ACER 5742G BIOS modding

You will need ezH2O 2.1.0.13 or newer
All the values in the latest bios (1.10) seem to be good (every option that's nice to have is enabled), except that, for me, UEFI boot isn't working.
Also, VSS modding doesn't seem to stick unless i change the value in both the Setup and the Custom variable, so I just did this with a hex editor (ACER doesn't have checksums on uncompressed VSS volumes). However, this requires a bios DUMP for each laptop, and then that to be modified. Instead, i like modifying the SetupUtility PE (well, actually the HII forms UEFI bytecode inside of its data section). This gives permanent option unlocking (just change the Suppress If statement to check some bogus variable for some bogus values).

You will need Python 2.6.x or 2.5.x installed and in your PATH for this to work, also copy the lzmadec.dll to it's dll dir.

First, we need the SetupUtility PE out of the bios, so do this:

Code:

python main.py PEW71110.fd

This will make a data folder with SetupUtility PE in it.
Then, we analyze the UEFI forms bytecode in this PE:

Code:

python dumpsetup2.py data\SetupUtility-mine.pe > bytecode.txt

Each form set listing starts with "Reading form 'Main'=7ecb0" where 7ecb0 is the offset in the PE where the HIIPACK header is located.
the HIIPACK header consists of 6 bytes: [UINT32 SIZE, UINT16 TYPE], so place the cursor at the offset, check intel little endian mode in your hex editor, and interpret the int of size. The UEFI bytecode is located in the area right after the 6 byte header, defined by size. You can see a list of opcodes inside dumpsetup2.py, for more information about a opcode you can just google it, and then follow the link to the Phoenix Wiki. Or consult the Intel EFI pdf that has definitions for most of them.


So, i wanted to expose the advanced boot options like UEFI BOOT, FAST BOOT, etc. I found the string in bytecode.txt, found the form package they're in ("Reading form 'Boot'=7f120"), and see why they're not displaying ("Suppress If LIST [0x85<1>] in (0x00,0x01,0x02,0x03,0x04)"
Now, we could either just hex edit our DUMPED bios to set the VSS var 0x85 to 0x05, but this would mess up some other pages where you will see unknown grayed out values, etc, and would be reset if you chose to restore to factory settings in the bios, or we could edit the UEFI bytecode to not check that variable anymore.
To do that, we find that the LIST check we want is "EFI_IFR_EQ_ID_LIST_OP = 0x14", so we search for first occurence of 0x14 in the uefi bytecode area (after the HII header), and see:

Code:

1411 8500 01 0500 0000 0100 0200 0300 0400

14 is our opcode, 11 is the length of it (+ additional bit, ignore it)
8500 is the variable we check
01 is the length (in bytes) we are checking
0500 is the size of the array of the values we are checking for
and after that we have values[5] of UINT16 for the values to check for
Since 0x85 is in the range of 0x00 to 0x05, i just changed the values to check for to : 0xFF 0xFE 0xFD 0xFC 0xFB, so our bytecode changes to:

Code:

1411 8500 01 0500 FF00 FE00 FD00 FC00 FB00

After we have done the change, we need a way to pack it back into our .fd image.
This is where ezH2O comes in.
Open the PEW71110.fd file in it.
You cannot open dumped ROMs (or any ROMs that have NVRAM in them) with ezH2O, as it will just crash while saving it later.
If it were a stable utility, i could just go to modules->replace and replace the SetupUtility with our modded PE
But that makes it crash.
So, after opening the .fd image in ezH2O, i opened WinHEX, opened the ezH2O primary memory in it
Now, we can search around the uncompressed memory of ezH2O.
To find the range we want to replace, simply select a big enough chunk of hex around the area you want to edit (make sure you can find only 1 occurence of it in the PE, make it a big enough chunk of hex)
Then search for that in WinHEX while having opened ezH2O's memory area.
If you get the message "Virtual memory layout has changed", simply exit WinHEX and attach to ezH2O's memory again and try again.
After changing the bytes you wanted, you can simply close WinHEX, there is no saving for memory.

