No rush from my end! I will add BCP edit's on top in duplicates from here on out, just in case. If the above fails I'll immediately send you those duplicated with BCP edit too.
Sometimes it's needed, other times, not, hard to say especially when I couldn't get it sorted without assembly in this case.
Mainly it's because this is newer BIOS style/internal layout, if it was older then the other methods I already tried would have worked, or I would have found magic string to easily enable too.
*edit - here x4 more, same assembly edit but 2x each + BCP edit, in advance in case those fail still and you need to try more while I'm out
http://s000.tinyupload.com/index.php?fil...756782090588652

Zitat von Lost_N_BIOS im Beitrag #57

---

@nimaim - I've seen some motherboards for laptops on ebay for decent prices, sometimes only $45 or so too, and I have 100's of CPU's so would only need the board. Probably wont see any on their for a year or two though, if this is a "new release" at least not at decent prices.
Thanks for confirming your backups are done and proven, makes me feel better for the BIOS edits I will hand you shortly! Probably wont "need" to recover, just will have jacked up menus or blank menus until you reflash something else, but just in case you can't get into BIOS or DOS to reflash, be ready.

* Edit - @nimaim - maybe only one test needed? But surely, I doubt I can get that lucky, you never know?
This is built from stock BIOS that was posted previously intel_CFL_GK5CN6Z_ESI_BIOS_N.1.05_EC_1.35.09_20181101, anyone else using may loose board details if flashed via FPT -
http://s000.tinyupload.com/index.php?fil...417513545692690

If this fails, next time I will package up a lot more BIOS for you to test, stopped at only this one first because it looked like maybe I could get lucky and be done right there.
This includes two BIOS to test, I included two because I wanted to see if only half of my edit here would enable one menu, then second BIOS enable both.
Only 4 bytes have been changed in total, two bytes in the "1" BIOS and 2+2 in the "2" BIOS. I think one enables one hidden menu, and two will enable both, IF I get lucky and that was the spot

---

Thanks for report back so quick, I guess no change is better than trashed boot/bricked BIOS Onto next routine, will attach more test BIOS soon, thanks again from everyone for being willing to run through all these tests
Don't give up so easily, that was only one change, plenty more to go through before we say not looking good. Yes, I did see your images saying Admin/User, that's why I send both ways when I do any BCP edits.

@CPL0 - I could do this a lot easier if I knew how to find each menu or tab ID, like in this example for Insyde BIOS
http://web.archive.org/web/2016111807325...power-tabs.html

I used this think maybe it's these, but then I see 30+ others similar later, and I get stuck/unsure.
unk_1D020
unk_1CFF0
unk_1D000
unk_1D010
unk_1D040

unk_1D2B0
unk_1D030

I'm sure there is an easy, known way for AMI like the insyde method shown above, but I can't find it. Do you know anyone else good at assembly and AMI that could maybe stop in here and give me some tips?

I think I'm looking to edit these three routines next, almost certain one of these is the main menu/tab selection
SUB_1C7E4 *
Sub_13C2C
sub_E48
Sub_6F1C >> Sub_179E0 + Sub_1B7C8
Sub_12A0

@oldirdey ?

* Edit @nimaim - new test, thanks
http://s000.tinyupload.com/index.php?fil...964563160923217

@Lost_N_BIOS, thanks for still trying to get this working for us ... tried all 3 files above, still nothing.

That's a nice tutorial above! I'll definitely read through it over the weekend to learn more about how this works.

@nimaim - You're welcome, and thanks for quick report back! So nothing new, anything missing main tab/section-wise?

That tutorial above is only meant as a reference to show CPL0 what type of tab header/ID I meant that I was trying to find. None of that tutorial applies to this BIOS, at all, it's for Intel Insyde BIOS, this BIOS is AMI
That will give you a short example of how assembly editing works though, but none of the details are in regards to this BIOS or this BIOS type etc.

Onto the next edit! We'll get there I'm sure, just take sometime to find since I'm blind editing due to not being able to for sure ID the tabs themselves.

*edit - @nimaim I noticed when saving via BCP it saves as "Saving unsecured rom" How are you testing these, flashing in? If yes, do you see any difference while flashing between the regular mod vs the two BCP ones?
Just something I've been thinking of, if we continue to see zero changes maybe we need to look into this, create some mod we know we'll see the change of and then see if both BIOS edited with and without BCP reflect that change or not after flashing in.
I expect some crashes, failed bootup, BIOS visible menu looses, etc, eventually from some of these changes, if not I think we'll need to look into that eventually.
New test - http://s000.tinyupload.com/index.php?fil...610333849970283

@Lost_N_BIOS I am flashing in FPT (from Intel ME 12 package) with a freedos bootable stick with command fpt -f bios.rom -bios. I cannot flash with AFU as it gives me a secure policy error. Should I be using something else, different options, etc?

