Hi,

I try to enable onboard graphics controller when using discrete graphic card.
The BIOS will disable onboard graphics controller (Intel UHD 630) when I put in a discrete graphic card. (AMD Radeon RX 5000 series)
However, I want to use both onboard and discrete graphic card together because hackintosh will need it.

I was able to dump the BIOS by using Intel ME tools. But when I try to flash it back, (even without modification) I got:

Zitat

---

Error 167: Protected Range Registers are currently set by BIOS, preventing flash access.
Please contact the target system BIOS vendor for an option to disable
Protected Range Registers.

FPT Operation Failed.

---

The command I am using:

FPTw.exe -bios -d biosreg.bin
FPTw.exe -bios -f biosreg.bin
 

I changed the BIOS Lock to 0x0 by using RUEXE, (modGRUB's setup_var doesn't work) but when I reboot back to Windows, I am still getting the same error.
Then I go back to RUEXE saw that BIOS Lock value reverse back to 0x1. (locked)

Another problem is I followed @Lost_N_BIOS 's General Aptio V Mod Guide try to unlock BISO hidden menu so I can change onboard graphics controller settings. But at step 9, I couldn't find hidden short list. I attached my File_DXE_driver_Setup_Setup.ffs and Section_PE32_image_AMITSE_AMITSE.sct files.

Any help is greatly appreciated.

@Black-Xstar - You usually cannot use both onboard and PCIE Card, unless in crossfire with AMD CPU/GPU etc. But, I'm not 100% sure about leaving internal graphics enabled, while also using PCIE Card, that may be possible and I just never noticed or tried etc.
But, I do doubt this is possible, it's generally always disabled automatically when PCIE Card is used, unsure outcome if you try to force it enabled. Why would Hackintosh require both?? I've never seen this mentioned, and I've setup hackintosh myself a few times and never had to mess with this or use onboard graphics etc

For FPT, you need to first disable secure boot, UEFI mode change to Legacy, remove any BIOS password, disable any TPM or encryption, then try again FPT BIOS region dump, then reflash.
You need to disable FPRR, this is what that 167 error is (usually), not BIOS Lock (but disable both)
Flash Protection Range Registers (FPRR), VarStoreInfo (VarOffset/VarName): 0x615
BIOS Lock, VarStoreInfo (VarOffset/VarName): 0x14, VarStore: 0x17

If you cannot change both with grub/setup_var, or RU method, then you may need to use H2OUVE and dump vars, edit there (in two locations usually, but I can't check since you did not attach BIOS), then flash back

BTW, you can also just change that setting to enabled with RU >> Onboard Graphics Controller, VarStoreInfo (VarOffset/VarName): 0x12D
Edit 0x12D in SaSetup @ GUID 72C5E28C-7783-43A1-8767-FAD73FCCAFA4 << This what I'm talking about below, just change the actual setting you want to change in the hidden menu, change it directly, then no need for mod BIOS
^^ This requires RU method, and you need to have all I mentioned above disabled too (secure boot, UEFI mod >> Legacy instead, no TPM, no BIOS password etc)

The guide you mention is about unlocking menus, editing menus etc, not about changing a setting. And, as mentioned in that guide, that is only a general example, some BIOS may have more "lists" or less "lists"
If you simply want to change one BIOS setting, you do not need to unlock any menu, and you do not even need to make or flash mod BIOS.
Is that your only real concern here, to change one setting? If yes, let me know and I will show you how to do that without having to work around being able to flash in mod BIOS.

@Lost_N_BIOS thanks for quick reply.

macOS will use onboard graphics controller to accelerate video decoding/encoding, more important, Apple's DRM requires Intel graphics. Without it, Safari will not able play any DRM video like netflix/primevideo and Apple TV+ won't work at all.
Most retail motherboards (desktop) and laptops can use 2 graphics cards together. For example, the laptop will auto switch to onboard card when using battery to save power.

The Flash Protection Range Registers (FPRR) is set to 0x0 (disabled) when I am checking from RUEXE.
However, the BIOS Lock is 0x1 (enabled), and I can't change it by using grub/setup_var and RUEXE. (it reverse back when I am reboot)

I did try to use RUEXE to change "Onboard Graphics Controller, VarStoreInfo (VarOffset/VarName): 0x12D" at SaSetup to 0x1, but it is the same issue, the value reverse back when I am reboot. (I tested in Windows the onboard gfx is still disabled)


I want to unlock the hidden menu so I can easily change the settings like CFG Lock. I was able to disable CFG Lock at RUEXE, but the onboard gfx change doesn't work as expected.
But if I can just change the settings to make both onboard and discrete gfx card work together, I don't need do a BIOS mod.

