[UEFIPatch] UEFI patching utility

[chriz74]

I got a problem with an asus laptop, I patched the bios version 211 for x301a. However the file becomes invalid for flashing, upon further research I found out that the bios has SMI lock, I tried to set that bit to 0 (as in this thread) but it resets itself to 1. By the way the dumped rom is 2k shorter than downloaded rom (6144KB vs 6146KB), did anyone apart the guy who bricked his laptop succesfully flash a patched rom using the /GAN option in AFU ? I don't have an eprom programmer and I prefer not trying this without further knowledge.

[hammer87]

Confirmed working on P8Z68 Deluxe/GEN3. I tested version 3202, 3304 and 3603. All works ok, flashed by bupdater under dos.

[NamelessMC]

Sorry, but this gets 0 stars out of 10,000 for me. This is literally the most poorly written excuse for a replacement utility that I've ever seen. Why didn't you keep the PMPatch links up? I use an MSI Z87-G41 and this board was tested and verified to work with PMPatch.

 

Guess what? It doesn't work with UEFIPatch. Your useless application doesn't even recognize my bios file. And no, it's not spelling or folder related. I'm quite capable of opening a command window in a selected folder in Administrative privileges with simplified file names. 

 

Your utility just flat out doesn't work, but you decided to be narcissistic and delete/remove/pull every single folder/upload online that had PMPatch so now I can't get a hold of the utility that actually works.

 

Can you do everyone here who actually uses MSI boards a favor, and put up the version of the utility that was actually a functioning program for us? 

 

TL:DR- UEFIPatch doesn't work with Z87-G41/G43 but PMPatch does. SO please put PMPatch back up or link a current mirror that has it hosted. Thanks.

[Gringo Vermelho]

Wow!! Who do you think you are? Your attitude gets 0 stars out of 10.000.

 

I'm sure that Coderush did not break compatibility with your particular motherboard on purpose, or as an insult directed at you personally. Apparently his utility works fine for most people.

 

Feel entitled all you want but please at least try to be polite when talking to talented developers who spend their free time fixing issues with other people's hardware while asking for nothing in return. After all is said and done, they are the ones who make this place happen, not you or me.

[CodeRush]

Honestly, I have now words to describe such outbreaks from some unknown guys. I will not quote every word of that one by one, proving them wrong, I will just make exactly one screenshot.

I will show how to patch BIOS v1.8 for Z87-G41 using UEFIPatch v0.2.4.

I will not involve any work with command line or Administrator mode, which can sure be used by anyone, but will require doing this 2 steps:

1. Unpack UEFIPatch.exe (engine), patches.txt (list of patches to apply) and E7850IMS.180 (BIOS image file) on desktop

2. Drag BIOS image file onto engine file, like this:

If any of patches listed in patches.txt can be applied to the input file, a .patched file will be generated, this time it will be named E7850IMS.180.patched.

 

Back to the insults: that useless application just patched your precious BIOS, would you kindly STFU and GTFO now?

 

 

 

[Pavo]

Honestly, I have now words to describe such outbreaks from some unknown guys. I will not quote every word of that one by one, proving them wrong, I will just make exactly one screenshot.

I will show how to patch BIOS v1.8 for Z87-G41 using UEFIPatch v0.2.4.

I will not involve any work with command line or Administrator mode, which can sure be used by anyone, but will require doing this 2 steps:

1. Unpack UEFIPatch.exe (engine), patches.txt (list of patches to apply) and E7850IMS.180 (BIOS image file) on desktop

2. Drag BIOS image file onto engine file, like this:

drag.png

If any of patches listed in patches.txt can be applied to the input file, a .patched file will be generated, this time it will be named E7850IMS.180.patched.

 

Back to the insults: that useless application just patched your precious BIOS, would you kindly STFU and GTFO now?

CodeRush, don't to listen to such stupidy, we love your work!!!!!! one question though, can anything be done about the write protection error message for Asus BIOS using FTK?

[Kill.Javascript]

A Different View -- for Perspective.

 

As a subscriber to this thread for well over a year, as well as someone who has tried to do some BIOS patching with CodeRush's old and more recent tools, I would like to add the following:

 

• Generally, strident comments or posts should be taken with a grain of salt. The reason? The vast majority of DIY'ers who are trying these tools DO NOT have the coding know-how or knowledge of low-level programming to do it themselves. Thus, they (myself included) are often at their wit's end as far as achieving predictable & successful results.
•  
• Also, with respect to the overwhelming majority of technical software utilities, the instructional writing is so opaque and insider-oriented that it is confounding and frustrating to the average user. I've edited technical manuals for over 20 years in a variety of industries, and the writing in the computer world is by far the most nightmarish I have ever had to deal with. Knowing how to code, knowing how & why processes and procedures work -- and attempting to clearly and concisely explain it to others -- are mutually exclusive skills. Personally, I've had to start from SCRATCH too many projects to count after wading through reams of computer-speak written by people for whom it might actually make perfect sense, but is utterly painful for the rest of us. For me, most of the zillions of software reference manuals -- by every publisher -- aren't worth the paper they're printed on.

