Page 2 of 4
#16 RE: guide for mod bios hp insyde on my experience by Fernando 21.05.2020 11:43

avatar

@leolift: @Lost_N_BIOS:
Congratulations for your work and your gotten results!
Since the previously existing problems obviously have been solved, I have customized the thread title.
Furthermore I have tried to shorten the start post, which was not easily to be read. I hope, that the readability has been enhanced and not downgraded.
If you should not agree with what I have done, feel free to change it again by editing the start post.

@Lost_N_BIOS:
Shall this thread be stickied?

#17 RE: [Solved] How to Unlock HP Insyde BIOSes by Lost_N_BIOS 21.05.2020 19:21

avatar

@leolift - your ME FW is corrupted, or yes, possibly missing (both look the same to you at many areas, but not all) Missing could ONLY be caused by someone programming in a BIOS without ME FW using hardware programmer, otherwise ME FW is just corrupted and you'll have to fix
Great to see you were able to edit and unlock your own BIOS, good work

In Power, I see >> Dynamic FSB Switching, but yes, this is all I see as far as FSB/CPU OC capabilities.

@theonlyjosh - I don't know about if 03676 is compatible with 3672 system or not, but I can make 03672 unlocked BIOS for you if you want?

@Fernando - No, no sticky, nothing worthy there and much of the first post is not correct or not correctly described, and or is more of a question than a how-to, furthermore this only applies to this particular BIOS

#18 RE: [Solved] How to Unlock HP Insyde BIOSes by theonlyjosh 22.05.2020 13:24

please that would be much appreciated

thank you

#19 RE: [Solved] How to Unlock HP Insyde BIOSes by Lost_N_BIOS 23.05.2020 07:30

avatar

@theonlyjosh - http://s000.tinyupload.com/index.php?fil...996557511798049

#20 RE: [Solved] How to Unlock HP Insyde BIOSes by Orlandino 20.07.2020 21:13

Hello! I have HP 630, and previously the BIOS was F39 with nearly no unblocked options.
Then I moved to sp53673-F19-03672-Unlocked, Thanks a lot!
(SP53673-03676 had an error "ROM file did not found")
But I still can not change the bus/core speed and memory timings. How can it be done?

#21 RE: [Solved] How to Unlock HP Insyde BIOSes by deadeye0313 24.10.2020 19:16

hey there Im using a hp g45 g5 laptop and I want to unlock advanced settings in BIOS.
so if I follow exactly what you have said will it work?

#22 RE: [Solved] How to Unlock HP Insyde BIOSes by merznu 29.10.2020 21:08

Hey! I've got HP 630 laptop aswell, and i'm willing to dedicate some more ram for my integrated graphics, since i upgraded my RAM to 8GB lately. My bios settings are locked, what can i do to unlock the setting for that? What other settings could be unlocked aswell? What recources should i read on that? I'll provide any information needed about my system.

#23 RE: [Solved] How to Unlock HP Insyde BIOSes by sagael 30.10.2020 18:36

Zitat von merznu im Beitrag #22
Hey! I've got HP 630 laptop aswell, and i'm willing to dedicate some more ram for my integrated graphics, since i upgraded my RAM to 8GB lately. My bios settings are locked, what can i do to unlock the setting for that? What other settings could be unlocked aswell? What recources should i read on that? I'll provide any information needed about my system.

i need less vram to my igpu in a laptop g4 hp

#24 RE: [Solved] How to Unlock HP Insyde BIOSes by deadeye0313 31.10.2020 07:29

yes thats what I want too
I need to reduce vram usage for my igpu

#25 RE: [Solved] How to Unlock HP Insyde BIOSes by uwyref 19.04.2021 08:25

Can someone reupload for all three board models (3672,3674,3676) from sp53673 that already modded on advance menu and whitelist removed ?
Maybe @leolift or @theonlyjosh can share it ?
Links from @Lost_N_BIOS now are invalid.
Thank you.

#26 RE: [Solved] How to Unlock HP Insyde BIOSes by Sweet Kitten 19.04.2021 14:35

Zitat von uwyref im Beitrag #25
Links from @Lost_N_BlOS now are invalid.

Although I downloaded it once to make explanations in the duplicate thread that leolift's request had already been responded to, I did not have his mod left.

But I have sp64612 modded.

#27 RE: [Solved] How to Unlock HP Insyde BIOSes by BDMaster 19.04.2021 17:14

You're the Best my friend !!!

P.S. Russians are the best ...

Here I can leave my oldest notes about the F.24 mod files (2015/16) ...

Bios v.F.24 - F.23 Model 03672 Slic 2.1 Mod :

EFI / Insyde BIOS
SLIC header found in 7E374E25-8E01-4FEE-87F2-390C23C606CD_932.ROM at 0
Pubkey found in 1A1E2341-A2FB-42C7-8D17-3073D08EB21D_1235.ROM at 0
Marker found in DD6569A7-E455-4EE5-B2BA-ECDA84ACBC99_1241.ROM at 0
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_50.ROM at 924
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_50.ROM at A66
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_50.ROM at B80
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_50.ROM at C42
'SLIC' string found in AFC04099-0D39-405D-BE46-846F08C51A31_945.ROM at 3C3
'SLIC' string found in AFC04099-0D39-405D-BE46-846F08C51A31_945.ROM at E2F
OEM/Table IDs identified are:
1. INSYDEHuronRiv
2. HPQOEMSLIC-MPC
Header (INSYDEHuronRiv SLIC) (x1)
Pubkey (x1)
Marker (2.1) (HPQOEMSLIC-MPC) (x1)