My bios dump:

https://mega.nz/file/SIIDXajB#BiCAtVaViZeWnpEM8qakw-pkNVzmNpcc_yLfpp4C_sE
 

Ahh, OK, I see! I never used any of that, nor did anything like you mentioned, when I've tested hackintosh, so I never had to have this concern about onboard graphics enabled or not.
So your concern here is about functionality of the OS for what you want to do, needs onboard graphics enabled too, not the install of hackintosh in general.

Most/all desktops disable onboard once you connect PCIE card. Laptops, 95% have onboard enabled always, otherwise no display out. In rare/expensive laptops, sometimes you can switch or use both etc, but that's not common.

Make the onboard graphics change in RU with PCIE card removed and ONLY booting with onboard graphics, I bet it stays then. Default is enabled anyway, so it should be 01 always, this is what you want
However, as mentioned, it may not be possible, and is abnormal to have it enabled + use a PCIE graphics card, this usually only possible in certain systems or certain AMD/Crossfire situations.

Did you did notice FPRR AND BIOS Lock is in PCHSetup, not Setup or SaSetup correct? PCHSetup >> VarStoreId: 0x17 [4570B7F1-ADE8-4943-8DC3-406472842384] << This is where you change BIOS Lock and FPRR while using RU, due to this, you cannot change with setup_var, since they are not in setup.
Sorry, I forgot to mention above!

Here, dump vars for me, I will edit to disable BIOS lock and FPRR (these both, or at least one, may still be enabled in "custom" NVRAM too, outside of their normal varstores)
Download the following package, and run the command below from each versions folder that directly contains it's exe.
Once done, copy the entire folder somewhere, delete everything but any created vars.txt and then repackage this and send to me, this way all created vars.txt remain in place in the folders of the version that created them.
http://s000.tinyupload.com/index.php?fil...212104496994806

H2OUVE.exe -gv vars.txt

I'll check the BIOS about menu mod for you now too, thanks for the dump

* Edit, we may be able to force enabled only, by editing setup and replace the disabled option, so the min/max is 01 only
Or similarly, make both options enabled only, so no matter what it switches to it would then = enabled.

like so >>
Onboard Graphics Controller, VarStoreInfo (VarOffset/VarName): 0x12D, VarStore: 0x16, QuestionId: 0xCE0, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 72 1C 73 1C E0 0C 16 00 2D 01 10 10 00 01 00}
One Of Option: Enabled, Value (8 bit): 0x0 {09 07 03 00 00 00 00}
One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 10 00 01}

Or this may also work
Onboard Graphics Controller, VarStoreInfo (VarOffset/VarName): 0x12D, VarStore: 0x16, QuestionId: 0xCE0, Size: 1, Min: 0x1, Max 0x1, Step: 0x0 {05 91 72 1C 73 1C E0 0C 16 00 2D 01 10 10 01 01 00}
One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 10 00 01}

* Edit 2 -
After looking at your AMITSE, you do not need AMITSE edit here, probably only AMITSE/SetupData edit to change Access Level to User or Super at ROOT of setup, which you can do with AMIBCP

@Lost_N_BIOS
Thanks god! I have the Acer Aspire TC-895 too!

I was trying to unlock the hidden menus as OP did but also failed.

1. The BIOS Lock is 0x14 in PCHSetup(0x17)

0x5A9A7 		One Of: BIOS Lock, VarStoreInfo (VarOffset/VarName): 0x14, VarStore: 0x17, QuestionId: 0xBDC, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 D4 0B D5 0B DC 0B 17 00 14 00 10 10 00 01 00}
0x5A9B8 			Default: DefaultId: 0x0, Value (8 bit): 0x1 {5B 06 00 00 00 01}
0x5A9BE 			One Of Option: Disabled, Value (8 bit): 0x0 (default MFG) {09 07 04 00 20 00 00}
0x5A9C5 			One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
 

I used RU to change 0x14 under PCHSetup to 0x0 to disable it. After reboot the value reversed back to 0x1 automatedly.

2. The FPRR is 0x615 in PCHSetup(0x17)

0x4F690 		One Of: Flash Protection Range Registers (FPRR), VarStoreInfo (VarOffset/VarName): 0x615, VarStore: 0x17, QuestionId: 0x741, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 35 12 36 12 41 07 17 00 15 06 10 10 00 01 00}
0x4F6A1 			One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 04 00 30 00 00}
0x4F6A8 			One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
 

Does this mean that the default value of FPRR is 0x0 disabled?
I used RU to check the value of 0x615 also shows 00.

3. I used AMIBCP5 to change all access from default to user, but I got Error 167 when I used the FPTW64 to flash it back same as OP.



I also tried to flash the original BIOS I just dumped by FPTW and I got same error 167.

