[request] hp envy 15-jxxx bios mod

[cloud17]

Hi, can anyone please help me unlocking the advance menu + advance boot menu for AHCI, I have dumped my bios using insyde tool and spi flasher (RPi 2 model b)
and extracted them using phoenixtool266 and have revealed the EFI strings

this from my SPI Flasher dump
  FE3542FE-C1D3-4EF8-657C-8048606FF670 IFR.txt (Size: 535.44 KB / Downloads: 7)

Code:

                                  Form Sets
--------------------------------------------------------------------------------
Offset:  Title:
--------------------------------------------------------------------------------
0xAC118  System Configuration (0x63 from string package 0x0)
0xADCF8  Power (0x41B from string package 0x0)
0xAFDC8  Security (0x133 from string package 0x0)
0xB1308  Advanced (0x1C9 from string package 0x0)
0xBFD08  Main (0x103 from string package 0x0)
0xBFFC8  Exit (0x187 from string package 0x0)
0xC0098  Diagnostics (0x49 from string package 0x0)
0xC01B8  Security (0x3D from string package 0x0)
0xC0278  Main (0x4 from string package 0x0)

and below from insyde tool flash dump (by changing the platform.ini file)
  FE3542FE-C1D3-4EF8-657C-8048606FF670_898 IFR insyde3.txt (Size: 537.68 KB / Downloads: 8)

Code:

                                   Form Sets
--------------------------------------------------------------------------------
Offset:  Title:
--------------------------------------------------------------------------------
0xAC1BC  System Configuration (0x63 from string package 0x0)
0xADD9C  Power (0x41B from string package 0x0)
0xAFE6C  Security (0x133 from string package 0x0)
0xB13AC  Advanced (0x1C9 from string package 0x0)
0xBFDAC  Main (0x103 from string package 0x0)
0xC006C  Exit (0x187 from string package 0x0)
0xC013C  Diagnostics (0x49 from string package 0x0)
0xC025C  Security (0x3D from string package 0x0)
0xC031C  Main (0x4 from string package 0x0)

don't know why the offsets are different.. could some one explain?
both of these are extracted from "setuputility" branch with GUID of FE3542FE-C1D3-4EF8-657C-8048606FF670
I have tried using efi shell to setup_var 0x39 0x01 (that's for ahci boot) and it fails
also tried to disable BIOS Lock 0x4bb fails as well with unable to set efi, but I know why cause its locked by [censored] HP
here are some more info I managed to get from UEFITool

Code:

Full size: 1000h (4096)
ME region offset:   1000h
BIOS region offset: 300000h
Region access settings:
BIOS:0B0Ah ME:0D0Ch GbE:FFFFh
BIOS access table:
      Read  Write
Desc  Yes   No 
BIOS  Yes   Yes
ME    No    No 
GbE   Yes   Yes
PDR   No    No 
Flash chips in VSCC table:
1F4700h
EF4017h
1C7017h
C84017h
C22017h

I want to unlock advance settings, my bios is RSA signed would that make a difference if I use hardware flasher?
how can I set the variables in the bios so I can flash it and install my hackintosh, need help

I have attached the insyde tool bios dump here 
  1966 insyde tool dump.bin (Size: 8 MB / Downloads: 12)
regards

[cloud17]

anyone please help!
bump

edit:
I have flashed after modding the bios enabling advance boot options but the laptop recovers the modded bios automatically maybe RSA signature failed ? or hash mismatch? , I honestly don't know so I'm stuck here with my laptop opened up and Raspberry pi connected to it

edit2: flashed backup of bios without mod seems okay no problem so I need a way to resign the bios or fix hash issue

[cloud17]

update: I'm trying to override the RSA signature check in bios I have come to a stand still and don't know how to proceed I found a module named "UEFIbiosimageinterface" trying to disassemble it in IDA pro gives me this (its an online version if the ida) https://www.onlinedisassembler.com/odaweb/wPWIC9sk/0 my basic knowledge in assembly says it have functions to write the bios (am I right?) please tell me if I'm looking in the correct area for disabling signature check on the bios. thanks