I'm trying to unlock the hidden pages in the Insyde H2O bios of an Acer TimelineX 5820T. The BIOS setup looks pretty decent in this computer as it is, but the fan goes off too early (40ºC) and I'd like to be able to tweak the thermal trip points. My progress so far: Using Marcan and D6Z's scripts, I've been able to dump the setup bytecodes and the SetupUtility PE itself (attached). I confirmed that the two hidden forms are there! I was hoping a "Suppress" opcode that would show/hide the forms based on some variable from the NVRAM, but both forms appear to be renderable unconditionally. In other words... no obvious tweak at the bytecode level and time to pull out the heavy weapons: IDA. I disassembled the SetupUtility PE and located the offsets of the 7 forms (Main, Exit, Boot, Power, Security, Advanced, Information). I tried to trace where these offsets are referenced from, looking for a big fat "CMP/JZ" that would exclude the two menus, as suggested by rajkosto in this thread: " h t t p://forums.mydigitallife.net/threads/23762-ACER-5742G-BIOS-modding-(unhidden-pages-enabled-UEFI-BOOT), but... NOTHING. Any clue or advice? I've seen a number of people who have reversed the Setup tool... How do you guys do it?? Manually tracing through a static disassembly is just hell...