[TUTORIAL] AMI Aptio UEFI Advanced Menu Unlock - Bonus MSR unlock!

Discussion in 'BIOS Mods' started by JRandomHacker, May 7, 2014.

  1. JRandomHacker

    JRandomHacker MDL Novice

    May 7, 2014
    2
    19
    0
    #1 JRandomHacker, May 7, 2014
    Last edited by a moderator: Apr 20, 2017
  2. donovan6000

    donovan6000 MDL Novice

    Dec 29, 2010
    33
    13
    0
    Excellent work! :cool:
     
  3. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    652
    10
    It's certanly not so easy for BIOSes with another menu setup, but the whole idea is the same.
    I could also recommend trying AMIBCP to modify menu entries vilibility from "Default" to "USER", if your menu setup is more complex then a setup above.
     
  4. nexus76

    nexus76 MDL Addicted

    Jan 25, 2009
    788
    296
    30
    ASUS UEFI Setup

    Hi JRandomHacker,

    thanks for your guide.
    On my P8Z77-V LX there's an interesting menu which isn't visble, but according to your guide I can't enable this menu as it isn't listed in the form settings section.
    That's the menu I'd like to see :D

    Form: BIOS Security Configuration, Form ID: 0x41C {01 86 1C 04 29 01}

    Any ideas? IFR dump attached.

    best regards

    View attachment 28780
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    652
    10
    nexus76, this is exactly what i'm talking about. Just change access to USER for all menu folders in the tree with AMIBCP and you will see it. You know how to flash the modified file, I assume. :)
    View attachment 28781
     
  6. nexus76

    nexus76 MDL Addicted

    Jan 25, 2009
    788
    296
    30
    thanks!! :beer:

    View attachment 28782

    Coderush, is there any news about where/how to unlock nvram-write for osx? What is the 'Lock ICC Registers' option?

    About 0xE2 unlock, am I right enabling this menu entry called SENFE, it's the only value for 0xE2 found:

    View attachment 28785
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  7. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    652
    10
    Not all AMI BIOSes have "Unclock C-States Config" option available for setup, and that SENFE option has nothing to do with MSR 0xE2, I think.
     
  8. nexus76

    nexus76 MDL Addicted

    Jan 25, 2009
    788
    296
    30
    #8 nexus76, May 10, 2014
    Last edited by a moderator: Apr 20, 2017
    aha, the magic words 'C-State'

    Code:
    0xBFAEE         Setting: Package C State Support, Variable: 0x58 {05 A6 0D 01 0E 01 20 00 01 00 58 00 10 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
    0xBFB14             Option: Auto, Value: 0x0 {09 0E FC 00 00 00 00 00 00 00 00 00 00 00}
    0xBFB22             Option: Disabled, Value: 0x1 {09 0E FE 00 00 00 01 00 00 00 00 00 00 00}
    0xBFB30             Option: Enabled, Value: 0x2 (default) {09 0E FD 00 10 00 02 00 00 00 00 00 00 00}
    0xBFB3E         End of Options {29 02}
    View attachment 28787
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  9. JRandomHacker

    JRandomHacker MDL Novice

    May 7, 2014
    2
    19
    0
    If AMIBCP works on your BIOS use CodeRush's method for sure! Much safer and easier. I had to figure out how to do this manually as no version of AMIBCP I was able to obtain could successfully open my BIOS image. Maybe Dell's doing something funny or maybe it's due to the large size(8M)?
     
  10. nexus76

    nexus76 MDL Addicted

    Jan 25, 2009
    788
    296
    30
    yes, it's most likely an issue with non standard-compliance ;)
    I had simliar problems opening gigabyte ami roms.
    But it's not regarding the size, my ROM hast 8192KB too.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  11. donovan6000

    donovan6000 MDL Novice

    Dec 29, 2010
    33
    13
    0
    It's just a coincidence that the SENFE setting's value is stored at offset 0xE2 of the setup's variable storage. It has nothing to do with the 0xE2 MSR register.
     
  12. CMMChris

    CMMChris MDL Novice

    Aug 14, 2014
    1
    0
    0
    Hello everyone!

    I have a Chinese Intel Atom Z7340D tablet here which is using an AMI Aptio Bios. Unfortunately there is something wrong with the Intel TXE Firmware which is causing it to turn off every 30 minutes. A solution would be to disabe Intel TXE, but unfortunately the menu for this has been hidden by the manufacturer.

    I already tried unlocking the menus according to this manual, but the file is looking totally different. I already tried changing it and flashed it but had a brick afterwards. Was able to re-flash a backup via USB and the famous CTRL + Home combo.

    I now tried doing it with AMIBCP, but this tool is crashing while loading the ROM. So I will now attach my Setup IFR file for you to have a look at. Maybe someone has an idea how to unlock all the hidden menus.

