[REQUEST] ASUS TUF A15 FA506IV BIOS Unlock

[Sml6397]

I am going to head to bed as it is past 3AM here. I will check this thread first thing in the morning and we will continue to work through this if the AFUWIN dump does not work.

[KnoxMe]

I am going to head to bed as it is past 3AM here. I will check this thread first thing in the morning and we will continue to work through this if the AFUWIN dump does not work.

I've tested the latest modded BIOS that you provided. Nothing being exposed at all.

Thank you for all your works btw, and have a good night.

[Sml6397]

I am going to head to bed as it is past 3AM here. I will check this thread first thing in the morning and we will continue to work through this if the AFUWIN dump does not work.

I've tested the latest modded BIOS that you provided. Nothing being exposed at all.

Thank you for all your works btw, and have a good night.

Hi,

Do you mean that the modded BIOS flashed correctly and your computer can start? Or do you mean that your computer still does not start?

If your computer still does not start, have you tried flashing the AFUWIN backup yet? Any of the backups should work, but it might be a good idea to try.

[KnoxMe]

I am going to head to bed as it is past 3AM here. I will check this thread first thing in the morning and we will continue to work through this if the AFUWIN dump does not work.

I've tested the latest modded BIOS that you provided. Nothing being exposed at all.

Thank you for all your works btw, and have a good night.

Hi,

Do you mean that the modded BIOS flashed correctly and your computer can start? Or do you mean that your computer still does not start?

If your computer still does not start, have you tried flashing the AFUWIN backup yet? Any of the backups should work, but it might be a good idea to try.

My laptop does start and working correctly, I just mentioned that no menu was exposed. or nothing happened inside the bios menu using the modded bios.

[Sml6397]

Good to hear. I am not sure why the other flash attempts failed. All of the backup images should have worked. Maybe there was a bad connection (very common, which is why I asked for several dumps and compared them).

For future reference, the modded BIOS from post #25 was based on the SPI backup (FA506IV.rom). I will base future mods on this backup since we know for certain that it is functional.

However you flashed the BIOS this time, I would take notes on what you did. I think the brick the first time was due to a bad connection or the CH341A flashing software that was used (or both). If you are willing, I'd recommend flashing the modified BIOS from Post #24 again and see what happens. If it results in another brick, then reflash the SPI backup (FA506IV.rom) or the mod from Post #24 (they are the same).

I'd recommend seeing if AFUWIN will allow you to flash the BIOS. At this point, that may give a more consistent result than the programmer, especially if you are using the cheap clip that came with the adapter. I had to order the Pomona 5250 clip in order to flash my test machine.

With the modified image from Post #25, do the normal BIOS menus (Main, Advanced, Security, Boot, Save & Exit) show up or does nothing show up at all?

[KnoxMe]

Good to hear. I am not sure why the other flash attempts failed. All of the backup images should have worked. Maybe there was a bad connection (very common, which is why I asked for several dumps and compared them).

For future reference, the modded BIOS from post #25 was based on the SPI backup (FA506IV.rom). I will base future mods on this backup since we know for certain that it is functional.

However you flashed the BIOS this time, I would take notes on what you did. I think the brick the first time was due to a bad connection or the CH341A flashing software that was used (or both). If you are willing, I'd recommend flashing the modified BIOS from Post #24 again and see what happens. If it results in another brick, then reflash the SPI backup (FA506IV.rom) or the mod from Post #24 (they are the same).

I'd recommend seeing if AFUWIN will allow you to flash the BIOS. At this point, that may give a more consistent result than the programmer, especially if you are using the cheap clip that came with the adapter. I had to order the Pomona 5250 clip in order to flash my test machine.

With the modified image from Post #25, do the normal BIOS menus (Main, Advanced, Security, Boot, Save & Exit) show up or does nothing show up at all?

Bios form post 25 is exactly like stock, all normal menus showing up.

I'll test post 24 BIOS, Thanks.

[Sml6397]

I've been doing quite a bit of research today and have gone through a few methods. I will post them here in case they might be of useful reference to me or others in the future.

Some AMI Aptio images (I believe AMI Aptio IV) use a boolean table that defines which menus are supposed to show up. An example of this table is 01 01 00 01 01 01. This denotes that menus 1-2, 4-6 are supposed to show up and menu 3 is not. Change 00 to 01 to make menu 3 show up. The menu positions are defined in the Setup module. You can see this by getting the IFR text from the module using Donovan6000's Universal IFR Extractor on the Setup module extracted with UEFITool.

