Hi,

I have a Gigabyte Aero 15 (https://www.gigabyte.com/uk/Laptop/AERO-15--i7-7700HQ#kf) and it is running Aptio setup.

My aim is to mod my BIOS so that the setup is unrestricted and allows me to see all options, most of which is currently hidden. However, I can use AMIBCP and for each menu option, I can change "Access/Use" to USER but there are so many hidden options/menus that I'm wondering if there is an easier way. I've extracted the IFR for the "Setup" PE32 image and I notice that each hidden menu looks like the following:

0x256E0 		Suppress If: {0A 82}
0x256E2 			Variable 0xB equals 0x1 {12 06 0B 00 01 00}
0x256E8 			Ref: Thunderbolt(TM) Configuration, Variable: 0xFFFF {0F 0F 77 14 78 14 15 00 00 00 FF FF 00 C8 27}
0x256F7 		End If {29 02}
 
 

0x25606 		Suppress If: {0A 82}
0x25608 			Variable 0xB equals 0x1 {12 06 0B 00 01 00}
0x2560E 			Ref: CPU Configuration, Variable: 0xFFFF {0F 0F 59 01 5A 01 0D 00 00 00 FF FF 00 24 27}
0x2561D 			Ref: Power & Performance, Variable: 0xFFFF {0F 0F 95 01 96 01 0E 00 00 00 FF FF 00 26 27}
0x2562C 		End If {29 02}
 
 

Could I not change variable 0xB some way so that it is not suppressed? I'm just looking for a quicker way to get these menu items (e.g - "Thunderbolt(TM) Configuration") to show in my BIOS without having to change each menu item/option to "USER" access in AMIBCP.

Thanks!

@tdarren - which Aero 15 do you have (like SA or XA etc)? I've unlocked these BIOS already, much more to do than unsuppress, but since you're already that far you probably know (AMITSE mod + AMITSE/SetupData or AMIBCP + Setup = all required to unlock everything)
Main menus need unlocked at AMITSE, a few individual settings need access level changed to User or Super (VERY FEW, mainly at the hidden boot page), I can't remember if anything needs unsuppressed at setup mainly I say this is edited to to text edits I make in AMIBCP
This is what I usually do >> Swapped Main & Advanced & Save/Exit, enable Chipset and both boot menus.

To directly answer your question above, so you know for this or other edits, that can be done a few ways, I explain and give example here. Yes, you are thinking correct, this is how, but do see both links below >> Variable 0xB equals 0x1 {12 06 0B 00 FF 00}
[SOLVED] How do I get hidden menus shown within IFS "Form Sets" (3)
[REQUEST]Need help for unlocking menus for ECS LIVA Core

Some BIOS break if you do the "Move outside" method, so you have to be careful, only test that if you can recover or you know other people have used on the BIOS you are doing (mainly MSI/Asrock break on this)

For AMITSE edits, see the advanced section at end of this guide, I show general method you need to use
OverPowered TONGFANG CyberPower Machrevo MACHENIKE - Unlocked BIOS Guide W/ Files

And here, is my notes from last Aero I did, don't use these as they may not apply to your model or BIOS version, this just to show you example of info collected for these and stock before/edits made etc

Hi @Lost_N_BIOS

Sorry I never got back to you on this, I did see your reply at the time and it did help a lot but just didn't get the chance to get back to you. So just giving you my thanks now!

I've since sold my Aero 15 and have got a Razer Blade Pro 17 (2019) instead and am looking to unlock the BIOS on this laptop as well to unlock the options etc. It uses the same Aptio setup as the Aero 15, have you had any experience unlocking Razer BIOSes or perhaps could point me to where to start? I'm hoping I could broadly follow the same process as the Aero 15, though I expect there are some differences between the two BIOS.

Thanks!

@tdarren - OK, you're welcome and well hopefully you like the new system better anyway Yes, I've unlocked some Razer BIOS too, can you link me to your stock BIOS download page?
And if so, or not, lets start here -

@Lost_N_BIOS

Thanks, stock BIOS download page can be found here: http://drivers.razersupport.com//index.p...2929.1578516518

It's the RazerUpdater utility, which does the work of downloading and updating the BIOS firmware.

I've dumped my BIOS using FPT and have attached it to this post (biosreg.zip). I got no errors when writing back the dump using the "FPTw.exe -bios -f biosreg.bin" command, which is good.

Hopefully that's all okay, let me know if you need me to do anything else or if you need any more information.