7E374E25-8E01-4FEE-87F2-390C23C606CD_932.ROM Header RSA Key + Marker 2.1


Bios v.F.24 - F.23 Model 03672 Menu Tabs Unlock Mod :

Form Sets
--------------------------------------------------------------------------------
Offset: Name:
--------------------------------------------------------------------------------
0x122C0 Exit (0x157)
0x123F0 System Configuration (0x5A)
0x12AD0 Power (0x38D)
0x13390 Diagnostics (0x41)
0x13400 Security (0x35)
0x134F0 Advanced (0x181)
0x176F0 Main (0xCF)
0x17850 Main (0x4)

065D : 74 5B to 74 00 jz short loc_1800006BA to jz $+2

0668 : 74 50 to 74 00 jz short loc_1800006BA to jz $+2

0673 : 74 45 to 74 00 jz short loc_1800006BA to jz $+2

.text:000000018000061A loc_18000061A: ; CODE XREF: sub_180000514+E7j
.text:000000018000061A ; sub_180000514+F7j
.text:000000018000061A cmp byte ptr [rdx+49h], 0Ah
.text:000000018000061E mov r12b, r14b

.text:0000000180000621 jnb loc_1800006BA

.text:0000000180000627 cmp cs:qword_1800122B0, r14
.text:000000018000062E jl short loc_180000654
.text:0000000180000630 mov rax, cs:qword_1800A6910
.text:0000000180000637 movzx r8d, word ptr [rdi+18h]
.text:000000018000063C movzx edx, bp
.text:000000018000063F mov rcx, rsi
.text:0000000180000642 call qword ptr [rax+1F2h]
.text:0000000180000648 mov rdx, cs:qword_1800A6A20
.text:000000018000064F cmp rax, r14
.text:0000000180000652 jge short loc_180000675
.text:0000000180000654
.text:0000000180000654 loc_180000654: ; CODE XREF: sub_180000514+11Aj
.text:0000000180000654 mov eax, 181h
.text:0000000180000659 cmp [rdi+18h], ax

.text:000000018000065D jz short loc_1800006BA

.text:000000018000065F mov eax, 0CFh
.text:0000000180000664 cmp [rdi+18h], ax

.text:0000000180000668 jz short loc_1800006BA

.text:000000018000066A mov eax, 38Dh
.text:000000018000066F cmp [rdi+18h], ax

.text:0000000180000673 jz short loc_1800006BA


Bios v.F.24 - F.23 Model 03672 Remove Whitelist Mod :

91472655-50E0-4D81-9AF6-239E6F431B8C_1403.ROM StartUpMenu
Nothing

CD28DACA-BDBE-481A-90AC-625C79CF234C_1447.ROM H19BIOSLock

0396 : E8 D9 11 00 00 to 90 90 90 90 90 call sub_180001574 to nop nop nop nop nop

.text:0000000180000396 loc_180000396: ; CODE XREF: DllEntryPoint+C2j
.text:0000000180000396 ; DllEntryPoint+E4j
.text:0000000180000396 call sub_180001574 ; Eliminate
.text:000000018000039B call sub_180000914

077B : 0F 85 2D 01 00 00 to 90 90 90 90 90 90 jnz loc_1800008AE to nop nop nop nop nop nop

078F : 0F 85 19 01 00 00 to 90 90 90 90 90 90 jnz loc_1800008AE to nop nop nop nop nop nop

07A6 : 0F 85 02 01 00 00 to 90 90 90 90 90 90 jnz loc_1800008AE to nop nop nop nop nop nop

07BD : 0F 85 EB 00 00 00 to 90 90 90 90 90 90 jnz loc_1800008AE to nop nop nop nop nop nop

.text:0000000180000762 loc_180000762: ; CODE XREF: sub_1800003A8+50Fj
.text:0000000180000762 movzx ebx, dil
.text:0000000180000766 imul rbx, 0A8h
.text:000000018000076D movzx eax, word ptr [rbx+r14+1980h]
.text:0000000180000776 cmp [rsp+0C8h+var_68], ax

.text:000000018000077B jnz loc_1800008AE

.text:0000000180000781 movzx eax, word ptr [rbx+r14+1982h]
.text:000000018000078A cmp [rsp+0C8h+var_66], ax

.text:000000018000078F jnz loc_1800008AE

.text:0000000180000795 movzx eax, word ptr [rbx+r14+1986h]
.text:000000018000079E cmp [rsp+0C8h+var_3A], ax

.text:00000001800007A6 jnz loc_1800008AE

.text:00000001800007AC movzx eax, word ptr [rbx+r14+1984h]
.text:00000001800007B5 cmp [rsp+0C8h+var_3C], ax

.text:00000001800007BD jnz loc_1800008AE

.text:00000001800007C3 lea rcx, [rbx+r14+1988h]
.text:00000001800007CB lea rdx, aH19notrecord ; "H19NotRecord"
.text:00000001800007D2 call sub_18000164C
.text:00000001800007D7 test rax, rax
.text:00000001800007DA jz loc_1800008BC


Bios v.F.24 - F.23 Model 03672 RSA Mod :

86D70125-BAA3-4296-A62F-602BEBBB9081_1625.ROM PEI

86D70125-BAA3-4296-A62F-602BEBBB9081_1801.ROM PEI (Shadow)

0220 : 0F 8C CF 00 00 00 to 90 E9 CF 00 00 00 jl loc_2F5 to nop + jmp loc_2F5


Bios v.F.24 - F.23 Model 03674 Slic 2.1 Mod :