    Thanks in advance!
    View attachment 30304
     
  13. GoNz0

    GoNz0 MDL Novice

    Feb 27, 2010
    40
    6
    0
    #14 GoNz0, Sep 8, 2014
    Last edited by a moderator: Apr 20, 2017
    Before I go and brick my motherboard I thought I would ask a question 1st.


    this is my ifr for my XPS 15 9503

    Code:
     Form Sets
    --------------------------------------------------------------------------------
    Offset:Title:
    --------------------------------------------------------------------------------
    0x4A17FMain (0x71 from string package 0x0)
    0x4A449Advanced (0x73 from string package 0x0)
    0x4AB66Intel (0xA5 from string package 0x0)
    0x4AC59Security (0x77 from string package 0x0)
    0x4BA0DBoot (0x79 from string package 0x0)
    0x4C2EFExit (0x7B from string package 0x0)
    0x4C538Main (0x7 from string package 0x0)
    0x5DC1AAdvanced (0x1D from string package 0x0)
    0x681A0Chipset (0x1F from string package 0x0)
    0x71E53Boot (0x21 from string package 0x0)
    0x72F5BSecurity (0x3C from string package 0x0)
    0x737F9Save & Exit (0x50 from string package 0x0)
    
    as expected it is the same as the 3800 listed by the OP.

    If I search for 01 01 00 01 01 01 it is found but the following is 01 not 00

    Code:
    01 01 00 01 01 01 01 00 00 00 00 00 00 00 00 00
    It says to me that I have main enabled twice?

    Is it safe to change it all to 01 01 01 01 01 01 01 01 01 01 01?
     
  14. lunlau

    lunlau MDL Novice

    Apr 18, 2013
    1
    0
    0
    Great! It is work for me my samsung 880Z5E.THANKS SO MUCH:p
     
  15. thune

    thune MDL Novice

    Sep 16, 2014
    1
    0
    0
    #16 thune, Sep 16, 2014
    Last edited by a moderator: Apr 20, 2017
    Hey. I've tried this on my AMI powered Asus laptop.

    This is what Universal IFR Extractor gives me:
    Code:
    0x1456D        
    Main (0x69 from string package 0x0)
    0x14746        Advanced (0x7C from string package 0x0)
    0x14BE3        Boot (0xBE from string package 0x0)
    0x15146        Security (0xC6 from string package 0x0)
    0x15815        Save & Exit (0xF0 from string package 0x0)
    0x15ACD        Main (0x6 from string package 0x0)
    0x189D3        Advanced (0x1C from string package 0x0)
    0x1B8A2        Chipset (0x1E from string package 0x0)
    0x1F266        Boot (0x20 from string package 0x0)
    0x1F702        Security (0x3B from string package 0x0)
    0x1FB03        Save & Exit (0x4A from string package 0x0)
    
    Only the first five show up in BIOS, so I went ahead and opened the PE32+ bin in a hex editor and did a search for 01 01 01 01 01 and I found something like this:

    Code:
    80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
    00 00 00 00 00 00 01 01 01 01 01 00 00 00 00 00 
    EE 2E 20 71 53 5F D9 40 AB 3D 9E 0C 26 D9 66 57
    
    So, after the last 01 group, there are only 5 groups of 00, and I need 6 (main, adv, chipset, boot, security, save..). I went ahead and edited it anyway, filled the five groups with 01, saved and made the changes to the bios image. I've flashed it with ASUS' WinFlash, but I was still getting the basic menu.

    What can I do? Thanks
     
  16. Muxuxi

    Muxuxi MDL Novice

    Oct 9, 2014
    5
    0
    0
    Hello guys, may this tut be used for Legacy Bios AMI? I set Lagacy standard for my lap although it supports both Legacy and UEFI. I am absolutely a newbie on this so sorry for this stupid question:p! Thanks in advance!
     
  17. mixmansc

    mixmansc MDL Novice

    May 15, 2008
    5
    0
    0
    No idea on Legacy although I plan to find out (mine is also in legacy mode but should be full uefi capable as well). Looking at this right now on the bios for a Dell Vostro 330 AIO. I have AMIBCP and that can open the file just fine and I can even set everything to "user" with AMIBCP save and install the edited bios just fine but none of the hidden menus get enabled with that method. That does enable a couple of options in the already enabled menus that were hidden though. So AMIBCP will not work. Looking at my bios I am going to have to dig some to determine the order of things. AMIBCP shows the menus in a different order than the extracted setup_whole_ifr so its going to take some digging to determine what the order will be that I need to search for. I did find one section but there are too many 00 bytes both before and after that section to know where it starts until I can determine what order the bin file actually shows them in. I'm assuming the same order as the entire setup module for now.

    Still a bit confusing and getting it wrong means bricking the system. One thing I'm going to determine ahead of time will be to try the Dell bios recovery and make sure I can recover the board if a bad bios gets flashed. This system came factory loaded with Win 7 Pro so the bios is currently in a legacy mode. I'd also like to determine if the bios is truly switchable between EFI and Legacy modes and finally might look closer at the MXM graphics module that is loaded in the BIOS. On this system Dell has a single optional discrete graphics option (ATI card) or the on board Intel graphics. I tried a higher end MXM card and the system rejects it (no video at all) which I'm assuming is because the single MXM driver in the BIOS is for a different model MXM card. The only one Dell offers is an ATI HD5470 (which I do not have) but I do have an ATI HD6770 from an HP laptop. I'd probably need to somehow find the dxe driver and its associated pei module though to add it to the Dell bios.
     
  18. tugyo

    tugyo MDL Junior Member

    Oct 11, 2014
    72
    0
    0
    thank you very much for you excellent work JrandomHacker.You are great ! :D:D
     
  19. tugyo

    tugyo MDL Junior Member

    Oct 11, 2014
    72
    0
    0
    i cant flash with your way "afuwinx64 bios_mod.rom /GAN"
    how can ı flash my modified bios ?