Page 1 of 4
#1 [Solved] How to Unlock HP Insyde BIOSes by leolift 19.05.2020 12:09

hello, I am new in this forum and I take this opportunity to speak and greet everyone.

in other forums,after about 1 month, my request to unlock my HP Insyde BIOS was ignored, so I tried to study independently via this forum or other forums on the web.
This forum was helpful to me to reach the results and therefore I thought to summarize what I found.
I have come to good results to unlock several hidden BIOS features.
I would like to list the various notions learned in order to facilitate the lives of other interested parties.
i am working on a hp 630 with bios insyde.

the bios insyde seems to be one of the most difficult to unlock besides the fact that many of these bios have an RSA signature which makes changes impossible ... in my case they managed to find in the bios network for my pc RSA and so I have worked on this.

HP 630

Versione Data SoftPaq
F.39 12-2013 sp64612.exe RSA
F.38 03-2013 sp60723.exe RSA
F.37 11-2012 sp59757.exe RSA
F.33 01-2012 sp55626.exe RSA
F.32 11-2011 sp55356.exe RSA
F.24 10-2011 sp54776.exe RSA
F.23 09-2011 sp54697.exe RSA
F.22 08-2011 sp54181.exe RSA
F.19 07-2011 sp53673.exe possiamo bios mod
F.18 06-2011 sp53593.exe possiamo bios mod
F.17 06-2011 sp53383.exe possiamo bios mod
F.16 05-2011 sp53108.exe possiamo bios mod
F.02 03-2011 sp52301.exe possiamo bios mod

so I worked on sp53673.exe (no rsa)
this .exe is multi Fd. (fd is the unit of the bios proper and in my case within the executable of qull there are 3 different models, mine is 03676.fd)
to eject this exe file just open it with win rar or 7zip.

I learned several tricks to unlock hidden functions, but I really had to be a web astronaut.
with the "fd" file we have to try to extract it with what in the network is called "Andy tool" is a tool that opens the fd file, dumps and can therefore cook the updated fd file with the changes made by us.
link image: https://ibb.co/TKsgDg0

press ok, in the root directory of the FD file there will be new files and folders.
DUMP inside there will be many files ...
to unlock the hidden functions when we are interested and almost always a file ending in 670_ and then with numbers
in my case it's called like this:
FE3542FE-C1D3-4EF8-657C-8048606FF670_649.ROM
of these there may be more than one, but we must identify the larger one.

ok now with a new tool called Universal IFR Extractor.exe created by Mr. Donovan6k we should read the identified ROM file.
The universal IFR extractor converts the code into human-readable data so that we can include the variables that condition the functions of our BIOS.
now we will have a .txt file with what we will have to understand in our functions:
I have shortened the text file for space reasons, I just want to show an example of the system configuration field.


EFI Protocol Detected
--------------------------------------------------------------------------------


String Packages
--------------------------------------------------------------------------------
Offset: Language:
--------------------------------------------------------------------------------
0xF080 eng
0x1BA68 fra
0x2941A chn
0x31DEE jpn
0x3E33C ita
0x4B3B8 spa
0x59222 ger
0x66758 por


Form Sets
--------------------------------------------------------------------------------
Offset: Title:
--------------------------------------------------------------------------------
0x73450 Main (0xE9)
0x735D0 Exit (0x365)
0x73700 System Configuration (0x5B)
0x73DD0 Power (0x2E5)
0x746D0 Security (0x36)
0x747C0 Advanced (0xFB)
0x77B10 Main (0x4)
0x77DD0 Diagnostics (0x42)


Internal Forms Representation
--------------------------------------------------------------------------------
Offset: Instruction:
--------------------------------------------------------------------------------