EFI / Insyde BIOS
SLIC header found in 7E374E25-8E01-4FEE-87F2-390C23C606CD_960.ROM at 0
Pubkey found in 1A1E2341-A2FB-42C7-8D17-3073D08EB21D_1146.ROM at 0
Marker found in DD6569A7-E455-4EE5-B2BA-ECDA84ACBC99_1152.ROM at 0
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_65.ROM at 8F4
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_65.ROM at 99C
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_65.ROM at ADE
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_65.ROM at B02
'SLIC' string found in AFC04099-0D39-405D-BE46-846F08C51A31_974.ROM at 37F
'SLIC' string found in AFC04099-0D39-405D-BE46-846F08C51A31_974.ROM at 3F6
'SLIC' string found in AFC04099-0D39-405D-BE46-846F08C51A31_974.ROM at 11FB
OEM/Table IDs identified are:
1. INSYDECalpella
2. HPQOEMSLIC-MPC
Header (INSYDECalpella SLIC) (x1)
Pubkey (x1)
Marker (2.1) (HPQOEMSLIC-MPC) (x1)

7E374E25-8E01-4FEE-87F2-390C23C606CD_960.ROM Header RSA Key + Marker 2.1


Bios v.F.24 - F.23 Model 03674 Menu Tabs Unlock Mod :

Form Sets
--------------------------------------------------------------------------------
Offset: Name:
--------------------------------------------------------------------------------
0x80350 Main (0xE8)
0x80600 Exit (0x384)
0x80710 System Configuration (0x59)
0x80DF0 Power (0x301)
0x81330 Security (0x34)
0x81420 Advanced (0xF5)
0x852B0 Diagnostics (0x40)

0651 : 74 50 to 74 00 jz short loc_1800006A3 to jz $+2

065C : 74 45 to 74 00 jz short loc_1800006A3 to jz $+2

.text:000000018000060E loc_18000060E: ; CODE XREF: sub_180000508+E7j
.text:000000018000060E ; sub_180000508+F7j
.text:000000018000060E cmp byte ptr [rdx+49h], 0Ah
.text:0000000180000612 mov r12b, r14b

.text:0000000180000615 jnb loc_1800006A3

.text:000000018000061B cmp cs:qword_18000EAD8, r14
.text:0000000180000622 jl short loc_180000648
.text:0000000180000624 mov rax, cs:qword_180085690
.text:000000018000062B movzx r8d, word ptr [rdi+18h]
.text:0000000180000630 movzx edx, bp
.text:0000000180000633 mov rcx, rsi
.text:0000000180000636 call qword ptr [rax+1F2h]
.text:000000018000063C mov rdx, cs:qword_180085730
.text:0000000180000643 cmp rax, r14
.text:0000000180000646 jge short loc_18000065E
.text:0000000180000648
.text:0000000180000648 loc_180000648: ; CODE XREF: sub_180000508+11Aj
.text:0000000180000648 mov eax, 0F5h
.text:000000018000064D cmp [rdi+18h], ax

.text:0000000180000651 jz short loc_1800006A3

.text:0000000180000653 mov eax, 301h
.text:0000000180000658 cmp [rdi+18h], ax

.text:000000018000065C jz short loc_1800006A3


Bios v.F.24 - F.23 Model 03674 Remove Whitelist Mod :

91472655-50E0-4D81-9AF6-239E6F431B8C_1288.ROM StartUpMenu
Nothing

CD28DACA-BDBE-481A-90AC-625C79CF234C_1334.ROM H19BIOSLock

0396 : E8 D9 11 00 00 to 90 90 90 90 90 call sub_180001574 to nop nop nop nop nop

.text:0000000180000396 loc_180000396: ; CODE XREF: DllEntryPoint+C2j
.text:0000000180000396 ; DllEntryPoint+E4j
.text:0000000180000396 call sub_180001574 ; Eliminate
.text:000000018000039B call sub_180000914

077B : 0F 85 2D 01 00 00 to 90 90 90 90 90 90 jnz loc_1800008AE to nop nop nop nop nop nop

078F : 0F 85 19 01 00 00 to 90 90 90 90 90 90 jnz loc_1800008AE to nop nop nop nop nop nop

07A6 : 0F 85 02 01 00 00 to 90 90 90 90 90 90 jnz loc_1800008AE to nop nop nop nop nop nop

07BD : 0F 85 EB 00 00 00 to 90 90 90 90 90 90 jnz loc_1800008AE to nop nop nop nop nop nop

.text:0000000180000762 loc_180000762: ; CODE XREF: sub_1800003A8+50Fj
.text:0000000180000762 movzx ebx, dil
.text:0000000180000766 imul rbx, 0A8h
.text:000000018000076D movzx eax, word ptr [rbx+r14+1980h]
.text:0000000180000776 cmp [rsp+0C8h+var_68], ax

.text:000000018000077B jnz loc_1800008AE

.text:0000000180000781 movzx eax, word ptr [rbx+r14+1982h]
.text:000000018000078A cmp [rsp+0C8h+var_66], ax

.text:000000018000078F jnz loc_1800008AE

.text:0000000180000795 movzx eax, word ptr [rbx+r14+1986h]
.text:000000018000079E cmp [rsp+0C8h+var_3A], ax

.text:00000001800007A6 jnz loc_1800008AE

.text:00000001800007AC movzx eax, word ptr [rbx+r14+1984h]
.text:00000001800007B5 cmp [rsp+0C8h+var_3C], ax

.text:00000001800007BD jnz loc_1800008AE

.text:00000001800007C3 lea rcx, [rbx+r14+1988h]
.text:00000001800007CB lea rdx, aH19notrecord ; "H19NotRecord"
.text:00000001800007D2 call sub_18000164C
.text:00000001800007D7 test rax, rax
.text:00000001800007DA jz loc_1800008BC


