AMI unlock to flash your modified ROMs [works on Intel Series 7]

Discussion in 'BIOS Mods' started by nexus76, Sep 28, 2013.

Tags:
  1. nexus76

    nexus76 MDL Addicted

    Jan 25, 2009
    788
    296
    30
    #1 nexus76, Sep 28, 2013
    Last edited: Jan 21, 2014
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    652
    10
    #2 CodeRush, Sep 28, 2013
    Last edited: Sep 28, 2013
    Tested by jjxaker@overclockers.ru, works on ASUS Z87 boards, but individual data transfer with FD44Copier/FD44Editor is still required for ASUS boards. BIOS regions, that are locked for write access will not be reflashed by the method, but it can be bypassed via HDA_SDO pinmod.
     
  3. nexus76

    nexus76 MDL Addicted

    Jan 25, 2009
    788
    296
    30
    #3 nexus76, Sep 28, 2013
    Last edited: Sep 28, 2013
    (OP)
    Even if we unlock PchInitDxe.ffs before flashing with this method?
    I'd suggest flashrom or fpt -rewrite will flash everything then.
    CodeRush, I'll extend the thread with your unlock method.

    Right, it doesn't update all regions. I'm trying to patch afuwin to jmp anyway.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    652
    10
    Nexus76, there are 2 types of protection, that can be on: locked descriptor and SMI-based checks.
    The first is old and easy to bypass if you have access to HDA chip on your board, but it's totally unrelated to modified BIOS flashing, because it locks regions other then BIOS: ME, GbE and descriptor itself.
    The second one is made on about 6 months ago (but was implemented and ready to be enabled in 2011) and protects BIOS region from flashing with "unauthorised" tools like FPT or flashrom. Your awesome finding, that /GAN key that was hidden since ages, can bypass that "new" lock, making flashing of modified BIOSes possible for people without programmers or USB BIOS Flashback.
    The interraction between both locks must be further tested, but please return your message about /GAN to the first post - it's much more valuable, then my PchInitDxe method, because it makes this art of patching unneeded at all.
     
  5. nexus76

    nexus76 MDL Addicted

    Jan 25, 2009
    788
    296
    30
    #5 nexus76, Sep 30, 2013
    Last edited by a moderator: Apr 20, 2017
    (OP)
    CodeRush,

    that's the problem, I wasn't able to unlock the board with amiflash /GAN switch.
    We need to further investigate what this switch does.

    The "Updating All Block" does a very short job:

    Code:
    erasing   1000h - 113000h (?)
    updating 105000h - ?
    verifying ~107000-7fa800
    and repeatedly different areas, started 3 times and three different results using the same ROM.

    As long as we don't know which regions get flashed by this switch exactly it's not a useful info. Even main bios block does not get flashed.

    I don't want someone using the switch resulting with a dead board (bios) condemning me for false info.

    At least I wasn't able to remove the flashlock this way on my Z77 board.
    That's why I removed the info - I'm not a poser, just wanna present relevant info that's valueable plus applicable.
    Do you have positive feedback, someone who unlocked the BIOS?

    Btw I was spending the night from saturday to sunday reverse engineering afu and found out a few things inverting jumps from 7c to 7e and 74 to 75, 00 84 to 00 85 and so on:
    afuwinx64.exe

    Code:
    19f3 : ignore capsule
    1c05h : ignore capsule
    2b74h : unable to access port
    3d26h : Power Write DCValueIndex data failure
    3d62h : Power Write ACValueIndex data failure
    3d86h : PowerSetActiveScheme failure
    4047h : PowerReadACValueIndex data failure
    4088h : PowerReadACValueIndex data failure
    40c5h : Power Write ACValueIndex data failure
    40ffh : Power Write DCValueIndex data failure
    4123h : PowerSetActiveScheme failure
    74e4h : Error: ROM file ROMID is not compatible with existing BIOS ROMID
    8781h : exit / quit
    Anywere in between I would have been even able to read and flash but it stopped telling me the ROM size doesn't match using the 8192 kB bin file.
    Maybe it would have been possible to use a patched capsule file here. AFU holds 1631 test routines, that's a monster job ;) ...
    http://forums.mydigitallife.net/vb4_style/smilies/sorry.gif But at 5:00 am I was was slightly too tired due to a © brain buffer overflow to figure it out at this time.
    I need to work it out furthermore.