Thanks, Darren

@tdarren - That razer page never loads for me Tried multiple browsers, and a proxy too So there's no BIOS download there anyway?? All I wanted is the stock BIOS itself, can you grab out of this utilities folder or temp folder while using the app?
Ohh! Finally got it to load in another proxy, I only see the BIOS updater "Guide" = PDF, no download, unless it's the tool at bottom of that list? If so, I can't download from proxy, so I can't grab it. It probably wouldn't run for me anyway, and if so certainly wouldn't grab the BIOS we want after it scanned by system

Good no errors writing back with FPT, this means we can flash in mod BIOS without issue
Please zip for me images of ALL your BIOS, all sections, all root areas so I can see up/down if needed to see all submenus for example in advanced if you have to scroll up/down to see all without going in a submenu, do that and take two images.
Show me every page, in every section, ALL Settings/pages etc. This way I can see what you see, so I don't miss anything that's hidden from you in an already visibel menu.

You may be able to use F12 to screenshot to USB. If not, use camera and if you can set to smaller images before you take them. I don't need to see 2-6K images, 800px wide or 100kb each or so is more than enough.
If you can't do that with camera, please resize them for me before you put into zip or rar (with max compression please)

Nice, looks like you can already see "Chipset" section! Correct? Looks like much LESS needs edited here, at least it doesn't look like any main menus are hiding from you (advanced or chipset)
Rest inside those is all easy to edit if you can already see them

@Lost_N_BIOS Whenever Razer issues a BIOS update, they package the BIOS firmware into a Razer Updater tool, which does the job of installing the BIOS and they release an update to the Razer Updater tool every time there is a BIOS update. I've run the app and it self extracts into "C:\Program Files (x86)\Razer\Update Tool".

That folder contains "FlashAFUWin.bat" which is what the Razer Updater app calls/executes when it updates the BIOS. That "FlashAFUWin.bat" batch file just runs the "AFUWINx64.EXE Dana17_2_0104.bin /p /b /n" command to update the BIOS. I believe what you're looking for is the "Dana17_2_0104.bin" file which is the stock 1.04 version of my BIOS.

I've attached all of my screenshots of my BIOS, all sections/pages. This is attached to this post (BiosScreenshots.zip).

I've also zipped a "BIOS Image" folder, which is a copy of everything in the "C:\Program Files (x86)\Razer\Update Tool" folder and includes the "Dana17_2_0104.bin" file. Due to the size of the zip file, I've put this on my OneDrive and you can download it from https://1drv.ms/u/s!Apqcet2BuryT5zfbYa-9_DDOCFFK?e=n10Nr4

Also I just want to correct my earlier post, the stock BIOS download page for my Razer system is actually https://support.razer.com/articles/1592008851

I hope that's all okay, let me know if you have any questions or if you need me to provide you with anything else.

Thanks, Darren

@Lost_N_BIOS Just want to follow up on this thread, I've been looking at my Setup IFR (following your How-2-Rip-It-Open-Yourself guide) a little bit.

The main thing that I notice different to when I was doing this with my previous Gigabyte Aero 15 is that the suppression is done differently (QuestionId instead of Variable), for example:

0x30DB4 		Suppress If {0A 82}
0x30DB6 			QuestionId: 0x3FD equals value 0x0 {12 86 FD 03 00 00}
0x30DBC 				Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
0x30DC0 				8 Bit Unsigned Int: 0x1 {42 03 01}
0x30DC3 				Less Than {33 02}
0x30DC5 				And {15 02}
0x30DC7 			End {29 02}
0x30DC9 			Ref: OverClocking Performance Menu, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x12, FormId: 0x2794 {0F 0F 9B 13 9C 13 12 00 00 00 FF FF 00 94 27}
0x30DD8 		End If {29 02}
 

A couple of questions regarding the above:

Where we have "QuestionId: 0x3FD equals value 0x0", Is this is referring to another option set in the BIOS, as doing a search for QuestionId: 0x3FD, I find the following "RD MODE Support" option?

0x3CB32 		Suppress If {0A 82}
0x3CB34 			QuestionId: 0x3FD equals value 0x0 {12 06 FD 03 00 00}
0x3CB3A 			One Of: RD MODE Support, VarStoreInfo (VarOffset/VarName): 0x12FD, VarStore: 0x1, QuestionId: 0x3FD, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 A4 18 A5 18 FD 03 01 00 FD 12 10 10 00 01 00}
0x3CB4B 				Default: DefaultId: 0x0, Value (8 bit): 0x0 {5B 06 00 00 00 00}
0x3CB51 				One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
0x3CB58 				One Of Option: Enabled, Value (8 bit): 0x1 (default MFG) {09 07 03 00 20 00 01}
0x3CB5F 			End One Of {29 02}
0x3CB61 		End If {29 02}
 

Am I correct in saying that "RD MODE Support" has to be "Disabled" for 0x3FD to equal 0x0, which seems to be the default anyway?

