[TUTORIAL] AMI Aptio UEFI Advanced Menu Unlock - Bonus MSR unlock!

Discussion in 'BIOS Mods' started by JRandomHacker, May 7, 2014.

  1. mixmansc

    mixmansc MDL Novice

    May 15, 2008
    5
    0
    0
    #21 mixmansc, Nov 8, 2014
    Last edited by a moderator: Apr 20, 2017
    Well I'm stuck in the same spot a few others seem to be. I have easily found the information and even the string but on my machine the IFR menu file shows 11 menu options. However the string in the hex editor does not have enough space after the menus that are enabled. To put eleven 01 in there I'd have to overwrite fields that are not currently 00 or 01.

    My IFR shows these as the form sets

    Code:
    Form Sets
    --------------------------------------------------------------------------------
    Offset:Title:
    --------------------------------------------------------------------------------
    0x1E0A2Main (0x5D from string package 0x0)
    0x1E2FBAdvanced (0x5F from string package 0x0)
    0x1E811Intel (0x91 from string package 0x0)
    0x1E894Security (0x61 from string package 0x0)
    0x1EBA7Boot (0x63 from string package 0x0)
    0x20C38Exit (0x65 from string package 0x0)
    0x20DA7Main (0x7 from string package 0x0)
    0x20F8FAdvanced (0x1B from string package 0x0)
    0x236EBChipset (0x1D from string package 0x0)
    0x245B1Boot (0x1F from string package 0x0)
    0x248D8Security (0x30 from string package 0x0)
    0x249DDSave & Exit (0x3E from string package 0x0)
    but the hex view of the string has this...

    Code:
    20 89 40 00 00 00 00 00 16 00 00 00 00 00 00 00
    00 00 00 00 00 00 01 01 00 01 01 01 00 00 00 00
    1C 76 40 00 00 00 00 00 14 76 40 00 00 00 00 00
    The correct menu string is there in the middle line 01 01 00 01 01 01 which corresponds to the first 5 menus in the list. I have also confirmed that those are the exact menus enabled in the Dell bios. I want to enable the last 6 menus in the list but there are only four more 00 fields after the current active menu string or I'd be changing the first two bytes on the next line 1C 76 which I dont think I'm willing to try....

    Anyone have any clues? I see others have run into this exact thing but I've not seen anyone say if they figured it out. Of course I can change everything in AMIBCP to "user" but that has no affect on anything except one option in the already enabled menus that was hidden does become visible.
     
  2. mixmansc

    mixmansc MDL Novice

    May 15, 2008
    5
    0
    0
    Ok. Figured it out. Looking at the order of the menus in the text file and comparing them to the order of them in AMIBCP I determined that they just had the order of the files mixed up. The more restrictive Dell menu options are listed first in the IFR however those 5 are the last 5 in the actual hex code. I went for it and made the first 6 bytes of that line 01 as well as the one Intel menu that was 00 in the middle of the Dell menus. Saved it all out and flashed it and bam. Worked perfect. All menus are enabled and working now. :biggrin:

    In fact digging into the advanced menus I'm seeing an insane amount of options. Many that I have never seen in 20 years of working on computers and literally having built hundreds and worked on thousands! This is on a Dell Vostro 330 All in One Desktop which is pretty much a laptop internally. Now I'm going to go back through and re-disable some menus that are not needed like the duplicate main, the Intel menu (there is nothing there), etc. I'm also feeling a little more confident in looking at updating the CPU microcode dxe package now as well as looking at adding support for additional MXM video cards.
     
  3. Kaliers

    Kaliers MDL Novice

    Nov 18, 2014
    6
    0
    0
    Thanks for this good tutorial.

    However, i face a problem that i'm not able to resolve.
    I've got almost the same menus as yours in the setup module and an another menu in the oem setup module.
    It seems that it's the second menu who is activated and, unfortunately, there's no advanced option there.

