Forum RSS Feed Follow @ Twitter Follow On Facebook

Thread Rating:
  • 1 Vote(s) - 5 Average
  • 1
  • 2
  • 3
  • 4
  • 5
[-]
Welcome
You have to register before you can post on our site.

Username:


Password:





[-]
Latest Threads
[REQUEST + BOUNTY] Lenovo Thinkpad P14s ...
Last Post: loadit
Today 12:16 PM
» Replies: 2
» Views: 37
[REQUEST] Lenovo Yoga 2 Pro (76CNxxWW) W...
Last Post: Dudu2002
Today 10:53 AM
» Replies: 845
» Views: 317091
[REQUEST] Lenovo Thinkpad E130 (H4ETxxWW...
Last Post: Dudu2002
Today 10:51 AM
» Replies: 509
» Views: 101056
[REQUEST] Lenovo Yoga 11E (N15ETxxW) Whi...
Last Post: Dudu2002
Today 08:15 AM
» Replies: 5
» Views: 2520
[REQUEST] Lenovo G50-70 (9ACNxxWW) BIOS ...
Last Post: Dudu2002
Today 07:23 AM
» Replies: 139
» Views: 40961
[REQUEST] CPU Support for Ryzen 5 3600 o...
Last Post: flexpavillion
Today 04:32 AM
» Replies: 1
» Views: 336
Clevo P775TM1-G BIOS
Last Post: ActivatedNut
Today 01:36 AM
» Replies: 145
» Views: 55308
ASUS P5G41T-M LX2/GB Unlocked Hidden Ove...
Last Post: GangsteR23
Yesterday 04:58 PM
» Replies: 25
» Views: 64130
lenovo z570 Advanced Menu Unlocked
Last Post: Kaluva12345
Yesterday 04:58 PM
» Replies: 7
» Views: 4101
[Request] HP Elitebook 6930P WLAN Whitel...
Last Post: Maxinator500
Yesterday 02:25 PM
» Replies: 15
» Views: 6567
Lenovo ThinkCentre M715q 2nd Gen & AMD R...
Last Post: RedfieldHUN1987
Yesterday 09:23 AM
» Replies: 2
» Views: 146
L14 Gen 3 AMD , Need UEFI unlock advance...
Last Post: frankeinstein2532555
Yesterday 04:08 AM
» Replies: 0
» Views: 92
[REQUEST] Lenovo Y400 & Y500 (6BCNxxWW) ...
Last Post: freedome
03-26-2024 11:00 PM
» Replies: 188
» Views: 52175
[REQUEST] Lenovo G510 (79CNxxWW) Whiteli...
Last Post: ghostinoss
03-26-2024 09:21 PM
» Replies: 655
» Views: 167161
[Request] CPU support for Lenovo IQ57I
Last Post: DeathBringer
03-26-2024 10:02 AM
» Replies: 5
» Views: 238
unlocked Bios for Machenike s16
Last Post: Dudu2002
03-26-2024 09:06 AM
» Replies: 5
» Views: 328
[REQUEST] Bios Unlock Whitelist HP DV6-6...
Last Post: DimanTLT63
03-26-2024 03:03 AM
» Replies: 0
» Views: 142
[REQUEST] HP Pavilion G6-1252ss Whitelis...
Last Post: joseefitness
03-26-2024 01:40 AM
» Replies: 0
» Views: 126
[REQUEST] Lenovo S310 & S410 (8BCNxxWW) ...
Last Post: morgley
03-25-2024 10:43 PM
» Replies: 14
» Views: 6333
Acer Nitro ANV15-51 Bios Bin File Reques...
Last Post: Papethzkie23
03-25-2024 06:04 PM
» Replies: 0
» Views: 138

guide for mod bios hp insyde on my experience
#1
Hi everyone,
after about 1 month, my request to unlock my HP Insyde BIOS was ignored, so I tried to study independently via this forum or other forums on the web.
I have come to good results to unlock several hidden BIOS features.
I would like to list the various notions learned in order to facilitate the lives of other interested parties.

i am working on a hp 630 with bios insyde.

the bios insyde seems to be one of the most difficult to unlock besides the fact that many of these bios have an RSA signature which makes changes impossible ...
in my case they managed to find in the bios network for my pc RSA and so I have worked on this.

