[READ FIRST] Access Advanced settings through EFI shell

[burhanafridi603]

Please help with the unlock of this BOIS

http://support.hp.com/us-en/product/HP-E...6/drivers/

thanks

THIS TOPIC mostly for newest notebooks (2012-2013 years) ONLY with RSA signed BIOSes, when Phoenix tool can't open your rom file.

3 weeks ago, when I came to this forums I was a newbie for BIOS modding or accessing it's hidden options.

But I searched a lot of information over internet and found some smart hints.

Having a huge programming skills in disassembling and ASN.1 data reading/parsing I realized a good way to change bios settings without modding.

I have HP Pavillion dv7 7171er with Insyde H2O RSA signed bios.

I found the way how to get it decrypted but all attempts to flash modded bios with patched DLL was unsuccessful. Each time I had to recover my Laptop with Win+B restoring.

On 15th time when by laptop was bricked again I decided to disassemble Setup Menu and found where needed options for me are hidden and how to access them for changes.

So here is small part of decompiled Setup Menu.

As you can see, it is realy represent's what we see in reality.

Code:

╔════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
║ FormSet: 'Main'                                                         GUID: a04a27f4-df00-4d42-b552-39511302113d ║
╟────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╢
║ VarStore Id: '0x1234', Size: '900', Name: 'SystemConfig'                GUID: a04a27f4-df00-4d42-b552-39511302113d ║
╚════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝
┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ Form Name: 'Main'                                                                                  [ ID: '0x0001' ]│
└────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
┌- Grayout IF:
|    Question [ ID: 0x08 ] == 0x02
|    Question [ ID: 0x07 ] == 0x01
|    AND expression
└- END IF Grayout;
Time: 'System Time' [ QId: '0x01', VarStoreId: '0x00', Help: '<Enter> selects field.' ]
  Default value: '00:00:00', Type: 0x05
Date: 'System Date' [ QId: '0x02', VarStoreId: '0x00', Help: '<Enter> selects field.' ]
  Default value: '2010/05/01', Type: 0x06
┌- Grayout IF:
|    EQ == TRUE
|    Text: 'Notebook Model'                 Default: '[Not Detected]'                 Help: ' '
|    Text: 'Product Number'                 Default: '[Not Detected]'                 Help: ' '
|    Text: 'System Board ID'                Default: '[Not Detected]'                 Help: ' '
|    Text: 'Born On Date'                   Default: '[Not Detected]'                 Help: ' '
|    Text: 'Processor Type'                 Default: '[Not Detected]'                 Help: ' '
|    ┌- Suppress IF:
|    |    Question [ ID: 0x06 ] == 0x00
|    |    Text: 'Processor Speed'                Default: '[Not Detected]'                 Help: ' '
|    └- END IF Suppress;
|    Text: 'Total Memory'                   Default: '[Not Detected]'                 Help: ' '
|    Text: 'BIOS Version'                   Default: 'Fake Data'                      Help: ' '
|    Text: 'BIOS Vendor'                    Default: 'Insyde'                         Help: ' '
|    Text: 'Serial Number'                  Default: '[Not Detected]'                 Help: ' '
|    Text: 'UUID Number'                    Default: '[Not Detected]'                 Help: ' '
|    Text: 'Product configuration ID'       Default: '[Not Detected]'                 Help: ' '
|    Text: 'System Board CT Number'         Default: 'C AAAA RR SS WW X X X'          Help: ' '
|    Text: 'Factory installed OS'           Default: '[Not Detected]'                 Help: ' '
|    ┌- Suppress IF:
|    |    Question [ ID: 0x05 ] == 0x00
|    |    Text: 'Primary Battery SN'             Default: 'N/A'                            Help: ' '
|    └- END IF Suppress;
|    ┌- Suppress IF:
|    |    Question [ ID: 0x04 ] == 0x00
|    |    Text: 'Secondary Battery SN'           Default: ''                               Help: ' '
|    └- END IF Suppress;
└- END IF Grayout;
Reference: 'System Log' [ ID: '0x0540' ]

┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ Form Name: 'System Log'                                                                            [ ID: '0x0540' ]│
└────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
Subtitle: 'System Log'
Action:                                 Help: View the system diagnostic failure results.
Text: 'Result:'                        Default: 'Time:'                          Help: 'View the system diagnostic failure results.'
┌- Grayout IF:
|    EQ == TRUE
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
|    Text: ' '                              Default: '- No Data -'                    Help: 'View the system diagnostic failure results.'
└- END IF Grayout;

So now I need 2-3 BIOSes to proof my concept.