Now, some people say that ezH2O won't even bother rewriting the image from uncompressed modules in RAM unless you change something in ezH2O before doing a save as.
To circumvent this, i just change the boot logo.
The preferred format to change it to is a 640x480 indexed PCX file.
I have put a link to the original ACER logo PCX in the bottom of this post, that you can use.
Don't worry if ezH2O asks you to change the format to 0x0 or some crazy thing, just click yes, it will change the logo image properly.
You can open the logo image dialog again, to verify that it changed properly.
After that, simply do a File->Save as and name it modified.fd or something.
Then you can flash this with the official InsydeFlash utility, either for windows or DOS.
I also like setting the ALL=0 option in platform.ini to ALL=1, this way it clears the passwords and some other things get reflashed as well.
To get the raw folder (instead of the self extracting exe you download from acer's site), you just run the exe from acer's site, and immediately close the CMD prompt that comes up.
You can find the raw folder inside your Windows' temp dir.
Copy your modified.fd as PEW71110.fd in that folder, overwriting the original one, and simply run DPJ.BAT on your laptop to flash it.

Now, the problem ive encountered is:
1. the UEFI BOOT variable in the bios is already set to [ENABLED], but UEFI BOOT is not working. This would mean that we require some modules that we don't have in our BIOS, or we need to modify some boot selector that decides where we boot. The problem is that ezH2O crashes when you try to modify a module, and just gives an error that i haven't given it the correct module type when i try to insert a new one. I've found a BIOS from some other ACER laptop that supposedly CAN UEFI boot, and extracted all it's modues using fsdump.py, and it indeed has more modules than the 5742G bios (like Terminal), but both our bios and their bios have the same BOOTX64.EFI strings, as well as INTERNAL EFI SHELL string etc, in the modules, which confuses me.
To extract all modules from a .fd image, first you will have to manually unLZMA it. To do this, open the .fd in a hex editor, and remove everything before the LZMA header(5D000080001000), then save it and run

Code:

lzma -c -d lzmacompressedfd.lzma > decompressed.bin
fvdump.py decompressed.bin
fsdump.py fv-00000010.bin

And you will get tons of files that correspond to the modules inside the fd image.

So, any ideas on how get UEFI boot going ?

Files like python scripts, sample bios with extra options, and the boot logo pcx can be found at Index of /acer/tools
To get ezH2O, just google ezH2O 2.1.0.13 (earlier versions will crash on .fd load)
Python scripts made by Marcan and d6z, i just edited them with correct offsets for this bios image

EDIT: I've found why the pages weren't showing, the SetupUtility code, on form init, checked if the form set string ID was either 0x67 ("Advanced") or 0x283 ("Power"). Simply replacing these checks with NOPs made them show up.
To reiterate, i've replaced 83F867 0F849E000000 (cmp eax, 67h, jz) with 83F867 909090909090 (cmp eax, 67h, 6*nop) and 3D83020000 0F848A000000 (cmp eax, 283h, jz) with 3D83020000 909090909090 (cmp eax, 283h, 6*nop). These are at 0x1249 and 0x125B in SetupUtility PE, respectively. I've uploaded a bios image that unlocks these pages to the link above.

EDIT2: Just inserting new modules properly extracted from other ACER laptop models using ezh2o does make a valid efi image, but the laptop will just keep resetting before display init if you do this
However, you can safely remove the following modules: Chinese, JpegDecoder (if you're using a PCX boot logo) and also all the VGA BIOS for the graphics card you don't have, if you have nvidia, you can remove all ATOMBIOS ATI, vice versa if you have ATI
In case anyone cares, the recovery bios filename for the Acer Aspire 5742G is PEW71X64.fd and you can use any 4MB .fd file from acer's site for this model, put it on a fat16/fat32 formatted usb drive or a CD/DVD

EDIT3:
If your laptop doesn't boot, and you don't know the filename you need to use for recovery from usb/dvd to work, you will need to extract modules from the PEI section as well, which i don't know how to do manually using these tools. However, the Phoenix SLIC Editor Package, which supports insyde h2o bioses, can automagically extract all modules, including the PEI ones. Simply have it open your bios, and after you see the .ROM files being extracted, a dialog box will show up, and then you can harvest the .ROM files from the same folder the bios was in, in a subfolder called TEMP. Then simply search them for ".fd" (unicode) and see what the filename is. On mine, i had an ASCII hit as well, right next to TORITO, which is DVD bootsector related.

