[REQ] Asus UX480FD Bios 313

[stezza88]

I want to unlock the bios (power limit, advanced options, ...) of an ASUS UX480FD laptop attached in this post. 
GOP Version : 9.0.1085
SC Version : F0WL0D09.00F
May i have some help?
BIOS link : https://www.asus.com/it/supportonly/UX48...Desk_BIOS/

[Sml6397]

I want to unlock the bios (power limit, advanced options, ...) of an ASUS UX480FD laptop attached in this post. 
GOP Version : 9.0.1085
SC Version : F0WL0D09.00F
May i have some help?
BIOS link : https://www.asus.com/it/supportonly/UX48...Desk_BIOS/

Hello stezza88,

Could you run this tool developed by Serg008 of MyDigitalLife/BIOS-Mods and upload the result file here? I will be modifying this backup.

~Steven

[stezza88]

I want to unlock the bios (power limit, advanced options, ...) of an ASUS UX480FD laptop attached in this post. 
GOP Version : 9.0.1085
SC Version : F0WL0D09.00F
May i have some help?
BIOS link : https://www.asus.com/it/supportonly/UX48...Desk_BIOS/

Hello stezza88,

Could you run this tool developed by Serg008 of MyDigitalLife/BIOS-Mods and upload the result file here? I will be modifying this backup.

~Steven

You mean this tool Github : https://github.com/LongSoft/UEFITool ?

I have attached the ROM file but i need a summary explanation of the tools that you will use and some little screenshots because flashing must be done carefully. 
I have some problems related to my wifi card and bluetooth too so i wanted more options to configure those.
Thanks a lot.

[Sml6397]

You mean this tool Github : https://github.com/LongSoft/UEFITool ?

I have attached the ROM file but i need a summary explanation of the tools that you will use and some little screenshots because flashing must be done carefully. 
I have some problems related to my wifi card and bluetooth too so i wanted more options to configure those.
Thanks a lot.

Caution is always good when modding your BIOS. Did you use Serg008's BackupTool utility to get that backup, or did you use FPT or AFU?

Also, could you download HWiNFO ( https://www.hwinfo.com/download/ ), launch it, uncheck the "Sensors only" and "Summary only" boxes before clicking Run?

In the window with "Summary" and "Save Report" icons at the top left, double click Motherboard, then double click Intel ME. Let me know what it says next to "Intel ME Version". This will help with the flashing process if we use FPT.


I will be using a couple of tools to perform this BIOS mod. Here's a list of involved tools:

1.) UEFITool: I will be using this tool to extract specific files (modules) from your BIOS image. I will make my edits with a hex editor and possibly AMIBCP and then use UEFITool to repack the BIOS image.

2.) HxD hex editor: I will use the hex editor to change bytes in the extracted module(s), likely Setup and AMITSE.

3.) AMIBCP: This tool by AMI speeds up the process of performing manual hex edits to the AMITSESetupData module, which controls, among other things, access level requirements for individual sub-menus and settings.

4.) PhoenixTool and WinMerge: I will use these two tools after the BIOS mod to ensure that only the modules I edited were changed after repacking with UEFITool following the mod. This is just a safety check.

5.) Intel Flash Programming Tool (FPT) and AFUDOS/AFUWIN/AFUEFI are all software flashing tools that we can use to flash certain modified BIOS images. Some require the $10 USD CH341A hardware programmer in order to flash mods.

EDIT: I will try to have this BIOS mod complete in the next 1-2 days.

[stezza88]

You mean this tool Github : https://github.com/LongSoft/UEFITool ?

I have attached the ROM file but i need a summary explanation of the tools that you will use and some little screenshots because flashing must be done carefully. 
I have some problems related to my wifi card and bluetooth too so i wanted more options to configure those.
Thanks a lot.

Caution is always good when modding your BIOS. Did you use Serg008's BackupTool utility to get that backup, or did you use FPT or AFU?

Also, could you download HWiNFO ( https://www.hwinfo.com/download/ ), launch it, uncheck the "Sensors only" and "Summary only" boxes before clicking Run?