    This would be the best option to flash any ROM from my point of view.
    There's a lot of code for verification inside and some outsb and outsd function to get or set registers via dx.
    I think the best option was to invert the SMI check and load the unlocked status module anyway (int 0x21?).

    best regardz
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    652
    10
    #6 CodeRush, Sep 30, 2013
    Last edited: Sep 30, 2013
    Will test in 2 days and report.
    UPD:
     
  7. nexus76

    nexus76 MDL Addicted

    Jan 25, 2009
    788
    296
    30
    #7 nexus76, Sep 30, 2013
    Last edited: Sep 30, 2013
    (OP)
    it's modded and flashunlocked? I'm stunning now :eek:
    ok, I'll downgrade to an earlier release and test it again now.
    Maybe my problems were caused cause of using the same version!?!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    652
    10
    I wasn't unlocked but definitely modded.
    And I have more reports from ASUS Z87 owners, that rightly prepared file (FD44Editor to add individual data and remove capsule header, OROM Replace to update OROMs and EFI drivers, FITC to update ME and GbE regions, etc.) can be flashed on locked BIOS and works after reboot with all things updated and modified.
     
  9. nexus76

    nexus76 MDL Addicted

    Jan 25, 2009
    788
    296
    30
    #9 nexus76, Sep 30, 2013
    Last edited by a moderator: Apr 20, 2017
    (OP)
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  10. nexus76

    nexus76 MDL Addicted

    Jan 25, 2009
    788
    296
    30
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  11. nexus76

    nexus76 MDL Addicted

    Jan 25, 2009
    788
    296
    30
    #11 nexus76, Oct 3, 2013
    Last edited by a moderator: Apr 20, 2017
    (OP)
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  12. nexus76

    nexus76 MDL Addicted

    Jan 25, 2009
    788
    296
    30
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  13. nexus76

    nexus76 MDL Addicted

    Jan 25, 2009
    788
    296
    30
    #14 nexus76, Jan 19, 2014
    Last edited: Jan 20, 2014
    (OP)
    reports

    Coderush tested it on ASUS Z87 Plus ;) , I tested it on my P8Z77-V LX, but every feedback about your results
    is very appreciated and recommended.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  14. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    652
    10
    It was SoniX aka LS_29 who had tested it on Z87+. :)
    And it produces empty NVRAM.txt file on my Zotac Z77ITX, so it definitely need more testing, especially on non-ASUS boards.
    But it's the only unlock method we have that needs no flashing, so if it works - it rocks. :cool:
     
  15. nexus76

    nexus76 MDL Addicted

    Jan 25, 2009
    788
    296
    30
    Thanks for your feedback, it's most likely a question of AMI standard compliance too.
    I'm not sure if it would work flawlessly on Gigabyte. At least ASUS is the best-selling vendor ;)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  16. Tito

    Tito Super Mod / Adviser
    Staff Member

    Nov 30, 2009
    17,499
    15,289
    340
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  17. e.v.o

    e.v.o MDL Novice

    Aug 28, 2015
    8
    0
    0
    #18 e.v.o, Sep 1, 2015
    Last edited by a moderator: Apr 20, 2017
    It's not a brain fart, just look at the Release Note:
    Code:
    Release Notes
    ==============================================================================
    3.07.00/5.07.00
    [AFU][Modify]
    01.Modify disable all hide commands.
    I think it says "hidden".. so 3.06 is the latest flasher with /GAN support
     
  18. Tito

    Tito Super Mod / Adviser
    Staff Member

    Nov 30, 2009
    17,499
    15,289
    340
    @e.v.o

    Thanks; anyway to get those?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...