[REQUEST] Acer Aspire VN7-592G BIOS Unlock

[Mhelkir]

Hi All,
Have new VN7-592G with hidden Adevenced Options and Power Options pages.
Followed vodek instruction for older Acer: https://www.bios-mods.com/forum/Thread-R...7#pid90017
Trying to modify bios 1.11, found:

Code:

0xB45EA Suppress If: {0A 82} 0xB45EC True {46 02} 0xB45EE Setting: i-Page:, Variable: 0x258 {05 91 42 14 43 14 0B 00 34 12 58 02 00 10 00 01 00} 0xB45FF Option: Disabled, Value: 0x0 (default) {09 07 B0 12 10 00 00} 0xB4606 Option: Enabled, Value: 0x1 {09 07 B1 12 00 00 01} 0xB460D End of Options {29 02} 0xB460F End If {29 02}

Used EFI shell to boot laptop but couldn't modify 0x258, by setup_var, got msg that it can't change variable.
Tried also setup_var2 which list 2 values for 0x258 instead of one, one named "Setup" second named "Custom", and it modify only"Custom" value, which don't do anything. Couldn't change this custom back to 0x0 so flashed back whole bios by Acer tool.

Now wondering:
1. Why some ppl have yellowe letters in efi shell, I had white, wrong efi shell?
2. What software would allow me to manually change variable in .fd file, so I will alter use Acer tool to flash bios instead changing in it one value?
3. Any other options?

P.S. Please could mod move topic to Insyde subforum, sorry for mistake.


Best Regards

[Mhelkir]

Espionage724,
could you please check for me if instead of flashing with changed bios, just installing by Acer tool v1.11 and changing in EFI shell 0x259 to 0 and after restart changing 0x258 to 1 will work or brick pc? because after brick I will not have any option to flash it back.
Have the same laptop, posted recently post (in wrong subforum) https://www.bios-mods.com/forum/Thread-F...apprecited

wondered about modifying just fd file and using Acer flasher to bypass lock.

Best Regards

[espionage724]

We can try last way:
Create list of some needed options with needed values,
after that i'll make it as default so you can use laptop with new settings even bios lock disabled.

I'm not sure what options are available to change, but here's what I was interested in:

- Toggle to enable and disable CSM/Legacy (I believe it's enabled by default; if so, I would like it disabled)

- Ability to set power mode for PCI devices (I can't recall what it was exactly but my old Acer laptop with its BIOS unlocked gained an option to set the PCI-E power mode to Performance instead of the default Balanced-Low)

- Ability to set NVIDIA GPU to primary (no idea if this would work; I basically want to disable Optimus but only use the NVIDIA GPU)

- UEFI option ROM for AHCI (my old Acer defaulted to a Legacy ROM even with UEFI boot set; no idea if this really makes a difference)

- Disable Secure Virtual Machine mode (I don't do virtualization or really plan to)

Espionage724,
could you please check for me if instead of flashing with changed bios, just installing by Acer tool v1.11 and changing in EFI shell 0x259 to 0 and after restart changing 0x258 to 1 will work or brick pc? because after brick I will not have any option to flash it back.
Have the same laptop, posted recently post (in wrong subforum) https://www.bios-mods.com/forum/Thread-F...apprecited

wondered about modifying just fd file and using Acer flasher to bypass lock.

Best Regards

Hmm, where can I find Acer tool v1.11? Do you mean the flash tool that comes with the BIOS flash archive Acer provides? If so, I believe it'll only flash unmodified BIOS files (it complained about a non-signed BIOS file last I checked), but I wonder if it would be possible to bypass that check with the platform.ini somehow.

[Mhelkir]

We can try last way:
Create list of some needed options with needed values,
after that i'll make it as default so you can use laptop with new settings even bios lock disabled.

