@Lost_N_BIOS Thank you very much for the detailed tutorials and instructions.
I meet the similar problem with @dreamcat4 on Intel-TongFang LAPQC7 (Element/Fusion 15/MAG-15/Vapor 15 Pro) and found this thread. I am also curious if it is possible to obtain more GPU options in BIOS. I see that you needed QC7 BIOS information last Oct, so I attach them and hope it can be useful. (Sorry for the poor quality, it seems that F12 can't work

--------------------
Model name: Intel LAPQC71A (and GK5CxxT MB V1.1 on PCB
BIOS link: https://downloadcenter.intel.com/downloa...te-QCCFL357-86A-
BIOS version: QCCFL357.0114.2020.0401.1544
ME version: 12.0.40.1433
EC version:1.25.09
Intel® Aptio * V Integrator-Tools for it: https://downloadcenter.intel.com/de/down...ntegrator-Tools

QC7 BIOS Image package:
https://drive.google.com/file/d/1U0hkBCO...iew?usp=sharing
QC7 BIOS Dump with FPTW64.rar
https://drive.google.com/file/d/1l8ngi2n...iew?usp=sharing
--------------------

In my testing, I can use FPTW64 12.0.6.1120 to dump and modify the BIOS bin file with UEFITool 0.28.0 and AMIBCP 5.2.0.31.
But the writing process reports an Error 301 even with original dumped bin file. Is it the BIOS Lock?

C:\BIOS>FPTW64.exe -f mod.bin -bios
Intel (R) Flash Programming Tool. Version: 12.0.6.1120
Copyright (c) 2007 - 2018, Intel Corporation. All rights reserved.
Reading HSFSTS register... Flash Descriptor: Valid
--- Flash Devices Found ---
GD25B128C ID:0xC84018 Size: 16384KB (131072Kb)
Error 301: Protected Range Registers are currently set by BIOS, preventing flash access.
Please contact the target system BIOS vendor for an option to disable Protected Range Registers.
FPT Operation Failed.

Thank you again, have a nice day.

@pitch007 - So you bricked the BIOS already, how did you do that? If yes, don't return it, just get a $6 flash programmer setup and fix it, You need CH341A + SOIC8 test clip w/ cable, let me know if you need linked examples
Do you mean the "Exit" page of the BIOS, that you want an image of? If yes, @iNova.bat @2010ngojo @Zeddi @geekasm @pcfr33k @vikss - all have the GK7CN6S - OP-LP3 model I believe, maybe one of them can give you image of the exit page and or tell you what shortcuts are there if any (any shortcut in BIOS can be used on any page)

@yezishu - You're welcome, and thanks to you as well!
Please use UEFITool 25, not 28, unless you know how to check the before/after BIOS, it may cause a bricked BIOS.

Looks like you need to disable FPRR/PRR via grub, same way we disable BIOS lock, SMI Lock, etc. Guide about that is here if you don't already know - [GUIDE] Grub Fix Intel FPT Error 280 or 368 - BIOS Lock Asus/Other Mod BIOS Flash
Or, changes may need to be made via RU method instead, if grub fails - RU method to unlock BIOS Lock (or any other setting) is here, Go to section 2.2 and make bootable USB with RU program, then read 2.3-2.5
http://forum.notebookreview.com/threads/...-issues.812372/

If this system has actual Intel BIOS in it (Insyde), not AMI, then you may not be able to modify like I've shown here.
And, if actual Intel made, you may not be able to modify and flash BIOS at all without flash programmer. But, I've never seen Intel make anything like this?

Even after you make changes in grub or RU, you still may need flash programmer due to Intel touched this BIOS
Be sure you disable all of the following if found, BIOS Lock, SMI Lock, FPRR/PRR/Protected Range Register, BIOS Guard, RTC Memory Lock, - And Enable this one >> Force unlock on all GPIO pads

Anything from October I don't remember Thank you for uploading files though
What is the difference between "BIOS Link" and "QC7 BIOS Image package" above? I don't want to download same thing twice.

@Lost_N_BIOS thank you very much for your help and detailed guidance.

This series is manufactured by Tongfang, Intel and secondary sellers added their own stickers and logos. As you say, intel never made BIOS itself, and the "Aptio V" is a an AMI product name.....I think intel/Tongfang ordered it from AMI. Furthermore, the CAP file can be modified by AMIBCP and useded in ordinary updating, before file validity verification failed.

Previous progress:
In this thread #366 and #368, I saw @dreamcat4 asked for help in unlocking and you had downloaded an earier version of this QC7 model's BIOS, and would add XMG Fusion 15 and Eluktronics MAG 15 (same model) to the top guide. In a later reply the BIOS seemed to be a mess :-) , and BIOS screenshots were needed for comparison. I think it means that the QC7 BIOS is somehow similar to other AMI bios?

The attachment:
The "QC7 BIOS Image package" is only the screenshots of BIOS main menu for reference.


-----------------------------------------
Update：
As your guidance, I change to UEFITool 25.0, and find BIOS Lock and Flash Protection Range Registers.

