Another interesting thing is that people have found a way to adjust some hidden bios settings through an app called OEMserv. Here's the link to it: https://mega.nz/#!Kz5VDYbR!qy7_d3i11G67B...nts7kY1zT4Iqc0Q

Most people use it to set the bios to accept higher wattage from the power adapter. In the following I copy some instructions of how to use it and some other settings in it people haven't been able to use. Mostly interestingly, there's an option called "HiddenPage : Enable/Disable the Hidden Page in BIOS Setup." but we don't know what value should we set that option to, so it seems no body has tried that.

How to use it:
- Download the file and open the correct folder regarding your laptop version
- Open F.bat with a text editor
- Find the following line : OemServiceWinApp.exe AdpType /Set #
- Depending on your AC adapter, replace the # at the end by : 1 (?W adapter), 2 (180W adapter), 3 (150W adapter), 4 (120W adapter)
- Save the file and run it as administrator
- Reboot and you're done

other settings:
********************************************************************************
* Uniwill OEM Service Application - Version 00.01 *
********************************************************************************
=>Help : Print all command sets.
=>RWBlock0 : Reada/Write Block 0 data.
=>MeUnlock : UnLock Intel ME region.
=>RgbLb : RGB LightBar Configurations.
=>AdpType : Adapter Type configuration.
=>NbType : Notebook Type selection.
=>HiddenPage : Enable/Disable the Hidden Page in BIOS Setup.
=>LOGO : Dump/Load Logo data.
=>SubWoofer : SubWoofer configuration.
=>SetApCtrl : Set AP support control.
=>RgbKb : RGB Keyboard configuration.
=>OCValue : Nvidia OverClocking configuration.
=>SWBID : SW Board ID configuration.
=>KBLBID : Set KB Board ID configuration.
=>OemTdr : OEM TDR configuration.
=>LEDKB : LED Keyboard configuration

Zitat von Johnazz im Beitrag #45

---

I just tried the rebuilt BIOS from @CLP0's setup.efi. The flash didn't succeed. I ran the f.bat and it stopped after it finishes "Loading capsule to secure memory buffer ... 0x008DD800" and didn't proceed to flash the BIOS.

Here's a 20s video I captured for what happened after opening the f.bat: http://s000.tinyupload.com/?file_id=43290852336041680509

---

That's bad news. Thanks for testing and sorry you had to get the programmer out but good that you can do that. Maybe it doesn't like the hidden Advanced being empty, idk. Perhaps we should have tried a smaller change first such as revealing one of the suppressed options first and then copying an option instead of moving it. Given the result lets see what @Lost_N_BIOS comes up with.

@Johnazz - Sorry I didn't think of that, about AFU and mod BIOS! I did initially think of this here, getting FPT dumps from a few members, but then didn't remember to mention later with the quick insertion of @CPL0's setup.
Sorry, this is commonly an issue with mod BIOS. For anyone that wants to flash that file via FPT, it will flash (use -bios region switch), but you may loose your system specific details unless you send me a -bios region FPT dump to mod instead. Luckily "BIOS Lock" is already disabled, so grub/setup_var change is not needed.
Any settings changes you want, even for settings not visible in the BIOS may be changed with AMIBCP (5.02.0031 or 0023) and then BIOS reflashed, or make same changes via grub / setup_var using the setup IFR to get your setting variables (VarOffset/VarName ID) from (Let me know if you need a copy of the IFR)

What was this OEMService app originally designed for use on, this system? I see inpoutx64.dll is made by highrez.co.uk (High Resolution Enterprises) w/ thanks to Red Fox UK for x64 Vista compatibility.
This website make it look like this is from "BIOS Hackers' like us, rather than some OEM/laptop company. AMIDEWIN is a general AMI DMI type application
If it was made for these systems, then that hidden page may reveal the second advance, or maybe some random page with only a few more settings shown, I'd say try it if it's made for this system.
I assume it's not, since you have RGB keyboard and subwoofer etc, sounds like it was made for a mainsteam branded laptop like Asus or MSI etc, but maybe some of these do come with such advanced features?

@nimaim - Very surprised to see it fail but thank you for FPT testing, sorry you had to recovery but it happens sometimes when trying to find out of the box ways to modify a BIOS.

@CPL0 - I didn't even look to see the changes you made, just inserted and sent as a package, I should have left out AFU/bat etc to avoid this confusion, that's my fault I did test IFR output just now, and it's fine, so the changes you made at least at that level came out OK
I've had varying results, but never a "visible" success unsuppressing a hidden setting inside a hidden menu. I've never seen it make a menu visible nor the unsuppressed setting, but sometimes is bootable, other times instant blank bootup, all depends on the BIOS/brand etc.

