If you have InsydeH2O bios, you may have some trouble booting from UEFI flash drive (with linux or Win8 or higher).
There is a ton of advice, like to switch to CSM boot mode, but that defeats the point of UEFI. So some tips for you:
'InsydeH20' is a BIOS setup created by 'Insyde Software'. Note: Modifying BIOS/ complementary metal oxide semiconductor (CMOS) settings incorrectly can cause serious problems that may prevent your computer from booting properly. Microsoft cannot guarantee that any problems resulting from the configuring of BIOS/CMOS settings can be solved. May 04, 2017 insydeH20-advanced-settings-tools. Tools needed to access advanced settings that are otherwise not shown in the firmware's GUI. This system allows to modify board settings otherwise kept hidden in vendor BIOS interfaces. It is suitable for systems that have signed images, which will refuse to boot a modded BIOS where they are shown again. Try the steps recommended below to change the advance settings on the BIOS page. Turn off the computer and wait five seconds. Press the Power button to start the computer and repeatedly press the F10 key to enter the BIOS setup menu. Use the arrow keys on the keyboard to access the Advance setting tab.
(release approved by the management of Insyde Software Japan) We believe that the commercial value of our outdated BIOS developer tools is quite low. As a gesture of good will towards the BIOS modding community and IT community in general, we have decided to release some of our outdated BIOS developer tools - which are a part of this GitHub.
To make UEFI flash drive, you don’t need any special tools, you just need FAT32 formatted usb drive with an active partition and EFI folder on it. So for example, I wanted to try Ubuntu 15.04 on my machine (Toshiba Qosmio X70-A-12X) so I did the following:
- Formatted my trusty Kingston 2GB drive with diskpart (select disk X, clean, create partition primary, select partition 1, active, format quick fs=fat32
- Mounted Ubuntu iso with Windows 8.1, copied all the files from it to the USB.
- Thats it… (UEFI rocks)
To boot this drive after many hours of trying, sadly only because of a bug:
- Reset your bios to default settings!
- Leave Secureboot ON
- Turn Fastboot OFF
- Save settings with F10
- Hold F12 while booting to get to the boot menu, and select your USB.
- It should boot!
So whats the trick?
Insydeh20 Bios Unlock Tool
My BIOS was not working correctly, and it didn’t register my USB drive. In the F12 menu, it just said USB when it should have said USB Kingston DataTraveler so I thought I haven’t made a bootable USB or that I must use CSM (which you shouldn’t ever use).
Hope this helps someone.
On a side note: Ubuntu 15.04 (daily) is the only distro that works on my notebook. (14.04, 14.10 and Fedora 21 and 22 alpha freeze after a few minutes of usage - probably kernel issues)
Insyde Bios Modding Advanced and Power TabsInsyde Bios Modding Advanced and Power Tabs Due to a request I received by drakonn, Ill be covering how to enable the advanced and power tabs in the setup utility. Also special thanks to Florin9doi for his impressive knowledge of BIOS. I rewrote my splash screen tutorial based on his input.Theres not really much background information I can put here, Its kind of public knowledge that there are hidden tabs in the setup utility. I think this decision is ultimately up to the OEM, so HP decided that we dont need to have access to these hidden tabs.
This is most likely because changing some settings can damager you computer, so theyre actually looking out for us. So heres a picture of what my unmodified setup utility looks like. If youd like to follow along with this tutorial by using the same BIOS that I am, then heres where you can download it. As you can see, it currently has Main, Security, Diagnostics, System Configuration, and Exit tabs. So Ill show you how to enable the hidden tabs.Ill try to keep all my tutorials as generic as possible, but I already know that this will be impossible.
Rarely do different BIOS implement these restrictions in the exact same way, so dont expect this to be a surefire way to unlock your hidden tabs. As simple as I make these tutorials seem, it still took me several weeks to get each modification working on my own BIOS.To get started make sure you unpack your BIOS installer so that you have access to the BIOS rom. Then open it with Andys tool, go to the structure view, check the Decompress Extracted Modules box, and extract the DXE Core module. The latest version of Andys tool can be downloaded here. My extracted module is named 4A538818-5AE0-4EB2-B2EB-42.MOD. Yours might be named something different. So lets open that module with a hex editor, and search for a familiar string so that we can locate what module contains the setup utility.
The hex editor I use is HxD. As a side note, my BIOS uses Unicode strings. This means that after each letter, theres a 00 hex character. This is because each character is actually two bytes long. I think all Insyde BIOS are that way, but Im not sure.
So heres what I am going to search for, notice how I have blank characters between each letter. The name of one of my tabs is System Configuration, so the module that contains this string should also contain the setup utility.
