4GHz+ Overclock i7 4xxxxmq/h to i7 extreme conversion Intel Haswell CPU Microcode bug hack

Hi all,

After I saw this result: http://hwbot.org/submission/2830783_0.0_cpu_frequency_core_i7_4700mq_4550_mhz , I got interested to replicate it with a similar method and decided to share my steps to score higher than a desktop 4.4ghz 4770k (according to cinebench )

My laptop model: Clevo P150SM

Intel Stock microcode has a Turbo multiplier bin glitch that allows unlimited multiplier increase, I used prema's bios and removed a cpu microcode update to let the cpu run the stock glitched microcode.

Note: steps vary with laptop brand/model, this is intended to share what I did |how it works maybe| with my P150SM.

1) Download or dump your BIOS, if your bios is AMI (my case) then use AFUWINx64

2) Get AMI Aptio UEFI MMTool v5.0.0.7 and UEFITool, HxD (or your fav hex editor)

3) Open your BIOS image with UEFITool, then File>Search, in our case Haswell has the following ID: C3 06 03 , enter C3 06 03 in Hex pattern dialog click OK

4) You can see the last four Hex pattern result(my case), double click the first result and a structure item in the main dialog will be highlighted, right click>Extract as-is to a folder (be sure it is organized or you will mess things up like i did XD)



5) If you have an additional result with type RAW, do the same with the third(in my case) result and save it as a different name other than the first one.

6) Now in the folder you have saved the 2 files from step 4&5, open the first one (second one too if present, see step 11) with HxD(any hex editor) and look for C3 06 03



be sure to choose Datatype:Hex-values then hit search

7) Press F3 to find again till you reach this pattern(highlighted):

8) (1) Indicates the microcode version, 17 in this case, we want 00 (cpu stock), (2) the platform ID (the search context we reached at) (3) the microcode length = 5000 (in my case) in reverse (important to know when the microcode ends in order to remove later).

9) Adjust the cursor on the beginning of the highlight text/microcode (01) right click>Select Block>Length> 5000 or whatever in your case

10) Delete the highlighted blocks (del button) (after step 9) then save the file

11) Do the same with the second file (if present) from step 6 to 10 then save

12) Go back to UEFITool, double click the first result like you did in step 4, right click the highlighted structure in the main dialogue > Replace as-is then choose the FIRST file you edited in HxD

13) Double click the third (or whatever your case - if present) result and follow step 12 with the SECOND file you edited in HxD instead.

14) You will see "Rebuild" in action row, File>Save image as> P15SM04.PM2 in my case (can be any name as long as your flashing tool recognize it)

15) Open AMI Aptio MMTool > Load Image > your modified rom; go to CPU Patch Tab and verify there is no 06C3 in CPU ID

16) Be brave and flash your BIOS


Windows Mod to remove auto update microcode on boot:

1) Remove mcupdate_GenuineIntel (and backup) from System32

2) Done


Overclocking:

1) Check CPU MCID ownload AIDA64 , open AIDA64>Motherboard>CPUID and look at IA Brand ID, it should be 00h


2) Download the latest beta ThrottleStop, used 810b2. TS 6 does not work.

3) Make sure you don't have XTU installed or running (especially at startup) or it will reset any changes in Throttlestop.

4) Open throttlestop, click FIVR and look at "[checkbox] Overclock [DIALOG] Max" and note it down

5) Now here is the magic! close FIVR and open it again, [DIALOG] Max value should increase by 2 (up to 80x max ~ 8ghz) everytime you open and close FIVR aslong as long as you increase one of the cores, in my case I have gone with 42x on all cores with 4700mq on stress testing. Seems to be the stable frequency, system uptime is 34 days as of latest post edit, with some Adobe Premier work aswell.

6) Increase "Set multiplier" to maximum after your final changes in FVIR (Iv set mine to 42x all cores, so I increased set multiplier to 42 aswell - note voltage ID is messed up ignore it, multiply by 2 to get the actual voltage)

7) Increase voltage in FVIR for stability by using Cinebench run 3-10 times instead of prime95, as it stresses FPU to a non-realistic level which increases heat and tdp. (Although it ran stable temps were ridiculous, got throttled down to 2.8ghz in seconds)

My experience/opinion: no real world optimized software puts the same load, at least in personal computing (rendering video, compiling software). Cinebench, aida64 and premier rendering all running at the same time resulted in ~78 watt, prime alone = 100 watt. Get a server if you are going to utilize the entire CPU functions at the same time and as efficiently as possible.
(Not to mention, p95 @stock frequency/voltage with no Turbo boost power limit (48 watt with 4700mq) reached 92c, and downclocked to 2.4ghz with stock TDP XD)
I think IBT and P95 are useful for detecting issues with stock settings, (e.g 99% server stability/uptime for data redundancy) Would be happy to be proven wrong as a desktop/laptop user and test as well.