HP 630

HP Compaq 630 - Mini 430 - Compaq Presario CQ43-414TU BDMaster
HP Mini 430 - Compaq 630 - Compaq Presario CQ43-414TU BDMaster

Versione Data Dimensione SoftPaq
F.39 12-2013 sp64612.exe RSA
F.38 03-2013 sp60723.exe RSA
F.37 11-2012 sp59757.exe RSA
F.33 01-2012 sp55626.exe RSA
F.32 11-2011 sp55356.exe RSA
F.24 10-2011 sp54776.exe RSA
F.23 09-2011 sp54697.exe RSA
F.22 08-2011 sp54181.exe RSA
F.19 07-2011 sp53673.exe possiamo bios mod
F.18 06-2011 sp53593.exe possiamo bios mod
F.17 06-2011 sp53383.exe possiamo bios mod
F.16 05-2011 sp53108.exe possiamo bios mod
F.02 03-2011 sp52301.exe possiamo bios mod

so I worked on sp53673.exe (no rsa)
this .exe is multi Fd. (fd is the unit of the bios proper and in my case within the executable of qull there are 3 different models, mine is 03676.fd)
to eject this exe file just open it with win rar or 7zip.
I learned several tricks to unlock hidden functions, but I really had to be a web astronaut.
with the "fd" file we have to try to extract it with what in the network is called "Andy tool" is a tool that opens the fd file, dumps and can therefore cook the updated fd file with the changes made by us.

link image: https://ibb.co/TKsgDg0

press ok, in the root directory of the FD file there will be new files and folders.
DUMP inside there will be many files ... to unlock the hidden functions when we are interested and almost always a file ending in FE...670_ (Module) and then with numbers (Checksums)
in my case it's called like this:

FE3542FE-C1D3-4EF8-657C-8048606FF670_649.ROM (SetupUtility)

of these, there may be more than one, but we must identify the larger one.
Ok now with a new tool called Universal IFR Extractor.exe created by Mr. Donovan6k we should read the identified ROM file.
The Universal IFR Extractor converts the code into human-readable data so that we can include the variables that condition the functions of our BIOS.
Now we will have a .txt file with what we will have to understand in our functions:

I have shortened the text file for space reasons, I just want to show an example of the system configuration field.

Code:
                               EFI Protocol Detected
--------------------------------------------------------------------------------

                               String Packages
--------------------------------------------------------------------------------
Offset:        Language:
--------------------------------------------------------------------------------
0xF080        eng
0x1BA68        fra
0x2941A        chn
0x31DEE        jpn
0x3E33C        ita
0x4B3B8        spa
0x59222        ger
0x66758        por

                                  Form Sets
--------------------------------------------------------------------------------
Offset:        Title:
--------------------------------------------------------------------------------
0x73450        Main (0xE9)
0x735D0        Exit (0x365)
0x73700        System Configuration (0x5B)
0x73DD0        Power (0x2E5)
0x746D0        Security (0x36)
0x747C0        Advanced (0xFB)
0x77B10        Main (0x4)
0x77DD0        Diagnostics (0x42)

                        Internal Forms Representation
--------------------------------------------------------------------------------
Offset:        Instruction:
--------------------------------------------------------------------------------

0x73706 Form Set: System Configuration {0E 24 F4 27 4A A0 00 DF 42 4D B5 52 39 51 13 02 11 3D 5B 00 DA 00 00 00 00 00 00 00 00 00 01 00 00 00 BC 02}
0x7372A     Form: System Configuration, Form ID: 0x1 {01 06 01 00 5B 00}
0x73730         Subtitle:   {02 04 DA 00}
0x73734         Suppress If: {0A 03 00}
0x73737         true {27 02}
0x73739             Setting: UEFI Boot, Variable: 0x7E[1] {05 09 7E 00 01 D6 00 D7 00}
0x73742                 Option: Enabled, Value: 0x0 {09 09 DC 00 00 00 01 00 00}
0x7374B                 Option: Disabled, Value: 0x1 {09 09 DB 00 01 00 00 00 00}
0x73754             End of Options {10 02}
0x73756             Setting: Quick Boot, Variable: 0x72[1] {05 09 72 00 01 48 03 49 03}
0x7375F                 Option: Enabled, Value: 0x1 {09 09 DC 00 01 00 01 00 00}
0x73768                 Option: Disabled, Value: 0x0 {09 09 DB 00 00 00 00 00 00}
0x73771             End of Options {10 02}
0x73773             Setting: Quiet Boot, Variable: 0x73[1] {05 09 73 00 01 4A 03 4B 03}
0x7377C                 Option: Enabled, Value: 0x1 {09 09 DC 00 01 00 01 00 00}
0x73785                 Option: Disabled, Value: 0x0 {09 09 DB 00 00 00 00 00 00}
0x7378E             End of Options {10 02}
0x73790             Setting: PXE Boot to LAN, Variable: 0x74[1] {05 09 74 00 01 4C 03 4D 03}
0x73799                 Option: Disabled, Value: 0x0 {09 09 DB 00 00 00 01 00 00}
0x737A2                 Option: Enabled, Value: 0x1 {09 09 DC 00 01 00 00 00 00}
0x737AB             End of Options {10 02}
0x737AD         End If {18 02}