 

Following the dumpsetup2.py I encountered:
UnicodeDecodeError: 'utf16' can't decode bytes in position 403678-403679:illegal encoding.
I took at look at the offset it is this char ¬

Edit: I got it, just forgotten to mod the string table. =P

Code:

Opened BIOS 'NALG0X64.fd' with md5:b88f67347247ae6853b5d928ed43a3d5
Operating on BIOS data/original_bios-mine.fd size = 0x400000
Loading compressed sections
 .. found 3 compressed sections
Locating Firmware Volumes
  .. found 8 FirmwareVolumes (4 compressed)
STRING_TABLE = 0x18340
String table:
 Language: eng (English)
 String count: 929
Location = 0x7c020
Location = 0x7c450
Location = 0x7c4e0
Location = 0x7c660
Location = 0x7cb90
Location = 0x7ccf0
Location = 0x80d30
Have vss_volume: FirmVol position=0x390000 size=0x00ffb8 where=None [VSS]
Have vss_volume: FirmVol position=0x3a0000 size=0x05ffb8 where=None [VSS]
Have vss_volume: FirmVol position=0x000010 size=0x47ffb8 where=[compr at 0x281069] [VSS]<firmvol position="0x390000" size='0x00ffb8' where="None" [vss]=""><firmvol position="0x3a0000" size='0x05ffb8' where="None" [vss]=""><firmvol position="0x000010" size='0x47ffb8' where="[compr" at="" 0x281069]="" [vss]=""><firmvol position="0x390000" size='0x00ffb8' where="None" [vss]=""><firmvol position="0x3a0000" size='0x05ffb8' where="None" [vss]=""><firmvol position="0x000010" size='0x47ffb8' where="[compr" at="" 0x281069]="" [vss]="">
Done

</firmvol></firmvol></firmvol></firmvol></firmvol></firmvol>

 

yep, you first run main.py, then modify dumpsetup2.py with the values you gotten from main.py (string table location and page offsets)
then, if you want to use vtenable.py, you have to search the .fd file for $VSS in a hex editor, and note that as VSS_OFFSET, for VSS_SIZE you have to do a fvdump whatever.fd and look at the size of the fv-*.bin file which contains $VSS at the top, PATCH_OFFSET is the storage offset you got from looking at output of dumpimage2.py (0x85, 0x1a3, etc), PATCH_VALUE is what you want the value to be.

however, when i wanted to do this, it was easier to just hex edit the .fd file directly, to do this, find $VSS, then find "Setup" unicode after it, then find the next AAFF hex after it, go back X bytes (X being the value of nvsize in dumpsetup2.py output) and then go forward your PATCH_OFFSET and edit the value. Repeat for "Custom" unicode as well to make sure the value sticks (didn't want to stick for me unless it was in both)

 

I was thinking of unlocking all menu.
VT is already enabled.
But after dumping all the tables there seems to be nothing of real useful there...

 

I've also now uploaded new python scripts rar which includes a fsdump.py which follows ezH2O guid format, and also dumps the original .ffs as well as the separate sections, so you can try to import the ffs in ezH2O (it will work, you need to change logo after import and before saving for ezH2O to notice ,but whether your laptop can still boot is the question)

Can your laptop UEFI boot (from a usb stick with EFI/BOOT/BOOTX64.EFI or from a EFI bootable DVD) ?
EDIT: Looks like your BIOS has about the same amount of options as mine...
There's a VID Override string, but no actual vid override option in the forms

 

I remember reading somewhere to UEFI Boot you need a /BOOT/ folder with certain EFI requirements.

 

in order to be uefi compatible, it should also just boot windows 7 x64 from the dvd using uefi, not mbr. all of this seems to be compiled out of the bios modules
and i had that boot folder just fine, and the strings in the module dump seem to be there on my bios, yet it doesnt work

would be nice if anyone here had Acer 3810T, because for that model, bios 1.08 allows uefi boot, while 1.10 doesnt. And i have a list of changed modules here, could try them one by one, see which one disabled it.