8) Unlock maximum TDP and turbo wattage in TPL, in my case:



9) Done! Changes should be persistent as long as you dont save and exit from BIOS(in my case), h̶e̶r̶e̶ ̶i̶s̶ ̶m̶y̶ ̶r̶e̶s̶u̶l̶t̶ ̶i̶n̶ ̶C̶i̶n̶e̶b̶e̶n̶c̶h̶ ̶w̶i̶t̶h̶ ̶t̶e̶m̶p̶ ̶t̶h̶r̶o̶t̶t̶l̶i̶n̶g̶ ̶(̶f̶r̶o̶m̶ ̶4̶.̶3̶ ̶t̶o̶ ̶3̶.̶9̶ ̶g̶h̶z̶)̶,̶ ̶r̶o̶o̶m̶ ̶t̶e̶m̶p̶ ̶2̶5̶-̶2̶7̶ ̶X̶D̶:̶ ̶(̶n̶o̶.̶1̶ ̶a̶t̶ ̶4̶.̶2̶g̶h̶z̶,̶ ̶n̶o̶.̶7̶ ̶s̶t̶o̶c̶k̶ ̶l̶a̶t̶e̶s̶t̶ ̶m̶i̶c̶r̶o̶c̶o̶d̶e̶)̶

UPDATE: OCed RAM from 1600 to 1866, [email protected], +200mV adaptive vcore and used CLU TIM (no more throttle):



I'm also getting 852 with 4.5ghz,t̶h̶o̶u̶g̶h̶ ̶i̶t̶s̶ ̶u̶n̶s̶t̶a̶b̶l̶e̶ ̶a̶s̶ ̶t̶h̶e̶ ̶f̶r̶e̶q̶u̶e̶n̶c̶y̶ ̶s̶c̶a̶l̶e̶s̶ ̶d̶o̶w̶n̶,̶ ̶(̶m̶a̶y̶b̶e̶ ̶d̶u̶e̶ ̶t̶o̶ ̶h̶i̶g̶h̶ ̶v̶o̶l̶t̶a̶g̶e̶)̶
Static voltage table like on load method using TS:




Post your results and I'll quote it here.



Tips:

• I highly recommend lapping heatsink and use liquid metal thermal paste or any decent tp ( I used collaboratory liquid ultra) before doing this
• -If your cpu throttles no matter what, try decreasing dynamic voltage in FVIR and look at maximum value the package power indicate while stressing, decrease the value by 10% in order to avoid rapid throttling (happens with bad TP)
• -Do not attempt the OC if you are looking after long service life wear&tear (I expect 2 years from now if I stress the cpu everyday for an hour, which i never do )

Happy overclocking, and don't melt your laptop

Updates:
-Tested on desktop i5 4430 without altering reference clock, OCable 3.2 to 3.6ghz max (high voltage monster cpu .just look at the stock TDP : 84 W)
-To add: This mod has been done and discovered by Asus with desktop on haswell launch aswell, though BIOS updates were pushed asap, steps should be similiar with desktop mobos, though there is a decent advantage of applying this on non-extreme mobile due to the insane cost. getting a K processor with desktops is a wiser choice for cheap extra and more thermal headroom.
-Intel has done the same mistake again with Skylake this time, would be interesting to see how far 6700HQ can go.


Just to clarify, only Throttlestop works with the OC, since in my case, XTU/BIOS does not read the [secret]MSR register, as reading it increments max bin with mc <v6 and set all core clocks to default single core clock with mc v7 with no increment. However TS version 8+ does; aswell as with UEFI/BIOS menus with some desktop motherboards (after mc mod) Asus is an example.

Thanks to Intel if they leaked this on purpose, kinda futureproofed my machine XD

 

@tpro if I put 4712MQ into notebook with no microcode for it, only for 4702MQ, chances are it will behave the same without any need to modify BIOS?

 

no, all 47xx are under 6c3 platform id. (share the same microcode)

 

I wish this was possible on Alienware 18, but this laptop can't flash a custom bios :|

 

Modding level = Extreme

 

Wow, thank you! I need to try this on my Clevo.