0x73706 Form Set: System Configuration {0E 24 F4 27 4A A0 00 DF 42 4D B5 52 39 51 13 02 11 3D 5B 00 DA 00 00 00 00 00 00 00 00 00 01 00 00 00 BC 02}
0x7372A Form: System Configuration, Form ID: 0x1 {01 06 01 00 5B 00}
0x73730 Subtitle: {02 04 DA 00}
0x73734 Suppress If: {0A 03 00}
0x73737 true {27 02}
0x73739 Setting: UEFI Boot, Variable: 0x7E[1] {05 09 7E 00 01 D6 00 D7 00}
0x73742 Option: Enabled, Value: 0x0 {09 09 DC 00 00 00 01 00 00}
0x7374B Option: Disabled, Value: 0x1 {09 09 DB 00 01 00 00 00 00}
0x73754 End of Options {10 02}
0x73756 Setting: Quick Boot, Variable: 0x72[1] {05 09 72 00 01 48 03 49 03}
0x7375F Option: Enabled, Value: 0x1 {09 09 DC 00 01 00 01 00 00}
0x73768 Option: Disabled, Value: 0x0 {09 09 DB 00 00 00 00 00 00}
0x73771 End of Options {10 02}
0x73773 Setting: Quiet Boot, Variable: 0x73[1] {05 09 73 00 01 4A 03 4B 03}
0x7377C Option: Enabled, Value: 0x1 {09 09 DC 00 01 00 01 00 00}
0x73785 Option: Disabled, Value: 0x0 {09 09 DB 00 00 00 00 00 00}
0x7378E End of Options {10 02}
0x73790 Setting: PXE Boot to LAN, Variable: 0x74[1] {05 09 74 00 01 4C 03 4D 03}
0x73799 Option: Disabled, Value: 0x0 {09 09 DB 00 00 00 01 00 00}
0x737A2 Option: Enabled, Value: 0x1 {09 09 DC 00 01 00 00 00 00}
0x737AB End of Options {10 02}
0x737AD End If {18 02}

if you want to try to take risks that I don't feel responsible for the damage you can do to your PC, and it would be a good thing to make sure that the BIOS is reset with a keyboard, or even to have a terminal with a programmer to repair the bios in case something goes wrong

in my case, for example, in the System Configuration tab, the startup function of Uefi is not visible and to unlock it and make it appear we have to make the variable false
0x73706 Module set: System configuration {0E 24 F4 27 4A A0 00 DF 42 4D B5 52 39 51 13 02 11 3D 5B 00 FROM 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 01 00 00 00 BC 02}
0x7372A Module: System configuration, Module ID: 0x1 {01 06 01 00 5B 00}
0x73730 Subtitles: {02 04 DA 00}
0x73734 Suppress if: {0A 03 00}
0x73737 true {27 02} <--------- we must make it false by changing 28 instead of 27

so now with a hexadecimal software like hxd, i have to change this value ...

I open the file (in my case) FE3542FE-C1D3-4EF8-657C-8048606FF670_649.ROM
identified at the beginning and we open it in HxD, we go to offset 0x73737 (always in my case) and change the value from 27 to 28. and save.
we make a copy of this file, on the desktop

let's go back to Andy's tool and select these parameters
link image1: https://ibb.co/V2MWHLX
linnk iimage2: https://ibb.co/QNmLX4N
link image3: https://ibb.co/FzcYpQZ

after the informational message, not replaced ok, you have to go to the directory of the "fd" file in the dump folder and replace the installed "rom" file and only now do ok.
now in the folder we have several files, one of which with the name 03676_SLIC.fd, we rename it by deleting _slic and we insert this file in the original folder for the flash.
now we can flash the new BIOS, I found a patch that allows me to do it ... it would be a change to be made to the iscflash.dll file

method 2
there are functions, however, that cannot be unlocked with this method because they have another function that blocks them ...
for example, the Vurtualization technology in my case is blocked by this formula:

0x73800 Label: 0x1001 {1D 04 01 10}
0x73804 Suppress if: {0A 03 00}
0x73807 Variable 0x225 [1] equal to 0x0 {12 07 25 02 01 00 00} <--------------------- change change this variable
0x7380E Setting: virtualization technology, variable: 0x1B0 [1] {05 09 B0 01 01 5C 00 5D 00}
0x73817 Option: enabled, value: 0x1 {09 09 83 00 01 00 04 45 00}
0x73820 Option: disabled, value: 0x0 {09 09 84 00 00 00 05 45 00}
0x73829 End of options {10 02}
0x7382B End If {18 02}

in my case the number 45 will have to be changed to FF, so open Hxd change the value in the offset and repeat the procedure as above with the useful tool.

method 3
these changes can also be made in other ways, without flashing the BIOS, but modifying the one already present
the shell method exists, in my case it didn't work, so you can use the H2Ouve.exe software
iimage link: https://ibb.co/25tMhrm

we always work on virtualization technology that the default on my laptop is disabled.
we have seen above that the variable is:
0x73807 Variable 0x225
and if deactivated the value is 00 if activated the value is 01

so to understand where to modify this variable on H2Ouve we have to take the variable 0x225 and go to the column in 220 and to the row number 5 and insert the value 01
link image: https://ibb.co/Q8TnXnn

in this case you just have to save and the setting will be saved in the BIOS.
it's not permanent if we wanted to delete it, just reset to reset the settings from the BIOS or by disconnecting the cmos battery.