EDIT: GREAT SUCCESS http://i.imgur.com/LE0Pb.jpg
thing holding me back was that ezh2o bitflips the header crc byte of a FFS entry, so you have to bitflip that byte in fsdump.py as well, if you want to directly use extracted .ffs files to insert in ezh2o.
updated fsdump.py is in the rar above

The modules i needed to insert, i found in the 3810T 1.08 firmware, and they were EmuVariable, DiskIo, Partition, Fat, LaunchApp, Terminal

I have achieved all my objectives.
The resulting bios file is here: http://rajko.info/acer/tools/ACER5742G_MoreOptionsMorePages_UEFIBOOT_NOATIBIOS.rar
As the filename says, i had to remove the ATI vbios modules to fit the ones required for efi boot. So don't use on a 5742G with ATI graphics.

 

please, i update my acer 5742g bios to 1.11 and now i cant upgrade with your mod bios because is 1.10. what can i do? please help me......

 

Was somebody able to install Win 7 in EFI mode on GPT partition? I have BSOD when trying to do this on acer 3810

 

Windows 7 current doesn't do GPT installs.
It can read GPT but not as a system disk, I came to the answer a couple of months back while trying to do the same.

 

Are you sure? It can't be installed on MBR partition in EFI mode. There are screenshots of EFI installing in first post but there is no info about was it successful or not

 

you have to install to a gpt formatted hdd if the dvd booted in uefi mode
it works just fine.

 

Are you sure?
I have a Intel EFI Motherboard.
Even if I enable UEFI Boot and created a GPT Partition for the harddisk, 32bit Windows will still complain it is unable to install because it is a GPT Harddisk.
Unless I am missing out on something it seems impossible to install 32bit Windows on GPT partitions.
Edit:
I didn't see it was for x64.
Now this is something I would hack the firmware for if it offers advantage over the legacy MBR.
Does it make it better?

 

Ok, so it's a problem with acer 3810

 

Hi !

I'm trying to enable VT on my acer aspire 5742 (not G).
I've tried with the vtenable.py script but it returning: "Variable not found !"
It seems that there is not AA55 in the hexdump of the .fd of my bios while the $VSS is found (without changing the VSS_OFFSET).

Is that script only working with the 5742G ?
And if yes, is there something i can do to make it works ?

Thank you if you have the time to answer me
And sorry if my english is not so good.

 

nothing important

 

Rajkosto, can you make "Moreoptions Morepages" bios for the last version 1.12?

 

Set the parameter in Platform.ini
[Bios_Version_Check]
Flag=0

in folder with InsydeFlash.exe

 

Could you unlock the hidden options for the 5745PG?

 

look at this post
http://forum.notebookreview.com/acer/541716-acer-5742g-bios-modding.html#post6983784

 

ive added 1.15 versions of moreoptionsmorepages, uefiboot_noati and an additional uefiboot_noati one that allows you to change intel VRAM size and gfx type (changing gfx type may brick, requiring you to reset NVRAM by reflashing bios using recovery mode)

 

Thanks for your work!

 

Hi, i'm new here.

I would like to thank rajkosto for all his work, i've flashed the moreoptions morepages bios on my brand new notebook (had to trick the installer since I had version 1.16).

However there is an option that is avaiable only after flashing the bios (either a custom one or the original one).

That's the "Display Mode [something]" option, in the second page.
It relates to the nvidia optimus technology. If the option I availabe I can choose to use the integrated video card (Intel HD), the nvidia one, or both using optimus (hybrid).

Since the latter is only supported by windows and it causes troubles under linux it could be nice to switch the option according to the OS to be booted.

The problem is that after the first startup of windows the option vanishes and it behaves as if hybrid was choosen (is windows or the graphic card writing some sort of flag?? Why??).

Maybe someone with more expertise might look into this... It would be great! (for me and for other linux users with this notebook).


More info on the matter (not strictly related to the missing option): [ubuntu] nVidia Optimus and Ubuntu explained - Ubuntu Forums


Thank you guys.

 

Ok I was able to edit the newest version of the bion 1.16 to always show the "display mode" setting ^^

Integrated graphics: works fine.
Switchable graphics: works fine.
Discrete graphics: the laptop boots normally but nothing is drawn on the screen (not even during post).

NOTE: Windows boots fine with the setting choosen from the bios but it resets it, so next time you boot you have to change that again (that allowed me to recover after having set "Discrete").