Can you tell me what this bit means?

0x30DBC 				Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
0x30DC0 				8 Bit Unsigned Int: 0x1 {42 03 01}
0x30DC3 				Less Than {33 02}
0x30DC5 				And {15 02}
 

Seems to be saying that 0xE11 has to be less than 1 as well?

How do you quickly unsuppress all of the options in all of the menus as it seems to me like it's a lot of work going through all of these if statements and making sure that they don't suppress? How do you go about this or is there no quick method?

Apologies for the barrage of questions, just keen to learn a bit how to go about doing these modifications myself.

Appreciate all of your help!

Thanks, Darren

@tdarren - Thanks for BIOS images, once I know result from below test I will unlock rest of BIOS for you
Yes, Dana17_2_0104.bin, would be what I wanted when I asked for the stock BIOS, thanks I'll grab that if I can download from there today

There is no quick way, other than move the setting outside of the suppression. That is OK on some BIOS, others it can brick the BIOS, or cause non-BIOS entry instantly (can still boot to DOS and recover here).
So due to possibility of brick, it's best to null suppression instead usually, unless you have BIOS switches on board or flash programmer in hand with backup made and checked by someone to be OK in advance.

To move something outside of suppression you simply move the target to be above/before "suppress if", or below the "end if" Example below

Suppress If {0A 82}
QuestionId: 0x3FD equals value 0x0 {12 86 FD 03 00 00}
Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
8 Bit Unsigned Int: 0x1 {42 03 01}
Less Than {33 02}
And {15 02}
End {29 02}
Ref: OverClocking Performance Menu, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x12, FormId: 0x2794 {0F 0F 9B 13 9C 13 12 00 00 00 FF FF 00 94 27}
End If {29 02}

Change to this (Most ideal way)
Suppress If {0A 82}
QuestionId: 0x3FD equals value 0x0 {12 86 FD 03 00 00}
Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
8 Bit Unsigned Int: 0x1 {42 03 01}
Less Than {33 02}
And {15 02}
End {29 02}
End If {29 02}
Ref: OverClocking Performance Menu, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x12, FormId: 0x2794 {0F 0F 9B 13 9C 13 12 00 00 00 FF FF 00 94 27}

Or
Ref: OverClocking Performance Menu, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x12, FormId: 0x2794 {0F 0F 9B 13 9C 13 12 00 00 00 FF FF 00 94 27}
Suppress If {0A 82}
QuestionId: 0x3FD equals value 0x0 {12 86 FD 03 00 00}
Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
8 Bit Unsigned Int: 0x1 {42 03 01}
Less Than {33 02}
And {15 02}
End {29 02}
End If {29 02}

But, both of those carry the risks I mentioned above, in some BIOS, and only way to know if your BIOS would be OK with that, or brick, or cause non-BIOS entry, would be direct test (so big risk if no programmer in hand)

Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
8 Bit Unsigned Int: 0x1 {42 03 01}
Less Than {33 02}
And {15 02}

^^ This, is looking for value stored here - And it's saying to suppress if 0x01 or less than (ie 0x00 >> so anything really above 01 such as 02 or 09 etc should be OK, or FF as well)
Numeric: en-US, VarStoreInfo (VarOffset/VarName): 0x921, VarStore: 0x1, QuestionId: 0xE11, Size: 1, Min: 0x0, Max 0xFF, Step: 0x0 {07 91 00 00 00 00 11 0E 01 00 21 09 00 10 00 FF 00}

"QuestionID" value is stored in AMITSE/SetupData at the question ID in little endian (so 11 0E here) + 52 bytes and byte 51/51 hold fail safe/optimal values (ie one part of what you would change if editing with AMIBCP) - example of this shown here, see last part of post + Image

Applied/current value are stored in NVRAM areas, in given VarStore at the given VarOffset in that areas NVRAM BODY. NVRAM editing is a bit more complicated to explain, I need to write a guide about it, but I've tried to explain briefly a few places linked below
NVRAM edit explained - Determine configurable aperture size from BIOS file
Setup and NVRAM editing here as well - [Help] Unlock advanced menu on 2019 Acer Predator Helios 300 PH315-52 (5)