    So, the least we can say is that i'm extremely confused. o_O
     
  4. akspa420

    akspa420 MDL Novice

    Feb 6, 2010
    13
    4
    0
    As for the security error that causes you to need to force the bios flash, I believe the issue is two-fold - all UEFI binaries have both a CRC and are signed with a digital certificate, of which both become invalidated when you edit the binary. The setup menu is one of these binaries. If you were able to re-sign the binary and change its CRC in the file header, you would likely be able to flash the bios normally. There may also be a way to patch the bios flash routine in the rom so that subsequent bios flashes can be performed within the bios itself instead of needing to flash the rom within Windows.
     
  5. passion4tech

    passion4tech MDL Novice

    Sep 1, 2014
    45
    0
    0
    I am having trouble upgrading the cpu on my hp touchsmart 300-1025 pc. I want to upgrade the cpu from an amd athlon II X2 240e to an amd athlon II X4 615e. So I install the 615e in the computer then I power on the computer and then after hp logo screen an error message appears saying "error unsupported cpu installed". That does not make any sense. The 615e is an AM3 cpu and 45w just like the 240e. The 615e should absolutely work on this computer. I need somebody to mod the bios for this computer to make the 615e work.

    Oh and before anybody asks, I already tried updating to latest bios from hp and it still did not work so the bios needs to be modded. I would really appreciate it if someone can mod the bios for me :)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. passion4tech

    passion4tech MDL Novice

    Sep 1, 2014
    45
    0
    0
    Anyone please help me?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  7. passion4tech

    passion4tech MDL Novice

    Sep 1, 2014
    45
    0
    0
    Someone help me please?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. passion4tech

    passion4tech MDL Novice

    Sep 1, 2014
    45
    0
    0
    How do I mod the bios to get the 615e to work?
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  9. tugyo

    tugyo MDL Junior Member

    Oct 11, 2014
    72
    0
    0
    it can be great if we can unlock the submenus of the advanced menu im working on it and i will not reach sucess with high posibility :)
     
  10. MANN12

    MANN12 MDL Novice

    Jan 29, 2015
    2
    1
    0
    #31 MANN12, Jan 29, 2015
    Last edited by a moderator: Apr 20, 2017
    Sorry for the old quote but I'm in the exact same situation, I thought that by using AMIBCP I could figure out if the menu was in a different order and modify the previous bits just like mixmansc did with his bios but as JRandomHacker said it's not possible to open some DELL bios with it.
    Is it possible to use other tool to check for the order of the menu? After everything I've read here I would assume there's more chance of getting the advanced options by changing the previous bits which are all 00 like it's supposed to be since none of the other menus like the second main are enabled. I really don't want to guess and if someone can give me some input or point me in the right direction I'll
    appreciate it.
     
  11. MANN12

    MANN12 MDL Novice

    Jan 29, 2015
    2
    1
    0
    #32 MANN12, Jan 31, 2015
    Last edited by a moderator: Apr 20, 2017
    After doing some simple research I found that the bits that need to be changed are as follow (the intel menu can be enabled but it's empty):
    Code:
    20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
     01 01 00 01 01 01 01 01 01 01 01 01 01 00 00 00 
    EE 2E 20 71 53 5F D9 40 AB 3D 9E 0C 26 D9 66 57
    
    I don't know what the "rogue" bit is for but I do know that the full not crippled menus are the following 6 bits.
    Most available settings work as supposed to but there are some that even through can be changed they don't work and go back to their original state after all.

    This is my ifr:
    Code:
                                       Form Sets
    --------------------------------------------------------------------------------
    Offset:Title:
    --------------------------------------------------------------------------------
    0x37FD9Main (0x67 from string package 0x0)
    0x38295Advanced (0x69 from string package 0x0)
    0x3882CIntel (0x9B from string package 0x0)
    0x3891FSecurity (0x6D from string package 0x0)
    0x3947ABoot (0x6F from string package 0x0)
    0x39D36Exit (0x71 from string package 0x0)
    0x39F7FMain (0x7 from string package 0x0)
    0x44D5DAdvanced (0x1D from string package 0x0)
    0x4B017Chipset (0x1F from string package 0x0)
    0x52834Boot (0x21 from string package 0x0)
    0x53800Security (0x32 from string package 0x0)
    0x54028Save & Exit (0x46 from string package 0x0)
    
    As it can be seen the order of boot/security is inverted, this was the key to find out that an extra bit must be enabled to get save & exit safely and that the last bit after the "regular" menu was for something else. I actually removed the last bit of my first modded bios to make sure security disappeared before going forward and take the least risk possible. This was done on a dell inspiron 14z for reference.
     