 

hey! someone done this on y510p ? i need help

 

Hi,

I'm stuck at stage 6. Where your 1st highlighted value is '17' mine appears to be '1C' and your third highlighted value is '00 50' mine is '00 54'.

Is this correct? Where exactly do I place the cursor and/or start to highlight before I right click>Select Block>Length>5000?

Using MSI GT72 with a i7-4720HQ.

Cheers.

 

00 50 translates to 5000 which is the length, yours is 00 54 which translates to 5400 use that, 1C is the uC version, 2nd value is important if it matches then you are good to go.

Though just my opinion, this is not simple guide, its just a thorough non-detailed steps taken to achieve the result, I would advise to not continue modding if you are unsure of the basic stuff to avoid brick.

 

@tpro

Hi,

Got some time to have fun with the i7-6600U? I could use your help for the surface book

 

That would be interesting altho there is no room for thermals (wait did u just say that u live in the north pole? XD)
I think it would be better to desolder the memory containing the bios and play with (also i believe there are two electronic controllers on it, donno much about surface), as i think the bios is encrypted and needs to match hardware key for onboard flash, not to mention the possibility of reflashing bios after brick

I'm currently working on microcode enforcer mod using refind uefi bootloader, needs fast boot bios support, patch applies after power cycle tho for some reason it is locking out on most systems, ill post it here when its almost functional.

 

I don't think I can disassemble it lol

 

That would be challenging.

 

can your magic overcome the challenge lol?

 

@MiSJAH You can use microcode 01 or 02. The way to patch them without breaking things is to check the length of the current, newer microcode and insert the older one with padding.
I.E If Microcode 1A has a length of 5200h, 02 has a length of 3200h I think. Then you add 2000h padding at the end.
Tha's how I made the older microcodes work on my Y50.

 

Waiting for my tape to arrive and ill give this mod a shot. Once tape is here ill be using some Grizzly-C liquid metal and pray its enough to manage the temps before throttle point. 755m will be disabled so should be interesting...

 

Hey, i've tested your method and i was really unsecure about the hightlight the good part of the microcode (Only the microcode 1 working for me , all other doesn't let me up more than ratio 38), so i've followed my search and i've find UBU tool in following this https://www.win-raid.com/t154f16-Tool-Guide-News-quot-UEFI-BIOS-Updater-quot-UBU.html

I've download my lastest bios, download all bios utility, run UBU.bat with my bios in his folder, change the microcode, and use AMIBCP to enable hidden options like cpu configuration, i've removed your dll (2 times), flashed my bios with the rufus-2.2p tool and after 3 reboot, that's done ! I can now change my ratio in ThrottleStop and my Graphic ratio in intel, you can see the result here :

https://valid.x86.fr/flj8ql




Thanks for your help ! i've reached stable 4.1Ghz on my 4720HQ, no need to upgrade now (But i really don't know how to pass the 55W package TDP limit ... i can lower more temp to get hight frequence but i'm always limited by this ****ing tdp, i've a 140W power brick, i really don't understand.

 

In the second photo, you can see an option that's labeled "Powercut-ucode 0x01". Check that box and you can get rid of those pesky TDP limits.

 

Thx but this doesn't allow me to pass 55W, i've changed PP0 & PP1 to 110 but no change, i'm stuck between 54.4W ~ 54.8W, i've disabled my dedicated graphic card to save some watts, same for bluetooth stuff, so i've reached CPU 4.2ghz stable + 1.4ghz GPU overclock, it works like a charm, i'm side by side with a 4970HK or 6700K ! (i'm using the stock aircooling of my laptop, i'm wondering how improve it or change it for plat watercooling system. (i've 3cm free between the die and the laptop bottom.) i'm really impressed by the change !

 

140w power brick I would be surprised if its just not capable of delivering more power.

I have the 4930mx and still cant hit 4.0 because of the motherboard I guess. Have to engineer some VRM cooling.

 

WOW! How come this topic hasn't been stickied yet?

 

Fear of lawsuits I think

 

So, i cannot go up than 4.2, 4.1 4.1 4.1 and + 77mv offset voltage core. my cpu suck 58,3W maximum so, if i understand, the rest of my laptop would suck 81,7W ?

my DVD drive, dedicated graphic card, bluetoooth are disabled, i can unplug then to save some W but not sure it it's work, well my overclock is engought now, no need more but i think it's possible share your work dude this tips able you to make a gamer pc for low $ just with a good overclocking.