 

Not saying that CodeRush's READ MEs fall into this category; I haven't looked at them for awhile. I am only trying to give a possible, legitimate, context for the frustration that user, or other users, expressed when trying these highly technical fixes. I know I've felt that myself in my experience building, testing, troubleshooting and maintaining h@ckint0shes over the past few years. Workable fixes are very hard to come by.

 

Most people seeking answers do follow forum protocol, and I would think that even those who don't, who fly off the handle due to frustration, are genuinely appreciative of the selfless work done by developers like CodeRush. If they didn't think it was worth trying and spending lots of time, effort and patience on, they wouldn't bother to download and give feedback at all. Actually, I would consider that kind of feedback more useful than dozens of "Thanks a lot!" or "I have the same problem too!" posts.

 

So, rather than consider it an insult, I would just chalk it up to feedback. I guess it's ultimately up to board admins to determine when someone is crossing the line, which I don't feel that guy did. Yes it was negative, but not without context. I liken it to being a musician. You can do tons of preparation and even turn in a good performance that measures up to your own high standards, but there will always be someone in the audience who says, "Pfff, he's not that good. What a waste of my time..."

 

I wouldn't quit being a musician in that case. Nor would I kick the guy out of the venue for good. I would take it as a call for me to work even harder, to find something in my playing that might not be there, and add it to my repertoire. Maybe I'd get him on board next time.

 

Anyway, Peace all, thanks for the thread & Happy New Year!

[CodeRush]

@Pavo, there is nothing to be really done except for disabling setting of BIOSWE and SMM_BWP bits on DXE phase end, but it requires BIOS modification itself, so the best solution there is an external SPI programmer. There are other solutions like AFU /GAN method, but I can't recommend it because they are working not in 100% of cases and can easily brick the board.

 

@Kill.Javascript, thank you for the opinion.

I'm not insulted much, but even people that pay money for my code didn't ever try to talk to me like that, so it's a bit of new experience for me. I appreciate any bug reports or feature requests, even plain "your software does not work for me" is enough (I will then try to know more on the case via PM), but here we have like 100k people using UEFIPatch and like 100 who have ever complained about it's UX somehow, which is tolerable for such specific applications, IMO. 

I know that my texts are not that good, but I still try to help users here if they can't understand something. I must also say that UEFIPatch as a whole is not a major project for me, it's only a variation of UEFITool's engine (which is a major project for me), and I don't even use non-virtual OSX anymore, so I can just say "you are now on your own, guys" if other people here will treat me like that one. I hope they won't.

[jalavoui]

Hi CodeRush,

 

As an developper of osx86 comunity i do understand how u feel about this fu@#ers who can't write 10 lines of good code - my advice - just ignore them.

 

Your tools are just great. I'm using UEFITool (latest windows version from git) and i found one thing that you might wanna add on a future release:

 

- Add a "decompress" option if the user wants to load a signed bios file (try to open 4 instance a hp bios file http://ftp.hp.com/pub/softpaq/sp54501-55000/sp54724.exe )

and maybe make a big warn message saying "you can modd this file but before flashing make shure you can flash unsigned files to your bios"

 

while the original file can be easily "extracted" (with phoenixtool259) i found a lot of modded bios files who can't (check this1 http://www.bios-mods.com/BIOS/index.php?dir=Whitelists%2F&download=sp54724_NWL_UlkMenus_Fantrip_ByCamiloml.exe)

 

 

This option might actually refrain people from trying to flash rsa signed bios and break their computers

Happy new year

[amgclk65]

Hello. I tried using UEFIpatch for my broad. I bricked the broad. Is anyone will to help my patch my bios? I will take all the risk in flashing it. I can't seem to upload the bios

Heres a link to the Newest bios. 

http://www.ecs.com.tw/ECSWebSite/Product/Product_Detail.aspx?DetailID=1448&CategoryID=1&DetailName=Feature&MenuID=103&LanID=9

 

I tried also using the old pmpatch. Heres a screen shot.

