[Request]Maximus XI Hero - Unlock AMIBCP

BIOS/UEFI Modding BIOS Modding Guides and Problems
1

Hello folks,

I need an help to unlock in AMIBCP the bios of the Maximus XI Hero.
Actually I’ve got some experience modding a z390 master aorus but this problem with that board doesn’t exist. Seems like there is an encryption from asus, maybe?
If it’s possible I would like to have a guide to unlock those blocked bioses instead having the bios already done and ready to edit in AMIBCP.

AMIBCP Error



This is the bios that i would like to unlock
https://mega.nz/#!KdhXECKB!8-1M71BVAW5UK…rUmu8yoXLp5Y354

Others posts that i checked but with no solutions:
Error: AMIBCP 5.02.0023 language name present exceeds 0x08 in lenght
[Request]How to fix “Some BIOS strings exceeds the maximum length(0x400)” error to enable AMIBCP working?

2

@noNa23131 - There is no easy solution to this, when it’s an actual problem (rather than software version), as you can see in those threads.
Modules must be removed one by one and then test between each module, to find the offending module, then it must be inspected and edited at great length to find the cause (if even possible)
First you should remove each volume one by one, to find the offending volume, then go back to original BIOS once you find it, and remove each module one at a time within that offending volume.
In this case, it was easy to find the offending module (Setup PE32). This can be removed, then BIOS will open in AMIBCP, but all settings names/options will be empty due to setup missing

It’s much easier and quicker to just edit the BIOS without AMIBCP, anything done in AMIBCP can be done by hand at the AMITSE/SetupData module (body), except renaming BIOS options, that edit would need done in Setup PE32 or the GUID-00000 module in setup if there is split setup

I can’t download your actual BIOS above, Mega has not been working for me all week long. I did check stock BIOS for ROG MAXIMUS XI HERO (WI-FI) BIOS 1105, I assume this is correct Board/BIOS?
Latest AMIBCP 5.02.0031 has same issue, not sure if that’s what version you were using or not, so I checked on stock BIOS to be sure.

Do you need some specific setting edited? If yes I can tell you how to do it

3

Ok, I understand. I re-uploaded the file with mediafire so you shouldn’t have problem to download.

https://www.mediafire.com/file/f0yvnv5x8…XIHERO.CAP/file
It’s the non-WIFI version of the board.

I already extracted the PE32 with UEFITool and Universal IFR Extractor but I don’t have the knowledge to change to the correct values and repack it inside the bios.
The main settings I would like to change are “HPET” and every “Spread Spectrum” settings to OFF.

I am really interested to learn how to edit the values myself if you don’t mind to teach me.

Thank you, Lost_N_Bios.

4

@noNa23131 - Thanks for the reup.

On editing the setup PE32, I don’t know how to edit for this issue to fix either, this error is not same as the others you linked where a string total amount is exceeded
The error you have means there is too many forms (actual BIOS menus/submenus/pages etc), so you can’t easily just remove some of those and it be OK.

I can disable HPET for you, on Spread Spectrum what do you mean “every setting” Normally if you disable spread spectrum it’s disabled

For these settings, there is three main possible places to change them to enabled/disabled, and some BIOS use one or the other so you may need to disable in all areas or possibly only one, but you’d have to test one by one to find out which is used or just set them all at once.
Those are setup module, AMITSE/SetupData module (This is what AMIBCP changes), and finally NVRAM. NVRAM can have multiple volumes at top of BIOS (usually 1-2) and then 1-2 more in other BIOS volumes, usually at least one in same volume as setup module, and then 1-2 others at last volume.
And those NVRAM may not always hold same setting values as you search them out, so it’s tricky to mod sometimes

Setup edit is easy, you find the setting string in hex from the IFR, then you change which setting is default via hex. Here is example from IFR for your BIOS

One Of: High Precision Timer, VarStoreInfo (VarOffset/VarName): 0xA86, VarStore: 0x1, QuestionId: 0x634, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 E0 09 E1 09 34 06 01 00 86 0A 10 10 00 01 00} << Search this string on PE32 module, edit as below
One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00} << replace 00 in bold here with 30
One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 30 00 01} << This 30, move to above at same position, replace here with 00 - this is what controls "Default"