unlock advanced and power boards
the methods described above do not unlock the functions of the hidden tabs as often happens (Advanced and power) but unlocking are the hidden functions of the active tabs
to unlock the hidden cards I was still helped by Mr. Donovan with his guide even if generic and therefore they did not work for my laptop but they are close (at least I hope)
but there are neighbors (at least I hope)
for this we need another softwrae called ida.exe
does nothing but disassemble and show us the various sequences using flowcharts to make us understand how the logic of our BIOS works.
link image: https://ibb.co/ygm5Lgb
in my case the 1800747C0 is the offset of the tabs advanced variable
link image: https://ibb.co/xzbbfp5 in this image the call is shown

in theory with this method you would need JZ (conditional jumps) and in a certain sense bypass them. I have not found them in mine, and here I ask the help of someone more experienced.
link image: https://ibb.co/BLY4DXB

I don't know how to proceed, but I feel I am very close to the solution ...

EDIT by Fernando: For a better readability I have shortened the start post by removing unneeded blank lines and putting the inserted codes into a "spoiler". Furthermore I have tried to specify the thread title.

#2 RE: guide for mod bios hp insyde on my experience by Lost_N_BIOS 19.05.2020 12:32

avatar

@leolift - Thanks for dropping your info and thoughts here for others!

So, at the end, you are asking for how to unlock BIOS menus, correct? If yes, link me to the stock BIOS sp53673.exe you are working on and I will look and see if I can find the unlock for you

Also, this is incorrect, in regards to the below setting, but I'm not 100% sure what you meant to be doing there >> 45 will have to be changed to FF
If you can already see this settings menu at the root level and you want to make this hidden setting visible, this is what you edit

0x73800 Label: 0x1001 {1D 04 01 10}
0x73804 Suppress if: {0A 03 00}
0x73807 Variable 0x225 [1] equal to 0x0 {12 07 25 02 01 00 00} <--------------------- change change this variable << Yes, change the bold 01 to FF, then setting will be visible IF you can already see whatever root menu contains this setting
0x7380E Setting: virtualization technology, variable: 0x1B0 [1] {05 09 B0 01 01 5C 00 5D 00}
0x73817 Option: enabled, value: 0x1 {09 09 83 00 01 00 04 45 00}
0x73820 Option: disabled, value: 0x0 {09 09 84 00 00 00 05 45 00}
0x73829 End of options {10 02}
0x7382B End If {18 02}

As for defined default above, it may not matter, applied value would be stored in NVRAM anyway. But, I can't tell you what is possibly defining default in the above, until I can get a copy of the sp53673.exe you are working with.
Nothing above with "45" in it would ever be edited 45 >> FF for any edit no matter what your intention was.

#3 RE: guide for mod bios hp insyde on my experience by leolift 19.05.2020 13:20

thank you for your answer ... in reality with the method (FF) it works ... the setting before in the bios was not visible ... however I will also find it with your solution.

link for bios I'm working on:

http://ftp.hp.com/pub/softpaq/sp53501-54000/sp53673.exe

my bios is the 03676.fd


thank you for your time

#4 RE: guide for mod bios hp insyde on my experience by Lost_N_BIOS 19.05.2020 18:01

avatar

@leolift - You're welcome! Yes, FF works to make that setting visible, if you can already see the menu that contains it, but you only FF where I showed you >> 0x73807 Variable 0x225 [1] equal to 0x0 {12 07 25 02 01 00 00} << FF here, then setting is unsuppressed/visible

Thanks for BIOS link! I checked your BIOS, and to change the default for virtualization technology you swap the 04 and 05, as you see below

Setting: virtualization technology, variable: 0x1B0 [1] {05 09 B0 01 01 5C 00 5D 00}
0x73817 Option: enabled, value: 0x1 {09 09 83 00 01 00 04 45 00}
0x73820 Option: disabled, value: 0x0 {09 09 84 00 00 00 05 45 00} << "05" indicates which is default, for this particular setting

So, to swap defaults, this would be correct edit
Setting: virtualization technology, variable: 0x1B0 [1] {05 09 B0 01 01 5C 00 5D 00}
0x73817 Option: enabled, value: 0x1 {09 09 83 00 01 00 05 45 00} << now, this is default, per setup (does not apply to current value stored in NVRAM)
0x73820 Option: disabled, value: 0x0 {09 09 84 00 00 00 04 45 00}

