Razer BIOS Mods - Potential to Unlock All Hidden Options

Awesome

 

You're giving it a go?! Good sh*t!

Also, if anyone can provide the updated AMIBCP I'll see what I can do as well! - I was using v5.02.0031

 

Yep! The latest I have is 5.01 so you got a newer one than me. Can you share that one with me? 5.01 won't read the bios image.

I'm still looking to see if there is anything newer.

 

I suspect it's nothing to do with the AMIBCP/AFUWIN programs - the machine isn't allowing for BIOS mods per Razers settings.

 

Agreed but I need a version of AMIBCP that lets me edit the bios so i can then flash it with programmer. The version I have gives a file name length error.

Edit: Found 5.02 but still same error so don't think its possible to use AMIBCP with this bios.

 

I downloaded the file to have to a poke around - maybe I can find something.

 

PM'd you the bios. Let me know what you think.

 

https://mega.nz/folder/bBAUFKjR#VZHUTbOGcQT-AEYek00x7w
AMIBCP 5.02.0031

 

:O a newer AMIBCP is all it needs?

 

No, I used this to modify the dumped BIOS, but STILL cannot flash when I use AFUWINGUI.

Uploaded per BPVarsity's request.

I can modify the file just fine, we need a way to bypass the signature verification error when flashing (aware the Programmer can do this), BUT, perhaps there is another way? Such as "Intel's Flash Programming Tool" - Just a thought, I've never used it

 

I'm able to open the dump with that AMIBCP - older versions were complaining about some Language error.

You can find the tools here: https://www.win-raid.com/t596f39-Intel-Management-Engine-Drivers-Firmware-amp-System-Tools.html

 

I had already found the tools, but thanks for the link anyhow. Just didn't have the time to sit and learn/fiddle with it.. Perhaps I will during this long weekend

 

Give this a blast:

 

That worked thanks!

 

This is what I get
Reading HSFSTS register... Flash Descriptor: Valid

--- Flash Devices Found ---
ID:0xEF4018 Size: 16384KB (131072Kb)


Error 167: Protected Range Registers are currently set by BIOS, preventing flash access.
Please contact the target system BIOS vendor for an option to disable
Protected Range Registers.

FPT Operation Failed.

 

There's a quicker way around this - do you know how to boot into an EFI shell?

Drop this file into a USB stick into a folder called BOOT inside a folder called EFI and rename it BOOTX64.efi - looks like this:



https://mega.nz/file/a1gwhIQa#HDd5fexfOHk7ocNqg11fGuw9ggDVgaIo0_41szzgZyY

 

Yeppers

 

Cool - drop this AMISetupWriter.efi onto the stick, it allows us to change BIOS options without the need of AMIBCP, reflashing etc etc. We will also be using FPT in the EFI shell so drop that on to the USB stick as well.

https://mega.nz/file/OspS1IBb#ehJiCSnGTXo49lHSb0PT3E1ye3elev7pTwSSLahsdA0

 

I will try it now

 

The command will be:

Which sets Flash Protection Range Registers (FPRR), Variable: 0x6DD to Disabled (0x0).

EDIT: Please be sure what you're doing from here on, there is a potential to brick it and the only way back is the CH341A programmer.

 

Ignore me. Looked at wrong tab

 

EFI version of FPT here: https://www.win-raid.com/t596f39-Intel-Management-Engine-Drivers-Firmware-amp-System-Tools.html

Make sure you have the right versions of the tools, I suspect the newest Blade is on Intel ME 14 Consumer H if it follows the pattern of this 2019 Blade.

 

See attached of what it output

 

We're on BIOS 1.0 or 1.03?

 

I'm on 1.03 still since I cant flash back to 1.0 yet.

 

Nevermind, the variable is the same on both.

Try 0x17 0x0 to turn off BIOS Lock.

 

Same error. See attached

 

They've totally locked down the BIOS, the only way is with a CH341A programmer.

 

Lame! Ugh wish I had it now. Itching to get this flashed. Guess I'll wait until Friday. Thanks for trying though!

 

Let us know how it goes!

 

Definitely will

 

Yes, please do! Can't wait for results!

Just got my Blade in (RAM was delayed, lame), and I'm on BIOS 1.01

Will hold off on updating/flashing until we find out if it works, good luck!!

 

Will do. Can you send me your version 1.01 bios dump? I haven't seen that version yet.

 

Sure I can do that a bit later today, but what system do you have?

Thought you have the 2020 17 Pro? I have the 2020 15 Advanced

 

Cool thanks. I just wanted to take a look at it for curiosity. But yeah I got the RBP 17 so def won't flash yours
Programmer comes tomorrow! I keep checking amazon for updates haha. Want to flash this thing so bad

 

PM'ed!