Bios v.F.24 - F.23 Model 03674 RSA Mod :

86D70125-BAA3-4296-A62F-602BEBBB9081_1840.ROM PEI

86D70125-BAA3-4296-A62F-602BEBBB9081_1663.ROM PEI (Shadow)

0220 : 0F 8C CF 00 00 00 to 90 E9 CF 00 00 00 jl loc_2F5 to nop + jmp loc_2F5


Bios v.F.24 - F.23 Model 03676 Slic 2.1 Mod :

EFI / Insyde BIOS
SLIC header found in 7E374E25-8E01-4FEE-87F2-390C23C606CD_869.ROM at 0
Pubkey found in 1A1E2341-A2FB-42C7-8D17-3073D08EB21D_1029.ROM at 0
Marker found in DD6569A7-E455-4EE5-B2BA-ECDA84ACBC99_1035.ROM at 0
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_50.ROM at 8F4
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_50.ROM at A1E
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_50.ROM at B62
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_50.ROM at C09
'SLIC' string found in AFC04099-0D39-405D-BE46-846F08C51A31_880.ROM at 3A0
'SLIC' string found in AFC04099-0D39-405D-BE46-846F08C51A31_880.ROM at 110B
'SLIC' string found in AFC04099-0D39-405D-BE46-846F08C51A31_880.ROM at 11CB
OEM/Table IDs identified are:
1. INSYDENapa
2. HPQOEMSLIC-MPC
Header (INSYDENapa SLIC) (x1)
Pubkey (x1)
Marker (2.1) (HPQOEMSLIC-MPC) (x1)

7E374E25-8E01-4FEE-87F2-390C23C606CD_869.ROM Header RSA Key + Marker 2.1


Bios v.F.24 - F.23 Model 03676 Menu Tabs Unlock Mod :

Form Sets
--------------------------------------------------------------------------------
Offset: Name:
--------------------------------------------------------------------------------
0x73450 Main (0xE9)
0x735D0 Exit (0x365)
0x73700 System Configuration (0x5B)
0x73DD0 Power (0x2E5)
0x746D0 Security (0x36)
0x747C0 Advanced (0xFB)
0x77B10 Main (0x4)
0x77DD0 Diagnostics (0x42)

067B : 74 55 to 74 00 jz short loc_1800006D2 to jz $+2

0685 : 74 4B to 74 00 jz short loc_1800006D2 to jz $+2

068F : 74 41 to 74 00 jz short loc_1800006D2 to jz $+2

.text:0000000180000666 loc_180000666: ; CODE XREF: sub_180000564+E7j
.text:0000000180000666 ; sub_180000564+F7j
.text:0000000180000666 cmp byte ptr [rdx+49h], 0Ah

.text:000000018000066A mov r12b, r14b

.text:000000018000066D jnb short loc_1800006D2

.text:000000018000066F movzx ecx, word ptr [rdi+18h]
.text:0000000180000673 mov eax, 0FBh
.text:0000000180000678 cmp cx, ax

.text:000000018000067B jz short loc_1800006D2

.text:000000018000067D mov eax, 0E9h
.text:0000000180000682 cmp cx, ax

.text:0000000180000685 jz short loc_1800006D2

.text:0000000180000687 mov eax, 2E5h
.text:000000018000068C cmp cx, ax

.text:000000018000068F jz short loc_1800006D2

.text:0000000180000691 movzx eax, byte ptr [rdx+49h]
.text:0000000180000695 add rax, rax
.text:0000000180000698 mov [rdx+rax*8+54h], cx
.text:000000018000069D mov rcx, cs:qword_180078298


Bios v.F.24 - F.23 Model 03676 Remove Whitelist Mod :

91472655-50E0-4D81-9AF6-239E6F431B8C_1164.ROM StartUpMenu
Nothing

CD28DACA-BDBE-481A-90AC-625C79CF234C_1210.ROM H19BIOSLock

0376 : E8 2D 11 00 00 to 90 90 90 90 90 call sub_1800014A8 to nop nop nop nop nop

.text:0000000180000376 loc_180000376: ; CODE XREF: DllEntryPoint+C2j
.text:0000000180000376 ; DllEntryPoint+E4j
.text:0000000180000376 call sub_1800014A8 ; Eliminate
.text:000000018000037B call sub_1800008F4

075B : 0F 85 2D 01 00 00 to 90 90 90 90 90 90 jnz loc_18000088E to nop nop nop nop nop nop

076F : 0F 85 19 01 00 00 to 90 90 90 90 90 90 jnz loc_18000088E to nop nop nop nop nop nop

0786 : 0F 85 02 01 00 00 to 90 90 90 90 90 90 jnz loc_18000088E to nop nop nop nop nop nop

079D : 0F 85 EB 00 00 00 to 90 90 90 90 90 90 jnz loc_18000088E to nop nop nop nop nop nop

.text:0000000180000742 loc_180000742: ; CODE XREF: sub_180000388+50Fj
.text:0000000180000742 movzx ebx, dil
.text:0000000180000746 imul rbx, 0A8h
.text:000000018000074D movzx eax, word ptr [rbx+r14+1860h]
.text:0000000180000756 cmp [rsp+0C8h+var_68], ax

.text:000000018000075B jnz loc_18000088E

.text:0000000180000761 movzx eax, word ptr [rbx+r14+1862h]
.text:000000018000076A cmp [rsp+0C8h+var_66], ax

.text:000000018000076F jnz loc_18000088E

.text:0000000180000775 movzx eax, word ptr [rbx+r14+1866h]
.text:000000018000077E cmp [rsp+0C8h+var_3A], ax