 

[CodeRush]

@amgclk65, examined your BIOS and found no clues why UEFIPatch'ed BIOS can brick your board, it's just a normal AMI Aptio4. 

The main problem here can be in flashing it, because ECS doesn't ship the full image.

I recommend buying SPI flash programmer, making a full SPI flash dump, patching it using UEFIPatch and flashing the patched dump back, only this way you can ensure that nothing will be changed by flasher.

[amgclk65]

@coderush..

Thx for responding.

Will this work for me ?

http://m.ebay.com/itm/301387748608?nav=SEARCH

Also Will that bring my bricked bios back into service. Or I'll need to replace the bios chip. Also Ive installed Yosemite on that broad. Using nullpowermanagement.kext also it doesn't seem to have proper power management. Would that mean it has a locked MSR?

Last question. I've got two of the same broads. Can I get a full dump from the working broad without a spi flasher ? And patch that.

Or should I just rma the bricked broad.

[CodeRush]

This SPI flasher is OK, I think.

I would not RMA the board, just wait for the programer to come, make a full dump from the working board and flash to the broken one.

If you have to use NCPM.kext and your BIOS can be patched by UEFIPatch you definitely have locked 0xE2 MSR.

[CodeRush]

Another guide, this time inspired by a request from Mirone.

 

 

Flashing your AMI Aptio4-based BIOS for desktop board blindly

 

Sometimes after (unsuccessfully) attempting to modify VBIOS or GOP driver your system can become headless, i.e. you can't see any output on the screen.

I do recommend buying a SPI flasher (chinese CH341A SPI flashers are dirt-cheap, about 4$ on EBay with international shipping included) in such cases, but you can also try following this guide to reflash your system blindly.

Because of unknown BIOS Lock state of any given system I will use AFU /GAN approach. It's not the best way in any means, but it works on about ~95% of systems.

0. You need another PC to prepare DOS-bootable USB drive with all files needed (attached to this post: Blindflash.zip). 

1. Unpack the archive, go to DOS folder and run USBDCR.exe as Administrator.

2. Select your USB drive, check Quick Format and Create Bootable Drive checkboxes, type a dot (.) into the text prompt below (it means that DOS files will be copied from the directory where USBDCR.exe located) and click on Start button.

3. Open your newly formatted DOS-bootable USB drive, it appears to be empty but DOS files are just hidden. Copy all files from TOOLS folder on this drive.

4. Download a factory BIOS image from board manufacturer's side and check if it's ready for flashing using AFU. Some board manufacturers like ASUS and Asrock are adding additional capsule headers, which must be removed before flashing. Open your BIOS file with UEFITool and see if it has capsule header (BIOS file extension .CAP can indicate it's presence too).

4.1. If so, click RMB on it and select Extract body..., then save a result as BIOS.BIN on your DOS-bootable USB drive. 

4.2. If not, just rename your BIOS file to BIOS.BIN and copy it on your DOS-bootable USB drive.

4.3. Please ensure that the really named BIOS.BIN (not BIOS.BIN.ROM or anything like that) before proceeding.

5. Power your PC off, clear CMOS with a jumper, remove all bootable devices except that DOS-bootable drive and power the PC on again. If you have a PC speaker on your board or connected to board's IO shield, you will hear 3 beeps indicating that DOS was successfully booted from USB drive and started to execute flashing commands.

Flashing itself consists of 3 stages separated by a beep:

1. AFUDOS BACKUP.BIN /O command tries to make a backup copy of your current BIOS region. It's can be needed for BIOS data recovery.

2. FD44CRP BACKUP.BIN BIOS.BIN command tries to transfer DMI data from a backup made on step 1 to a supplied BIOS.BIN file. It's only needed on ASUS boards and makes no harm on any other ones.

3. AFUDOS BIOS.BIN /REBOOT /GAN command tries to flash BIOS.BIN file and reboot the system after flashing is complete. Reboot will only be done if flashing was successful, so if anything goes wrong you can just wait for ~10 minutes and try booting DOS again.

6. After the first reboot please plug your USB drive out to prevent a loop then wait for BIOS POST screen to show up, it must work now. If it's still not working as expected consider finding another video card, flashing your BIOS with SPI flasher and do other useful stuff. Good luck.

[Mirone]

Thanks, I'll try as fast as possible and let you know the results.

