I found HP Z420 didn’t got smi lock and so on,but they remain error 28 when I flash with the modded bios region.
So whether I could just only flash the modded address and it would succeed by FPT?@DeathBringer Many Thanks !!!
@Lost_N_BIOS
Actually I still remain a little skeptical of killing FPRR by disable SMI Lock, BIOS Lock + GPIO Lock, BIOS Interface Lock, RTC RAM Lock
I would tried it when I own another machine and feedback.
No, it would only work on system when you can unlock all that, and then it works (ie when it’s all there and it works, it works, when it doesn’t it doesn’t)
If you can’t flash BIOS region, you can’t flash microcode… At least I’m pretty sure you would get blocked, it’s a “region” block, so anything in that region would be blocked, if it’s blocked. But DeathBringer would have to answer you for sure
I only tagged you because of this applied to 800 G1, not all other systems 
but yes, maybe some you could get lucky and disable all that and then it would unlock, but probably only some rare or similar cases
@Lost_N_BIOS
Unfortunately,I had tried it on 800G1DM ,and disable all the locks,but it still prompted error28 even only flashing the bios region.
I also had tried to short the FDO,but it seemed the same as above.
I think it must flash the allocated region of the bios so that it would be OK
Sometimes lock is in module (pchinitdxe or powermanagement etc), and in those cases you have to edit module then program back, if other methods do not work (Like PRR/PRR2 tool, S3 sleep bug, variable edit etc)
Thanks!!!
And I tried to shutdown the locks you mentioned and the MEinfowin64 showed the same.
@DeathBringer
I had tried to set the "Me FW Image Re-Flash" on,and the result is below different from the above post.
This BIOS has one write protected range 0xFF0000-0xFFFFFF
It’s the reason of Error 28
@DeathBringer
Thanks!
I think error 28 is about bios lock and related locks.Error 28 is about Protected Range Register.Error 25 and 26 is about ME protected.
And could you tell me how to solve this problem ?
@gloobox
What’s your problem? Why do you need to remove this protection?
Just flash necessary part of BIOS only.
@gloobox Did you ever get your HP 800 G1 DM flashed. I have one too and was going to mod it but got distracted trying it on my HP Z220 instead and everything has been the same so far except setup_var was 0x68, 0x69, 0x6A, 0x6B, 0x6C instead of the HP 800s 0x96, 0x97, 0x98, 0x99, 0x9A, for flashing bios i did this.
1. fptw64 -I which should tell you bios address start. for HP z220 it was 0xA90000
2. fptw64 -BIOS -D backup.rom
3. mod and add NvmExpressDxe_4.ffs to backup.rom save it as modded.rom
4. use a hex editor like frhed to delete the end of the file leaving only first 0x55FFFF bytes
5. fptw64 -A 0xA90000 -L 0x55FFFF -F modded.rom
0xA90000 + 0x55FFFF = 0xFEFFFF
0xFEFFFF + 1 = 0xFF0000
and 0XFF0000 -> 0xFFFFFF = the write protected region.
reboot and dump bios again and open it in mmtool to see if nvme module is still there. It was for me.
I ordered my nvme drive and riser card but won’t be here till saturday to make sure it works. but i was able
to shut off computer and reboot just fine.
Got my riser card in today and a inland premium 1tb nvme ssd and I was able to boot from it. Bios would not see drive at all
until i cloned my os drive into it and converted it to GPT/UEFI using the mbr2gpt tool.
@gloobox for the HP EliteDesk 800 G1 mini bios starts at 0x580000 and the length should be 0x98FFFF
to avoid the protected region. 0x580000 + 0x98FFFF = F0FFFF
@dman79 Hi! Thanks for your tutorial on how to flash bios only and can i ask a quick question please?
I am trying to make my Hp EliteDesk 800 G1 mini to boot from a nvme and a little confused with the numbers for the BIOS length (as i believe you have indicated different in your post), would you mind having a look please?
I’ve made a fptw64 -I and it appears the BIOS starts at 0x580000 but i am confused in second parameter - lenth. If i am calculating correctly so the length would be A7FFFF in my case (0xffffff – 0x580000 = 0xA7FFFF). Can you advise please looking into my screenshots please?
Thank you!
Found my mistake in the calculations above, so continued in the HP Elitedesk 800 G1 DM mini PC - Nvme support info for ssd M2 (3)
But still, how can i understand the BIOS protected region range?
Dear @dman79 where the 0x980000 comes from?
@BigMax sorry I didn’t check my email until today. the math is pretty simple. You’re right that the length is 0xA7FFFF for the whole flash.
0x580000 + 0xA7FFFF = 0xFFFFFF
but the problem is that a region is protected so u can only write up to 0xFEFFFF since 0xFF0000 through 0xFFFFFF is protected
so he math is
0x580000 - F0FFFF = 0x98FFFF
so i did have a mistake. whoops I have edit i. and it should be 0x98FFFF for the lenght
luckily my mod didn’t go that far so reading it back was the same.
let me know if you understood. Sometimes my fingers and mind don’t cooperate together
@dman79 thanks a lot, i understand that clear, i just missed the protected region range so i thought i should reflash all dumped bios. looks of now so i will retry with 0x98ffff and post back here later today.
@dman79 do you have the modded bios for the hp z220 posted anywhere? i have a hp z220 cmt and would like to get nvme drive booting on it 