.text:0000000180000786 jnz loc_18000088E

.text:000000018000078C movzx eax, word ptr [rbx+r14+1864h]
.text:0000000180000795 cmp [rsp+0C8h+var_3C], ax

.text:000000018000079D jnz loc_18000088E

.text:00000001800007A3 lea rcx, [rbx+r14+1868h]
.text:00000001800007AB lea rdx, aH19notrecord ; "H19NotRecord"
.text:00000001800007B2 call sub_180001580
.text:00000001800007B7 test rax, rax
.text:00000001800007BA jz loc_18000089C


Bios v.F.24 - F.23 Model 03676 RSA Mod :

86D70125-BAA3-4296-A62F-602BEBBB9081_1347.ROM PEI

86D70125-BAA3-4296-A62F-602BEBBB9081_1480.ROM PEI (Shadow)


Donovan RSA Mod :

86D70125-BAA3-4296-A62F-602BEBBB9081_1407.ROM PEI

86D70125-BAA3-4296-A62F-602BEBBB9081_1585.ROM PEI (Shadow)

0220 : 0F 8C CF 00 00 00 to 90 E9 CF 00 00 00 jl loc_2F5 to nop + jmp loc_2F5


CodeRush RSA Mod :

62EB36E4-61DC-4861-9451-45AB2D3EFABA_1208.ROM NO

86D70125-BAA3-4296-A62F-602BEBBB9081_1407.ROM PEI

86D70125-BAA3-4296-A62F-602BEBBB9081_1585.ROM PEI (Shadow)

02F1 : 85 C0 to 31 C0 test eax, eax to xor eax, eax


If I remeber yet I didn't check the RSA Lock bypass at that time, but now all is possible and also we know how to do ...
I hope that these will be helpfull for you and for Lost_N_BIOS who has spent his life helping us all, many thanks firend !!!

#28 RE: [Solved] How to Unlock HP Insyde BIOSes by uwyref 19.04.2021 18:20

Thank for your share @Sweet Kitten
I'm surprised you already create mod for latest bios.

FYI, after running InsydeFlash then klik start, my notebook suddenly hang and flashing failed before erase/write process.
I have to unplugged my battery to boot normally again.
Any consideration for using your mod bios?

#29 RE: [Solved] How to Unlock HP Insyde BIOSes by uwyref 20.04.2021 00:44

Zitat von BDMaster im Beitrag #27
You're the Best my friend !!!

P.S. Russians are the best ...

Here I can leave my oldest notes about the F.24 mod files (2015/16) ...

Bios v.F.24 - F.23 Model 03672 Slic 2.1 Mod :

EFI / Insyde BIOS
SLIC header found in 7E374E25-8E01-4FEE-87F2-390C23C606CD_932.ROM at 0
Pubkey found in 1A1E2341-A2FB-42C7-8D17-3073D08EB21D_1235.ROM at 0
Marker found in DD6569A7-E455-4EE5-B2BA-ECDA84ACBC99_1241.ROM at 0
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_50.ROM at 924
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_50.ROM at A66
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_50.ROM at B80
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_50.ROM at C42
'SLIC' string found in AFC04099-0D39-405D-BE46-846F08C51A31_945.ROM at 3C3
'SLIC' string found in AFC04099-0D39-405D-BE46-846F08C51A31_945.ROM at E2F
OEM/Table IDs identified are:
1. INSYDEHuronRiv
2. HPQOEMSLIC-MPC
Header (INSYDEHuronRiv SLIC) (x1)
Pubkey (x1)
Marker (2.1) (HPQOEMSLIC-MPC) (x1)

7E374E25-8E01-4FEE-87F2-390C23C606CD_932.ROM Header RSA Key + Marker 2.1


Bios v.F.24 - F.23 Model 03672 Menu Tabs Unlock Mod :

Form Sets
--------------------------------------------------------------------------------
Offset: Name:
--------------------------------------------------------------------------------
0x122C0 Exit (0x157)
0x123F0 System Configuration (0x5A)
0x12AD0 Power (0x38D)
0x13390 Diagnostics (0x41)
0x13400 Security (0x35)
0x134F0 Advanced (0x181)
0x176F0 Main (0xCF)
0x17850 Main (0x4)

065D : 74 5B to 74 00 jz short loc_1800006BA to jz $+2

0668 : 74 50 to 74 00 jz short loc_1800006BA to jz $+2

0673 : 74 45 to 74 00 jz short loc_1800006BA to jz $+2

.text:000000018000061A loc_18000061A: ; CODE XREF: sub_180000514+E7j
.text:000000018000061A ; sub_180000514+F7j
.text:000000018000061A cmp byte ptr [rdx+49h], 0Ah
.text:000000018000061E mov r12b, r14b

.text:0000000180000621 jnb loc_1800006BA

.text:0000000180000627 cmp cs:qword_1800122B0, r14
.text:000000018000062E jl short loc_180000654
.text:0000000180000630 mov rax, cs:qword_1800A6910
.text:0000000180000637 movzx r8d, word ptr [rdi+18h]
.text:000000018000063C movzx edx, bp
.text:000000018000063F mov rcx, rsi
.text:0000000180000642 call qword ptr [rax+1F2h]
.text:0000000180000648 mov rdx, cs:qword_1800A6A20
.text:000000018000064F cmp rax, r14
.text:0000000180000652 jge short loc_180000675
.text:0000000180000654
.text:0000000180000654 loc_180000654: ; CODE XREF: sub_180000514+11Aj
.text:0000000180000654 mov eax, 181h
.text:0000000180000659 cmp [rdi+18h], ax