Change wise I see zero changes between the menus whatsoever. There are no added or missing options. I think we need to start with something that will def show a change as well just to get a baseline.

I will test the new ones in a little bit.

If it helps, on my model (GJ5CN6E) editing string "System information" to "System information1" through BCP 5.02.0023 and flashing it via fpt actually applied and on the main tab I was able to see "System information1" instead of old label

@nimaim - thanks, good to know the method at least, FPT forces in and erases before writing, so any kind of security check would be ignored.
Thanks for the AFU info again too, I forgot someone already mentioned that error with AFU, that must be what this refers to in BCP, like Asus security capsule, only this one must be hidden capsule within the BIOS like Asrock does.
No, FPT is great choice, I only asked how so I'd know.

@truelecter - thanks, I will test to confirm one with nimaim too, since I've been using a different BCP (5.02.0031 - 2017) than the one you mentioned.

Here nimaim, please test this too once you have a chance, enabled via AMIBCP >> Advanced page (Set User) >> Shared Memory setting, show SLIC Table, and USB Camera Setting
http://s000.tinyupload.com/index.php?fil...618034790577858

How did the test go with E48 set?

Just to let you know I've not been well these last couple of days, hopefully back up and running soon.

Zitat von CPL0 im Beitrag #69

---

Just to let you know I've not been well these last couple of days, hopefully back up and running soon.

---

I don't know if it can be useful. But I decompiled the Control Center and i found how values are written in the ECRAM.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Management;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
 
namespace MyColor2
{
 

    static public class WMIEC
    {
        static private ManagementEventWatcher watcher = null;
        static public bool WMIReadECRAM(UInt64 Addr, ref object data)
        {
            try
            {
                ManagementObject classInstance =
                    new ManagementObject("root\\WMI",
                    "AcpiTest_MULong.InstanceName='ACPI\\PNP0C14\\1_1'",
                    null);
 
                // Obtain in-parameters for the method
                ManagementBaseObject inParams =
                    classInstance.GetMethodParameters("GetSetULong");
 
                // Add the input parameters.
 
                Addr = 0x10000000000 + Addr;
                inParams["Data"] = Addr;
 
                // Execute the method and obtain the return values.
                // Wordaround to avoid busy flag
                System.Threading.Thread.Sleep(200);
                ManagementBaseObject outParams =
                    classInstance.InvokeMethod("GetSetULong", inParams, null);
                // List outParams
                data = outParams["Return"];
                return true;
            }
            catch (ManagementException err)
            {
                Console.WriteLine("GetSetULong failed" + err.Message);
                return false;
            }
        }
        static public String WMIWriteECRAM(UInt64 Addr, UInt64 Value)
        {
            try
            {
                ManagementObject classInstance =
                    new ManagementObject("root\\WMI",
                    "AcpiTest_MULong.InstanceName='ACPI\\PNP0C14\\1_1'",
                    null);
 
                // Obtain in-parameters for the method
                ManagementBaseObject inParams =
                    classInstance.GetMethodParameters("GetSetULong");
 
                // Add the input parameters.
                Value = Value << 16;
                Addr = 0x0000000000000000 + Value + Addr;
                inParams["Data"] = Addr;
 
                // Execute the method and obtain the return values.
                // Wordaround to avoid busy flag
                System.Threading.Thread.Sleep(200);
                ManagementBaseObject outParams =
                    classInstance.InvokeMethod("GetSetULong", inParams, null);
                // List outParams
                return outParams["Return"].ToString();
 
            }
            catch (ManagementException err)
            {
                Console.WriteLine("GetSetULong failed" + err.Message);
                return "Failed";
            }
        }
        static public void StartWMIReceiveEvent(EventArrivedEventHandler WMIHandleEvent)
        {
            try
            {
 
                WqlEventQuery query = new WqlEventQuery("SELECT * FROM AcpiTest_EventULong");
 
                watcher = new ManagementEventWatcher(new ManagementScope("\\\\.\\Root\\WMI"), query);
                //Console.WriteLine("Waiting for an event...");
 
                watcher.EventArrived += WMIHandleEvent;
 