EDIT :
I've found a way to enable the powerCut, just click on the checkbox to enable it, quit FIVR and re-open it, set your processor offset voltage to a low value to make a crash, let your laptop restart, reopen throttlestop and you're done ! You can now overpass your tdp limit, i'm currently running @4.2Ghz, just amazing !

Note : I've added a fan on my MSI GP70 2PE, the temp drop a lot it's noisy but i prefer perfs

https://valid.x86.fr/x4jaiu

 

Could someone share v.0 and v.1 microcodes for bios mod?

 

http://www.majorgeeks.com/mg/getmirror/uefi_bios_updater,1.html

download UBU tool, extract on a folder, download your original bios from your constructor website, extract your bios in the UBU tool folder, run UBU.bat, press 7 (update microcode), press 1 , 1 again, after it's done just press 0 (exit) and 1 (mod_XX_BIOS_XX.XXX), rename this bios in a simple name like b.XXX (XXX is the file extension of your bios), download rufus here : https://rufus.akeo.ie/downloads/ (last version), run it, plug an usb key, format it (file system EXFAT/FAT16/FAT32, operating system MSDOS), download AFUDOS here https://ami.com/en/download-license...IOS_and_Aptio_AMI_Firmware_Update_Utility.zip, extract all file on your usb key WITH YOUR BIOS MODDED FILE !

Reboot your laptop on your usb key, and type AFUDOS b.XXX /GAN

replace b.XXX by your moded bios file name

/!\ Be carefull, the size of your new modded bios must match with the old ! the program check it for you.

Cross finger ... and after 3 auto reboot, you're done ! Your microcode is downgraded !

Note : You can use AMIBCP4.53 (google it) to unlock some feature of your bios like cpu configuration and much more !

Enjoy your unlocked laptop

 

Is this same microcode bug exploit usable on a Kaby Lake i7 7700HQ too? I thought it was very closely related to the 6700HQ.

 

Will this guide work with Alienware 18?

 

Hi
It was mentioned in firs post that this mod was tested on desktop i5 as well. Does anyone know on what kind of desktop chipset this mod work. Is it only on Z87/Z97 or on non-Z to?

 

I'm with MiSJAH on this one. It'd be super cool if you could make your guide a bit more detailed. I know how to overclock, but I'm not at all familiar with the hex editing.
It's super interesting and I'm curious to see the process behind it.
It would also make me feel a lot safer about trying it.
The 4720hq is realy getting on my nerves so it'd be cool to get a bit more performance out of it right after my fresh repaste

 

hello. thank you very much for sharing your work. i am stuck with a dell precision m6800 with an i7 4600m. it is power and current limit throttling as shown in xtu in p95 load. how to read bios type. will you kindly shed some light on this?

thanks again!

 

Hey dude, if you are not affraid by 1.3V + Vcore, you can try to disable VR Fault, if you have a big power brick you can go highter.

I've reached stable 4.6Ghz (1.42V) , put some fan with tape on the air extraction of your laptop, use liquid metal + copper heatskin are you're done !

I can get near of an i7-7700K for free, i5 8XXX if i disable multithreading -> Up to 4.7Ghz. (on 4 cores)

I've not pushed away , i've hit my powerbrick limit (if your laptop submit shutdown, not engought watt)

If you are too unstable try static voltage !

About me : (HT enabled, ratio on all core, no turbo boost)
41 : +91Mv
42 : 125Mv
43 : 183Mv
44 : 250mv unstable -> 1.28v static -> stable
45 : 1.35v static
46 : 1.43v static

I'll not try to go highter cause electron migration, i can keep my cpu cool with lot of fan added (i've maked hole, plug fan, and the temps drastically down)

About 450-470 Mono thread / 2400-2500 Multi thread on CPU-Z

this 4720Hq is not bad, what your scores ?

 

Viewers,

I have attempted this on a precision 4800 with a 4700mq. I find the part of the hex that is the correct code but the part to edit is unclear. The images of the code are at this link. If anyone can help I will send the bios and extracted microcode for editing. https://postimg.cc/gallery/1nnfyxc10
Jacob Eli Goodson

 

I gave this a go today on my p375sm, unsure where I went wrong as now the notebook won't post.

I tried to mod the p375sm bios from here :
http://forum.notebookreview.com/threads/clevo-bios-older-models-released-in-after-2014.790474/

It turns on, spins the fan for a while then turns off and back on. This loop Continues until I pull the power cord.

No display on the internal screen or via HDMI.