FPTW64.exe -bios -d 1.bin
FPTW64.exe -bios -f 1.bin
 

Error 167: Protected Range Registers are currently set by BIOS, preventing flash access.
Please contact the target system BIOS vendor for an option to disable
Protected Range Registers.
[[File:Capture.PNG|none|auto]]
FPT Operation Failed.
 
 

@Michaelsunzy - As mentioned above, often there is hidden NVRAM area that also needs these items changed, please dump vars as outlined above at post #4 and I will disable BIOS Lock and FPRR for you.
Then you will be able to FPT flash BIOS region, if you still get 167 after that, then that means flash programmer is required to flash in mod BIOS on this model. Sometiems that is only way, due to lock being inside a module not an actual setting you can change or that matters etc

Also, DO NOT change everything to USER or Super like you showed above, only change the exact items you need to change

@Lost_N_BIOS Thanks for looking the dump.

I already successful installed hackintosh without any BIOS mod, although remove CFG Lock is a bonus. (In deep, this can be emulated by OpenCore, but actual BIOS setting is more reliable)
Leaking onboard gfx in hackintosh is my main concern. Because the functions (video accelerate and DRM) I need are depending on it.

I actually tried to use AMIBCP to change access level to USER at the very beginning. However, the problem is I can not flash mod BIOS back. I am always getting Error 147 when using Intel ME tools. Besides, the afuwin flash tool doesn't work either.
So I turned into remove the BIOS Lock and FPRR. I figured out that they are not in the SaSetup or Setup, but in the PchSetup. RU is able to change those values, but it reversed back after reboot.

I haven't use H2OUVE.exe before but I will try and upload vars.txt, thanks!

Could you explain how to edit setup and replace the disabled option or make both options enabled only for Onboard Graphics Controller?
My goal is to use both graphics card together, so if the way works, that will be great.

@Black-Xstar - Good you have hackintosh up and running now
Please dump vars for me as mentioned above, then we will see if FPRR and or BIOS lock can be disabled by settings to bypass error 167 or not, if not you will need flash programmer.
Please also run this command with FPT and show me the report >> FPTw.exe -i
You may be able to flash volume instead of region with FPT, and not get stopped by BIOS lock of FPRR - If we can't bypass this with vars edit.

The edits I mentioned above rely on being able to flash BIOS region, or main DXE volume with FPT first, so we need to sort that out before any edits matter.

@Lost_N_BIOS Looks like I am not lucky.

I run 4 H2OUVE.exe versions, none of them is working:

Now parsing Variable Information.
Failed to get bios data!
Fail to get Variable Information.
 

I am using Win10 x64, do I need older Windows version to do that?

Here is my FPT -i dump:

C:\>FPTW.exe -i
Intel (R) Flash Programming Tool Version: 14.5.12.1111
Copyright (C) 2005 - 2020, Intel Corporation. All rights reserved.
 
Reading HSFSTS register... Flash Descriptor: Valid
 
    --- Flash Devices Found ---
    ID:0xEF4018    Size: 16384KB (131072Kb)
 
    --- Flash Image Information --
    Signature: VALID
    Number of Flash Components: 1
        Component 1 - 16384KB (131072Kb)
    Regions:
        DESC     - Base: 0x00000000, Limit: 0x00000FFF
        BIOS     - Base: 0x00400000, Limit: 0x00FFFFFF
        CSME     - Base: 0x00001000, Limit: 0x003FFFFF
        GbE      - NOT PRESENT
        PDR      - NOT PRESENT
        EC       - NOT PRESENT
    Master Region Access:
        BIOS     - ID: Read: 0x000F, Write: 0x000A
        CSME     - ID: Read: 0x000D, Write: 0x0004
        GbE      - ID: Read: 0x0009, Write: 0x0008
        EC       - ID: Read: 0x0101, Write: 0x0100
 
Total Accessible SPI Memory: 16384KB, Total Installed SPI Memory: 16384KB
 

@Michaelsunzy welcome to the party!

Can H2OUVE be used on AMI chip?

I was playing with RU, an interesting found.

If I change any settings in PchSetup, the next time reboot, when I choose enter BIOS, the system will reboot automatically, I guess the BIOS found abnormal and reset itself.
Also I found another one called PchColdReset which exactly same as PchSetup. Does it from NVRAM?

Another question, I found 2 8pin chip in the motherboard:


Which one is BIOS chip if I need get a programmer to flash it?

@Lost_N_BIOS
Here is my whole dumped file Flash Image including all regions

https://mega.nz/file/fVxhjSxS#3k4LlVyOaa...VMxrCtOExQtOPDE


I tried every H2OUVE you send us, none of them works.

I don’t know what to do next:/
-----------------------

My programer should be delivered today
----------------------

@Lost_N_BIOS

My programer arrived today.