Gimme some time to sleep and I will upload the file

I really hope that Acer releases a proper fix.

 

steven3k, where are u?)

 

Hi, sorry for the late reply... actually i bricked my computer in one of other attempts.

Anyway the bios file is here: modified_display.fd - 4.00MB

Remember that discrete only is not working!!

HTH!

 

steven3k, insydeFlash say - Error: Load File - New rom size did not match this platform((

 

Strange. What is the size of the original
I just modified the 1.16 rom from Acer Support: Downloads & Support Documents - Notebook / Aspire / Aspire 5742G

 

If it uses optimus the nvidia graphics is not wired up to the display outputs

 

HELP! Bricked!

I turned off hyperthreading and now my laptop is bricked.

It turns on, fan comes on, screen stays blank, then reboots itself after a minute.

I've tried recovering by using a ROM file from Acer's site renamed to PEW71X64.fd on CD and on USB, but nothing happens. Same symptoms.

 

Remove CMOS battery- this will revert BIOS to default settings with HT on.

 

here's my dilemma... just got a acer5742G with nvidia 540M.
as I understand it switches video adapters on need but the dumb system stops me for watching any flash video in full screen... imagine that! all this technology at my hand and can't watch a crappy youtube video in full screen!
so I updated the bios to the latest version 1.19 to hopefully fix the problem but of course the problem persists.
my intention is to disable the crappy intel HD onboard video card and use only the dedicated nvidia 540M... but the brilliant geniuses at ACER said: let's screw the users and make their live a living hell...so they hidden the options in BIOS which could give me the chance to disable the on board intel video card.
so now I have to use a modded BIOS and possibly screw up my laptop just because I cant watch a damn youtube video on full screen... I can do this even on my crappy phone. I've tried all the major browsers of course and even various flash player version(even the latest beta)... the result: the same!
now where can I get a good modded bios version 1.19 which won't cripple my brand new laptop? can you help me on this one?
thanks in advanced!

 

Here Index of /acer/tools is 1.15 version of modded bios only. (waiting for last)

If you want to flash it over 1.19 version, you must

Set the parameter in Platform.ini
[Bios_Version_Check]
Flag=0

in folder with InsydeFlash.exe


Disable integrated Intel HD Graphics not allowed there.
It's called "optimus" technology. You can set use N540 for IE or other browsers in Nvidia's control panel, the same way how it's works for games
but i think thats your problems with flash video is anywhere else

you need tune your Windows or Linux

 

Hi there, I'm new here so please don't kill me over my noob question:
I've go 5742G-382G50Mnss, its the one with 420M and no optimus sticker.
Is it possible for me to enable optimus? Which modded bios and what settings should I use to not brick my notebook?

 

Hello

Did you guys try to upgrade the processor on the 5742G please ?
And has someone modified the last bios already, and so could he/she share it with us please ?

Thanks in advance, have a good day everyone

 

@Anynoupy whats your problem with processor upgrade?
You check out if there's support for cpu in newest bios, then flash bios and replace cpu - no magic here.

 

No problem, just to know I'm gonna do mine in a few days, just ordered a 820qm to replace my 460m.

 

Cool, let us know if its when u'll get it.

Anyway I'd like to have my optimus enabled to have advantages of both open source(good desktop config support and some tricks for scaling resolution) and proprietary(performance) drivers on my linux and I found out that recently someone fixed some code to support it.

Would be nice if someone did post some most recent modded bios that could do that with my 5742G

 

Yep, I will
If it interests people, I could do a little comparison between 460m and 820qm, and/or how to install on the 5742G.

 

Here's latest version of the bios (v 1.24 from ACER's site): http://rajko.info/acer/tools/ACER5742G_124_MoreOptionsMorePages_UEFIBOOT.rar
If you already have 1.24 flashed, run InsydeFlash.exe , otherwise run DPJ.bat to flash this bios
In the newer versions, ACER changed their boot logo, and removed some unused modules, so i had space to put in the UEFI stuff even without removing any modules !
Instead, there were Packard Bell, eMachines, and one more logo, that i just blanked out. The acer logo stayed the same so you will see nothing different if you use the logo
Blanking out the logos gave me more than enough space, so i didn't remove any modules from the firmware, just added additional ones.
Also, in insydeh2o laptops, the NVRAM is on the flash itself, not in CMOS, so if you want to reset any settings, just reflash the bios with ALL = 1 in the config file, or do the USB flash stick recovery (it happens in PEI, and it will just rewrite your flash with whatever file you put on the flash disk, which means your NVRAM will be reset too (VSS area))