                // Start listening for events
                watcher.Start();
 

                return;
            }
            catch (ManagementException err)
            {
                Console.WriteLine("An error occurred while trying to receive an event: " + err.Message);
            }
        }
        static public void EndWMIRecieveEvent()
        {
            if(watcher != null)
            {
                watcher.Stop();
                watcher = null;
            }
 
        }
 
    }
}
 

 

@Lost_N_BIOS, I've found interesting thread on another forum related to TONGFANG GK5CN* ( http://forum.notebookreview.com/threads/...gk5cn6z.815943/ DOWNLOAD LINKS sections ) models and they have multiple bioses version from different rebrands of this model. And on of the comments ( http://forum.notebookreview.com/threads/...0#post-10736345 ) mentions that "Configurable TDP in Bios: Fireying Z5 shares the same base as Mech Z2 so I flashed lasted Z2 bios to get configurable TDP. 35, 45, 55 watts". So this can be somehow related to unlocking hidden features as well.

@CPL0 - hope you're feeling better soon, I hate being sick, feel for you!

@Nimaim - thanks for reports back! I still wanted to know about BCP changes for two reasons, one I'm using a newer build than others mentioned, and two I wanted to know if User worked or if we needed to set Supervisor (Due to your screenshots access level)
Tonight I will make some tests for you relating to NVRAM changes, a few with different settings changes, and one without NVRAM - so we can rule out control of menu's being there. Then back to assembly, since it's always controllable there, just have to find where it's bypassing the other menus

@truelecter - thanks, yes I noticed several threads there on these, and a few users have posted other systems info here using similar/same BIOS too.
For settings you mentioned, someone posted an app that can change too, all this we can easily change with AMIBCP or via setup_var with grub, so it's useful for some that don't want to modify BIOS, or wait on a mod, request a mod etc but it doesn't help with unlocking the hidden menus.
Thanks for looking and taking notice though, if you see anyone talking about unlocking second advanced, chipset, other root menus that's what needs to be done here. We need hidden/Root/Menu unlock info.

For now, if you don't want to wait, or anyone doesn't want to wait, any setting you see in AMIBCP hidden or not, you can change it's default value, save and reflash and you will have those settings applied as default even when you cannot see them in the BIOS.
Tell anyone flashing via FPT, to first backup BIOS region (FPTw -bios -d -biosreg.bin), then make their edits, then reflash BIOS region (FPTw -bios -f modbiosreg.bin), otherwise they may loose system specific details.

Zitat von Lost_N_BIOS im Beitrag #73

---

@CPL0 - hope you're feeling better soon, I hate being sick, feel for you!

@Nimaim - thanks for reports back! I still wanted to know about BCP changes for two reasons, one I'm using a newer build than others mentioned, and two I wanted to know if User worked or if we needed to set Supervisor (Due to your screenshots access level)
Tonight I will make some tests for you relating to NVRAM changes, a few with different settings changes, and one without NVRAM - so we can rule out control of menu's being there. Then back to assembly, since it's always controllable there, just have to find where it's bypassing the other menus

@truelecter - thanks, yes I noticed several threads there on these, and a few users have posted other systems info here using similar/same BIOS too.
For settings you mentioned, someone posted an app that can change too, all this we can easily change with AMIBCP or via setup_var with grub, so it's useful for some that don't want to modify BIOS, or wait on a mod, request a mod etc but it doesn't help with unlocking the hidden menus.
Thanks for looking and taking notice though, if you see anyone talking about unlocking second advanced, chipset, other root menus that's what needs to be done here. We need hidden/Root/Menu unlock info.

For now, if you don't want to wait, or anyone doesn't want to wait, any setting you see in AMIBCP hidden or not, you can change it's default value, save and reflash and you will have those settings applied as default even when you cannot see them in the BIOS.
Tell anyone flashing via FPT, to first backup BIOS region (FPTw -bios -d -biosreg.bin), then make their edits, then reflash BIOS region (FPTw -bios -f modbiosreg.bin), otherwise they may loose system specific details.

---

@pcfr33k - You can use FPTw from DOS, EFI Boot, or Windows (Command prompt only) Yes, FPT dumps like a programmer, that's why I gave the warnings. What you want can be done via AMIBCP, Chipset > SA > Graphics Config section (Internal graphics disable, I assume that's what you wanted)
See also Advanced >> Switchable graphics for the Muxless setting (never mind, muxless is only option ), but on page mentioned above you can disable default SG anyway if you wanted, once done with testing other setting changes
For this BIOS use AMIBCP 5 - here is latest version - Unlock Aptio V Z170 Board Menu Chipset unhide and other Menu