1. I use FTPW.exe -bios -d to get the bios file

2. I use AMIBCP to edit my bios file and change some menus access to user

3. I use CH341 to flash the edited file back

4. Turn on the PC.

5. The pc will restart after a few seconds and everything will be reset to default.

@Black-Xstar - You said >> If I change any settings in PchSetup, the next time reboot, when I choose enter BIOS, the system will reboot automatically << What do you mean "When you choose "enter BIOS"?
Is there some screen offering you options, if yes, what does it say, and is that always there when you try to enter BIOS, ie is that normal?

BIOS chip is the W25Q128JV and for that only the following I know is true, software package linked below
W25Q128JV - 1.18 (read, not write) or ASProgrammer 1.40/1.41 (maybe OK read/write)
W25Q128JV - Colibri ver. 1.0.1.62 confirmed read/write OK - I suggest you use this for read and or write
http://s000.tinyupload.com/index.php?fil...213094641136166

Please do the following with FPT and send me the created files, thanks
FPTw.exe -desc -d fd.bin
FPTw.exe -me -d fd.bin << If error, OK, we'll wait till you get programmer (I only need these two, to help fix users BIOS below)

Apologies to you both about the H2OUVE, I must have been asleep and forgot or not noticed when writing that out!
H2OUVE cannot be used on AMI BIOS, sorry

Please dump your NVRAM for me using FPT and following commands
FPTw.exe -a 0x400000 -l 0x30000 -d vol1.bin
FPTw.exe -a 0x430000 -l 0x30000 -d vol1.bin

Then, once done, try writing it back once and see if error 167 or not
FPTw.exe -a 0x400000 -l 0x30000 -f vol1.bin

Also, please test this command instead of FPT spoiler #1-2, to see if we can write the main DXE volume instead of the entire BIOS region, this may get around the 167 error too, since it does not appear to be blocked from writing to the entire BIOS region at all in your FPTw.exe -i info
FPTw.exe -a 0x476000 -l 0x44A000 -d mainDXEVol.bin

Then >>
FPTw.exe -a 0x476000 -l 0x44A000 -f mainDXEVol.bin << If this passes, we can do menu mod now! If it fails, let me edit above first, if that does not error on write back, then we'll know for sure if FPRR and or BIOS Lock are settings causing the 167 error

Instead of H2OUVE , please download this SCEWin package, and see if any of these will work for you or not, if any NVRAM.TXT created, upload them for me as-is, in their version created folders
https://ufile.io/ylbsj1xt

Use this command from each versions folder >> SCEWIN /o /s nvram.txt /h Hii.db /v /q
If any give valid output, we can probably change the NVRAM this way as well, if the above FPT dump/write of NVRAM only fails too.

Before doing ANY of this!!! Make sure in BIOS, there is no BIOS password, that TPM is disabled, and that secure boot is disabled.


@Michaelsunzy - FPTw.exe -bios -d only gives you the BIOS region, you can't program that back in as-is with a flash programmer.
Hopefully you made a backup of the chip FIRST with programmer, before you did anything else with programmer. AND, hopefully you used correct software/version to do your dump, or at least compatible for valid read. What is your chip ID?
If your chip is W25Q128JV as well, see above. If you did not make a backup first with programmer, then I will have to rebuild you a new complete BIOS to program back in (send me your FPT dumps BIOS region)
Also, see above bold item

Or, did you dump, and then rebuild your own BIOS, putting the edited region back into your dumped BIOS before programming back in?
Sounds like maybe you did this above, but I am not sure. Also, sounds like AMIBCP may not be able to be used on this BIOS, it may be breaking something on rebuild, not sure.
I will make similar edits for you manually, once you send me entire programmer dump of working system, with above bolded items done first.
* Edit, sorry, I missed your linked file above. Is this programmer dump? If yes, did you do the above bold items first? If not, do them now, and dump the BIOS with the program I linked above (colibri)

@Lost_N_BIOS
No, there is not screen or error messages, just reboot automatically.

FPTw.exe -desc -d fd.bin
FPTw.exe -me -d me.bin
Dumped: https://mega.nz/file/jYZziACR#6c6Bni42a_...hKAQs6CvlTcKsl0

FPTw.exe -a 0x400000 -l 0x30000 -d vol1.bin
Success.
FPTw.exe -a 0x400000 -l 0x30000 -f vol1.bin
Error 167

FPTw.exe -a 0x476000 -l 0x44A000 -d mainDXEVol.bin
Success.
FPTw.exe -a 0x476000 -l 0x44A000 -f mainDXEVol.bin
Error 167

2 of SCEWin versions are working. Here is the dump files:
https://mega.nz/file/WVBxDYKT#w8fHVjUgN7...Cczcp37nVpBn3z4

I placed order for flash programmer. Should arrive next week.