I do not know what you mean, "you can't in FPT way"?

If you want unlocked BIOS, I can do that for you, but you have to be able to flash mod BIOS or flash FPT (thus disable BIOS lock first)

Hi,

Trying to remove the bios lock default option from my Apex IX bios permanently. Found the variable in the bios dump afr and made note of all the 01 00 hex default values in a long string I searched for in uefitool. This led me to the setupefi Nvram module. There were three of them, but in the first one I found a byte by byte match corresponding to a half dozen default values forward and back. Only problem is this value reoccurs a dozen times in the nvram module. Do I change all of them?

Thanks

@davidm71 - change it in setup module only and test, that may be all you need to edit, this is usually the case. If that does not work, then yes, sometimes you may need to change the value in NVRAM (with BCP first so it also changes in AMITSE/SetupData)
Make 100% sure you are changing the correct thing at NVRAM when you change this, often yes there may be 2-4 etc instances. If you are working on a dump, there may be more, due to "setup" is repeated copies many times in populated NVRAM volumes (check both volumes if it is dump from board)
If you want to edit the AMITSE/SetupData module manually, without BCP, then extract SetupData "Body" and edit >> 3F165h change 01 to 00

Also check the default NVRAM (NVRAM External Defaults module >> SubModule >> StdDefaults) module that's within the main DXE BIOS volume (usually, but not in this case),not the two top NVRAM volumes.
I found it twice in your BIOS, first at second to last volume and second time at last volume. This looks like this in UEFITool if you aren't sure what I meant, and yes, this is your BIOS


When you edit those volumes, be sure on rebuild all "Padding" and Non-UEFI or Non-Empty-padding files remain there and look the same (may need to use UEFITool 25)

So editing the nvram volumes is optional only if editing the last byte code string from 01 to 00 doesn’t work. Ok. Also thanks for explaining why there were so many copies. Thank you.

Yes, usually you do not need to edit all that I mentioned above (plus the NVRAM volumes at top of BIOS that I assume you were referring to). Usually if you change it in setup module then it's disabled always, until you reflash another BIOS with it enabled.
Sometimes that doesn't work, and in those cases, simple setting change with AMIBCP will get it. It's when both don't, then you dig into all we discussed, and I've rarely if ever ran into that

Hi!
I found “bios lock” may not be in the GUID - 899407D7-99FE-43D8-9A21-79EC328CAC21 in some mobos such as DELL T630.
It's "bios lock" is in the GUID - ABBCE13D-E25A-4D9F-A1F9-2F7710786892
So,I could not modify it by grub.
Do you know how to modify it?Thanks!!!

Zitat von gloobox im Beitrag #111

---

Hi!
I found “bios lock” may not be in the GUID - 899407D7-99FE-43D8-9A21-79EC328CAC21 in some mobos such as DELL T630.
It's "bios lock" is in the GUID - ABBCE13D-E25A-4D9F-A1F9-2F7710786892
So,I could not modify it by grub.
Do you know how to modify it?Thanks!!!

---

@davidm71
Thanks for your RU.efi
We usually use the "setup_var" to change the volumes of the setup,and I found the "bios lock" in the GUID - ABBCE13D-E25A-4D9F-A1F9-2F7710786892 which name is "platform"(check by the uefitool NE)
I will try the order "platform_var"~~~

Yes, sorry, I need to make clear in the guide if I did not already, BIOS Lock is not always in same GUID or same module by name even and name of module does not always matter for grub either (so always try, then check issue by error outcome).
Also, some modules contain "Textual Mention" of BIOS lock, but do not control or contain it's setting, so you may be looking at a mention/reference of it and not the actual setting location.
Some BIOS you may need to use modified grub that has setup_var2 or setup_var3 commands. And if BIOS Insyde you may also need to use H2OUVE to change variable, and with that you can specify module you are needing to edit (setup, custom etc).
Some, only direct BIOS mod will work

What error do you get with normal grub, show me an image of command entered and error given.

Found this guide regarding unlocking descriptors on a Dell laptop:

"ME FW Image Re-Flash" and "Disable ME" bios options.

The guy figured out that disabling the variables “Disable ME” and enabling “ME firmware reflash” will give him access to his whole bios albeit individually. So was wondering if the very same variables exist on other mainboards and if so help facilitate pinless modding of the firmware in the case of Coffeelake mods for example?

If anyone could do an afr dump of their setup and check? I would but am away from home.

Thanks

ME Re-Flash settings disable ME for one session, so that it can be re-flashed via FPT, this is on many standard Intel boards. I've only seen the "Disable ME" on certain (very few) Dell's, and many of those have jumpers for this anyway.

@davidm71 @Lost_N_BIOS
This is the Intel S2600CP
The "bios lock" is in the var 0xA60 and is in the guid "blank"(97E409E6……) under the "setup".


And when I used the grub,it showed wrong message no matter I typed "setup_var" or "setup_var2"
"Does not match expected GUID" means var 0xA60 don't exist in the SETUP GUID?

@gloobox - yes that is correct for this BIOS. You may not be able to use setup_var for this BIOS since that is not in "Setup" Or, it may be working/correctly finding the proper module here, but can't edit like this (Sometimes this happens, even with var2 or var3)
For this you'll have to try H20UVE, try all versions - if you need these let me know and I'll send you in PM

H2OUVE.exe -gv vars.txt
H2OUVE.exe -gs -all Setup.txt
H2OUVE -gv var-GUID.txt -g 72C5E28C-7783-43A1-8767-FAD73FCCAFA4 -all (If error, remove -all)

You can try with GUID 97E409E6-4CC1-11D9-81F6-000000000000 but that may not work, since there is about 8 other modules with same GUID

The above is to dump only, to write back after edit
H2OUVE.exe -sv varsM.txt
H2OUVE.exe -ss -all Setup.txt
H2OUVE -sv var-GUID.txt -g 72C5E28C-7783-43A1-8767-FAD73FCCAFA4 -all (If error, remove -all)

After you write back anything, dump it again with new "mod" text name, and check that your correct edit was written in, if not write back the original (unless your new dump matches original, if that is the case re-check your write command and try again)

If all the above fails, your only option is mod BIOS

Wanted to share a more convenient way to access the Shell.efi environment without needing a usb drive. Someone else actually wrote about this elsewhere but good to know. Basically what you do is access your Windows system partition and mount it to a drive letter and copy the Shell.efi file to the root of the system partition. According to what I read you need to this under administrative priveledges by restarting explorer.exe under an admin command window. Once the file is copied all you have to do is go into bios and select boot into efi shell. Kind of cool little trick.

@davidm71 - good trick! Some BIOS may need that file named differently, some BIOS look for Shellx64.efi, I'm not sure how that would react in those cases. Maybe a copy of both in place would be OK?