However, the above is just for informational purposes, since you asked, I would do this edit as you see below, to Null the "suppress if" and unsuppress Overclock Performance Menu

Suppress If {0A 82}
0x30DB6 QuestionId: 0x3FD equals value 0x0 {12 86 FD 03 00 00} Change 00 to FF
0x30DBC Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
0x30DC0 8 Bit Unsigned Int: 0x1 {42 03 01} << Change to FF
0x30DC3 Less Than {33 02} << Change to 16 02 (OR)
0x30DC5 And {15 02}
0x30DC7 End {29 02}
0x30DC9 Ref: OverClocking Performance Menu, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x12, FormId: 0x2794 {0F 0F 9B 13 9C 13 12 00 00 00 FF FF 00 94 27}

^^ If that fails, you will have to test one of the "move" methods, or leave this as original and directly change QuestionId: 0xE11 stored values in AMITSE/SetupData to FF FF, or any value above 00 or 01
And Change NVRAM stored value to same for VarOffset/VarName): 0x921 in all NVRAM areas (usually 1/2 at top + one in main BIOS DXE volume near AMITSE - called defaults or STDDefaults)

All this may be avoided by simply setting Access Level in AMIBCP to User or Supervisor once this parent menu is visible to you, or nothing may need changed once parent menu is visible to you.
So this would be looked into after any main menu section reveal.... Which in this case we do not have to do. Did you test changing ONLY this submenu access level to User or Supervisor at the root of Advanced?
If you haven't tested, lets do that as first test here, test each of these BIOS, can you now see OverClocking Performance Menu, and if so, which one?
This will tell us, probably for "most" hidden submenus and or settings, if we have to unsuppress or if Access Level change may get "most" things visible.
http://s000.tinyupload.com/index.php?fil...769277142643917

@Lost_N_BIOS

Thanks for your reply and for the clear instructions. I've tested both BIOS images that you attached, unfortunately both BIOS images "biosregOverclockMenuAMITSDS.bin" and "biosregOverclockMenuAMITSDU.bin" did not reveal the "OverClocking Performance Menu" in the "Advanced" page of the BIOS. Checked twice for each and flashed more than once as well.

Just so you know, this is what I did:

1. Run command "FPTw.exe -bios -f biosregOverclockMenuAMITSDS.bin"
2. Rebooted and checked Advanced page on my BIOS, did not see OverClocking menu

1. Run command "FPTw.exe -bios -f biosregOverclockMenuAMITSDU.bin"
2. Rebooted and checked Advanced page on my BIOS, did not see OverClocking menu

Repeated the above steps twice just to make sure.

Thanks again for your help. Let me know if you need me to do any further tests or if there's anything else you'd like me to do.

Thanks, Darren

Maybe you need to [Load Setup defualts] in bios settings ->Save&EXIT to update the nvram .

@Lost_N_BIOS

Zitat von jhsvip im Beitrag #11

---

Maybe you need to [Load Setup defualts] in bios settings ->Save&EXIT to update the nvram .

---

@tdarren - Then this means you have to unsuppress via hex as outlined above, instead of Access Level change, at least this means Access Level change alone will not reveal it (you may still need to add that on top of setup edit unsuppress, but test that by itself first)

I would unsuppress it as mentioned toward the end of my reply, do you need me to do that? This >>
Suppress If {0A 82}
0x30DB6 QuestionId: 0x3FD equals value 0x0 {12 86 FD 03 00 00} Change 00 to FF
0x30DBC Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
0x30DC0 8 Bit Unsigned Int: 0x1 {42 03 01} << Change to FF
0x30DC3 Less Than {33 02} << Change to 16 02 (OR)
0x30DC5 And {15 02}
0x30DC7 End {29 02}
0x30DC9 Ref: OverClocking Performance Menu, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x12, FormId: 0x2794 {0F 0F 9B 13 9C 13 12 00 00 00 FF FF 00 94 27}

Make those changes, test by itself, then do Access Level Edit on top of those and re-test if unsuppress alone does not work

If that fails, then I would next test this next (move method, only test if you have programmer) >>

Suppress If {0A 82}
QuestionId: 0x3FD equals value 0x0 {12 86 FD 03 00 00}
Question Ref1: QuestionId: 0xE11 {40 04 11 0E}
8 Bit Unsigned Int: 0x1 {42 03 01}
Less Than {33 02}
And {15 02}
End {29 02}
End If {29 02}
Ref: OverClocking Performance Menu, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x12, FormId: 0x2794 {0F 0F 9B 13 9C 13 12 00 00 00 FF FF 00 94 27}

If you have flash programmer to recover, make a backup, let me check, then you can test move outside of suppression edit first if you want, since that is an easier/cleaner type of edit.
This may very well be OK on your BIOS, it is on MANY BIOS, but some it will break it, and no way to know in advance. Up to you, if you want to test like this first without programmer, let me know and I can make you edit like this too.
If you need me to make any of these edits for you let me know

@Lost_N_BIOS Yes your edit worked, nulling the suppression worked and it revealed the Overclocking Menu, no additional Access Level change was needed.