also, for the optimus queries, i've tried and tried, but the problem is in HARDWARE setup
for OPTIMUS, the laptops display is connected to INTEL GRAPHICS, and when nvidia graphics is enabled, it finds a way to jack it from intel and use it for its own purposes
on NON OPTIMUS laptops, the laptops display is connected to NVIDIA grpahics, and intel graphics are just doing nothing and stay in disabled state (no PCI-E lanes occupied)

so, a simple software setting CANNOT change the mode you are in, it's a hardware thing

if you wish to install UEFI loaded Win7, you MUST select the "weird" boot entry from the F12 boot manager (like this: http://images.rajko.info/IMG_20110913_002033.jpg), if you select the other one, your laptop will boot from MBR of the DVD, which will start the normal Win7 installation for BIOS-based computers. When you boot the disk this way, you will be FORCED to use a GPT partitioned hdd to install (if your hdd is MBR, you will have to remove and recreate all the partitions, and end up with something like http://images.rajko.info/IMG_20110913_004126.jpg (the System partition isn't there on MBR disks)
otherwise, if you wish to install normal, BIOS-based WIN7, it will ONLY install on MBR disks, not GPT, and to do that, just boot from the device with the same name as your DVD drive (HLDST or whatever) from the F12 boot manager

 

Could you help with unlocking the memory remapping option on the Acer 5745G/PG?

I previously had 4GB ram with only 3.86GB usable now I have upgraded to 8GB and have only 7.87GB usable..

I have managed to patch the graphics option to stay as discrete (although it is still greyed out)

Latest bios 1.19 can be found here

http://global-download.acer.com/GDF...Aspire 5745PG&OS=721&LC=en&BC=Acer&SC=EMEA_27

 

I'd successfully flashed this bios mod, my laptop is started.
But when I change HT (HyperTrading) settings to disable, and press save and exit, laptop is dead. It not try to boot from different usb sticks, when I put PEW71X64.fd on stick,and hold Fn+Esc and press power button. Laptop is worked about 30 sec and power off
(((

 

@rajkosto - thanks for checking out the optimus thing - I'm little disappointed but I dont see why would I need optimus for power saving when 420M can lay low on 50mhz in power saving. The thing is I hate nvidia proprietary drivers on linux and wanted to use geforce as 3d accelerator only with optimus. Well now I hope that some day proprietaries won't suck...

@kauksi I'm not trying to kick the lying guy but why did you try to disable HT? HT is one of the best intel's achievements in a decade so why? Any explanation other than playing with stuff?

 

Hey,
Just found this Thread.

I have an Acer Aspire 5742g (380m, gt540m) to, but already with the 1.25 Bios.
So how can I flash to the older Version?
Or may you made a newer modded Bios?

I want to undervolt my CPU and so i need the unlocked Bios.

Thanks

 

No one here?

 

You can flash an older BIOS if you want but I doubt there's anything related to CPU voltage there.

 

Hey,
My question wasn´t "Can I flash?" but " How can I flash?"
But thanks for answer

 

Can someone tell us? I need to install older version cause after i installed 1.27, the HDD started to make a "clunk" when laptop starts.

Thanks.

 

you need to clear CMOS, check the manuals post on this forum
PD: I wish I could, dat stripped screw

 

You can downgrade by following the Recovery procedure like if you bricked it (or maybe there's an ini option for InsydeFlash as well, didn't check)
1.30 is here: http://rajko.info/acer/tools/PEW7130_MoreOptionsMorePages_UefiBoot_HackedBds.zip

The procedure for editing this stuff is also much simpler now, just use j-bios for SetupUtility editing (use the manual patch stuff j-bios has) and for FFS extract/replace/insert you can just use PhoenixTool now (open .fd file, click Structure at the bottom, never click Go, when inside Structure, check both checkboxes before extracting/replacing/inserting, once you close that window, it will ask you to save, say yes and exit phoenixtool)