Method 1

if you want to try to take risks that I don't feel responsible for the damage you can do to your PC, and it would be a good thing to make sure that the BIOS is reset with a keyboard,
or even to have a terminal with a programmer to repair the bios in case something goes wrong.
In my case, for example, in the System Configuration tab, the startup function of Eufi is not visible and to unlock it and make it appear we have to make the variable false:
 
0x73706 Module set: System configuration {0E 24 F4 27 4A A0 00 DF 42 4D B5 52 39 51 13 02 11 3D 5B 00 FROM 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 01 00 00 00 BC 02}

0x7372A Module: System configuration, Module ID: 0x1 {01 06 01 00 5B 00}
0x73730 Subtitles: {02 04 DA 00}
0x73734 Suppress if: {0A 03 00}
0x73737 true {27 02} <--------- we must make it false by changing 28 instead of 27

so now with a hexadecimal software like hxd, i have to change this value ...

I open the file (in my case) FE3542FE-C1D3-4EF8-657C-8048606FF670_649.ROM
identified at the beginning and we open it in HxD, we go to offset 0x73737 (always in my case) and change the value from 27 to 28. and save.

we make a copy of this file, on the desktop, let's go back to Andy's tool and select these parameters :

link image1https://ibb.co/V2MWHLX

linnk iimage2: https://ibb.co/QNmLX4N

link image3: https://ibb.co/FzcYpQZ

After the informational message, not replaced ok, you have to go to the directory of the "fd" file in the dump folder and replace the installed "rom" file and only now do ok.
Now in the folder we have several files, one of which with the name 03676_SLIC.fd, we rename it by deleting _slic and we insert this file in the original folder for the flash.
Now we can flash the new BIOS, I found a patch that allows me to do it ... it would be a change to be made to the iscflash.dll file

Method 2

There are functions, however, that cannot be unlocked with this method because they have another function that blocks them ...
for example, the Vurtualization technology in my case is blocked by this formula:

0x73800 Label: 0x1001 {1D 04 01 10}
0x73804 Suppress if: {0A 03 00}
0x73807 Variable 0x225 [1] equal to 0x0 {12 07 25 02 01 00 00} <--------------------- change change this variable
0x7380E Setting: virtualization technology, variable: 0x1B0 [1] {05 09 B0 01 01 5C 00 5D 00}
0x73817 Option: enabled, value: 0x1 {09 09 83 00 01 00 04 45 00}
0x73820 Option: disabled, value: 0x0 {09 09 84 00 00 00 05 45 00}
0x73829 End of options {10 02}
0x7382B End If {18 02}

In my case the number 45 will have to be changed to FF, so open Hxd change the value in the offset and repeat the procedure as above with the useful tool.

Method 3

these changes can also be made in other ways, without flashing the BIOS, but modifying the one already present, the shell method exists, in my case it didn't work,
so you can use the H2Ouve.exe software:

iimage link: https://ibb.co/25tMhrm

We always work on virtualization technology that the default on my laptop is disabled.
We have seen above that the variable is:

0x73807 Variable 0x225

and if deactivated the value is 00 if activated the value is 01
so to understand where to modify this variable on H2Ouve we have to take the variable 0x225 and go to the column in 220 and to the row number 5 and insert the value 01

link image: https://ibb.co/Q8TnXnn

in this case you just have to save and the setting will be saved in the BIOS.
It's not permanent if we wanted to delete it, just reset to reset the settings from the BIOS or by disconnecting the cmos battery.

unlock advanced and power boards

The methods described above do not unlock the functions of the hidden tabs as often happens (Advanced and power) but unlocking are the hidden functions of the active tabs.
To unlock the hidden cards I was still helped by Mr. Donovan with his guide even if generic and therefore they did not work for my laptop but they are close (at least I hope),
but there are neighbors (at least I hope), for this we need another softwrae called ida.exe.
It does nothing but disassemble and show us the various sequences using flowcharts to make us understand how the logic of our BIOS works.

link image: https://ibb.co/ygm5Lgb

in my case the 1800747C0 is the offset of the tabs advanced variable

link image: https://ibb.co/xzbbfp5 in this image the call is shown

In theory with this method you would need JZ (conditional jumps) and in a certain sense bypass them. I have not found them in mine, and here I ask the help of someone more experienced.

link image: https://ibb.co/BLY4DXB

I don't know how to proceed, but I feel I am very close to the solution ...