The only thing now is that within the Overclocking Menu, I can only see "Memory", and then within the "Memory" menu, I can only see "Memory profile" and the only option available to me for this is "Default profile". Looks like most of it is suppressed :( Good news is that I now know that I can use the nulling method to unspress these sub-menus and options, a shame it is a bit tedious.

I'm happy to get a programmer if it is a quicker way to remove all of the suppressions, as I don't have one yet, never used one before either, are they simple enough to use? I've disassembled boards on laptops before (re-pasted, etc) so I'm comfortable in doing that - though I might need some help in actually locating the BIOS on the MB when/if it comes to it.

Thanks again, Darren

Edit: Just seen the various guides around the forum about programmers, looks simple enough (probbaly should have looked before asking the question!) Do you think the move outside method is less tedious than the nulling method or does it not really make any difference? Just want a quicker or the simplest way to unlock the BIOS options really but if the nulling method is the only way, then I'll have to put the time in to make all of the edits. Could take weeks by the looks of it.

@tdarren - Nice

Now that you can see inside there, you can test Access Level changes to the missing settings first to see if it makes them visible. Pick one setting or submenu only, change it to User or Super, then test, once it becomes visible then you can do same to all the rest that is missing at once in larger edit (Saves time this way, test one item first, then do all at once)
If neither User/Super makes something visible inside there, then yes, you will have to do similar unsuppression edits to each item. If when looking at IFR and you see some missing setting that does not have suppression above it at all, then that would be one that could be made visible with Access Level edit only, not all may be suppressed and hidden.

Programmer would only help if you had to recover from brick, unless you mean by quicker testing instead of null the suppression move items outside the suppression << If you meant that, then yes, it's best to have this and backup made before you test this kind of edit in case is bricks.
Yes, they are easy to use, we have a good image guide here too - [GUIDE] Flash BIOS with CH341A programmer
For sure, I can help you locate BIOS if you open it up, show me some images

To me, editing either way is easy, both can be tedious to someone that doesn't do it all the time. But really, either way, it's going to be tedious edits for anyone not familiar with doing them all day long, lots of back-n-forth looking at IFR/hex etc.
And, moving outside suppression may be more confusing than nulling suppression for some not familiar with hex editing because you have to cut/paste to move and that must be done exact vs putting FF on a byte to null the other way.

Did you see the RD MODE Support setting that the above suppression is referring to? Make this setting visible by nulling that suppress IF, then test enable/disable of this setting and see what shows up.
This sounds like Research/Dev mode to me, and setting 01/Enabled may make all settings suppressed by (Suppress If {0A 82} >> QuestionId: 0x3FD equals value 0x0 {12 06 FD 03 00 00}) visible = x122 instances
Easy one I see to check, after enable this and reboot, do you then see "System Agent" inside Chipset, or not? It's suppressed by this value only

Suppress If {0A 82}
QuestionId: 0x3FD equals value 0x0 {12 06 FD 03 00 00} << << FF that - Then this setting will be visible at root of Chipset, then you can test as mentioned above, this may gain you 122 settings, or at least cut out 122 instances of nulling needed (since you can bypass nulling this line anywhere, when you have this enabled/01)
One Of: RD MODE Support, VarStoreInfo (VarOffset/VarName): 0x12FD, VarStore: 0x1, QuestionId: 0x3FD, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 A4 18 A5 18 FD 03 01 00 FD 12 10 10 00 01 00}
Default: DefaultId: 0x0, Value (8 bit): 0x0 {5B 06 00 00 00 00}
One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
One Of Option: Enabled, Value (8 bit): 0x1 (default MFG) {09 07 03 00 20 00 01}

This wont help with the overclocking area, I see it has a lot of varying suppressions, those would be best bypassed by just going through them IFR/Hex side by side and null each as you go.
I can do all these edits for you if you want?