Unlocking specific options in AMD CBS without {46 02}

I think the title explains it mostly but to be more specific this is something myself and @Lost_N_BIOS have been looking in to. In a nutshell there are many AMD CBS modules out there that do not contain True {46 02} so the method to expose specific options as detailed HERE will not work, so we have to find another way. I’ve been doing a lot of cross referencing and have come to one of the following conclusions being the correct answer, perhaps someone who knows more can provide some clarification on if this is right or all wrong.

1. True {46 02} has to be added and given its own offset
2. Suppress If {0A 82} must be zeroed for each option you want to expose
3. Not {17 02} must be changed to a different (unknown) value (15?)

Conclusion 2 is my gut instinct but I’m not sure.

Thanks for asking about this @ket hopefully someone will chime in with some answers! I do not have newer AMD board to test anything like this on, so I can only guess/try for others.

Is #1 true, or are you asking if it has to be added?

Can’t you test on the Biostar your working on or no setting with suppress like that, without 46 02 leading it?

@Lost_N_BIOS I could just try but I’m fairly busy atm so am hoping someone can chime in and save some time To clarify “True {46 02}” (without quotes) might possibly need to be added along with its own offset that piece of code, for most cases, is just completely gone. Only very few instances still have it. “Not {17 02}” is something that just looks suspicious to me and to my mind at least can’t be ruled out yet.

I’ve seen all that in some Gigabyte BIOS before too, with missing 46 02, so it may be some standard method AMD has passed around as optional use too.

Yeah the odd thing is that you don’t see Not {17 02} anywhere near as much in CBS files that use it compared to CBS files using True {46 02}. I’ve not given up though theres still more for me to look at.

I was reading somewhere tonight, about suppress if, and I think what I mentioned was discussed as correct, edit so that the original suppress if is not valid FF

Random example, byte to edit not always in this location of course, you have to browse around other suppress if’s in BIOS editing then and see where byte is based on question values
Suppress If {0A 82} << These numbers not always same with Suppress If
QuestionId: 0x1FE equals value 0x0 {12 06 FE 01 00 00}

Change to
Suppress If {0A 82} << These numbers not always same with Suppress If
QuestionId: 0x1FE equals value 0x0 {12 06 FE 01 FF 00} << This edit, will change output IFR to “Equals value 0xFF” making the original intended value null (Same as your zeroing method I assume) Testing is required by someone, both ways

I’ll give that a go as well once I’ve finished implanting the new UI. It is going to take some time though the minimum amount of images to edit is 82, so visual changes to 82 images, then add filesize in Hex and add the header for each one of those 82 images, then inject each image one by one… repeat until bored to death. Any luck with that PBS module?

I tried to extract images on two BIOS just to see the output process (one Asus and one Gigabyte) and all I get is files not images. Is that how yours original started as well?
I have not tested an edit on that, waiting to see if user has flash programmer or not, if not I probably wont since it’s a laptop I don’t want to stick him with having to recover when he’s not used to opening it up and using programmer.
Or did you mean something on this BIOS? If you mean the one we’re working on, message me again and let me know what’s needed, I may have forgot!

@barisuraz maybe if you detail how you are editing the CBS module it will inspire some ideas. I’ll send a PM your way Lost.

I haven’t done any editing in the CBS though. It seems like MSI has the most unlocked CBS so I just copied theirs into Biostars BIOS.

@SoniX and / or @CodeRush any sage wisdom you can impart on us? :o) @Lost_N_BIOS the new UI is now complete if there are any other drivers that need updating the firmware is ready to be passed back to you. @barisuraz can you explain how you are changing the CBS for the rest of us or are you just ripping the CBS out of the MSI board and injecting it to the Biostar?

Yes that’s exactly what I did

@Lost_N_BIOS & @barisuraz I’ve been looking at the CBS modules in the GT7 and I’m pretty sure I’m on to something here, take a look at this. Some testing is required Bar so time to abuse your GT7 a bit

Firstly, a pic of the DDR4 Common Options menu for the GT7



Now take a look at the code for the CBS modules (A5E3 & 3E77)