In the window with "Summary" and "Save Report" icons at the top left, double click Motherboard, then double click Intel ME. Let me know what it says next to "Intel ME Version". This will help with the flashing process if we use FPT.


I will be using a couple of tools to perform this BIOS mod. Here's a list of involved tools:

1.) UEFITool: I will be using this tool to extract specific files (modules) from your BIOS image. I will make my edits with a hex editor and possibly AMIBCP and then use UEFITool to repack the BIOS image.

2.) HxD hex editor: I will use the hex editor to change bytes in the extracted module(s), likely Setup and AMITSE.

3.) AMIBCP: This tool by AMI speeds up the process of performing manual hex edits to the AMITSESetupData module, which controls, among other things, access level requirements for individual sub-menus and settings.

4.) PhoenixTool and WinMerge: I will use these two tools after the BIOS mod to ensure that only the modules I edited were changed after repacking with UEFITool following the mod. This is just a safety check.

5.) Intel Flash Programming Tool (FPT) and AFUDOS/AFUWIN/AFUEFI are all software flashing tools that we can use to flash certain modified BIOS images. Some require the $10 USD CH341A hardware programmer in order to flash mods.

EDIT: I will try to have this BIOS mod complete in the next 1-2 days.

Intel ME Version : 12.0, Build 1427, Hot Fix 35
Intel ME Recovery Image Version: 12.0, Build 1427, Hot Fix 35
Intel ME FITC Version: 12.0, Build 1128, Hot Fix 10

The afuwin.zip was taken with Aptio_V_AMI_Firmware_Update_Utility.
Here i've attached the rar file of the ROM taken with the software by Serg008.
Thanks. I'll wait.

[Sml6397]

Hello stezza88,

Your BIOS mod is complete!

I have unhidden a second Advanced Menu and a Chipset Menu. You should find a vast array of settings in these menus. Additionally, you should (in theory) find a new "Overclocking Performance Menu" at the beginning of your BIOS Setup Utility located before the other menus. It should be Overclocking Performance Menu, Main, Advanced, Chipset, Security, Boot, Save & Exit.


For flashing, let's use the FPT (Intel Flash Programming Tool) method.

1.) Format a USB Flashdrive as FAT32. This will erase all files on your flashdrive. Follow these instructions: https://www.easeus.com/partition-master/format-usb-flash-drive-in-windows-10.html#part2 BUT DO NOT TICK "QUICK FORMAT" in Step 3. We do not want to do a quick format.

2.) https://github.com/chipsec/chipsec/raw/master/chipsec/modules/tools/secureboot/Shell.efi Download this file. It is a UEFI shell. Create the directory /efi/boot on the flashdrive and then place the Shell.efi file there. Rename it to "bootx64.efi".

2.) https://mega.nz/folder/qdVAyDSB#FLCPaDVIsPYiy2TAUjD7RQ From here, download "CSME System Tools v12 r35.rar". Extract "Fpt.efi" from the Flash Programming Tool > EFI64 > directory in the RAR file. Place it under /efi/ on your flashdrive.

3.) Place the modified BIOS image in the /efi/ directory on the flashdrive.

You should now have the following three files on the flashdrive:
/efi/boot/bootx64.efi
/efi/Fpt.efi
/efi/mod.rom *

*Substitute "mod.rom" with the name of the modified BIOS image.

4.) With the flashdrive inserted into a USB port, reboot your computer and enter the BIOS Setup Utility (BIOS menus). Set the computer to boot from the USB flashdrive.

5.) Once you reboot into the EFI Shell Environment (from your flashdrive), run the following commands:
fs0:
cd efi
Fpt.efi -bios -f mod.rom

Let me know if this works. If you encounter an error, write down *exactly* what it says or take a picture of it and upload it here.

[stezza88]

Error 167: Protected Range Registers are currently set by BIOS, preventing flash access. Please contact the target system BIOS vendor for an option to disable Protected Range Registers.

FPT operation failed.

[Sml6397]

Error 167: Protected Range Registers are currently set by BIOS, preventing flash access. Please contact the target system BIOS vendor for an option to disable Protected Range Registers.

FPT operation failed.