  12. qjack

    qjack MDL Novice

    Feb 3, 2015
    1
    0
    0
    acer veriton 2110g

    thanks for this! :clap:
    works fine with acer veriton 2110g.

    for modded bios pm me.
     
  13. m8mbl

    m8mbl MDL Novice

    Feb 7, 2015
    1
    0
    0
    the /GAN option no longer works in AMI Firmware Update Utility v3.07.00 is there an alternative? or can someone post me a link to the old version.

    Thanks
    Bun
     
  14. gregor1230

    gregor1230 MDL Novice

    Feb 20, 2015
    1
    0
    0
    Hi,
    Please somebody help me with enabling hidden options in msi gt 80 bios. I am using amibcp tool 4.55 versio it is reading bios correctly however during save operation I receive error.

    Please help me :).
     
  15. K1R1LL

    K1R1LL MDL Novice

    Dec 27, 2016
    1
    1
    0
    #36 K1R1LL, Jan 14, 2017
    Last edited by a moderator: Apr 20, 2017
    Didn't wok for me. I have Dell Alienware X51 R2 with i7 4790, H87 chipset and AMI BIOS with Alienware skin.
    There are two sets of menus in setup module. The first ones are AMI standart and second ones are Alienware's, they are shown in BIOS setup.

    Code:
    Form Sets
    --------------------------------------------------------------------------------
    Offset: Title:
    --------------------------------------------------------------------------------
    0x42830 Main (0x6)
    0x528E2 Advanced (0x1C)
    0x5B18C Chipset (0x1E)
    0x6629A Boot (0x20)
    0x66B28 Security (0x3B)
    0x671D8 Save & Exit (0x4F)
    0x6745F Main (0x6)
    0x6778D Advanced (0xBB)
    0x6829A Security (0xB0)
    0x685F7 Boot (0x20)
    0x6F1A8 Exit (0xC4)
    I found boolean sequence 00 00 00 00 00 00 01 01 01 01 01 and changed it to 01 01 01 01 01 01 01 01 01 01 01. And it for some reason didn't work - no additional tabs are shown now. I also unlocked some options in AMIBCP from the Alienware tabs and it is worked for me.
    So now I absolutely don't know how to unlock at least Chipset tab. May be there are limit for tabs shown in BIOS or they are controlled by other module (maybe SimpleClickBIOSUI?)?
    So I hope there are people with more experience which can help me.
     
  16. norocel

    norocel MDL Novice

    Jan 31, 2017
    5
    0
    0
    #37 norocel, Feb 6, 2017
    Last edited: Feb 6, 2017
    Alienware 15 r1 with intel i74710hq and intel HM87 Lynx point and 4k screen . would this work for mine ? Ami bios here too , no ideea what version this is , if anyone willing to help I can compensate your time .
    I just need to get to DVMT option , that is what I need most .
     
  17. davidleee

    davidleee MDL Novice

    Jul 8, 2017
    1
    1
    0
    IFR Extractor says Unknown. What should I do?
     
  18. THEBOSS619

    THEBOSS619 MDL Novice

    Sep 20, 2017
    4
    3
    0
    Thank you! it is working on my laptop! , I followed the procedure but there was a little difference here and there but I sorted it out :) , Thank you again!

    I have got ASUS ROG GL552VX skylake cpu :)
     
  19. feastapollo

    feastapollo MDL Novice

    Oct 15, 2017
    1
    0
    0
    Where exactly is the module we're looking for? I think that I've might found one, but the problem is that the IFR Extractor can't open it.
    Maybe someone could help me put locating the "correct" setup module, or maybe someone can upload a file ready to install with already edited hex value.

    Thanks in advance.