Actually, can you see “PCH Configuration” page in your BIOS at Advanced section? If yes, you can easily make this setting visible to you as well (This may require setup only edit, or setup + AMIBCP Access Level (AMITSE/SetupData Instead))
Setup edit is simple, unsuppress by making this edit, then it will be visible in BIOS unless setupData also needs edited to change access level to User/Supervisor (Which I didn’t show below ) - Added info pre-post, but it’s already set to visible by default there
Due to checking all this, I now can answer myself at above question, no you cannot see PCH Config on Advanced BIOS page

Suppress If {0A 82}
True {46 02} << Change this to 47 02 (= false)
One Of: High Precision Timer, VarStoreInfo (VarOffset/VarName): 0xA86, VarStore: 0x1, QuestionId: 0x634, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 E0 09 E1 09 34 06 01 00 86 0A 10 10 00 01 00} << Search this string on PE32 module, directly in front of it you will see above edit
One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 30 00 01}

Now, to edit AMITSE/SetupData, find this in main BIOS volume (Same one that contains setup), it’s usually near the bottom of the volume and often directly below AMITSE module.
Make sure you are extracting AMITSE/SetupData (body). You may need to look at BIOS side by side in UEFITool NE and regular, sometimes the AMITSE/SetupData module (at least SetupData itself) is not shown by name in regular UEFITool.
This side by side comparison will help you make sure you are extracting and replacing the correct module. I always use NE version for all inspections, extractions etc, it’s just easier to find due to often giving more info/names etc, and it auto gives you the correct name in full when you extract too
Once you’ve extracted the SetupData body, edit using info below

Using same setting as above for this example >> One Of: High Precision Timer, VarStoreInfo (VarOffset/VarName): 0xA86, VarStore: 0x1, QuestionId: 0x634 << this is what we’ll hunt down here (backwards in hex so = 34 06)
Open the SetupData body module in hex, search (Find all) that QuestionID backwards in hex 34 06, last result will hold the failsafe/optimal settings that you change in AMIBCP. The setting bytes are 34 bytes past the ID, so bytes 33 and 34 are Failsafe/Optimal
To change “Access Level” is 0xF (15) bytes past the ID >> Type - Access Level / Show Yes/No - DEFAULT = 00/No - 01/Yes (08/No - 09/Yes) USER= 04/No - 05/Yes (or 0C/No - 0D/Yes) Supervisor= 06/No - 07/Yes (Or 0E/No - 0F/Yes)
Default = 29 (Yes) / 28 (NO) / User = 2D (Yes) / 2C (NO) / Super/Admin = 2F (Yes) / 2E (NO)
Here is image example of this for the above setting, both are currently set to 01 (enabled)

AMITSE-SetupData-Edit-Instead-Of-AMIBCP2.png



NVRAM edit is too many areas and too involved to explain/show without making out an in-depth guide. Hopefully you will not need this.
If you do all of above and it still is enabled, then let me know and I can mod the NVRAM for you

1 Like
5

Huge post, pretty clear. One thing Im not understanding : Using same setting as above for this example >> One Of: High Precision Timer, VarStoreInfo (VarOffset/VarName): 0xA86, VarStore: 0x1, QuestionId: 0x634 << this is what we’ll hunt down here (backwards in hex so = 34 06) How can you get that value? I tried some decimal to hex converter but the value they gave me is completely different. If QuestionId : 0x871 what would it be in hex?
How did you check the length of the hex code that you are editing?

Hex edit is fine. I’m trying this with the z390 master aorus because I can actually see if the bios is fine.
Still no success. Actually managed to put Disabled and Disabled in both spaces and set one of the two values in default mode but somehow the bios still start the HPET because I’m missing the editing in setupdata.

Thank you for the help till now.

