HP Pavilion g4-1012tx [UNLOCK ADVANCED OPTIONS]

[Lost_N_BIOS]

What didn't work? What did you do, what did you do after that?

I am still looking for unlocking the Protected Range Register for you (Deathbringer, can you help? If yes, show me in PM location via assembly if you don't mind.) If you simply meant you cannot unlock the FD, here is BIOS with unlocked FD. Sometimes after you unlock FD, you will be able to write to the BIOS region with protected range register enabled, but I doubt it in this case since your FD was already unlocked for read/write to the BIOS region.
https://www.sendspace.com/file/adxkba

I remember one thing you can test, a bug, to see if it's still active on your system. Put the system to sleep (S3) and then resume after few minutes, then test flash via FPT again and see if you still get error 28 Protected Range Registers or not.

[kenkit]

I've just restored my backup and it booted.
with the one you sent.The laptop starts with blank screen. Also the harddisk doesn't show any activity.
I think we can try again. I'll try looking for a connector to connect the chip to so I won't have to desolder it all the time.
I think we were this close since It first started as it would've when I remove the cmos chip.
Phew! I had accidentally connected the chip in reverse twice. Luckily this was on the programmer. But all seems good.
I'll be available again as from 9pm to try again. You can checkout my profile so you know my timezone.
Also from 9pm I can mess with this untill around 2:30am and some few hours in the morning.

[Lost_N_BIOS]

Thanks for explaining what you meant! So when you wrote that BIOS, did you verify after? If yes, then that method of modification wont work for your BIOS, I will try another.

Yes, it's always safe, you can always recover now with your backup since your programmer is working, so don't let a failed flash worry you

I will figure out the protected range register lock FLOCKDN, I think I found it now. Please test above method of flashing via FPT after sleep, use your current backup image to flash with

Of course, none of this matters if I can't figure out the actual BIOS mod anyway for you, since first method failed. Also, please post an image of your current BIOS, so I can see all tab/sections you have visible.

And, here is test BIOS with FLOCKDN bit cleared (PRR-Protected Range Register removed), I hope. This has no other mods, built from your current backup dump, with only this single bit change
https://www.sendspace.com/file/ebengy

Test programming the above BIOS, then once in windows, try flashing again with FPT. Use this BIOS again, so lock stays unlocked, this is only meant as test, to see what if any errors show up in FPT. Use this command >> FPTw -bios -f W25Q32BV_FV_4MB-PRR-FLOCKDN-Unlocked.rom

Sorry, forgot to add -bios above for FPT, we only need to test -bios region to see if lock is still there or not.

You may need to unlock SMM again in grub, before flashing via FPT, to get to the same point you was previously with error 28 and your bios region dump test attempts

[kenkit]

I'll try the file you sent when I come back later in the evening.
Srry I also work on sundays. In the meantime I'll try looking for a connect to make this work easy. My programmer uses connectors which I pulled from some old mobos.

[kenkit]

Yeah, I verified and got a few errors which in my case doesn't happen often with this programmer. But I erased and wrote it back again, the verified twice just to be certain.
Also with the original dump did the same so I repeated the above.
I guess I am lucky we didn't read an incorrect dump since we would never know if the original dump is bugged with errors

[Lost_N_BIOS]

Please see my edits above, refresh page. Also, on the mod BIOS failure, since you mentioned you verified and got errors, that means it's not a verified write and that may be the sole cause of the failure to boot. Once you have time, after testing this lock removed BIOS above, try the mod again later and only attempt booting on any BIOS once you write and get a verify without error, otherwise it's a failed write and of course will not boot 99.9% of the time.

[kenkit]

I made sure to verify the chip against the file you sent before testiing it on the laptop. [I mean I wrote in then verified without error] I had to write it back again since the first time it failed to verify,
I wouldn't replace the chip not unless I was certain the contents of the chip matched the file.
Also I am supposed to program file with unlocked FLOCKDN bit cleared (PRR-Protected Range Register removed) via the programmer then try programming the original dump via fpt ?

[kenkit]

It wasn't a failed write, I said I verified it twice after writing just to be sure.
I've just completed a full flash of the last file you sent with not a single verify error.
Here is the log.
Now returning chip to board.
As for the screenshot of current bios page, I'll have to find a camera phone or something maybe tommorow.
But the advaced options tab is not visible at all.

Code:

SPI FlashROM Programmer 2.28 (C) 2008-2018 by Martin Rehak; rayer@seznam.cz
Compiled by GCC 8.1.0 at 11:48:02, Oct  6 2018
(Win9x/NT/64 compatability)

SPI connected to LPT port at I/O base address: 378h, SCK pulse width: t+0us
FlashROM JEDEC ID, type: EF4016h
Winbond W25Q32BV/FV (4MB)
S/N = C6609040434D4C2Fh
Status = 02h, WE bit is enabled, blocks protection is disabled
Unlocking...
Status = 00h, FlashROM is unlocked now.

C:\Users\Aiden\Desktop\spi\SPIPGM>spipgmw /e

SPI FlashROM Programmer 2.28 (C) 2008-2018 by Martin Rehak; rayer@seznam.cz
Compiled by GCC 8.1.0 at 11:48:02, Oct  6 2018
(Win9x/NT/64 compatability)

SPI connected to LPT port at I/O base address: 378h, SCK pulse width: t+0us
FlashROM JEDEC ID, type: EF4016h
Winbond W25Q32BV/FV (4MB)
S/N = C6609040434D4C2Fh
Status = 02h, WE bit is enabled, blocks protection is disabled
Chip Erase, please wait... done.

C:\Users\Aiden\Desktop\spi\SPIPGM>spipgmw /p C:\Users\Aiden\Downloads\unlocked_bit\W25Q32BV_FV_4MB-PRR-FLOCKDN-Unlocked.bin

SPI FlashROM Programmer 2.28 (C) 2008-2018 by Martin Rehak; rayer@seznam.cz
Compiled by GCC 8.1.0 at 11:48:02, Oct  6 2018
(Win9x/NT/64 compatability)

SPI connected to LPT port at I/O base address: 378h, SCK pulse width: t+0us
FlashROM JEDEC ID, type: EF4016h
Winbond W25Q32BV/FV (4MB)
S/N = C6609040434D4C2Fh
Programming page at: 003FFF00h (100%)

C:\Users\Aiden\Desktop\spi\SPIPGM>spipgmw /v C:\Users\Aiden\Downloads\unlocked_bit\W25Q32BV_FV_4MB-PRR-FLOCKDN-Unlocked.bin

SPI FlashROM Programmer 2.28 (C) 2008-2018 by Martin Rehak; rayer@seznam.cz
Compiled by GCC 8.1.0 at 11:48:02, Oct  6 2018
(Win9x/NT/64 compatability)

SPI connected to LPT port at I/O base address: 378h, SCK pulse width: t+0us
FlashROM JEDEC ID, type: EF4016h
Winbond W25Q32BV/FV (4MB)
S/N = C6609040434D4C2Fh
Verifying sector at: 003FF000h (100%)
Verify OK.

C:\Users\Aiden\Desktop\spi\SPIPGM>

[kenkit]

what do you mean by unlock smm ?

[kenkit]

it didn't work once more.
I've just verified it again after pulling the chip from the board.
It behaves just like the first mod you sent.
Now restoring the original backup.
EDIT:It turns out it may have been a cmos bug (currently redoing it over). I think I was supposed to remove the cmos battery before and after programming.
I hope this is what caused even the first mod to fail, but if it works I suppose I could programme it using fpt