The Solution :

Code:
Bios v.F.16 Model 03672 Menu Tabs Unlock Mod :

                                   Form Sets
--------------------------------------------------------------------------------
Offset:        Name:
--------------------------------------------------------------------------------
0x12300        Exit (0x158)
0x12430        System Configuration (0x5B)
0x12B10        Power (0x38E)
0x133D0        Diagnostics (0x42)
0x13440        Security (0x36)
0x13530        Advanced (0x182)
0x17730        Main (0xD0)
0x17890        Main (0x4)

065D : 74 5B  to  74 00               jz      short loc_1800006BA  to  jz  $+2
0668 : 74 50  to  74 00               jz      short loc_1800006BA  to  jz  $+2
0673 : 74 45  to  74 00               jz      short loc_1800006BA  to  jz  $+2


Code:
Bios v.F.16 Model 03674 Menu Tabs Unlock Mod :

                                   Form Sets
--------------------------------------------------------------------------------
Offset:        Name:
--------------------------------------------------------------------------------
0x80400        Main (0xE8)
0x806C0        Exit (0x384)
0x807D0        System Configuration (0x5B)
0x80E90        Power (0x301)
0x813D0        Security (0x36)
0x814C0        Advanced (0xF5)
0x85350        Diagnostics (0x42)

0651 : 74 50  to  74 00     jz      short loc_1800006A3  to  jz $+2
065C : 74 45  to  74 00     jz      short loc_1800006A3  to  jz $+2


Code:
Bios v.F.16 Model 03676 Menu Tabs Unlock Mod :

                                   Form Sets
--------------------------------------------------------------------------------
Offset:        Name:
--------------------------------------------------------------------------------
0x73450        Main (0xE9)
0x735D0        Exit (0x365)
0x73700        System Configuration (0x5B)
0x73DD0        Power (0x2E5)
0x746D0        Security (0x36)
0x747C0        Advanced (0xFB)
0x77B10        Main (0x4)
0x77DD0        Diagnostics (0x42)

067B : 74 55  to  74 00               jz      short loc_1800006D2  to  jz $+2
0685 : 74 4B  to  74 00               jz      short loc_1800006D2  to  jz $+2
068F : 74 41  to  74 00               jz      short loc_1800006D2  to  jz $+2


It will helps many users !
Regards
find
quote
#2
Wink 
I am glad that they helped you at least on the win-raid forum.
So what did YOU done:
It's 2-byte SHORT Jumps
   
and they patched iscflash.dll
[Image: DLL-patch.jpg]
find
quote
#3
Hello, i'm trying to flash a insydeh20 bios that i have modded but the software insyde flasher refuse to write. Is it possibile to have the isc.dll modified to allow flashing of modded (non rsa) bios?

Inviato dal mio Mi Note 10 Lite utilizzando Tapatalk
find
quote
#4
(03-08-2021, 05:39 AM)Pa0l0ne Wrote: Is it possibile to have the isc.dll modified to allow flashing of modded (non rsa) bios?
Hi! It's possible. I need your flashing pack.
find
quote
#5
(03-08-2021, 05:58 AM)Maxinator500 Wrote:
(03-08-2021, 05:39 AM)Pa0l0ne Wrote: Is it possibile to have the isc.dll modified to allow flashing of modded (non rsa) bios?
Hi! It's possible. I need your flashing pack.
Thank you very much!! I will attach it when i come home. Thanks in advance!!!

Inviato dal mio Mi Note 10 Lite utilizzando Tapatalk
find
quote
#6
Hello, do You think that with this guide I could add a new wifi card that is not in whitelist on my Probook 4320s?
Thanks
find
quote
#7
(03-14-2021, 03:59 AM)CapVi Wrote: Hello, do You think that with this guide I could add a new wifi card that is not in whitelist on my Probook 4320s?
No.
find
quote
#8
Hello leolift,

I wanted to extend my thanks on behalf of BIOS-Mods.com to you for writing up and sharing this information. I am currently studying how to modify Insyde BIOS images myself, so this guide has been very helpful.

I am sticking this thread under Important Threads in this section.

Thanks again!

!!!!!PLEASE READ!!!!!! Our Ukrainian friends are undergoing atrocities right now and need support. There are two things you can do for starters:

1.) Donate to one of various organizations offering medical, military, and psychological support to those impacted: Support Organizations

2.) Combat misinformation on social media. 

Also, please feel free to PM me if I have not replied again about your BIOS mod request after 5 days.
www find
quote
#9
Hello, do you believe I could use this process to install a new wifi card that isn't on the whitelist to my Probook 4320s?
cookie clicker 2
find
quote
#10
(06-26-2021, 02:40 AM)aricjoshua Wrote: Hello, do you believe I could use this process to install a new wifi card that isn't on the whitelist to my Probook 4320s?
ProBooks has no insyde bios.
find
quote


Forum Jump:


Users browsing this thread: 1 Guest(s)