6

@noNa23131 - This is just how this BIOS stuff works, it’s not something you need put in some converter and get a value, well you can but it’s not needed. This is hex to little endian in hex (hex value for 0x634=0634) 0634 >> 3406 (Last byte first, first byte last)
You can get value here if it confuses you still, look at INT16 Little endian at bottom row, second from left. Put in data on top, analyze, then check at INT16 Little Endian. You can leave off the added/leading zero if you want too, if that makes it less confusing? Result will be same/same

QuestionId : 0x871 hex value is 0871 then little endian >> 71 08
If, for example QuestionID was 0x1871 >> 71 18 (Maybe that makes it less confusing?) It’s mainly just “backwards/reverse”, that’s the easiest way to think of it when this applies and is used in this fashion

https://thebittheories.com/little-endian…an-b4046c63e1f2

Don’t put disable/disabled in both spaces in a setup edit, that may mess up or invalidate other things. Undue that, then carry on

7

Thank you very much. It’s working. <3



Sorry for double post,
Even if i edit correctly the amitse_setup_data and PE32 image it still remains enabled even if amibcp sees that it’s disabled.
If i disable via amibcp it works but if i disable manually with hex editor it is still enabled even if amibcp sees that it’s disabled.
This is going to be tricky.

8

Some settings you can only disable in either one or two of the three possible places (NVRAM and all it’s possible locations, Setup Module, AMITSE/SetupData), some you can only do in one or it cancels itself out like you mention. Some may require all three, so yes, it’s tricky sometimes.
Best way to go about it is first, test AMIBCP edit (in this case we can’t, so test changing what AMIBCP does instead >> AMITSE/SetupData). If that fails to make desired setting change occur, undue this change, or use stock/FPT dump again, then do setup module only change.
If both those fail, then undo both/use stock or FPT dump, and edit NVRAM only.

Only AMITSE/SetupData edit will show a visible change in AMIBCP, when you can use AMIBCP Such as changing a default setting from enabled to disable etc.
Changes to setup module will not be shown at AMIBCP, since it reads the AMITSE/SetupData module only for setting values (names shown in AMIBCP come from setup)

In this case, any edit you make to AMITSE/SetupData cannot be checked in AMIBCP, since you can’t open AMIBCP on this BIOS, so your entire last post contradicts the reason for this thread and makes this all very confusing
But, the idea/anomaly is true and happens on some BIOS or some settings, depending on where the BIOS actually pulls the data from that is displays or uses.

If you could use AMIBCP, as an example, your last comment would also not be true if you are talking about AMITSE/SetupData Edit only, at least this line >> If i disable via amibcp it works but if i disable manually with hex editor it is still enabled even if amibcp sees that it’s disabled
Although, that comment you made is not very clear, so I could just be reading it wont. You don’t define what “it works” means, setting is actually changed, or you can see the setting is changed in AMIBCP, or you also don’t define in that comment if you are also editing setup too.
Disabled by AMIBCP = same/same as Disabled by Hex at AMITSE/SetupData (only), no difference in either of those edits at all, if done correctly.

9

Yeah, sorry. I didn’t explain the situation.
I’m asking for editing the XI Hero bios but I’m actually testing all the hex editing to the z390 Master Aorus bios because I can actually see if the changes works via AMIBCP.
I managed to edit values correctly with UEFITool_NE/UEFITool/Universal IFR Extractor but even if everything is right, if I flash the Hex edited bios HPET still remains Enabled even if AMIBCP says that is Disabled (PE32 Image and Setupdata edited). If I flash the AMIBCP edited bios hpet is off
So I have to check the NVRAM module and edit it in the same way you told me to do with AMITSE Setupdata? Editing the latest values N. 33 and 34 from 01 01 to 00 00 ?

I am trying to edit the z390 master aorus bios because i haven’t got in my hands the XI Hero. I’m waiting the motherboard and till that moment I am testing how to edit a bios without using amibcp but actually testing if the changes works somehow in the master aorus bios before editing the XI Hero bios.

10

@noNa23131 - XI Hero and z390 Master Aorus are not even from same brand, so anything I’ve mentioned may only apply to the BIOS you initially asked me to look at, not all BIOS are done in the same way.
Your bold comment contradicts itself, so still confusing. Are you flashing same way each time? Are you loading optimal defaults after each flash?

