish hw init failure due and kernel boot delay because I disabled Intel me. I wanted to disable of ME and retain my sensor functionality (accel, rotation, etc). So… I had gone into the forbidden ME test settings and soft bricked my laptop. I should have done my research, me_cleaner project would have yielded better results :p. I have the ch431a programmer coming tomorrow to flash biosregnew.bin. I will check connection, dump current, flash the one I referenced, verify and go back to being happy. Does that sound ok?
I’ve also attached the photo of the cop and desoldered I think the same module from another Asus laptop.
@curpy - ME Cleaner would have yielded same, maybe not brick if used properly, but if you disable ME FW lots of things will fail to function properly, this should be left enabled.
You can’t program in BIOSregnew/biosregnewm, that is only part of the BIOS. You will need to dump your current BIOS contents and send to me then I can make complete BIOS for you to program back in.
In that fixed BIOS, do you want me functional, or disabled? What is your BIOS Chip ID, so I can tell you what software version or chip ID may be best to use, otherwise read or writes will fail.
Sorry, I don’t understand your last line above, and there is no image
@Lost_N_BIOS - Yeah, I’m not sure what result will let me keep Intel sensor hub functionality. I think It’s best to keep it on. BIOS turns ME status to temporary disable. I wanted to try me_cleaners soft disable status (hap bit).
I thought those bin files were the entire rom huh. I’m still waiting on the programmer.
I don’t know what happened in the last line heh. I tried sending a photo of the bios chip and have another one on hand. Anyway, the bios chip id is a winbond 25q64fvsiq. I’ve attached a photo again, hopefully it worked.
@curpy - Lots of things get messed up with corrupted or missing/disable ME FW, so this was probably cause of the items you noticed failing or missing. BIOS ME Temp disable is for one reboot, and is meant for ME Update purposes
Set the HAP Bit yourself using Intel FITc tool
No, whatever bin you are referring to, I assume what you sent me before, is only BIOS region dumps, this is not complete BIOS (only 6MB out of 8MB).
For W25Q64FV using 1.30 or 1.34 software and W25Q64BV ID - Please redo the dump above if you did not use this version/ID
I will fix ME For you, but if you want ME Disabled HAP Bit set, then you will again see all the issues you mentioned (ie missing or non-working items) probably
* Edit @curpy - Here is fixed BIOS (M1 BIOS region used), both with updated latest 11.8 ME FW - one with ME HAP set/reserved=Yes and one without (So ME FW enabled) - Program in using the info I mentioned above or write may fail
With both of these, FD is unlocked, so once you program one in, if you want to switch ME regions you can just write with FPT from windows or DOS (if ME Disabled, you may have to use FPT from DOS, I can’t remember)
http://s000.tinyupload.com/index.php?fil…580981090176956