[Request] HP Envy 15 vBios Mod

[HP_ENVY_User_32]

Hello all,

My laptop is an HP Envy 15 q473cl. This model uses Insyde Bios version F.17. My goal is to extract the vBios for my laptops Nvidia gtx 950m so that I can use the Maxwell 2 Tweaker tool to increase my GPUs maximum clock rate. My GPU is not currently under any power or thermal limit when under full load, so I would like to push it past the 135mhz offset limit that is embedded in the vBios.

I have been able to download the most recent bios for my laptop from HPs website, and I get the following four files;
08110.bin 8192kb
08110.s12 1kb
08155.bin 8192kb
08155.s12 1kb

The documentation for modifying insyde bios files is very sparse online so I haven’t had any luck in finding a tool that can read either the .s12 files or the .bin files shown above. Even if there is a program that can edit my bios, I would need to know what parts of it represent the vBios so I know what to upload into maxwell 2 bios tweaker.

From there I would be able to change clock rates, however I would also have no idea how to load the vBios back into my Bios, and from there I would also have no idea how to flash that modded bios onto my PC.

There are similar stories of success using identical hardware to mine such as this:https://www.techinferno.com/index.php?/forums/topic/9022-lenovo-y50-70-860m-4gb-overclock/&page=2
so I know the GPU is capable, it’s just a matter of finding the correct method for an insyde F.17 Bios.

In summary, these are my 5 questions:
Which of the 4 files from HP are my actual Bios?
Are there any tools to edit the Insyde F.17 Bios?
How would I get my vBios extracted from that Bios?
How would I reintegrate the modded vBios with the original Bios?
How would I flash the modded Bios to my laptop?

Any answers of the above questions is greatly appreciated!

Edit: I just found a chip in hwinfo64 named 8155 which makes me think the 08155 named files are the right ones

[Maxinator500]

Which of the 4 files from HP are my actual Bios?

Hello. It's one of 8912kb files. See "System Board ID" on the main tab of BIOS.

Are there any tools to edit the Insyde F.17 Bios?

The most common ones are suitable for editing: UEFITool, some hex editor.

How would I get my vBios extracted from that Bios?

To make finding vbios easier, use UBU on your bios. All files will appear in the "tmp" folder.

How would I reintegrate the modded vBios with the original Bios?

Find them by GUIDs in UEFITool. They will become known after using UBU.

How would I flash the modded Bios to my laptop?

For the first time of flashing it's SPI programmer (CH341A for example). But it is possible to flash something only if your BIOS is 08110.bin, because there is one catch. HP BIOSes use encryption, and I can't bypass it in 08155.bin.

[HP_ENVY_User_32]

What browser are you using to post here? I can't get the "Full Reply" to work on Chrome, Edge or IE so i can paste in pictures, I can only quick reply

[Maxinator500]

I can't get the "Full Reply" to work

Posting new thread message box does not appear

[HP_ENVY_User_32]

Alright now that I can post, thank you for answering my questions! Here is what I have achieved thus far:
I was able to find what I believe is my board model https://imgur.com/yq4qtsS
It looks like I have 08155...

I was also able to get my vbios extracted from my BIoS using UBU: https://imgur.com/Ua3uX1Q
From there I was able to edit my vBIoS with Maxwell 2 BIS Editor and save the modded vBIoS as vBI0S.rom:
https://imgur.com/8SvGiBV

My next step was to use UEFITool to find where my vBios is stored in the main BIoS, which I was able to find by searching the name of the original vBIoS file:
https://imgur.com/yLZEVR7

At this point I have two roadblocks:
1: How would I use UEFITool to inject the modded vBIoS into the main bios?
2: Is it worth trying to overcome roadblock #1 if the 08155 BIoS is not flashable as you mentioned?
2a) If this BIos isnt moddable, is that due to the RSA signature issue I keep reading about with HP Bios's?
2b) If RSA signatures are the "only" issue here, what is the status of any attempts in the community to crack this enigma? Do the experts generally agree that these Bios files will never be moddable?

[Maxinator500]

1: How would I use UEFITool to inject the modded vBIoS into the main bios?

Right click, replace, save.

2: Is it worth trying to overcome roadblock #1 if the 08155 BIoS is not flashable as you mentioned?

No. It's not worth it.

2a) If this BIos isnt moddable, is that due to the RSA signature issue I keep reading about with HP Bios's?

Yes.

2b) If RSA signatures are the "only" issue here, what is the status of any attempts in the community to crack this enigma? Do the experts generally agree that these Bios files will never be moddable?

My attempts are all failed. I just managed to disable the blinking of the caps lock reporting the error, but the device still did not work. I'm not good at assembly language, and it just seems to me this is happening because some function is not getting a response.
Maybe CodeRush is able to deal with this revision of protection, but I did not ask him.

[HP_ENVY_User_32]

Well I was able to rebuild the bios and confirmed that the process worked by reopening the new bios with UBU & then opening the vbios to confirm that the clock adjustments I made were still there, so at least I could do that.

After rebuilding the bios I noticed that the output only contained a .rom file [which I can rename to the original .bin format without issue and still repeat the above process with UBU] without the .s12 file that came with the original bios. Are these .s12 files related to the RSA signatures?

Do you know of any successful attempts to bypass RSA encryption? From what I've read its spoken about like the holy grail of bios modding that a fair bit of work has gone into solving. Does coderush have any public documentation 0f his work on RSA?

[Maxinator500]

Are these .s12 files related to the RSA signatures?

No. They are designed to prevent the beginning of the flashing process.

Do you know of any successful attempts to bypass RSA encryption?

Sure. But this is for other versions of protection. And I know which specific RSA bios can be modified. That's why I was asking what board you have.
CodeRush has a couple of instructions that are barely applicable in new bios.

[HP_ENVY_User_32]

What I gather from your linked post is that you didn’t directly bypass RSA encryption, but rather ran an unsuccessful flash which then allowed you to rollback to the non-signed (presumably modded) Bios with a recovery tool, is that correct?

If so, have you tried that process with a 8155 board laptop? Would that be worth a go or does the 8155 board prevent rollback to unsigned Bioses?

Or is it the case that the 8155 board cannot even be flashed in the first place?

[Maxinator500]

ran an unsuccessful flash which then allowed you to rollback to the non-signed (presumably modded) Bios with a recovery tool, is that correct?

Not at all. I initially applied a known working patch and tried flashing through the update utility, but the fact is that this is not possible. The BIOS contains a copy of the service module with protection and it does not change during flashing. This means that at the stage of checking the protection module with its copy, the check will not be passed and the notebook will be soft bricked. To prevent this from happening, you need to flash the patch with the programmer at least once.

Or is it the case that the 8155 board cannot even be flashed in the first place?

Without a protection bypass patch, it just doesn't make sense.