I've looked through the setup in IDA assembly, and have a few suspected jumps to bypass, but am not certain and it's tough to hand out a BIOS that you know may fail instantly, wish I had a board here to quickly test/recover. Have you looked in assembly at all?
Do you know of a method or tool I can use to get the exact 0xoffset/ID-unk_xxxx/loc_1x000xxxx used by each menu? I know how to easily do that for Insyde BIOS, but unsure for AMD, it's not same as AMIBCP handles, or IFR output menu offsets.
If I knew how to do that, we'd be done by now because I wouldn't be unsure which jumps to change! I may have to give in and send @nimaim a bunch of probably failed boot files to test, if he's up for a large round of recoveries trying to figure it out through successive jump edits

Zitat von Lost_N_BIOS im Beitrag #49

---

@Johnazz - Sorry I didn't think of that, about AFU and mod BIOS! I did initially think of this here, getting FPT dumps from a few members, but then didn't remember to mention later with the quick insertion of @CPL0's setup.
Sorry, this is commonly an issue with mod BIOS. For anyone that wants to flash that file via FPT, it will flash (use -bios region switch), but you may loose your system specific details unless you send me a -bios region FPT dump to mod instead. Luckily "BIOS Lock" is already disabled, so grub/setup_var change is not needed.
Any settings changes you want, even for settings not visible in the BIOS may be changed with AMIBCP (5.02.0031 or 0023) and then BIOS reflashed, or make same changes via grub / setup_var using the setup IFR to get your setting variables (VarOffset/VarName ID) from (Let me know if you need a copy of the IFR)

What was this OEMService app originally designed for use on, this system? I see inpoutx64.dll is made by highrez.co.uk (High Resolution Enterprises) w/ thanks to Red Fox UK for x64 Vista compatibility.
This website make it look like this is from "BIOS Hackers' like us, rather than some OEM/laptop company. AMIDEWIN is a general AMI DMI type application
If it was made for these systems, then that hidden page may reveal the second advance, or maybe some random page with only a few more settings shown, I'd say try it if it's made for this system.
I assume it's not, since you have RGB keyboard and subwoofer etc, sounds like it was made for a mainsteam branded laptop like Asus or MSI etc, but maybe some of these do come with such advanced features?

@nimaim - Very surprised to see it fail but thank you for FPT testing, sorry you had to recovery but it happens sometimes when trying to find out of the box ways to modify a BIOS.

@CPL0 - I didn't even look to see the changes you made, just inserted and sent as a package, I should have left out AFU/bat etc to avoid this confusion, that's my fault I did test IFR output just now, and it's fine, so the changes you made at least at that level came out OK
I've had varying results, but never a "visible" success unsuppressing a hidden setting inside a hidden menu. I've never seen it make a menu visible nor the unsuppressed setting, but sometimes is bootable, other times instant blank bootup, all depends on the BIOS/brand etc.

I've looked through the setup in IDA assembly, and have a few suspected jumps to bypass, but am not certain and it's tough to hand out a BIOS that you know may fail instantly, wish I had a board here to quickly test/recover. Have you looked in assembly at all?
Do you know of a method or tool I can use to get the exact 0xoffset/ID-unk_xxxx/loc_1x000xxxx used by each menu? I know how to easily do that for Insyde BIOS, but unsure for AMD, it's not same as AMIBCP handles, or IFR output menu offsets.
If I knew how to do that, we'd be done by now because I wouldn't be unsure which jumps to change! I may have to give in and send @nimaim a bunch of probably failed boot files to test, if he's up for a large round of recoveries trying to figure it out through successive jump edits

---

@nimaim - you are OK with program testing a bunch of BIOS that will likely brick and need recovery each time? Well you can flash then in via FPT after first one if you want, I will unlock FD for all, so only programed in one will be required for first test.
Unless you go from one brick or failed test to recovery using next test file as recovery/next test source, then you'd have to program in each one as you go.
If yes, we can get to the bottom of this fairly quickly then I think, give me some time to make a pile of edited test BIOS for you

Zitat von Lost_N_BIOS im Beitrag #51

---

@nimaim - you are OK with program testing a bunch of BIOS that will likely brick and need recovery each time? Well you can flash then in via FPT after first one if you want, I will unlock FD for all, so only programed in one will be required for first test.
Unless you go from one brick or failed test to recovery using next test file as recovery/next test source, then you'd have to program in each one as you go.
If yes, we can get to the bottom of this fairly quickly then I think, give me some time to make a pile of edited test BIOS for you

---

Zitat von Lost_N_BIOS im Beitrag #49

---

I've looked through the setup in IDA assembly, and have a few suspected jumps to bypass, but am not certain and it's tough to hand out a BIOS that you know may fail instantly, wish I had a board here to quickly test/recover. Have you looked in assembly at all?
Do you know of a method or tool I can use to get the exact 0xoffset/ID-unk_xxxx/loc_1x000xxxx used by each menu? I know how to easily do that for Insyde BIOS, but unsure for AMD, it's not same as AMIBCP handles, or IFR output menu offsets.
If I knew how to do that, we'd be done by now because I wouldn't be unsure which jumps to change! I may have to give in and send @nimaim a bunch of probably failed boot files to test, if he's up for a large round of recoveries trying to figure it out through successive jump edits