0x2B3A5 Form: Setup, Form ID: 0x2710 {01 86 10 27 07 00}
0x2B3AB Ref: Main, Variable: 0xFFFF {0F 0F 09 00 02 00 01 00 00 00 FF FF 00 11 27}
0x2B3BA Ref: Advanced, Variable: 0xFFFF {0F 0F 1E 00 02 00 02 00 00 00 FF FF 00 12 27}
0x2B3C9 Ref: Chipset, Variable: 0xFFFF {0F 0F 1F 00 02 00 03 00 00 00 FF FF 00 13 27}
0x2B3D8 Ref: Security, Variable: 0xFFFF {0F 0F 3A 00 02 00 04 00 00 00 FF FF 00 14 27}
0x2B3E7 Ref: Boot, Variable: 0xFFFF {0F 0F 20 00 02 00 05 00 00 00 FF FF 00 15 27}
0x2B3F6 Ref: Save & Exit, Variable: 0xFFFF {0F 0F 4D 00 02 00 06 00 00 00 FF FF 00 16 27}

Here is the post link: https://www.win-raid.com/t728f16-K-SD-Bi...l#msg12254 Thank you lordkag from win-raid for sharing this!

^Your image is an AMI Aptio V BIOS, however, so this code did not exist. Again, I'm not 100% sure about this being a IV vs V thing due to lack of personal experience, but I do know your image does not use this method to control which menus show up.

I also noticed that the form IDs (the last 2 bracketed bytes next to each menu name above (ie: 11 27 for Main) show up a lot in AMITSE. All 6 menus seem to show up sequentially multiple times in this manner, sometimes with a common GUID or other pattern of bytes between them.

Curious about this, I came across this post by Outsyde (I believe their username is a reference to Insyde BIOSes!): https://www.win-raid.com/t5590f36-Succes...l#msg97634

This post has a lot of great information. Unfortunately, I am having trouble finding some of the referenced code. I will continue to investigate this.

I have a feeling that everything I am learning trying to unlock this Chipset Menu will be helpful when trying to unlock the more difficult CBS menu. I am very curious about whether the mod from post #24 will actually show the CBS Menu. My prediction based on looking at AMITSetup is that nothing will be present in the BIOS Setup Utility and it will hang. I say this because I am not seeing certain Form IDs in AMITSESetup module. It would be cool if it showed up though!

[KnoxMe]

I've been doing quite a bit of research today and have gone through a few methods. I will post them here in case they might be of useful reference to me or others in the future.

Some AMI Aptio images (I believe AMI Aptio IV) use a boolean table that defines which menus are supposed to show up. An example of this table is 01 01 00 01 01 01. This denotes that menus 1-2, 4-6 are supposed to show up and menu 3 is not. Change 00 to 01 to make menu 3 show up. The menu positions are defined in the Setup module. You can see this by getting the IFR text from the module using Donovan6000's Universal IFR Extractor on the Setup module extracted with UEFITool.

0x2B3A5 Form: Setup, Form ID: 0x2710 {01 86 10 27 07 00}
0x2B3AB Ref: Main, Variable: 0xFFFF {0F 0F 09 00 02 00 01 00 00 00 FF FF 00 11 27}
0x2B3BA Ref: Advanced, Variable: 0xFFFF {0F 0F 1E 00 02 00 02 00 00 00 FF FF 00 12 27}
0x2B3C9 Ref: Chipset, Variable: 0xFFFF {0F 0F 1F 00 02 00 03 00 00 00 FF FF 00 13 27}
0x2B3D8 Ref: Security, Variable: 0xFFFF {0F 0F 3A 00 02 00 04 00 00 00 FF FF 00 14 27}
0x2B3E7 Ref: Boot, Variable: 0xFFFF {0F 0F 20 00 02 00 05 00 00 00 FF FF 00 15 27}
0x2B3F6 Ref: Save & Exit, Variable: 0xFFFF {0F 0F 4D 00 02 00 06 00 00 00 FF FF 00 16 27}

Here is the post link: https://www.win-raid.com/t728f16-K-SD-Bi...l#msg12254 Thank you lordkag from win-raid for sharing this!

^Your image is an AMI Aptio V BIOS, however, so this code did not exist. Again, I'm not 100% sure about this being a IV vs V thing due to lack of personal experience, but I do know your image does not use this method to control which menus show up.

I also noticed that the form IDs (the last 2 bracketed bytes next to each menu name above (ie: 11 27 for Main) show up a lot in AMITSE. All 6 menus seem to show up sequentially multiple times in this manner, sometimes with a common GUID or other pattern of bytes between them.

Curious about this, I came across this post by Outsyde (I believe their username is a reference to Insyde BIOSes!): https://www.win-raid.com/t5590f36-Succes...l#msg97634

This post has a lot of great information. Unfortunately, I am having trouble finding some of the referenced code. I will continue to investigate this.