.text:000000018000065D jz short loc_1800006BA

.text:000000018000065F mov eax, 0CFh
.text:0000000180000664 cmp [rdi+18h], ax

.text:0000000180000668 jz short loc_1800006BA

.text:000000018000066A mov eax, 38Dh
.text:000000018000066F cmp [rdi+18h], ax

.text:0000000180000673 jz short loc_1800006BA


Bios v.F.24 - F.23 Model 03672 Remove Whitelist Mod :

91472655-50E0-4D81-9AF6-239E6F431B8C_1403.ROM StartUpMenu
Nothing

CD28DACA-BDBE-481A-90AC-625C79CF234C_1447.ROM H19BIOSLock

0396 : E8 D9 11 00 00 to 90 90 90 90 90 call sub_180001574 to nop nop nop nop nop

.text:0000000180000396 loc_180000396: ; CODE XREF: DllEntryPoint+C2j
.text:0000000180000396 ; DllEntryPoint+E4j
.text:0000000180000396 call sub_180001574 ; Eliminate
.text:000000018000039B call sub_180000914

077B : 0F 85 2D 01 00 00 to 90 90 90 90 90 90 jnz loc_1800008AE to nop nop nop nop nop nop

078F : 0F 85 19 01 00 00 to 90 90 90 90 90 90 jnz loc_1800008AE to nop nop nop nop nop nop

07A6 : 0F 85 02 01 00 00 to 90 90 90 90 90 90 jnz loc_1800008AE to nop nop nop nop nop nop

07BD : 0F 85 EB 00 00 00 to 90 90 90 90 90 90 jnz loc_1800008AE to nop nop nop nop nop nop

.text:0000000180000762 loc_180000762: ; CODE XREF: sub_1800003A8+50Fj
.text:0000000180000762 movzx ebx, dil
.text:0000000180000766 imul rbx, 0A8h
.text:000000018000076D movzx eax, word ptr [rbx+r14+1980h]
.text:0000000180000776 cmp [rsp+0C8h+var_68], ax

.text:000000018000077B jnz loc_1800008AE

.text:0000000180000781 movzx eax, word ptr [rbx+r14+1982h]
.text:000000018000078A cmp [rsp+0C8h+var_66], ax

.text:000000018000078F jnz loc_1800008AE

.text:0000000180000795 movzx eax, word ptr [rbx+r14+1986h]
.text:000000018000079E cmp [rsp+0C8h+var_3A], ax

.text:00000001800007A6 jnz loc_1800008AE

.text:00000001800007AC movzx eax, word ptr [rbx+r14+1984h]
.text:00000001800007B5 cmp [rsp+0C8h+var_3C], ax

.text:00000001800007BD jnz loc_1800008AE

.text:00000001800007C3 lea rcx, [rbx+r14+1988h]
.text:00000001800007CB lea rdx, aH19notrecord ; "H19NotRecord"
.text:00000001800007D2 call sub_18000164C
.text:00000001800007D7 test rax, rax
.text:00000001800007DA jz loc_1800008BC


Bios v.F.24 - F.23 Model 03672 RSA Mod :

86D70125-BAA3-4296-A62F-602BEBBB9081_1625.ROM PEI

86D70125-BAA3-4296-A62F-602BEBBB9081_1801.ROM PEI (Shadow)

0220 : 0F 8C CF 00 00 00 to 90 E9 CF 00 00 00 jl loc_2F5 to nop + jmp loc_2F5


Bios v.F.24 - F.23 Model 03674 Slic 2.1 Mod :

EFI / Insyde BIOS
SLIC header found in 7E374E25-8E01-4FEE-87F2-390C23C606CD_960.ROM at 0
Pubkey found in 1A1E2341-A2FB-42C7-8D17-3073D08EB21D_1146.ROM at 0
Marker found in DD6569A7-E455-4EE5-B2BA-ECDA84ACBC99_1152.ROM at 0
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_65.ROM at 8F4
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_65.ROM at 99C
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_65.ROM at ADE
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_65.ROM at B02
'SLIC' string found in AFC04099-0D39-405D-BE46-846F08C51A31_974.ROM at 37F
'SLIC' string found in AFC04099-0D39-405D-BE46-846F08C51A31_974.ROM at 3F6
'SLIC' string found in AFC04099-0D39-405D-BE46-846F08C51A31_974.ROM at 11FB
OEM/Table IDs identified are:
1. INSYDECalpella
2. HPQOEMSLIC-MPC
Header (INSYDECalpella SLIC) (x1)
Pubkey (x1)
Marker (2.1) (HPQOEMSLIC-MPC) (x1)

7E374E25-8E01-4FEE-87F2-390C23C606CD_960.ROM Header RSA Key + Marker 2.1


Bios v.F.24 - F.23 Model 03674 Menu Tabs Unlock Mod :

Form Sets
--------------------------------------------------------------------------------
Offset: Name:
--------------------------------------------------------------------------------
0x80350 Main (0xE8)
0x80600 Exit (0x384)
0x80710 System Configuration (0x59)
0x80DF0 Power (0x301)
0x81330 Security (0x34)
0x81420 Advanced (0xF5)
0x852B0 Diagnostics (0x40)

0651 : 74 50 to 74 00 jz short loc_1800006A3 to jz $+2

065C : 74 45 to 74 00 jz short loc_1800006A3 to jz $+2

.text:000000018000060E loc_18000060E: ; CODE XREF: sub_180000508+E7j
.text:000000018000060E ; sub_180000508+F7j
.text:000000018000060E cmp byte ptr [rdx+49h], 0Ah
.text:0000000180000612 mov r12b, r14b