If you need to enable AHCI for example of change something else. please post you BIOS links here.

I will test and after 100% success I will write GUIDE and provide source code.

IMPORTANT: This is related only newest BIOSes which are not encrypted.
If it is RSA signed, you will need additional steps. I will inform you in this case.

---

Moderators, please pin this topic for some time.
You can always unpin in the feature.

[john-wingnut]

I cannot get the laptop to boot from the modified bootx64.efi file, just sits there with a black screen.

The laptop is a Yoga 2 11, BIOS version 92cn35ww v1.15

I don't have any legacy options in the BIOS, only a Boot mode: UEFI which is greyed out.

I did a test with an original bootx64.efi file from an MS bootstick, and it loaded that quite happily - stopped at a warning for missing windows boot files, but that is to be expected.

Any ideas?

[BDMaster]

Look here :

https://craftedflash.com/info/how-boot-c...lash-drive

https://www.youtube.com/watch?v=6JnDbc8uOxw

Use Novo-Button !!!

Let me know
Regards

[john-wingnut]

I tried the novo button as well - doesn't really make any difference, as one can go into the BIOS via F2 or the boot menu via F12

Still cannot activate legacy mode as its greyed out.

Surely it has to be the modified bootx64 file, as the laptop will boot without issue from usb when using an original windows b00tx64 file.

Doesn't make any sense to me

[BDMaster]

Problem is Secure Boot (It check RSA signature) It locks boot !

Haven't seen video ?

You will have this settings into Bios Menu Boot Tab :

Boot UEFI and You have to set to Legacy Support (Secure Boot Disabled)
Boot Priority and You have to set to UEFI First (Legacy USB whit UEFI)
USB Boot and You have to set to Enabled (Boot from USB)

[john-wingnut]

Yip...........

Secure boot disabled
Fast boot disable
Boot mode uefi (locked / greyed out)

[BDMaster]

Many times It needs to create a SVP = SuperVisor Paddword to Enable that option !
Have You tried ?
Regards

[john-wingnut]

Many times It needs to create a SVP = SuperVisor Paddword to Enable that option !
Have You tried ?
Regards

Yip

Admin password and supervisor password set

[retro71]

Hello all,

I've got an so called Wintel Box from China and I want to set up
Wake on Lan &
Power on after Power loss &
maybe the dual boot option (android and windows)

Here the product description:
http://www.aliexpress.com/item/Vensmile-...5,201409_3

I tried the pearl script but got always an error.

SVP is added in BIOS so I was able to use the OTG port als USB under Win10 but i cant find WOL and Power options.

Can anyone take a look at this bios:

https://mega.nz/#!9lQVCa4J!TsZzTCa7xLp_X...pp7Jg5GRGE

Setup is in module:
FE3542FE-C1D3-4EF8-657C-8048606FF670_518.ROM

Btw.: for all users which would like to backup her BIOSes from PC (this was my problem   :
Just use the Insydeflash.exe or Insydeflash64.exe  in command line with option: insydeflash backupbiosname.fd /g 

Thanks!

[BDMaster]

Hi friend,
It's a Firmware so You used and SPI Programmer to read It !
I think only chance You have is to change the VarStore Variables You are interesting
using Flaseclock if It permit to Boot from an USB Stick FAT32 formatted !

Look into EFI IFR txt file :

http://rghost.net/private/79nvcjlNw/4f69...8a349de115

http://rghost.net/private/7ZhSSlBPm/e72a...300000a942

But It's a non conventional Insyde Bios so very closed, there are many functions to check
by chars displaied on TV during execution Code . . . a lot of time to waste !

These are the Menu Tabs present into this Bios :


FE3542FE-C1D3-4EF8-657C-8048606FF670_518.ROM Setuputility


Form Sets
--------------------------------------------------------------------------------
Offset: Title:
--------------------------------------------------------------------------------
0xFB4C Power (0x1CE from string package 0x4)
0x102D4 Advanced (0xB from string package 0x4)
0x1D3AC Boot (0x59 from string package 0x4)
0x1DD04 Security (0x38 from string package 0x4)
0x1E14C Main (0x5 from string package 0x4)
0x1E35C Exit (0x8B from string package 0x4)


0x1110F Setting: Wake on LAN Enable, Variable: 0x14F
0x11120 Option: Enabled, Value: 0x1
0x11127 Option: Disabled, Value: 0x0 (default)
0x1112E End of Options

Regards