I have a feeling that everything I am learning trying to unlock this Chipset Menu will be helpful when trying to unlock the more difficult CBS menu. I am very curious about whether the mod from post #24 will actually show the CBS Menu. My prediction based on looking at AMITSetup is that nothing will be present in the BIOS Setup Utility and it will hang. I say this because I am not seeing certain Form IDs in AMITSESetup module. It would be cool if it showed up though!

Again, I've tested BIOS from Post 24 & 25.

Nothing was exposed and it's exactly like a stock BIOS.

[Sml6397]

EDIT: This mod did not change anything. Please refer to later posts. I will update this post with a link to the working mod for reference once it is confirmed.

Hello KnoxMe,

Thank you for your continued patience with this! Hopefully soon you'll have access to not only the CBS Menu, but also the Chipset Menu.

I have prepared another mod for the Chipset Menu. This mod involves edits to the AMITSESetupData module that change the required access level for the chipset menu to "USER" instead of "DEFAULT". Let me know how this flash goes!


The rest of this post is an informational reference containing the details of the mod. You can skip over this if you wish or read it if you want to know what is going on behind the scenes.

0x19921 Form: Chipset, Form ID: 0x2713 {01 86 13 27 1E 00}

The last two bracketed bytes (1E 00) in the line above appear in AMISESetupData for each menu and sub-menu (these bytes will be different for different menus and sub-menus, of course). This line was taken from the IFR text given from Donovon6000's Universal IFR Extractor run on the Setup module extracted from the UEFI image using UEFITool.


1E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
04 00 00 00 00 00 00 00 01 00 01 00 31 00 00 00
01 00 00 00 02 00 00 00 04 00 01 00 66 07 00 00

The code segment above is 0x30 bytes long and occurs at offset 0x2120 in the extracted AMITSESetupData module. As you can see, "1E 00" are the first two bytes**. This code segment corresponds to the Chipset Menu. The first byte in the third row "01" controls which access level is assigned to the menu/sub-menu defined by the first two bytes "1E 00" (in this case, the Chipset Menu).

"01" represents an access level of "Default". I think the "Default" access level is defined someplace elsewhere in the BIOS image. I'm not sure how to edit that, but that is unnecessary (in theory). We can change "01" to "05" to set the access level to "User", which I believe is the access level you have when you enter your BIOS Setup Utility.

**Note: you may have to skip over several instances of "1E 00" that occur earlier in the module. You will know when you have encountered the correct "1E 00" when you find a 48-byte (0x30) long code segment beginning with "1E 00" and surrounded by sixteen 00 bytes before and after. In another image, these code segments defining access levels for various menus were actually 64-bytes (0x40) long. These code segments also each contained many FF bytes in the middle. Just use the same methodology to find the segments regardless of the size.

Based on what shows up in the AMITSE and Setup modules I believe that, unless there is some lock hidden somewhere I haven't yet looked, this access level lock is the only thing hiding the Chipset Menu.

[KnoxMe]

Hello KnoxMe,

Thank you for your continued patience with this! Hopefully soon you'll have access to not only the CBS Menu, but also the Chipset Menu.

I have prepared another mod for the Chipset Menu. This mod involves edits to the AMITSESetupData module that change the required access level for the chipset menu to "USER" instead of "DEFAULT". Let me know how this flash goes!


The rest of this post is an informational reference containing the details of the mod. You can skip over this if you wish or read it if you want to know what is going on behind the scenes.

0x19921 Form: Chipset, Form ID: 0x2713 {01 86 13 27 1E 00}

The last two bracketed bytes (1E 00) in the line above appear in AMISESetupData for each menu and sub-menu (these bytes will be different for different menus and sub-menus, of course). This line was taken from the IFR text given from Donovon6000's Universal IFR Extractor run on the Setup module extracted from the UEFI image using UEFITool.


1E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
04 00 00 00 00 00 00 00 01 00 01 00 31 00 00 00
01 00 00 00 02 00 00 00 04 00 01 00 66 07 00 00

The code segment above is 0x30 bytes long and occurs at offset 0x2120 in the extracted AMITSESetupData module. As you can see, "1E 00" are the first two bytes. This code segment corresponds to the Chipset Menu. The first byte in the third row "01" controls which access level is assigned to the menu/sub-menu defined by the first two bytes "1E 00" (in this case, the Chipset Menu).

"01" represents an access level of "Default". I think the "Default" access level is defined someplace elsewhere in the BIOS image. I'm not sure how to edit that, but that is unnecessary (in theory). We can change "01" to "05" to set the access level to "User", which I believe is the access level you have when you enter your BIOS Setup Utility.

Based on what shows up in the AMITSE and Setup modules I believe that, unless there is some lock hidden somewhere I haven't yet looked, this access level lock is the only thing hiding the Chipset Menu.

I'll hook up CH341A for flashing in no time. Thank you for your efforts.