So, this would be proper edit to reveal the setting and switch default to Enabled
0x73800 Label: 0x1001 {1D 04 01 10}
0x73804 Suppress if: {0A 03 00}
0x73807 Variable 0x225 [1] equal to 0x0 {12 07 25 02 FF 00 00} << FF'd
0x7380E Setting: virtualization technology, variable: 0x1B0 [1] {05 09 B0 01 01 5C 00 5D 00}
0x73817 Option: enabled, value: 0x1 {09 09 83 00 01 00 05 45 00} << 04 swapped for 05, now = Default
0x73820 Option: disabled, value: 0x0 {09 09 84 00 00 00 04 45 00} << 05 swapped for 04, now NOT default

#5 RE: guide for mod bios hp insyde on my experience by leolift 19.05.2020 18:42

thanks, but as I said before, I would like to unlock the advanced and power board ... I have been working on it for a month ... the link for the file downolad I have verified that it works

#6 RE: guide for mod bios hp insyde on my experience by Lost_N_BIOS 20.05.2020 11:02

avatar

@leolift - Please send me one image of your BIOS, so I can see what all menus you can currently see, thanks

* Edit - Never mind, here is unlock for your BIOS menu Adv/Power (for SP5673, only 03676 variant)
These locations are for when working on the Section_PE32_image_DriverSampleDxe_SetupUtility_body ONLY
0x67C: 55 >> Change to >> 00
0x686: 4B >> Change to >> 00
0x690: 41 >> Change to >> 00

#7 RE: guide for mod bios hp insyde on my experience by leolift 20.05.2020 12:22

thanks for your advice ...
but this must be processed by uefitool?

to work with uefitool, I have to extract my bios and to do it I use Universal BIOS Backup ToolKit 2.

but the backup file obtained is not equal in size to the original one ...
the original one downloaded from the hp site is 2.18 mb while the extracted one is 2.00 mb.

how should i do?

#8 RE: guide for mod bios hp insyde on my experience by Lost_N_BIOS 20.05.2020 12:31

avatar

@leolift - You're welcome! Do you want me to do it? I can if you want, just let me know

But, yes, to answer your question. You extract "DriverSampleDxe_SetupUtility" PE32 BODY, then edit in hex editor at exact locations mentioned above, then replace body once done using UEIFTool (use version 25, not 25.1, not 21.5, not newer etc >> 25.0 ).
You can however use newer or NE Alpha versions such as 51-57 to extract, inspect etc - this is what I use for extracting and inspecting (51 or 54-57)

If at those locations in hex, you do not see what I say you replace (ie at 0x67C you do not find 55), then you've not extracted the correct module, or you've not extracted the PE32 body of that module.

#9 RE: guide for mod bios hp insyde on my experience by leolift 20.05.2020 12:38

to work with uefitool, I have to extract my bios and to do it I use Universal BIOS Backup ToolKit 2.

but the backup file obtained is not equal in size to the original one ...
the original one downloaded from the hp site is 2.18 mb while the extracted one is 2.00 mb.

I checked your information and I found the right values that you indicated to me but I think the file being smaller in size would give me problems

#10 RE: guide for mod bios hp insyde on my experience by Lost_N_BIOS 20.05.2020 13:32

avatar

@leolift - No, don't use that! Sorry, I thought you already knew all about BIOS flashing, and how to flash mod BIOS on your system, and or had a flash programmer etc.
BIOS on this system is neither 2MB or 2.18MB, nor is any BIOS from HP 2.xxMB. Full BIOS I assume it's 4MB, but I don't have any dump to confirm, I will look and find.

I found a dump, BIOS region is 2.5MB, and rest of 4MB is ME FW and FD. So complete BIOS from chip = 4MB, but you can work on BIOS region only if you want.

Since you do not have programmer, and don't already know how to flash mod BIOS on this system (I assume), best we start here. Do below, tell me what error you get, if any, at step #2
We will then use Intel H2OUVE to bypass the error you get. Send me the created biosreg.bin file, so I can give you info to bypass the error if there is one. If we can't bypass it, I will have to edit the stock flash tool package for you.

If you have already modified the BIOS in ANY way, you will need to re-flash it back to factory defaults using factory method (NOT FPT)!!!

If you do not have Intel ME drivers installed, install them now from your system driver download page, then start over here after reboot.
Check your BIOS' main page and see if ME FW version is shown. If not then > DOWNLOAD HWINFO64 HERE <

Once HWINFO is open, look at the large window on the left side, expand motherboard, and find the ME area.
Inside that section is the ME Firmware version. Take note of the version. (ie. write it down or get a screenshot)

Once you have that, go to the thread linked below, and in the section "C.2" find and download the matching ME System Tools Package for your system.
(ie if ME FW version = 10.x get V10 package, if 9.0-9.1 get V9.1 package, if 9.5 or above get V9.5 package etc)
> DOWNLOAD " ME System Tools " packages HERE <

Once downloaded, inside you will find Flash Programming Tool folder, and then inside that a Windows or Win/Win32 folder (NOT x64).
Highlight that Win/Win32 folder, then hold shift and press right click. Choose "open command window here" (Not power shell! >> * See Registry file below *).