.text:0000000180000615 jnb loc_1800006A3

.text:000000018000061B cmp cs:qword_18000EAD8, r14
.text:0000000180000622 jl short loc_180000648
.text:0000000180000624 mov rax, cs:qword_180085690
.text:000000018000062B movzx r8d, word ptr [rdi+18h]
.text:0000000180000630 movzx edx, bp
.text:0000000180000633 mov rcx, rsi
.text:0000000180000636 call qword ptr [rax+1F2h]
.text:000000018000063C mov rdx, cs:qword_180085730
.text:0000000180000643 cmp rax, r14
.text:0000000180000646 jge short loc_18000065E
.text:0000000180000648
.text:0000000180000648 loc_180000648: ; CODE XREF: sub_180000508+11Aj
.text:0000000180000648 mov eax, 0F5h
.text:000000018000064D cmp [rdi+18h], ax

.text:0000000180000651 jz short loc_1800006A3

.text:0000000180000653 mov eax, 301h
.text:0000000180000658 cmp [rdi+18h], ax

.text:000000018000065C jz short loc_1800006A3


Bios v.F.24 - F.23 Model 03674 Remove Whitelist Mod :

91472655-50E0-4D81-9AF6-239E6F431B8C_1288.ROM StartUpMenu
Nothing

CD28DACA-BDBE-481A-90AC-625C79CF234C_1334.ROM H19BIOSLock

0396 : E8 D9 11 00 00 to 90 90 90 90 90 call sub_180001574 to nop nop nop nop nop

.text:0000000180000396 loc_180000396: ; CODE XREF: DllEntryPoint+C2j
.text:0000000180000396 ; DllEntryPoint+E4j
.text:0000000180000396 call sub_180001574 ; Eliminate
.text:000000018000039B call sub_180000914

077B : 0F 85 2D 01 00 00 to 90 90 90 90 90 90 jnz loc_1800008AE to nop nop nop nop nop nop

078F : 0F 85 19 01 00 00 to 90 90 90 90 90 90 jnz loc_1800008AE to nop nop nop nop nop nop

07A6 : 0F 85 02 01 00 00 to 90 90 90 90 90 90 jnz loc_1800008AE to nop nop nop nop nop nop

07BD : 0F 85 EB 00 00 00 to 90 90 90 90 90 90 jnz loc_1800008AE to nop nop nop nop nop nop

.text:0000000180000762 loc_180000762: ; CODE XREF: sub_1800003A8+50Fj
.text:0000000180000762 movzx ebx, dil
.text:0000000180000766 imul rbx, 0A8h
.text:000000018000076D movzx eax, word ptr [rbx+r14+1980h]
.text:0000000180000776 cmp [rsp+0C8h+var_68], ax

.text:000000018000077B jnz loc_1800008AE

.text:0000000180000781 movzx eax, word ptr [rbx+r14+1982h]
.text:000000018000078A cmp [rsp+0C8h+var_66], ax

.text:000000018000078F jnz loc_1800008AE

.text:0000000180000795 movzx eax, word ptr [rbx+r14+1986h]
.text:000000018000079E cmp [rsp+0C8h+var_3A], ax

.text:00000001800007A6 jnz loc_1800008AE

.text:00000001800007AC movzx eax, word ptr [rbx+r14+1984h]
.text:00000001800007B5 cmp [rsp+0C8h+var_3C], ax

.text:00000001800007BD jnz loc_1800008AE

.text:00000001800007C3 lea rcx, [rbx+r14+1988h]
.text:00000001800007CB lea rdx, aH19notrecord ; "H19NotRecord"
.text:00000001800007D2 call sub_18000164C
.text:00000001800007D7 test rax, rax
.text:00000001800007DA jz loc_1800008BC


Bios v.F.24 - F.23 Model 03674 RSA Mod :

86D70125-BAA3-4296-A62F-602BEBBB9081_1840.ROM PEI

86D70125-BAA3-4296-A62F-602BEBBB9081_1663.ROM PEI (Shadow)

0220 : 0F 8C CF 00 00 00 to 90 E9 CF 00 00 00 jl loc_2F5 to nop + jmp loc_2F5


Bios v.F.24 - F.23 Model 03676 Slic 2.1 Mod :

EFI / Insyde BIOS
SLIC header found in 7E374E25-8E01-4FEE-87F2-390C23C606CD_869.ROM at 0
Pubkey found in 1A1E2341-A2FB-42C7-8D17-3073D08EB21D_1029.ROM at 0
Marker found in DD6569A7-E455-4EE5-B2BA-ECDA84ACBC99_1035.ROM at 0
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_50.ROM at 8F4
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_50.ROM at A1E
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_50.ROM at B62
'SLIC' string found in 85674556-04B3-4151-8612-53C628835F34_50.ROM at C09
'SLIC' string found in AFC04099-0D39-405D-BE46-846F08C51A31_880.ROM at 3A0
'SLIC' string found in AFC04099-0D39-405D-BE46-846F08C51A31_880.ROM at 110B
'SLIC' string found in AFC04099-0D39-405D-BE46-846F08C51A31_880.ROM at 11CB
OEM/Table IDs identified are:
1. INSYDENapa
2. HPQOEMSLIC-MPC
Header (INSYDENapa SLIC) (x1)
Pubkey (x1)
Marker (2.1) (HPQOEMSLIC-MPC) (x1)

7E374E25-8E01-4FEE-87F2-390C23C606CD_869.ROM Header RSA Key + Marker 2.1


Bios v.F.24 - F.23 Model 03676 Menu Tabs Unlock Mod :