---

Zitat von CPL0 im Beitrag #53

---

Zitat von Lost_N_BIOS im Beitrag #49

---

I've looked through the setup in IDA assembly, and have a few suspected jumps to bypass, but am not certain and it's tough to hand out a BIOS that you know may fail instantly, wish I had a board here to quickly test/recover. Have you looked in assembly at all?
Do you know of a method or tool I can use to get the exact 0xoffset/ID-unk_xxxx/loc_1x000xxxx used by each menu? I know how to easily do that for Insyde BIOS, but unsure for AMD, it's not same as AMIBCP handles, or IFR output menu offsets.
If I knew how to do that, we'd be done by now because I wouldn't be unsure which jumps to change! I may have to give in and send @nimaim a bunch of probably failed boot files to test, if he's up for a large round of recoveries trying to figure it out through successive jump edits

---

Yes I had a look, remember the ManufacturerMode? looks like it was meant as an nvram variable but decided to use RTC cmos. Doesn't seem to be much in the way of error checking either. The arrays are there for the forms such as 2710h (10000) to 271ch, see offset 0x55c60 and 55de0 plus a horrible table at 0x55750. Also table at 0x534c0 and setup form at 0x5330e. How exactly they are selected idk. The BCP handles seem to be just label numbers for texts with an offset of +11 (0xb).

@nimaim are you familiar with EFI shell?

---

@CPL0 - sorry, I thought you mentioned ManufacturerMode from looking at AMITSE via hex or something, didn't realize you were looking at that in assembly modes. Yes, I think the BCP handles also line up with the help strings you can export via BCP, but I didn't check for this BIOS.
Thank you for the info and offsets to check out, maybe that will help me identify proper offset/ID's to use to edit the setup module. Is what you mentioned in AMITSE or Setup?

@nimaim - yes, if I had the board it would be much easier from my end, I wonder how much replacement board cost on ebay, have you looked? Thanks for being guinea pig, I'm sure once we figure it out you'll be drown in praise!
Give me some time to look at the stuff CPL0 mentioned, and then get back to the setup module and see if I can narrow things down more so less testing on your end.
In the meantime, make a full image of your BIOS via programmer and make sure it's all OK and can be programmed back in without issue. I assume you probably have done this already, but in case not that is step one!

Zitat von Lost_N_BIOS im Beitrag #55

---

@CPL0 - sorry, I thought you mentioned ManufacturerMode from looking at AMITSE via hex or something, didn't realize you were looking at that in assembly modes. Yes, I think the BCP handles also line up with the help strings you can export via BCP, but I didn't check for this BIOS.
Thank you for the info and offsets to check out, maybe that will help me identify proper offset/ID's to use to edit the setup module. Is what you mentioned in AMITSE or Setup?

@nimaim - yes, if I had the board it would be much easier from my end, I wonder how much replacement board cost on ebay, have you looked? Thanks for being guinea pig, I'm sure once we figure it out you'll be drown in praise!
Give me some time to look at the stuff CPL0 mentioned, and then get back to the setup module and see if I can narrow things down more so less testing on your end.
In the meantime, make a full image of your BIOS via programmer and make sure it's all OK and can be programmed back in without issue. I assume you probably have done this already, but in case not that is step one!

---

@nimaim - I've seen some motherboards for laptops on ebay for decent prices, sometimes only $45 or so too, and I have 100's of CPU's so would only need the board. Probably wont see any on their for a year or two though, if this is a "new release" at least not at decent prices.
Thanks for confirming your backups are done and proven, makes me feel better for the BIOS edits I will hand you shortly! Probably wont "need" to recover, just will have jacked up menus or blank menus until you reflash something else, but just in case you can't get into BIOS or DOS to reflash, be ready.

* Edit - @nimaim - maybe only one test needed? But surely, I doubt I can get that lucky, you never know?
This is built from stock BIOS that was posted previously intel_CFL_GK5CN6Z_ESI_BIOS_N.1.05_EC_1.35.09_20181101, anyone else using may loose board details if flashed via FPT -
http://s000.tinyupload.com/index.php?fil...417513545692690

If this fails, next time I will package up a lot more BIOS for you to test, stopped at only this one first because it looked like maybe I could get lucky and be done right there.
This includes two BIOS to test, I included two because I wanted to see if only half of my edit here would enable one menu, then second BIOS enable both.
Only 4 bytes have been changed in total, two bytes in the "1" BIOS and 2+2 in the "2" BIOS. I think one enables one hidden menu, and two will enable both, IF I get lucky and that was the spot

Will test after work today and post results, thank you!

Great, thanks! I was thinking, after I sent that, it will be hard to know if this kind of assembly change will also need AMIBCP set to user on top of that too, so maybe next round if these fail I will do assembly edit and include those then duplicates of those with AMIBCP edit on top too.
Sometimes that is needed when other methods do work to unlock menus, sometimes must use 2 methods or even three at once before it works, it's always tough to know for sure until you've rule everything out.
I want to send you AMIBCP edits on top of these you have now, but we'll see how it goes, if it's a fail I'll toss out some quick edits on those too for you to test before I edit anything else in assembly.

^ Sure thing Lost_N_BIOS ... gimme til end of day to test it. I will definitely get to it later today.

Agree, probably better to stick BCP edits on top as well. I feel like one of these methods may have already worked but because we didn't change everything at once, the changes did not surface.