Pulled out the battery and CMOS battery and held the power button for a minute and still no luck.

If I hold FN+ B I don't get the bios recovery option.
However after holding FN + B the notebook will eventually turn off and the power light flashes orange rapidly forever until power is disconnected. (This is with the following bios on a USB drive https://www.techinferno.com/index.p...bricked-or-not/&do=findComment&comment=111281).
I have also tried putting the p375sm bios from the Clevo bios thread on the USB drive and still nothing changes).

If I try FN + D, the notebook doesn't turn on , I just get the power light flashing orange at a slower but constants rate.

I'm thinking my only option would be similar to this:
https://www.badcaps.net/forum/showthread.php?t=70924

 

So I can confirm, using a raspberry pi 4 and this method below worked to recover the laptop. Now that I have a recover method I'll try the mod again till it works.

https://www.rototron.info/recover-bricked-bios-using-flashrom-on-a-raspberry-pi/

 

You can use a RPi as a programmer? Hmm, might wipe the dust off my old Pi 3 and try it

 

Yeah it seems to be a great way to perform bios recovery and then you get to use the Pi for other things afterwards.

Also I had success with unlocking after my second attempt. I had to follow the more automated steps as per:

However the UBU tool did not include MMTool (which it needs to perform the task).
I had MMTool on hand so moved that into the folder before running UBU.bat

I also have AMIBCP which appears to be hard to find these days online (for unlocking hidden settings in the bios).

 

Bios overclocking options on this generation of Clevo are really easy to enable with the right amibcp version.

Just a matter of changing "access/use" to "User" for the menus and items you want to show.

Happy to post my P375SM modded bios for anyone else or modify a similar Clevo model bios if you need.
*But only if you have a recovery method prepared beforehand as I've experienced how annoying it is to own a brick many times now.

Will now follow this Haswell overclocking guide to get something stable:
https://overclocking.fandom.com/wiki/Haswell

 

Curious if anyone could confirm whether this worked for any other generation ?
Skylake / kabylake ?

Edit:
Apparently skylake it was still possible and not only that, bclk is able to go up 20% +

Will investigate when a replacement motherboard arrives for my skylake sager.
https://web.archive.org/web/2019021...d-msi-z170-non-k-overclocking-guide-new-bios/

Will update...

 

Does someone know if it work on a MS-1763 / MSI GT70 haswell edition?

 

If you load the first microcode and change the name of the microcode update file present on the Windows directory, yes, it should work, but I never had much luck with my 4720HQ, too instable, and I think your GT70 will be power starved due to firmware.

 

Okay, and do you know at which point the power is limited ? is it software ? from the mosfet drivers ? from the intel power reading ?

 

I think its either 180Watts or 200Watts total system, so if you draw 80-90Watts on an OC'ed CPU(the locked CPU's will usually need a lot of voltage to clock), you end with a starved GPU.

Its enforced by the EC, it should be possible to bypass the current shunt resistors, but then something else will give(in other words, something might/will burn).

 

It's not for an H24 use, it's more for a bench use, do you know what is the EC reading ? power monitored by the cpu itself or power monitored by the mosfet driver ?
Thanks for replying to me

 

Hello,
I have the same problem with throttling with my I7-4710MQ. I tried (mutiple) to deactivating the Power Throttling according to the discription from Helden57 but it does not work so far. Did someone had have success with this instruction? I despair ...

Thank for your support. Stay healthy.

 

This method works for me, regarding enabling powercut.

Now I'm just stuck with cooling being the issue. 3.7ghz seems to be the sweet spot. Anything further and I have to bump the voltage a lot and will easily hit tjmax.
Might get some fans on my coolermater U2 and drill some extra holes in the bottom cover.

 

Thank you very much!!
Your instruction is working. Now I have no more Power Limitation (PL1).

Is there a way to set this option (VCCIN) in BIOS. I can't find the setting in the BIOS settings. (I have a BIOS-Mod from Svet from MSI-forum). I don't want to run ThrottleStop permamently in the backround.

 

You can grab several versions of AMIBCP here:
https://forums.tweaktown.com/gigaby...system-info-benchmarking-stability-tools.html

One of them may open your bios rom file, then you can verify that you had all the settings unlocked.

Unsure what laptop you have though.

 

I have a p375sm with 4gen processor and prema bios. i cannot change the processor speed in the bios could you share yours?

 

Just confirming , do you have a CPU with an unlocked multiplier or are you hoping to use the microcode bug?