I read the variable value of BIOS Lock(0xB4C) , try to change it from 0x01 to 0x00.
But grub-2.00+20130519 and Ru 5.25.0379 both report error in writing 0x00:

Grub: Error：can't set variable using efi (error:0x000000000000001a)
Ru: Write variable failed: 0x0000001A

Thanks again for your guidance.

---------------------

CH341 works, but after replace in the edited AMITSE module, the bios auto turn off laptop before BIOS logo.
The same problem occurs with the modification of the BIOS LOCK option in setup menu with AMIBCP.
I doubt it may be Boot guard, so I check ME info, but can't find Measured Boot and Verified Boot in it.
Could you please give me some tips on my modification? @Lost_N_BIOS

Dumped BIOS
https://drive.google.com/file/d/1BL2ga2C...iew?usp=sharing
Modified BIOS (Can not work)
https://drive.google.com/file/d/1txmuhcY...iew?usp=sharing
ME info
https://drive.google.com/file/d/12k6Z8ds...iew?usp=sharing

@yezishu - you probably need to use other method, like RU to change variable then if grub/setup_var does not work (or SCEWin) - Maybe I gave you wrong info, maybe BIOS Lock etc is not in "Setup" I will check now and let you know (it's in setup, so this is not the issue)
For MEINFOWin -verbose, please run that again using latest ME System Tools package, current is r24 (or newer), and you are using very old r9 - We'll check that again first, before I look at anything else here
If that is OK and Measured/Verified boot is not enabled at FPF side, then your mod or AMITSE replacement may have been done incorrectly.

Please make sure before you dump BIOS, then you can mod, that all the following = true >> Secure Boot Disabled, Any BIOS password removed, any Encryption or TPM disabled, BIOS Guard Disabled (if you can see it, it looks like it should be disabled by default)
Your mod BIOS doesn't look too bad, I don't see any issues generally. If Boot Guard is not enabled at the PCH/FPF side, I will make you test BIOS with one menu change only, may be 2-3 BIOS to test. It's best to test that way before doing all at once, that way you can figure out working method, then do to all at once
But, if Measured or Verified Boot enabled at FPF side you cannot mod this BIOS menu-wise

* Edit - From this post, user with same system, Measured & Verified boot both enabled, so no menu mods can be done to this model (only change current applied settings, visible or hidden)
OverPowered TONGFANG CyberPower Machrevo MACHENIKE - Unlocked BIOS Guide W/ Files (23)

Sad that the Measured Boot and Verified Boot are both enabled in MEinfo 12 r24 result, thanks to Intel ToT
That may be the reason why grub/RU/CH341 method both failed.

Measured Boot Enabled Enabled Enabled # Disabled=0, Enabled=1
Verified Boot Enabled Enabled Enabled # Disabled=0, Enabled=1

new MEinfo File link:
https://drive.google.com/file/d/10_eGCQj...iew?usp=sharing


Is there any tutorial in changing the current applied values? One of my target is to change CPU and GPU themal configurations, I can see some CPU themal configuration options with AMIBCP. And GPU themal configurations is in vbios?

For example, with third-party software such as ASUS GPU tweakII I can change the GPU temperature limit from default 75C to 87C (and Intel XTU works on CPU, too), I want to know if some method can work without those software.

Thanks again.

@yezishu - Not sure on Grub/RU, but yes, that could be why. It would for sure be why any dumped BIOS with programmer that was then edited within a boot guard covered area would fail. You can see what is covered by Boot Guard with UEFITool NE, any area covered in yellow, cyan, or red cannot be touched.
So yes, we can change all settings current values, hidden or visible to you in BIOS, via NVRAM edit because this is not covered by boot guard. Please wait until we test out and find correct method for this system in the other thread, unless you want to send me your dumped BIOS and give me exact list of settings you want changed and what you want them changed to.
If you send dump to me, please be sure before you dump that Secure Boot is disabled, any encryption or TPM is disabled, and all BIOS passwords are removed/un-set, then dump and send to me with your list of settings and what you want them changed to.

Sorry, there is not any tutorial on this kind of edit, I need to make a guide sometime.
It's kinda tough to explain, so that may be why I have not yet, but in the two links below, I tried to explain to users a few times at random threads (do not edit the internal NVRAM mentioned inside main BIOS volume, nor any PEI copies if mentioned, only top of BIOS region NVRAM)
NVRAM edit explained - Determine configurable aperture size from BIOS file
Setup and NVRAM editing here as well - [Request] Unlock advanced menu on 2019 Acer Predator Helios 300 PH315-52 (5)

Hello, may I ask a question that may be slightly irrelevant?

For my main need (modify the CPU and GPU temperature limit), recently I checked and confirmed the NVRAM variable and found that the GPU temperature limit is not in it. I also tried to flash vbios from other model into it, new vbios works but the GPU temperature limit keeps the same.

Does this mean that temperature limits may be written in the EC? Have you heard of some precedents of thrid-party EC modification? I wouldn't be surprised if it is very difficult and dangerous and not for non-professionals like me.

