Bios Unlock and Overclocking of Mobile Skylake Cpu
Total Page:16
File Type:pdf, Size:1020Kb
Bios Unlock and Overclocking of Mobile Skylake Cpu To begin with, please note that there is great risk involved in doing this. If you have no experience with bios editing or flashing, please be VERY VERY cautious. I also highly recommend having or getting an spi programmer in the event you brick your system. This will make recovery very painless (CH341a programmer with SOIC8 chip clip). But again, this is not an easy task and has great risk involved. Please be very careful if attempting any of this. Now then, all of this was done on an MSI laptop, a GE72 to be exact. The unlocking of the bios regions will be different for different manufacturers, but the process is basically the same afterwards. There is a wonderful and very in depth guide on the unlocking of the regions HERE, so I will only briefly go over the procedure. References Here are some sources/guides that are very useful for understanding the scope of modifying the Bios. Many of these offer great insight. Aptio Skylake Bios Manual > https://www.acromag.com/sites/default/files/Aptio-Skylake-Core-BIOS-Manual-1097A.pdf TechInferno Forum on 6 and 7 series Overclocking > https://www.techinferno.com/index.php?/forums/topic/1624-lets-enable-overclocking-on-all-6-an d-7-series-laptops/ ME Analyzer Tool Information > https://n0where.net/intel-engine-firmware-analysis-tool-meanalyzer Intel ME Bring Up Guide > http://www.corus.pro/pilotes/VAD/VAD517/XP/ME/1.5MB%20FW%20Bring%20Up%20Guid e%208.1.0.1248%20PV.pdf Bios Mods Forum > https://www.bios-mods.com/forum/archive/index.php?thread-7795-1.html PCI Access Error Solution > http://watfak.com/?q=node/10 I would first like to thank Dreamonic, Paloseco, Svet, Kasar, and everyone else involved in this. Months were spent figuring all this out. Many long nights and bricked systems were used to get to this point. Without their help and knowledge none of this could have been done. So may you benefit from our time spent on this project. The BIOS is non-volatile firmware used to perform hardware initialization during the booting process, and to provide runtime services for operating systems and programs. It takes care of initializing ram speeds, cpu clock, turning on drives, etc. As for overclocking, the cpu, ram, and cache are the main focus and what we want control of. This guide will go over how to gain access to those so that the settings/speeds or each can be changed. So the bios is normally locked when you can't write to it (flash ROM) directly from an operating system like Windows or Linux. Although older computers allowed to do that, modern ones block it, so malware can't break your computer. This also presents a problem when trying to modify it since there is no read or write access to most of the regions. The descriptor region by default allows read access. This is a start because that's where the locks for the other regions are located. Unlocking the BIOS is a required previous step to flash a modded ROM later on so that we can edit settings. However, unlocking the bios regions does not alter anything. Please note, everything I am about to go over in this first section is located in THIS guide. This unlocking of all the regions in the bios is SPECIFIC to your manufacturer. All of this is specific to MSI notebooks. Asus notebooks should be unlocked already. Not sure about other Manufacturers. Also, Screenshots of EVERYTHING are located HERE. If you have any doubts or can’t find something, refer to the screenshots. Modifying the wrong thing can result in a bricked system. Please be VERY careful. My modified Bios is located HERE as FullOC.bin. Please DO NOT flash this bios, just use it for reference. Find Bios Lock Bit First, we need to find the BIOS lock position inside the ROM (offset): 1.) Download and extract the BIOS (For the GE72 I used Bios version E1795IMS.106, which is not available on the MSI website anymore. But you can grab a copy of it HERE in Bioses folder. Not sure if all of this works on newer bios versions (should work), but the latest versions are located HERE .) 2) Download and extract latest UEFITool for Windows, located HERE . (Note that all tools that I used are also available in the drive also which is HERE in tools folder.) 