Alright, it seems there are some hidden BIOS settings that are preventing write access to the BIOS chip via FPT. We will use a program called RU.EFI to change this setting before we flash the BIOS mod.

Using the same flashdrive setup from earlier, please following the following:

1.) http://ruexe.blogspot.com/2020/05/ru-5250379-beta.html Download this file (the password is right under the download link). It includes RU.EFI. Extract this file to /efi/ on your flashdrive.

2.) Once you boot into the EFI Shell Environment, run the following commands:
fs0:
cd efi
RU.EFI

3.) You should now be in the RU utility. Press "Alt" and "=" at the same time on your keyboard. This should take you to Config -> UEFI Variable.

Another way to reach this is to press "Alt" and "C" to get into the Config Menu and then press the down arrow until you get to "UEFI Variable" and then press enter.

See this page if you need pictures or more guidance: https://nstarke.github.io/firmware/uefi/...u-efi.html

4.) In the list of UEFI Variables, scroll down to "PchSetup". I believe that they should be in English alphabetical order. Hit Enter on your keyboard to enter the Variable.

5.) Now you need to go to offset 0x1206 in PchSetup. This will not be on the first page. You will need to press "Ctrl" and "Page Down" on your keyboard repeatedly until you reach a page where the LEFT column contains "1200". In the row next to "1200", go over right until you get to the 7th cell. At the top, you will see "06". This is offset 0x1206. We get "120" from the left side and "6" from the top.

6.) Press Enter to begin writing to the cell. **Please write down what the old value is and let me know** It should be "01" (enabled). Change it from whatever it is to "00" (disabled).

7.) The "BIOS Lock" setting might also be preventing us from flashing mods. To disable it, go backwards ("Ctrl" and "Page Down") to reach cell 0xB4C. This will be "B40" on the left column and the 13th cell to the right (under "C" at the top). If the value is "01" (enabled), then set it to "00" (disabled). If the value is something other than "01", don't change it but do let me know what it is.

8.) Okay, final step. Press "Ctrl" and "W" at the same time to write your changes to the NVRAM. Press "Ctrl" and "Q" to exit RU.EFI. Reboot your computer and try flashing the BIOS again as before.

Let me know how it goes.

[stezza88]

I have done the flashing BUT NO BIOS' OPTIONS ARE CHANGED, i have attached the screenshot of the succesfull flashing operation.

EDIT: the only passage i not understood was this,

/efi/mod.rom * *Substitute "mod.rom" with the name of the modified BIOS image.

so i did not renamed the file mod.rom. Maybe is this the problem?

[stezza88]

Intel ME Version : 12.0, Build 1427, Hot Fix 35

I've modded my BIOS Lock using this guide : "https://www.win-raid.com/t3908f16-GUIDE-Grub-Fix-Intel-FPT-Error-or-BIOS-Lock-Asus-Other-Mod-BIOS-Flash.html"

So i used the program "https://github.com/LongSoft/UEFITool/releases" to find setup module (in this instance this is GUID - 899407D7-99FE-43D8-9A21-79EC328CAC21 - find via search/GUID tab), i've extracted the PE32image, then opened it via Universal IFR Extractor and i found this BIOS Lock values

One Of: BIOS Lock, VarStoreInfo (VarOffset/VarName): 0xB4C, VarStore: 0x1, QuestionId: 0xBAE, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 92 0A 93 0A AE 0B 01 00 4C 0B 10 10 00 01 00}
0x47765 Default: DefaultId: 0x0, Value (8 bit): 0x1 {5B 06 00 00 00 01}
0x4776B One Of Option: Disabled, Value (8 bit): 0x0 (default MFG) {09 07 04 00 20 00 00}
0x47772 One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}

and putted the following command via this modded EFI Grub "https://github.com/datasone/grub-mod-setup_var"
> setup_var 0xB4C 0x00

(all of this because via shell with RU.efi there was no PchSetup UEFI variable)

To test it, when i exctracted my BIOS via command line
> FPTW64.exe -d bios.bin (using "CSME System Tools v12 r35.rar")
, but when i opened the .bin file with AMIBCP-5-02 the variable Flash Protection Range Registers was still on YES value.

Where i did get wrong?