HP Pavilion g4-1012tx [UNLOCK ADVANCED OPTIONS]

[kenkit]

Naaaah. It didn't work. It wasn't a cmos bug. The firmware just ain't right.
I mean this file

And, here is test BIOS with FLOCKDN bit cleared (PRR-Protected Range Register removed), I hope. This has no other mods, built from your current backup dump, with only this single bit change
https://www.sendspace.com/file/ebengy

The bug is on your side.
Take your time. In the meantime I'll try to make the process of removing the chip easier. Also I'm waiting for the programmer then I won't be locked to doing this at home pc only.
It seems we can't mod this bios even a bit. I'll also try modding it, but I'm pretty new to this stuff.
I found an article linked from within here https://h30434.www3.hp.com/t5/Notebooks-...d-p/974083

[Lost_N_BIOS]

Still, you said first time it didn't verify again. So to me this says, at least sometimes there is writing errors, but this probably is irrelevant and not the issue anyway since you can always program back the original BIOS and all is OK

No, I wanted you to program the PPR unlocked BIOS, then try FPT that same BIOS again using -bios to test flashing the BIOS region once more and see if the PRR unlock worked or not (It's pretty much a sure thing, only one main one to do it and your BIOS matched 100% the several methods that outline how to do it, vs some BIOS that may differ a little bit). There may be some other OEM locks, I noticed several lock modules in the BIOS, vs the one usual norm where this bit I unlocked is, so it's probably failing to due to these other modules that are also locking things down.

Sorry for the confusion about SMM lock and BIOS lock, I thought we'd already discussed unlocking those via grub, but looking back I see we hadn't discussed that, I must have been thinking of another thread with HP user I'm helping right now here or elsewhere. These, BIOS Lock and SMM/SMI lock are changed via EFI shell booting to Grub and using Setup_Var commands, but none of this applies to your situation or you would have received different error in FPT (36x usually, BIOS protected region, instead of error 28 PRR)

So, seems like PRR unlock is out on this BIOS due to other security features making it a moot point. You'll have to always flash mod BIOS via programmer in the future. If!!! I can ever figure out mod BIOS for you that is! Sorry, it was not the simple change I expected and have found with other similar Intel BIOS.

[kenkit]

I don't have write errors. It seems you misunderstood me.
At the first time as I was flashing your very first mod. I tried flashing it then It failed to verify for the first time. So I redid the write again before restoring the chip on the board. After writing it back I did the verify and it was success. So I put it in the mobo then but it didn't boot.
I've always verified all the files I'm testing before replacing it on the mobo. It wouldn't feel right if I ignored this, I just can't.\
I repeate the same procedure with the original dump, hence why it has never failed to boot after restoring it.

[Lost_N_BIOS]

Thanks for clarifying. I think the main issue is this is RSA Signed BIOS, and even after extraction/decryption/dump etc there is internal checking when board is started on this particular model. We can test, change some other simple file, like update CPU microcode or change a logo, then see if fails in the same way when programmed, that will confirm it for us.

I think this is the problem, because in that one test BIOS I sent you for the PRR unlock, I literally changed one bit (not byte even) in hex and it failed.

I will create new mod for you to test tonight, with a single CPU microcode update, if that works, then we know either CPU microcodes is outside the RSA check, or it's possible the version of UEFITool I was using is not compatible with this BIOS (I'll try older if we think that)

[kenkit]

I wanted to ask you how you bypased RSA verification but I thought you knew your way around that stuff.
Is there a way to bypass the verification ?
I'm working on a new way to allow me to easily remove the chip without re-soldering.

[Lost_N_BIOS]

I'm not aware of a way around it, but sometimes you can get lucky and it's only used when flashing BIOS not with BIOS actually loaded on chip already. Sometimes you can dump and edit that and it's OK, but not always, only way to find out is to test it.

Someone here might know a way around it, but I doubt it based on all the warnings here about RSA