I'm not sure what options are available to change, but here's what I was interested in:

- Toggle to enable and disable CSM/Legacy (I believe it's enabled by default; if so, I would like it disabled)

- Ability to set power mode for PCI devices (I can't recall what it was exactly but my old Acer laptop with its BIOS unlocked gained an option to set the PCI-E power mode to Performance instead of the default Balanced-Low)

- Ability to set NVIDIA GPU to primary (no idea if this would work; I basically want to disable Optimus but only use the NVIDIA GPU)

- UEFI option ROM for AHCI (my old Acer defaulted to a Legacy ROM even with UEFI boot set; no idea if this really makes a difference)

- Disable Secure Virtual Machine mode (I don't do virtualization or really plan to)

Espionage724,
could you please check for me if instead of flashing with changed bios, just installing by Acer tool v1.11 and changing in EFI shell 0x259 to 0 and after restart changing 0x258 to 1 will work or brick pc? because after brick I will not have any option to flash it back.
Have the same laptop, posted recently post (in wrong subforum) https://www.bios-mods.com/forum/Thread-F...apprecited

wondered about modifying just fd file and using Acer flasher to bypass lock.

Best Regards

Hmm, where can I find Acer tool v1.11? Do you mean the flash tool that comes with the BIOS flash archive Acer provides? If so, I believe it'll only flash unmodified BIOS files (it complained about a non-signed BIOS file last I checked), but I wonder if it would be possible to bypass that check with the platform.ini somehow.

Yes, about this tool, there are many changeable flags there in platform.ini, maybe some bring more freedom,
I for sure show there flag that enable "options" without any information what options
Maybe it would help and this is enough to change bits.
Also I would like (if you could) you to check could you flash Acer bios 1.11. by this tool, original one, and then boot from usb with EFI shell to change first 0x259 and after 0x258 by setup_var - would check myself but I'm worry of brick, not have programmer.
This is different approach than flashing whole bios like you did, so maybe it will work.

[espionage724]

Hmm, I'm not really sure what options specifically to mess with in platform.ini or if it would really help (I can't imagine it being that easy to bypass SecureFlash :p), but I'm not too sure.

As for your request, you would want me to flash the stock latest Acer BIOS to my laptop and then try to use EFI shell to change those variables? Unfortunately that doesn't work either (both are unable to be changed).

I wonder if https://github.com/Cr4sh/ThinkPwn might be of some kind of help. I'm not sure if my laptop is exploitable with that (didn't really feel like compiling the EFI Shell to check but i'll look into it).

I'm open to any more ideas.

[espionage724]

So it looks like ThinkPwn doesn't work as-is (claims it can't find image or something like that).

I'm experimenting with changing EFI variables now. I can boot into EDK EFI Shell (v2) and change variables through there, and they look to carry over to both whatever EFI file I boot from that shell, and the OS (I can see the changed variable through efivar in Linux). They don't seem to stick after a reboot though.

This is a list of all the variables I can change along with their GUIDs:

Code:

8be4df61-93ca-11d2-aa0d-00e098032b8c-dbxDefault 8be4df61-93ca-11d2-aa0d-00e098032b8c-dbDefault 8be4df61-93ca-11d2-aa0d-00e098032b8c-KEKDefault 8be4df61-93ca-11d2-aa0d-00e098032b8c-PKDefault 5bce4c83-6a97-444b-63b4-672c014742ff-IrsiInfo 8be4df61-93ca-11d2-aa0d-00e098032b8c-BootCurrent 59d1c24f-50f1-401a-b101-f33e0daed443-BootPrev 39473de5-df3b-49a1-9fa6-41b35b36fa39-DynamicBar 39473de5-df3b-49a1-9fa6-41b35b36fa39-FixedBar 8be4df61-93ca-11d2-aa0d-00e098032b8c-ErrOutDev 8be4df61-93ca-11d2-aa0d-00e098032b8c-ConInDev 59d1c24f-50f1-401a-b101-f33e0daed443-ActiveVgaDev 59d1c24f-50f1-401a-b101-f33e0daed443-ConOutCandidateDev 8be4df61-93ca-11d2-aa0d-00e098032b8c-ConOutDev 59d1c24f-50f1-401a-b101-f33e0daed443-ConInCandidateDev 8be4df61-93ca-11d2-aa0d-00e098032b8c-PlatformLangCodes 8be4df61-93ca-11d2-aa0d-00e098032b8c-LangCodes 8be4df61-93ca-11d2-aa0d-00e098032b8c-VendorKeys 8be4df61-93ca-11d2-aa0d-00e098032b8c-SignatureSupport 8be4df61-93ca-11d2-aa0d-00e098032b8c-OsIndicationsSupported 8be4df61-93ca-11d2-aa0d-00e098032b8c-BootOrder b2b7c21f-1786-4a64-be69-16cef7647331-SwitchableGraphicsVariable 59d1c24f-50f1-401a-b101-f33e0daed443-PhysicalBootOrder 89cb0e8d-393c-4830-bfff-65d9147e8c3b-AACV a04a27f4-df00-4d42-b552-39511302113d-Custom 89cb0e8d-393c-4830-bfff-65d9147e8c3b-ASSN a04a27f4-df00-4d42-b552-39511302113d-Setup 59d1c24f-50f1-401a-b101-f33e0daed443-SecureBootEnforce 8be4df61-93ca-11d2-aa0d-00e098032b8c-Boot0001 89cb0e8d-393c-4830-bfff-65d9147e8c3b-AFBD 89cb0e8d-393c-4830-bfff-65d9147e8c3b-SMAB 8be4df61-93ca-11d2-aa0d-00e098032b8c-Boot0003 8be4df61-93ca-11d2-aa0d-00e098032b8c-Boot0000 89cb0e8d-393c-4830-bfff-65d9147e8c3b-ACUB 8be4df61-93ca-11d2-aa0d-00e098032b8c-Boot0002 89cb0e8d-393c-4830-bfff-65d9147e8c3b-AEBT d719b2cb-3d3a-4596-a3bc-dad00e67656f-db d719b2cb-3d3a-4596-a3bc-dad00e67656f-dbx 8be4df61-93ca-11d2-aa0d-00e098032b8c-SetupMode 8be4df61-93ca-11d2-aa0d-00e098032b8c-Boot2003 8be4df61-93ca-11d2-aa0d-00e098032b8c-Boot2002 8be4df61-93ca-11d2-aa0d-00e098032b8c-Boot2001 711c703f-c285-4b10-a3b0-36ecbd3c8be2-CapsuleLongModeBuffer 973218b9-1697-432a-8b34-4884b5dfb359-S3MemVariable 8be4df61-93ca-11d2-aa0d-00e098032b8c-ConOut a04a27f4-df00-4d42-b552-39511302113d-BootType a56074db-65fe-45f7-bd21-2d2bdd8e9652-LegacyDevOrder 0a4cd120-ea2d-4aef-a4b0-b0c08cbbdbbe-BootDevice bbd1fd65-5668-4fb2-8999-231095717a07-VBiosInfo e20939be-32d4-41be-a150-897f85d49829-MemoryOverwriteRequestControl 8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot 59d1c24f-50f1-401a-b101-f33e0daed443-CustomSecurity a9b5f8d2-cb6d-42c2-bc01-b5ffaae4335e-PBRDevicePath 59d1c24f-50f1-401a-b101-f33e0daed443-RestoreFactoryDefault 89cb0e8d-393c-4830-bfff-65d9147e8c3b-ACFB 16233f3e-d2bf-4de4-9b83-3bb0a581ca4d-SetupDefault 4c19049f-4137-4dd3-9c10-8b97a83ffdfa-MemoeryTypeUpdateInfo f24643c2-c622-494e-8a0d-4632579c2d5b-TrEEPhysicalPresence 9c57c6e2-4c78-42d9-9051-96b9d80c9c92-BiosGuardStatus 382af2bb-ffff-abcd-aaee-cce099338877-SecureFlashInfo 4c19049f-4137-4dd3-9c10-8b97a83ffdfa-MemoryTypeInformation 89cb0e8d-393c-4830-bfff-65d9147e8c3b-WBSN 89cb0e8d-393c-4830-bfff-65d9147e8c3b-WBMN 89cb0e8d-393c-4830-bfff-65d9147e8c3b-AHPL 89cb0e8d-393c-4830-bfff-65d9147e8c3b-SMAC 89cb0e8d-393c-4830-bfff-65d9147e8c3b-SMAA 04b37fe8-f6ae-480b-bdd5-37d98c5e89aa-VarErrorFlag 8be4df61-93ca-11d2-aa0d-00e098032b8c-ConIn 89cb0e8d-393c-4830-bfff-65d9147e8c3b-A01LastSataPortPresent f24643c2-c622-494e-8a0d-4632579c2d5b-TrEEPhysicalPresenceFlags c60aa7f6-e8d6-4956-8ba1-fe26298f5e87-EPCBIOS 89cb0e8d-393c-4830-bfff-65d9147e8c3b-ADTC 89cb0e8d-393c-4830-bfff-65d9147e8c3b-ASTM 89cb0e8d-393c-4830-bfff-65d9147e8c3b-ABRV 45b5acb9-0359-49be-adb1-49377bd607f7-SgxSetupDefaultVariable 45b5acb9-0359-49be-adb1-49377bd607f7-SgxSetupVariable 8be4df61-93ca-11d2-aa0d-00e098032b8c-Timeout 59d1c24f-50f1-401a-b101-f33e0daed443-CustomPlatformLang 8be4df61-93ca-11d2-aa0d-00e098032b8c-SyncSetup aeb9c5c1-94f1-4d02-bfd9-4602db2d3c54-Tcg2PhysicalPresence aeb9c5c1-94f1-4d02-bfd9-4602db2d3c54-Tcg2PhysicalPresenceFlags bb983ccf-151d-40e1-a07b-4a17be168292-MemoryOverwriteRequestControlLock 28cf6d27-0694-45d0-a06a-15266f1e8346-PegDataVar 14ef381c-9721-434e-be09-192ab97e781f-MrcS3RestoreVariable 8be4df61-93ca-11d2-aa0d-00e098032b8c-PlatformLang 8be4df61-93ca-11d2-aa0d-00e098032b8c-Lang c020489e-6db2-4ef2-9aa5-ca06fc11d36a-AcpiGlobalVariable eb704011-1402-11d3-8e77-00a0c969723b-MTC 89cb0e8d-393c-4830-bfff-65d9147e8c3b-AT2D0 59d1c24f-50f1-401a-b101-f33e0daed443-AdministerSecureBoot 59d1c24f-50f1-401a-b101-f33e0daed443-certdb aaf32c78-947b-439a-a180-2e144ec37792-AuthVarKeyDatabase