@yezishu - Sometimes that is controlled by EC FW, but not always. Since you checked, how did you check? What is the exact BIOS settings by name, if you checked a BIOS setting? If it is a BIOS setting, it's value is stored in NVRAM
When you say you flashed in other vBIOS, was that directly to chip, or inside of the motherboard BIOS? If inside the motherboard BIOS, what GUID is this?
If it was in the BIOS, and inside main DXE region and your edit didn't = brick, that is surprising due to Boot Guard enabled at PCH, it may mean we can also unlock your menu if this is true
Editing EC FW I don't know of any tools that work for that kind of thing.

1. I checked the SCEWIN nvram output file. For example, some CPU temperature options are like this, and their seetings can also be found in hidden menu in AMIBCP:

Setup Question	=  Passive Thermal Trip Point
Token	=28A	// Do NOT change this line
Offset	=3BD
Width	=01
BIOS Default	=<71> 
Value	=<71>
 
Setup Question	=  Critical Thermal Trip Point
Token	=28B	// Do NOT change this line
Offset	=3BE
Width	=01
BIOS Default	=<100> 
Value	=<100>
 

There are too many temperature options here, I am still looking (it would be much easier if I can unlock the menu, but...). But I did't see GPU/VGA related options.

2.I am not sure about this ....In order to flash vbios in, I used NVflash in win10 CMD(nvflash64 -6 xxx.rom) and prepared to repair bios by SPI. Unexpectedly, no problem happens.
Maybe: 1. vbios has its own chip on the motherboard; 2. vbios is not in the Boot Guard area；
A vbios that works: https://www.techpowerup.com/vgabios/2106...ile-6144-190311

3. Thank you very much again. I think the manufacturers‘ EC tools only for theirself.

Yes, usually there is not any GPU/VGA option, if none of the options affect temps/fan speeds you find in BIOS then it's all EC FW controlled. SCEWin may not show all options, best to check with Setup IFR AND AMIBCP

Yes, some GFX cards have vBIOS on card itself, others are inside BIOS, that's why I asked what method you used.
Since you use NVFlash the vBIOS on card and if you can modify that cards series of vBIOS (ie not encrypted by Nvidia, there is mod tools etc) then that is how you would adjust card controls such as freq, fan speeds, TDP etc.
There is some EC FW tool, but I've not seen them ever work for anything, you can download entire package that I know about here - https://github.com/MorgenZhu/ITE_ECTool << Click Code >> Download Zip
See also here for some relevant info - https://github.com/acidanthera/bugtracker/issues/395

I think maybe Mobile Pascal/Turing TDP tweaker works for your card series, but you need to dump chip with programmer, and then program back
This is encrypted series Nvidia, so it may fail, thus use of programmer suggested - If that happens, then it means you can only flash other same model known compatible vBIOS instead - unedited
https://github.com/LaneLyng/MobilePascalTDPTweaker/releases

Thanks for your advice. Mobile Pascal TDP tweaker works on its vbios (it has not support my 1660Ti on LAPQC71A yet, but I know some one use it on 2070MQ on LAPQC71B model).
The problem is that even they changed TDP to 90w and defaults temperature limit to 87C in vbios and flashed it in, nvidia Inspector still shows a current temperature limit 74C with other value like (low: 74C, high 87C, default 87C ) after rebooting, ignore change of default values. They still need to adjust temperature limit manually. I flashed some vbios without 74 degree limit and got the same result.
I guess there may be some higher priority setting in EC, and the temperature limit in vbios is forced to be set at bootting.

@yezishu - Then probably EC FW controlled as you suspected. If you have flash programmer, and EC FW chip is same type as BIOS chip, you can dump it and try to find those values and change (values probably in hex, and may be in hex/little Endian (backwards))
So look for example 74C >> = 4A 00 or 00 4A, if not spaced out, it may just be a 4A somewhere and that would be tough to ID as correct one to edit unless immediately followed by high or default (87 = 57h)

@Lost_N_BIOS and @yezishu I also have a TongFang QC7 (rebranded as a Maingear Element 15). I've been successful dumping the firmware with chipsec, but I also cannot write the firmware back in software (FPT, Grub, RU) without getting a (error:0x000000000000001a). I was able to write my modified firmware image with a SPI programmer, but every time I boot the laptop and check for the modified UEFI vars they change back to the original value. I verify every time I program the chip and it matches, but after booting the image changes. I redump the image and the md5sums change. Is there another SPI flash chip on-board rewriting the Winbond or could some other chip be doing this? I have found another SPI flash on board, but it's not a Winbond.

Dear @Lost_N_BIOS, could you please, help me assemble a full .bin dump for my GK5CN6Z to flash with ch341a programmer from my BIOS region FPT dumps?

I've uploaded FPT dump to mega here (unmodded one is just biosreg-OPLP2.bin): http s://mega. nz/folder/YU8hxA6D#L2UhJ9tM4PrTWqjJF1CAvA (sorry for the spaces before "s" and "nz" — I am somehow not allowed to post links).

Thank you a lot in advance!

@pitch007
Could you provide me with a dump of your bios since mine is corrupt, I would appreciate it immensely