I have a few things coming in from Amazon as well, "F5-LIFE" lol

 

Hey everyone. Interesting thread. Sadly after multiple hours trying and multiple tools, I still can't get Undervolting back after upgrading to BIOS v1.03 on a 2020 Blade with 10th Gen Comet Lake

• AFUWIN doesn't flash (even untouched 12MB dumps from the very tool can't be re-flashed at all due to secure ROM flash requirement. Same with ones modded in AMIBCP)
  
• modGrubShell / setup_var UEFI method doesn't work (IRF-dumped VarOffset seem incorrect and the Overclocking Lock variable can't be adjusted - see below)
• FPTw doesn't work (dumps OK but errors out with locked flash areas when trying to flash)
• Rebuilding from 1.03 official 16MB BIOS with UEFITool doesn't work either, regardless of what's inside the bin file (even re-building with the same packages breaks flashing)
• Only thing that seems to be possible to flash is the official firmware package from Razer. It's inside the installer, just needs an un-zip
  
• There's no 1.01 official firmware available to download to roll back
• At least in the new one the Overclocking menu is unlocked when you use XMP memory

Code:

0x2EB9F     Form: View/Configure CPU Lock Options, FormId: 0x2749 {01 86 49 27 34 02}
0x2EBA5         One Of: CFG Lock, VarStoreInfo (VarOffset/VarName): 0x3E, VarStore: 0x11, QuestionId: 0x1C6, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 64 04 65 04 C6 01 11 00 3E 00 10 10 00 01 00}
0x2EBB6             One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
0x2EBBD             One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 30 00 01}
0x2EBC4         End One Of {29 02}
0x2EBC6         One Of: Overclocking Lock, VarStoreInfo (VarOffset/VarName): 0xDA, VarStore: 0x11, QuestionId: 0x1C7, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 60 04 61 04 C7 01 11 00 DA 00 10 10 00 01 00}
0x2EBD7             One Of Option: Disabled, Value (8 bit): 0x0 {09 07 04 00 00 00 00}
0x2EBDE             One Of Option: Enabled, Value (8 bit): 0x1 (default) {09 07 03 00 30 00 01}
0x2EBE5         End One Of {29 02}

 

Yes, that was Razer's intention. BIOS 1.03 enables XMP but it will disable undervolting.

 

Oh I'm completely aware of it. The problem is that they're locking any modifications behind secure flash wall. They only changed one setting (Overclocking Lock) for that which can be easily brought out for user to be controlled in BIOS menus. But they didn't do it and with secure ROM flash there's no real way to do it now

 

We need BIOS 1.01 so we can roll back. If anyone can provide it would be awesome.

 

Got it flashed on the 2020 RBP 17. Got full memory overclocking enabled also unlocked undervolting on the latest bios1.03

Thanks again for the help. Worked perfectly with programmer device.

Edit: and got my 64gb running at 3200MHz

 

So the only way you can do this is with the CH341A programmer?

 

Given the new software security restrictions put in place: yes. Hardware is the only way around such a restriction.

Whats mind blowing to me is that the Blades are capable of handling all the settings we're unlocking/hacking - I wonder why they aren't shipped more tweakable by default.

 

Hey guys, got the Stealth Blade 2020 13", doesn't seem it wants to flash. I get a AMI blue screen on reboot for like a split second saying something cant be found, and the flash fails

Should I get a programmer? anyone know if the chip is located on the back plate side? Was planning to opening it up anyway at some point to get some nice liquid metal paste on it

And another question: Are the fan curves also configurable through bios?

 

Easy - more restrictions means less opportunity for end users, most of whom don't know what they're doing, to screw something up. This results in fewer tech support requests and potential RMAs.

 

Then again how hard is it to build in some sort of redundancy / failsafe if said user does screw it up.

I guess laptops in general arent really aimed at the power user in general.

 

It already exists - pull the CMOS battery and the BIOS rewrites itself back to default.

 

I ment if people reflash with modded bios i.e.

Unless pulling CMOS literally reflashes original rom?

 

Yep, it's a failsafe in the "Pro" model anyway - literally reflashes the chip on boot up with no CMOS battery in.

 

Thanks, didn't know that! I wonder if this holds true on the Stealth 2020 as well. Either way bought a programmer and some other useful things, might come in handy one day.

My ultimate goal is to not be reliant on this horrible Synapse bloatware, requires scripting to unload/reload this software to get maximum performance or power saving depending on AC/DC.

Ive had no luck unlocking the TDP duration (equivalent to gaming mode), although i see state changes in embedded controller changing these profiles, I seem to be missing something.