xsmile

@twm You need to open your body.bin in a hex editor, not IFR.txt. I wish editing the BIOS was as easy as that :-)

1 hour ago, twm said:

It's not working for A20 or at least I was not able to make it work. When I choose BIOS from F12 menu I receive the following message: "Fatal Error: DellHiiHandle not set!" .  [...]

This sounds like badly edited SetupPrep module. I didn't try it with A20 yet though.

 

Upload the attachment on an external site, I can't seem to access it here because of account restrictions.

First of all - there has been a minor bug with the menu visible. The fancy BIOS menu reachable via F2 did not render this section correctly and froze upon saving setting. A manual reboot was necessary but the changes were saved. The textual BIOS menu reachable with F12 didn't have this issue.

 

You are right about the convenience. Settings in this menu display all possible options in a human readable form and you don't have to deal with hexadecimal numbers.

 

Here is a quick walkthrough. I recommend against trying this if you don't have an external programmer for recovery purposes.

You need following tools:
- UEFITool 0.21.5 by CodeRush

- Universal IFR Extractor by donovan6000

- Flash Programming Tool (FPT) by Intel, part of System Tools v8

- modified GRUB shell with setup_var from the first post

- hex editor, e.g. HxD

 

1) With FPT - make a dump of your current BIOS

fptw -D bios-dump.bin -BIOS

2) With UEFITool - find the SetupPrep module containing the menu structure. Ctrl+F and search for unicode text 'SetupPrep'. It should be in module 899407D7. Extract the body of the compressed section in this module to setupprep-body.bin.

3) With IFR Extractor - parse your setupprep-body.bin and let it generate a text file.

4) The menu contains following form references in A18.

0x58669 		Ref: General, Variable: 0xFFFF {0F 0F 56 00 57 00 01 00 00 00 FF FF 00 00 80}
0x58678 		Ref: System Configuration, Variable: 0xFFFF {0F 0F 64 00 65 00 02 00 00 00 FF FF 00 02 80}
0x58687 		Ref: Video, Variable: 0xFFFF {0F 0F 66 00 66 00 03 00 00 00 FF FF 00 03 80}
0x58696 		Ref: Security, Variable: 0xFFFF {0F 0F 67 00 68 00 04 00 00 00 FF FF 00 04 80}
0x586A5 		Ref: Secure Boot, Variable: 0xFFFF {0F 0F 69 00 6A 00 05 00 00 00 FF FF 00 10 80}
0x586B4 		Ref: Performance, Variable: 0xFFFF {0F 0F 6B 00 6C 00 06 00 00 00 FF FF 00 05 80}
0x586C3 		Ref: Power Management, Variable: 0xFFFF {0F 0F 6D 00 6E 00 07 00 00 00 FF FF 00 06 80}
0x586D2 		Ref: POST Behavior, Variable: 0xFFFF {0F 0F 6F 00 70 00 08 00 00 00 FF FF 00 07 80}
0x586E1 		Ref: Virtualization Support, Variable: 0xFFFF {0F 0F 71 00 72 00 09 00 00 00 FF FF 00 08 80}
0x586F0 		Ref: Wireless, Variable: 0xFFFF {0F 0F 73 00 74 00 0A 00 00 00 FF FF 00 09 80}
0x586FF 		Ref: Maintenance, Variable: 0xFFFF {0F 0F 75 00 76 00 0B 00 00 00 FF FF 00 0A 80}
0x5870E 		Ref: System Logs, Variable: 0xFFFF {0F 0F 79 00 7A 00 0C 00 00 00 FF FF 00 0B 80}

For each reference, the last two bytes of the code visible in the curly brackets determine the ID of the form to load. General loads the form at 0x8000 (00 80), System Configuration loads 0x8002 and System Logs loads 0x800B.

 

Scroll down a bit and you find a huge form section with all the interesting settings that are hidden. It has no name but with 0x401 it has an ID, as every other form does.

0x58909 	Form: , Form ID: 0x401 {01 86 01 04 02 00}

 

Additionally search for the variable 'BIOS Lock', find its address and write it down. It should be around 0x40.

0x598A3 		Setting: BIOS Lock, Variable: 0x40

 

5) Now who needs System Logs, right? Open setupprep-body.bin in a hex editor, go to address 0x5870E (of the System Logs reference) and you should see the same byte sequence as above in the brackets.

Instead of referencing the System Logs form, let it reference the nameless form. Change the last two bytes from 0B 80 to 01 04 (0x401).

Save the modified file to setupprep-mod-body.bin.

 

6) With UEFITool - replace the body of the compressed section with your file setupprep-mod-body.bin and save the modified BIOS as bios-mod.bin.

7) With setup_var

Check the current state of the BIOS Lock variable, it should read 0x1 as in 'BIOS Lock active'. Replace <address> with the address you wrote down in step 4).

setup_var <address>

Disable the lock with:

setup_var <address> 0x0

Check the current state again to verify.

 

8) With FPT - flash the modified BIOS

ftpw -F bios-mod.bin -BIOS

9) Reboot and open the BIOS configuration menu (I don't remember the exact name) via F12. Now have a look at the System Logs

Managed to display the hidden settings by exchanging the address of an existing menu item with the debug form. However, there is nothing new. All settings can already be accessed with the modified GRUB shell.