If you make some change with AMIBCP and the resulting outcome is your desired thing (ie success), but then you edit AMITSE/SetupData and the resulting outcome is not the same, then you didn’t do the edit properly, these are same exact edits and only this.
Sounds like this is the issue, something in your manual edit is off. It may be this >> Setup PE32 edit is not required and should not be done if AMIBCP edit gives you the desired outcome, editing both can conflict and cancel each other out. Only edit one or the other.
At first you can edit both ways in separate test BIOS, then test each, and then you will know which one is require per that BIOS being worked on right then.

No, NVRAM editing has nothing to do with, and is not like editing AMITSE/SetupData at all. And, you do not need to edit NVRAM if AMIBCP edit gives you what you want, problem is solved there.

If your goal for now is testing BIOS edits on the z390 master aorus BIOS, and AMIBCP edit gives you desired outcome, but your manual edit without AMIBCP does not, then your manual edit is being done incorrectly.
To see where you went wrong. Take two clean BIOS, edit one with AMIBCP only, name it AMIBCP only so you know. Edit the other at AMITSE/SetupData (Body) ONLY, save it and then and then name it so you know it was edited manually.
Then extract AMITSE/Setupdata (body) from each one, name each AMITSE/Setupdata file so you know which is which, and compare in hex, you will see the error immediately. If you still can’t figure it out, send me these two test BIOS I told you to make in this example, I will show you what’s wrong.

11

there is a version for z390 of amibcp

12

@pipes80 - What exact model, so I can check BIOS and let you know.
I can maybe send you edited version of AMIBCP, that you can use for inspection/looking around, but this should not be used for editing if BIOS does not open properly in the non-edited version, all edits should be done manually as outlined and explained above in post #4
If you need me to do a manual edit for you I can, just let me know.

1 Like
13

It’s a version Ryan work on chipset z390, but i can try of work fine or not

14

@pipes80 - Ryan and Z390??? If you meant Ryzen and Z390, this is unrelated, but do not matter for AMIBCP
What is the model, link me to the BIOS download page. If I send you edited AMIBCP, it will work, but you can’t and should not edit BIOS with it, for two reasons.
One, it will crash on save if you do not remove all strings except English, and two, even if you do remove all strings except English first, it still makes incorrect and additional changes to settings more than what you intended to make.
So, this edit version is ONLY good to view BIOS, look around at settings etc, you should not make ANY edits with it, or use any of the edited modules from an edited/saved BIOS made with it.
It’s for inspection and testing only If you understand all that are still want, let me know I will send to you.

Any edit you need to make to a BIOS that you can’t open in other AMIBCP, you will need to do manually instead, it’s very easy to do this yourself, if you cannot understand how to do from above info let me know and I can do the edit for you.

15

Sorry it’s phone corrector, i don’t Need of mod my mai z490 unify, there are many parameter undefinied.
It’s for thread user that ask a version that work on z390.
I want understand Joe can enable gestire, today when i put on my PC want understand sell Joe can do

16

@pipes80 - Ohh, I thought for you. 5.02.0023 and 5.02.0031 both work for Z390 BIOS, but if you just see undefined options or odd language not normal names, nothing you can do to fix that until we find new leaked more up to date version.
The edited version I was talking about only helps for BIOS that you can’t open in AMIBCP to begin with, or more directly, for BIOS that do not show setup menu/tab (due to error >> too many strings, setup will not be shown)
I do not understand your last sentence, please explain differently.

Do you need some setting changed? If yes, link me to BIOS and tell me what you want changed, and what you want it changed to, I will show you how to do manually or do it for you if you want.

17



I think i’ts all unlocked, watch ifr extracted

setup_extr.zip (344 KB)

18

@pipes80 - Sorry, I am not sure what you are doing above, what you want me to look at etc? I don’t need to see IFR, I need link to BIOS and you tell me what setting you what changed, and what you want it changed to, I will change the default value for you so it’s always what value you want applied.
Or, you can make a thread for this exact model, and I can unlock the BIOS menu for you, then you can see and change the setting directly anytime right in the BIOS.

19

I had open a thread but no take answer. 'll try again

20

@pipes80 - Sorry if I missed thread you had opened! I get behind here quickly, and stuff is buried by new posts much quicker than I can keep up with, so sometimes I can’t answer in all threads