[rio2]

I found another option for AMI Aptio : ) suggested and more reliable:

 

SCEWIN_64 /o /s nvram.txt /h Hii.db /v /q

 

open the extracted nvram.txt with notepad++ and search for

 

Setup Question    = SMI Lock

Token    =78    // Do NOT change this line

Offset    =88

Width    =01

BIOS Default    =[01]Enabled

Options    =[00]Disabled    // Move "*" to the desired Option

         *[01]Enabled

 

Setup Question    = BIOS Lock

Token    =79    // Do NOT change this line

Offset    =89

Width    =01

BIOS Default    =[00]Disabled

Options    =*[00]Disabled    // Move "*" to the desired Option

         [01]Enabled

 

Setup Question    = GPIO Lock

Token    =7A    // Do NOT change this line

Offset    =8A

Width    =01

BIOS Default    =[00]Disabled

Options    =*[00]Disabled    // Move "*" to the desired Option

         [01]Enabled

 

Setup Question    = BIOS Interface Lock

Token    =7B    // Do NOT change this line

Offset    =8B

Width    =01

BIOS Default    =[00]Disabled

Options    =*[00]Disabled    // Move "*" to the desired Option

         [01]Enabled

 

on my P8Z77-V LX the options appear twice, so you'll have to change it twice.

As explained in the dump move the wildcard (*) to the required option and change Default from

 

BIOS Default    =[01]Enabled to

BIOS Default    =[00]Disabled

 

save the nvram.txt and flash back with command

 

SCEWIN_64 /i /s nvram.txt

 

afterwards I do a globalreset with,

 

fpt -greset

 

it maybe an important step!

 

tested succesfully from linux with flashrom.

 

best regards

Works really well but i needed to use a newer version of winsce what i salvaged from msi command center Mobo: ASUS p8b75-v newest bios tested with FTK flashed patched bios sucessfully

[Mirone]

Another guide, this time inspired by a request from Mirone.

 

 

 

Unfortunately it didn't work for me, I'm going to wait for a new Bios chip that I bought.

I didn't hear any beep, it seems to me that isn't working boot from pendrive for some reason.

[amgclk65]

Hello.

What's the best way to make a full back up of a ami bios ?

[CodeRush]

The best way to make a full backup of any BIOS is using hardware SPI flasher.

The second best on Intel-based boards - boot it into Descriptor Security Override mode by shorting HDA_SDO pin with 3.3V during boot and the using Intel FPT to make a backup. 

On AMD boards you can just use flashrom from Linux or OSX to make a full BIOS backup (FPT doesn't work there).

[amgclk65]

@coderush.

Thx for the info. 

I was able to make a full back up. I used the full backup and applied Your UEFIpatch to the bios. All went well. But I'm still seeing some CPU KP on my h61h1-i with I5-3570k.

I can't boot 50 percent of the time without NCPM.kext. The Other 50 percent i get CPU KP. I also have to use VooDooTSCSync.kext  to use all four cores. If not i can only boot cpus=1. Maybe I need a SSDT.aml for my board. Is there a way to make sure my Msr is now Unlocked?

[CodeRush]

If you have patched it and the system can start without NCPM.kext - you have unlocked your 0xE2 MSR for sure. I know very few things related to hackintosh, so can't help you further here, sorry.

[Andy Vandijck]

@coderush.

Thx for the info. 

I was able to make a full back up. I used the full backup and applied Your UEFIpatch to the bios. All went well. But I'm still seeing some CPU KP on my h61h1-i with I5-3570k.

I can't boot 50 percent of the time without NCPM.kext. The Other 50 percent i get CPU KP. I also have to use VooDooTSCSync.kext  to use all four cores. If not i can only boot cpus=1. Maybe I need a SSDT.aml for my board. Is there a way to make sure my Msr is now Unlocked?

Check result of MSR read of register 0xE2.

If bit 15 is not set, you've successfully unlocked PM

[AVCFR]

Bonjour, je suis  désespéramment a la recherche d'un moyen d'installer Osx  sur ma Msi Z87 G-55 //

mon résultat ( écran blanc avec pomme une fraction de seconde puis reboot)

J'ai essayer d'en apprendre plus sur DSDT // SSDT // sans résultat.

J'ai cru comprendre que je devais flasher l'UEFI // pour avoir accès a MSR . mais après plusieurs de recherche je ne trouve pas de source a téléchargé, je me suis donc penché sur PMPatch et UEFIExtract mais je les lance et il me semble que rien ne ce passe :/ .

J'aurais besoin d'aide !!!!! 

[Mirone]

After replace my BIOS chip, everything works very well!!

[chriz74]

Can anyone explain if it's possible to create a valid asus bios using amidewin? I patched my notebook bios but then it becomes not valid for flash. I have now downloaded amidewinx64 and I can dump the smbios data. Is it possibile to make the patched bios valid by writing back the smbios.data to the modded bios? If so how?

 

Thanks