3) UEFITool ● Open UEFITool > File > Open image file... > select "All files (*)" on the corner > choose E1795IMS.106 ● File > Search > GUID > Leave selected "Header only" > Paste on the textbox: 899407D799FE43D89A2179EC328CAC21 > Ok ● A message will be displayed in the lower frame (Very Bottom Pane): GUID pattern "899407D7-99FE-43D8-9A21-79EC328CAC21” found as "D7079489FE99D8439A2179EC328CAC21" in 899407D7-99FE-43D8-9A21-79EC328CAC21 at header-offset 0h ● Double click on the message. The entry/module called Setup should be selected displaying additional information ● Action > File > Extract as is... > save as setup.ffs 4) Download Universal IFR Extractor, located HERE. (Scroll down and download the executable) ● Run Universal IFR Extractor > Open setup.ffs > Extract > Save as "setup IFR.txt" > IFR extracted successfully 5) Open "setup IFR.txt" with any text editor and search for "BIOS Lock". There should be only one coincidence. "Variable:" will show the offset, respect to the Setup module, where the BIOS Lock value is stored. In my case the offset is 0x5A8, (This may change on different notebooks). The value stored in that address is the actual BIOS lock, and if it's set to 01, it prevents the BIOS from being written directly from Windows or any other operating system. If it's 00 the BIOS should not be locked. Create Bootable Hex Editor With RU To actually change the BIOS Lock, we can't do it directly from the operating system, we need an utility called RU: ● RU homepage: http://ruexe.blogspot.com ● Download latest version. ● There should be 3 files inside: RU.efi, RU.exe and RU32.efi ● Grab any USB flash drive. Very little space is required, 64 MB should be enough depending on how you format it. ● Download Rufus , and open it as administrator. ● Select from the device list your pendrive or card, with the following options, and hit Start. It will delete all the data on that device. ● Partition scheme and target system type: MBR partition scheme for UEFI ● File system: use FAT32 . ● Quick format ● Uncheck "Make a bootable disk using" ● Now, browse to the unit with Windows explorer (in my case it's E: drive) and create the folder EFI on the root of the pendrive and another folder BOOT inside EFI. ● Copy the downloaded file RU.efi to E:\EFI\BOOT and rename it to bootx64.efi ● Now we are ready to change the lock bit. Booting into RU Reboot the computer with the USB drive inserted already and hit repeatedly DELETE key when powering on to enter to BIOS. Secure boot needs to be disabled to boot into RU or you will get a secure boot violation error. Boot mode also needs to be uefi, but this should be default on newer notebooks. ● Security > Secure boot menu > Secure Boot > Disabled ● The usb should also come before your Hard Drive in the boot order. This will automatically boot into RU if the USB is present. Basic RU commands: ● Press F12 in any screen to take a screenshot. It will be saved in BMP format to the root of the pendrive where RU is stored, provided that the pendrive or card is formatted in FAT32 filesystem. If it's in NTFS won't work. ● Press F1 on the main screen to display basic keyboard shortcuts table. ● Press CTRL + F1 to display the Universal Help. ● Press ALT + any of the letters in red in the menu bar to unfold that particular menu. ○ ALT + F: File options ○ ALT + C : Config options ○ ALT + E : Edit options ○ ALT + G : Go options ○ ALT + T : Tools options ○ ALT + S : System options ○ ALT + Q : Quit (close RU and reboot) ● CTRL +W : to save changes to the BIOS once you made some modification. If you don't want to save any random modification you made just exit from RU without saving. Changes are not automatically saved. Changing the Lock Bit: ● If you plan on overclocking the cpu, you will need read write access to ALL regions, not just the Bios region. So before you do anything the first screen you see in RU will have some bits we need to change. If you don’t care about this, then you can skip ahead. ● Offset 00000080 and 00000090 are the locks for all the regions. (Intel Management region, Descriptor region, Bios region, etc.) ● Everything in these two lines needs to be changed to FF , but before you change them take a screenshot. These bits will need to be changed back after everything is done for security reasons. (If you don’t want to change them don’t, but any program in windows/linux could potentially write to your bios if it wanted) ● Once you have changed both lines to all FF , you can continue unlocking the bios bit. ● Screenshots of this are located HERE. ● Hit ALT+ C to expand the Config menu, then select UEFI variable and hit enter. ● A list of UEFI variables will be displayed in alphabetical order. Use the keyboard arrows to move down until you see "Setup". There will be two of them. The second one, which has much more data, is the one we need to reach the address 0x5A8 in hexadecimal.