Form Sets
--------------------------------------------------------------------------------
Offset: Name:
--------------------------------------------------------------------------------
0x73450 Main (0xE9)
0x735D0 Exit (0x365)
0x73700 System Configuration (0x5B)
0x73DD0 Power (0x2E5)
0x746D0 Security (0x36)
0x747C0 Advanced (0xFB)
0x77B10 Main (0x4)
0x77DD0 Diagnostics (0x42)

067B : 74 55 to 74 00 jz short loc_1800006D2 to jz $+2

0685 : 74 4B to 74 00 jz short loc_1800006D2 to jz $+2

068F : 74 41 to 74 00 jz short loc_1800006D2 to jz $+2

.text:0000000180000666 loc_180000666: ; CODE XREF: sub_180000564+E7j
.text:0000000180000666 ; sub_180000564+F7j
.text:0000000180000666 cmp byte ptr [rdx+49h], 0Ah

.text:000000018000066A mov r12b, r14b

.text:000000018000066D jnb short loc_1800006D2

.text:000000018000066F movzx ecx, word ptr [rdi+18h]
.text:0000000180000673 mov eax, 0FBh
.text:0000000180000678 cmp cx, ax

.text:000000018000067B jz short loc_1800006D2

.text:000000018000067D mov eax, 0E9h
.text:0000000180000682 cmp cx, ax

.text:0000000180000685 jz short loc_1800006D2

.text:0000000180000687 mov eax, 2E5h
.text:000000018000068C cmp cx, ax

.text:000000018000068F jz short loc_1800006D2

.text:0000000180000691 movzx eax, byte ptr [rdx+49h]
.text:0000000180000695 add rax, rax
.text:0000000180000698 mov [rdx+rax*8+54h], cx
.text:000000018000069D mov rcx, cs:qword_180078298


Bios v.F.24 - F.23 Model 03676 Remove Whitelist Mod :

91472655-50E0-4D81-9AF6-239E6F431B8C_1164.ROM StartUpMenu
Nothing

CD28DACA-BDBE-481A-90AC-625C79CF234C_1210.ROM H19BIOSLock

0376 : E8 2D 11 00 00 to 90 90 90 90 90 call sub_1800014A8 to nop nop nop nop nop

.text:0000000180000376 loc_180000376: ; CODE XREF: DllEntryPoint+C2j
.text:0000000180000376 ; DllEntryPoint+E4j
.text:0000000180000376 call sub_1800014A8 ; Eliminate
.text:000000018000037B call sub_1800008F4

075B : 0F 85 2D 01 00 00 to 90 90 90 90 90 90 jnz loc_18000088E to nop nop nop nop nop nop

076F : 0F 85 19 01 00 00 to 90 90 90 90 90 90 jnz loc_18000088E to nop nop nop nop nop nop

0786 : 0F 85 02 01 00 00 to 90 90 90 90 90 90 jnz loc_18000088E to nop nop nop nop nop nop

079D : 0F 85 EB 00 00 00 to 90 90 90 90 90 90 jnz loc_18000088E to nop nop nop nop nop nop

.text:0000000180000742 loc_180000742: ; CODE XREF: sub_180000388+50Fj
.text:0000000180000742 movzx ebx, dil
.text:0000000180000746 imul rbx, 0A8h
.text:000000018000074D movzx eax, word ptr [rbx+r14+1860h]
.text:0000000180000756 cmp [rsp+0C8h+var_68], ax

.text:000000018000075B jnz loc_18000088E

.text:0000000180000761 movzx eax, word ptr [rbx+r14+1862h]
.text:000000018000076A cmp [rsp+0C8h+var_66], ax

.text:000000018000076F jnz loc_18000088E

.text:0000000180000775 movzx eax, word ptr [rbx+r14+1866h]
.text:000000018000077E cmp [rsp+0C8h+var_3A], ax

.text:0000000180000786 jnz loc_18000088E

.text:000000018000078C movzx eax, word ptr [rbx+r14+1864h]
.text:0000000180000795 cmp [rsp+0C8h+var_3C], ax

.text:000000018000079D jnz loc_18000088E

.text:00000001800007A3 lea rcx, [rbx+r14+1868h]
.text:00000001800007AB lea rdx, aH19notrecord ; "H19NotRecord"
.text:00000001800007B2 call sub_180001580
.text:00000001800007B7 test rax, rax
.text:00000001800007BA jz loc_18000089C


Bios v.F.24 - F.23 Model 03676 RSA Mod :

86D70125-BAA3-4296-A62F-602BEBBB9081_1347.ROM PEI

86D70125-BAA3-4296-A62F-602BEBBB9081_1480.ROM PEI (Shadow)

If I remeber yet I didn't check the RSA Lock bypass at that time, but now all is possible and also we know how to do ...
I hope that these will be helpfull for you and for Lost_N_BIOS who has spent his life helping us all, many thanks firend !!!




thank you for reveal it, is it using IDA ?

#30 RE: [Solved] How to Unlock HP Insyde BIOSes by Sweet Kitten 20.04.2021 06:29

Zitat von uwyref im Beitrag #28
FYI, after running InsydeFlash then klik start, my notebook suddenly hang and flashing failed before erase/write process.
This happens when the BIOS is not for your notebook, but it is pointless in your case, because the BIOS is exactly for the HP 630.
For a faster response of the flash tool, I disabled the platform check by bios in the mod. It usually works, it seems like I shouldn't have done it this time. I reverted the changes, but the flashing will start slowly.

The mod is available at the same link!

Xobor Forum Software von Xobor
Datenschutz