I can show the data for some of those variables and alter them with setvar from EDK Shell V2. I can also show the data (but not modify it; can't quite figure it out) from Linux.

I'm working on playing with some settings and i'll edit this post with whatever I find out.

EDK EFI Shells V1 and V2: https://superuser.com/questions/1057446/...94#1057594

Command syntax for setvar: setvar VARIABLENAME -guid GUID-NAME =DATA

List variables and GUIDs: Boot into the setup_var modified EFI Shell and use lsefivar to show variables (this shows a lot more variables than both setvar from EDK Shell and efivar from Linux)

Hmm, so if I'm understanding correctly, my BIOS has two different layouts to determine what is shown for options. One is called Setup and the other is Custom. Custom appears to be the locked-down setup Acer is enforcing currently, and the other is the unlocked and/or editable one. Using the Insyde EFI Shell's setup_var2 command can freely edit variables on the Setup layout, but not the Custom one. So if I can get the BIOS to load up the Setup page instead of the Custom page, awesome things may happen :p

Can't seem to edit anything within /sys/firmware/efi/efivars either (it's mounted as rw and paranoid efi disabled). Was thinking the trick to edit some BIOS settings from there would work but unfortunately it doesn't.

[espionage724]

Bump; any more suggestions or ideas?

Not sure if it's applicable on my laptop, but apparently one method some people used to unlocked their descriptors was an official method from Intel involving shorting pins on the audio chip (HDA_SDO). No idea if this is still possible on newer hardware.

[Da Vinci Code]

Ok, we found new version of modding tool, it uses new algorithms of checksum calculating (perharps old version is reason of bricked laptop).
I'll prepare new mod quickly.Stay tuned

[Da Vinci Code]

Check your PM!

[espionage724]

Alright, got around to trying it a little bit ago. My laptop was able to boot

However, the initial boot was a little weird (it claimed the default boot device was missing and didn't want to boot any other device until I rebooted twice), and I was also unable to access the setup utility (pressing F2 at boot flashed the screen and rebooted. I was eventually able to boot my OS, but when I shut it down, I was unable to boot it again (laptop stayed powered off). Re-flashing my previous BIOS worked fine.

Here's another more-recent chip backup: https://drive.google.com/file/d/0B9CekGW...sp=sharing (the only real differences should be different boot devices and updated Intel ME firmware).