If you get an error, reply to this post with a screenshot of it, OR write down the EXACT command entered and the EXACT error given.

((If "open command window here" does not appear, look for the "Simple Registry Edit" below...))

Now you should be at the command prompt.
You are going to BACKUP the factory un-modified firmware, so type the following command:
Command: " FPTw.exe -bios -d biosreg.bin "

>> Attach the saved "biosreg.bin ", placed into a compressed ZIP/RAR file, to your next post!!! <<

Right after you do that, try to write back the BIOS Region dump and see if you get any error(s).
Command: " FPTw.exe -bios -f biosreg.bin "
^^ This step is important! Don't forget! ^^

If you get an error, reply to this post with a screenshot of it, OR write down the EXACT command entered and the EXACT error given.

Here is a SIMPLE REGISTRY EDIT that adds "Open command window here as Administrator" to the right click menu, instead of Power Shell
Double-click downloaded file to install. Reboot after install may be required
> CLICK HERE TO DOWNLOAD CMD PROMPT REGISTRY ENTRY <

If the windows method above does NOT work for you...
Then you may have to copy all contents from the Flash Programming Tool \ DOS folder to the root of a Bootable USB disk and do the dump from DOS
( DOS command: " FPT.exe -bios -d biosreg.bin " )

#11 RE: guide for mod bios hp insyde on my experience by leolift 20.05.2020 14:05

size 03676.fd :

https://ibb.co/mCrB5yF


hwi_626 img:

https://ibb.co/jkBsbcq

https://ibb.co/Gc6jt09


I can't install the drivers because from the official HP website where I download the chipset driver from once it starts telling me that the system does not have the minimum requirements

#12 RE: guide for mod bios hp insyde on my experience by theonlyjosh 20.05.2020 17:20

i did the above and came across these errors:

cmd screenshot: https://ibb.co/T4CmBKF

#13 RE: guide for mod bios hp insyde on my experience by Lost_N_BIOS 21.05.2020 06:19

avatar

@leolift - Ohh yes, sorry, I glanced at 03672.fd and must have thought they were all the same size and didn't notice the one for your variant was smaller.
Anyway, rest of what I mentioned above = true. As for your HWINFO images, I can't see, you expanded way too much (ie close SMBIOS/DMI), only expand "Motherboard" so I can see ME as shown in the image below
If you cannot see this as shown, then your ME FW is corrupted and you'll have to try from DOS or get flash programmer to fix ME FW


@theonlyjosh - There is a program that can sometimes bypass 28, but it's very risky (may brick), and I would only suggest you try that if you had flash programmer in hand and backup already made (in which case, you wouldn't need to go this route, so kinda pointless then )
You can try and see if your BIOS has S3 sleep bug, from desktop put system to S3 sleep (not hibernate) for 1-3 minutes, then wake it up and try the FPT flash again. If still error 28, then your BIOS does not have sleep bug.

Both of you guys, don't worry, I have now edited stock package for this BIOS, so I can give you both stock edited BIOS to flash using the standard included tools with the stock .exe

Here is unlocked BIOS F.19, run InsydeFlash.exe and unlocked BIOS will be flashed in
http://s000.tinyupload.com/index.php?fil...803807852858258

#14 RE: guide for mod bios hp insyde on my experience by leolift 21.05.2020 09:53

I spent the last 24h trying to understand the question about Me region ..
I searched everywhere for drivers but on my laltop they did not install ... after many hours of work, I came to the conclusion that "in my opinion" my laptop has no me region ...
it is not contemplated ...

so in frustration I made a desperate attempt ...

I opened the file with andy's phoenix tool, I dumped, I modified the SetupUtlity rom with the unlock values ​​directly with HxD, I saved and cooked the new bios ...

I flashed the .fd mod and I prayed that it would turn on !!!

it came on and it worked ...
the main, power and advance tabs have appeared!

victory!!!!!

with disappointment I learned that the parameters are practically useless because I hoped to find something to push FSB or otherwise increase the CPU performance ... but it's a stupid bios !!!

we did the same job !!

#15 RE: guide for mod bios hp insyde on my experience by theonlyjosh 21.05.2020 10:58

Thank you so much

Is it compatible with 3672? or is it just for 3676

Xobor Forum Software von Xobor
Datenschutz