So now that its disassembled, we have to find out where the tabs are located, then we can see what calls them. I created a program that can dump the internal forms representation used in EFIs human interface infrastructure. This can assist in finding the tab offsets, so you can download it here if you want to try using it. If youd rather find them manually, then in IDA Pro go to Search sequence of bytes. Then enter DF 42 4D B5 52 39 51 and press Ok.
These hex values seem to always be in the header of the tabs, and are about 13 bytes after the start of the beginning of the tabs offset. You might be able to determine in IDA Pros Graph overview that this subroutine is most likely what switches between the tabs when you press left and right. It does references all the tab offsets, but this is just to determine which one its currently selecting. This function is not the one were looking for.
If you want to make sure of this, you can modify some conditional jumps, but you will probably brick your computer this way. I should make a tutorial on how to recover from a brick.
Lets check out the next calling function. So heres what the second calling function looks like. Dont be surprised that its not in a flow chart view. IDA Pro isnt perfect, so sometime it cant produce this style for all function.
As a side note, you can press the space bar to swap back and forth between the flow chart view and the assembly view. Since I know how this tutorial is going to end, Im going to tell you that this is the function that decides what tabs are available in my BIOS. In yours, you might have to go through several more of the calling function before you find the one your looking for. Let me know if you guys think I add too many pictures. I want these tutorials to be through, but Im feeling like this is almost to slow.
Let me know what you think. So lets see where these conditional jumps go to. I just scrolled down a little. So it seems like the first one it jumping over two of the tab locations. These could be the two hidden tabs. The second conditional jump is going directly to the two tab locations. And the third unconditional jump at the end is also going to bypass the two tabs.
Now the program always jumps to 0x180001099 which references those two tabs. So lets try this out. Produce a DIF file in IDA Pro by going to File Produce file Create DIF file. I recommend you dont save it in the DUMP folder because it will most likely be deleted by Andys tool at some point. A DIF file contains the offsets and changes that we made in IDA Pro. IDA Pro cant physically edit a file, so we have to use the information in the DIF file and a hex editor to apply the changes.
Insyde Bios Update Utility Download
Insydeh20 Bios Advanced Options
You can close IDA Pro now. Before actually applying the changes with a hex editor, go back to Andys tool and press the Advanced button. We want to enable the ability to make modifications to the modules. So these are the settings I changed. I also checked No SLIC because otherwise we would have to select a SLIC table in order to repack our changes. Im fine with my BIOS current SLIC table.
Save the file. Now you can press Ok on the message from Andys tool, and it should repack your BIOS with your modified SetupUtility module. Lets try it out. Rename Andys tools outputted file, mines named 01448F29SLIC.bin, to what the original rom was called, mines 01448F29.bin. Thisll replace the original rom with the modified one. Now run InsydeFlash.exe. Press Start, wait for it to initialize, then press Ok. It will now flash your computer with you modified BIOS then restart.
Let me take it from here! I could hardly believe it.Pipsqueak: Nerd, Vanilla can't take another hit! Touhou puppet play emerald rom download.
Upon startup, press the key that corresponds to your setup utility, mines F10, to view your changes. Heres mine. An advanced tab! Thats weird??? Why didnt it unlock two tabs?
Bios Editor Tool
Shouldnt there be seven tabs now? As it turns out, I havent found a way to enable all seven tabs at once in my BIOS. But I do have a way of replacing an existing tab with this hidden seventh tab. Lets go back to the disassembled code where we changed the jump locations. Now lets change one of the referenced tabs to the seventh tab. My hidden tab is at address 0x18007F490 (I know this because its the only one not referenced in the disassembled function we edited), so lets change the line of code 'lea rax, 0x18007FA00' to reference this tab. The hex values for this line are 48 8D 05 55 E9 07 00.
The first three bytes are the load affective address into rax part, and the last four bytes are the offset of the address. This is a relative address based off of the current instructions address. And its stored in little endian. So if your good with math you can determine the new values with a calculator, or you can just changes some values and see if theyll work right by seeing what IDA Pro displays.
Heres what mine looked like when I was finished. That power tab doesnt have anything new in it that the advanced tab didnt already have. I guess there is something new about interrupts under one of the settings, which Ill never change anyway. I hope your power tab isnt as lame as mine. So Im just revert it back to having the advanced tab instead.This method of replacing one tab with another is probably the easiest way of unlocking one of the hidden tabs. The only downside to it is that youll have to give up one of the other tabs.I hope you enjoyed this tutorial.
I know it was a long one, but it was worth reading because it did cover some pretty good fundamentals of reverse engineering. IDA Pro makes this process much easier since it can quickly show what references what at any time. You can still do this same process with any other disassembler, but it probably wont be as easy.Available for download.