Form: DDR4 Common Options, FormId: 0x7031 {01 86 31 70 B4 00}
0x9865 Subtitle: Statement.Prompt: DDR4 Common Options, Flags: 0x0 {02 87 B4 00 00 00 00}
0x986C End {29 02}
0x986E Subtitle: Statement.Prompt: , Flags: 0x0 {02 87 02 00 00 00 00}
0x9875 End {29 02}
0x9877 Suppress If {0A 82}
0x9879 64 Bit Unsigned Int: 0x1 {45 0A 01 00 00 00 00 00 00 00}
0x9883 Ref: DRAM Timing Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x38, FormId: 0x7034 {0F 0F B7 00 B7 00 38 00 00 00 FF FF 00 34 70}
0x9892 Ref: DRAM Controller Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x39, FormId: 0x7035 {0F 0F B8 00 B8 00 39 00 00 00 FF FF 00 35 70}
0x98A1 Ref: CAD Bus Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x3A, FormId: 0x7036 {0F 0F B9 00 B9 00 3A 00 00 00 FF FF 00 36 70}
0x98B0 End If {29 02}
0x98B2 Ref: Data Bus Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x3B, FormId: 0x7037 {0F 0F BA 00 BA 00 3B 00 00 00 FF FF 00 37 70}
0x98C1 Ref: Common RAS, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x3C, FormId: 0x7038 {0F 0F BB 00 BB 00 3C 00 00 00 FF FF 00 38 70}
0x98D0 Ref: Security, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x3D, FormId: 0x7039 {0F 0F BC 00 BC 00 3D 00 00 00 FF FF 00 39 70}
0x98DF End Form {29 02}


…and now let’s compare to the CBS module from the X370 Taichi

Form: DDR4 Common Options, FormId: 0x7031 {01 86 31 70 B4 00}
0x9594 Subtitle: Statement.Prompt: DDR4 Common Options, Flags: 0x0 {02 87 B4 00 00 00 00}
0x959B End {29 02}
0x959D Subtitle: Statement.Prompt: , Flags: 0x0 {02 87 02 00 00 00 00}
0x95A4 End {29 02}
0x95A6 Ref: DRAM Timing Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x37, FormId: 0x7034 {0F 0F B7 00 B7 00 37 00 00 00 FF FF 00 34 70}
0x95B5 Ref: DRAM Controller Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x38, FormId: 0x7035 {0F 0F B8 00 B8 00 38 00 00 00 FF FF 00 35 70}
0x95C4 Ref: CAD Bus Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x39, FormId: 0x7036 {0F 0F B9 00 B9 00 39 00 00 00 FF FF 00 36 70}
0x95D3 Ref: Data Bus Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x3A, FormId: 0x7037 {0F 0F BA 00 BA 00 3A 00 00 00 FF FF 00 37 70}
0x95E2 Ref: Common RAS, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x3B, FormId: 0x7038 {0F 0F BB 00 BB 00 3B 00 00 00 FF FF 00 38 70}
0x95F1 Ref: Security, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x3C, FormId: 0x7039 {0F 0F BC 00 BC 00 3C 00 00 00 FF FF 00 39 70}
0x9600 End Form {29 02}


No doubt you have both seen the obvious differences here, and I don’t believe in coincidence. Now IF I am right about what I’m thinking here I have three conclusions (Lost correct me here if I’m going wrong)

1. Both “Suppress If” and “End If” need to be zeroed (00 00) or feked out, as I call it (FF FF)
2. 64 Bit Unsigned Int: 0x1 needs to be changed to “0” {45 0A 01 00 00 00 00 00 00 00} > {45 0A 00 00 00 00 00 00 00 00}
3. Somewhat more simply, just move any of the options between “Suppress If” and “End If” outside of those restrictions.

EDIT: Gentlemen, we have a solution. Once again my brain was overcomplicating things the most obvious answer being the correct one , which is to say, conclusion 3 is the key at least as far as unlocking whole menus goes. Time to start having some fun

I think this 1+2 is same function
0x9877 Suppress If {0A 82} << Leave
0x9879 64 Bit Unsigned Int: 0x1 {45 0A 01 00 00 00 00 00 00 00} << make that change 01 to 00 or FF, probably best 00 - then your #1-2 covered in same edit, since suppress if refers to this, and your changing this, you can leave suppress if as it is.

Shoot me a file again whenever your ready, I can do that Auto/100 edit you mentioned, then you can test and see if it’s OK.

@Lost_N_BIOS ah ok so basically all of my thought patterns were right and the same thing can be accomplished either way.

Yes, I do think so, but only you can verify if both methods work (Or even 00 like you mentioned once before instead of FF, but I think it should be FF)
If you test what I mentioned sometime, let me know so I will know it’s valid method for future edits, thanks!

When you said you “Simply removed/cut” the Suppress line at the hex level, what does that entail to keep file from breaking? Simply FF that entire line out, or 00, and if yes how do you know what in Hex is that exact line.
Or is that as simple as remove all the text/words in IFR so you’re left with 0A 82 45 0A 01 00 00 00 00 00 00 00 - and FF that entire string?

Or, as I read that again now, move outside suppress, same thing at hex level, but move for example
0x9877 Suppress If {0A 82}
0x9879 64 Bit Unsigned Int: 0x1 {45 0A 01 00 00 00 00 00 00 00}

To below the options, before end, instead of above the options

This is from Lost_N_BIOS, we have another way of exposing hidden options it would seem; For your reference, I found tonight, changing suppress if 27 02 (True) to 28 02 (False) works, just like the 46 to 47 This was found in Intel Insyde BIOS, but surely we’ll see it elsewhere too instead of the usual suppress.