Hey there,

a few members of the OXP-community and I are currently trying to mod the BIOS to show additional menus.
However, we are unfortunately not very experienced in this regard and the OXP seems to put up a specific fight.
(The OXP is a handheld laptop, based around the 11th gen Intel CPUs and has recently been crowdfunded)

There are a few aspects that point to this device being somewhat strange (at least compared to what I have encountered):
- when modifying the UEFI variables, it uses different VarStores instead of one single monolothic one
- setting the various settings / menus to access level "User" via AMIBCP does not unhide them
- when extracting the IFR (via https://github.com/LongSoft/Universal-IFR-Extractor/releases) there is only one menu shown at the top

When booting the OXP into BIOS, the following menus are shown:
Main - Security - Boot - Save & Exit

However, the IFR dump looks like this:
Form Sets
--------------------------------------------------------------------------------
Offset: Title:
--------------------------------------------------------------------------------
0x24B5C Setup (0x7 from string package 0x0)


Could you please point me in the direction of a guide or some pointers as to how we can unlock this BIOS and show the hidden menus?
(Those menus seem to be there when viewing the file with AMIBCP)

As the BIOS is too big to upload it to the forum directly, I needed to split it into two files and then add ".zip" at the end to uplaod it.
Please remove the ".zip" and extract it with 7zip.

Thank you very much

Ok, so after some lucky hits during my research, I came across those threads:
https://techtablets.com/forum/reply/77649/
http://forum.notebookreview.com/threads/...options.830993/

Both are quite thorough in describing what needs to be done and I think it makes little sense to copy & paste or plagiarize or even summarize those threads further.
Nonetheless, the gist of it is:
The AMI BIOS does have checks inside "Setup" and the order of menu items inside "AMITSE".
Consequently, one needs to fake the checks (switch True {46 02} to False {47 02} in the corresponding place, easily located via the IFR extract) in Setup.
Afterwards, the menu items need to be added back in AMITSE, but space might be limited there, which means that even though there are a few items hidden (at least 2 in my case), there might only be space for one item.

I am currently stuck at this space issue, as I would like to add back "Advanced" and "Chipset", but have only got space for one.
If I add both, I either have to overwrite existing (non-null) bytes, resulting in the menus not working, or add bytes to the file, which results in the Setup not opening at all :D
Based on a rough idea, I did give hex editing the setup a try - trying to switch FormIds of useless menu items to the FormId of the menu I wanted to open.
Unfortunately, this too resulted in a Setup that would no longer open.

Please let me know if there is a nice way around this limitation or if there is a known good way to redirect menu items inside Setup.
Thank you very much! :)

A short follow-up in case anyone stumbles across this issue.
I was able to solve the issue of having space for 2 options but needing 3 - that is in AMITSE.
It seems that simply adding the other option would increase AMITSE's size, shifting everything after those menu options to a point where any offset would jump into the wrong space.
Unfortunately, I have no clue where these specific offsets reside, so I can't edit them.

However, after some messing around I came across a workaround :)
In my case, the Chipset-menu contains only 2 entries, both of which are submenus.
And lucky for me, setup does not check whether submenus are being called from the correct menu.
This means that one can simply replace useless submenus with the submenus one would like to have.

Or more specifically:
1. Extract Setup (GUID iny my case: 899407D7-99FE-43D8-9A21-79EC328CAC21) with UEFITool
2. Use Universal IFR Extractor (e.g. this one https://github.com/tomrus88/Universal-IFR-Extractor) to extract a somewhat readable format
3. Choose a menu you can do without, it only needs to be in the visible / accessible part of the BIOS (in my case: ACPI D3Cold settings)

The IFR of which looks like this:

Zitat

---

Ref: ACPI D3Cold settings, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x11, FormId: 0x2819 {0F 0F 0A 19 0B 19 11 00 00 00 FF FF 00 19 28}

---

("Ref" seems to be the reference to another menu, i.e. a link there, and 19 28, or 0x2819, at the end of the hex string is the menu-id / FormId, whereas 0A 19 seems to be the title showing for this reference):


4. Choose the BIOS option you would rather have (in my case: System Agent (SA) Configuration)

The IFR of which looks like this:

Zitat

---

Ref: System Agent (SA) Configuration, VarStoreInfo (VarOffset/VarName): 0xFFFF, VarStore: 0x0, QuestionId: 0x422, FormId: 0x2778 {0F 0F D7 04 D8 04 22 04 00 00 FF FF 00 78 27}

---

5. Search for "0F 0F 0A 19 0B 19 11 00 00 00 FF FF 00 19 28" in Setup with a hex editor
6. Replace "0F 0F 0A 19 0B 19 11 00 00 00 FF FF 00 19 28" (= entry for ACPI D3Cold settings) with "0F 0F D7 04 D8 04 22 04 00 00 FF FF 00 78 27" (= entry for System Agent (SA) Configuration)
7. Replace the old Setup with the modded Setup via UEFITool

It is that simple :D

During my research, I came across this post that adds some details:
https://forums.overclockers.ru/viewtopic.php?f=25&t=599984