$ dd if=/dev/mem of=original_bios.fd bs=1024 count=2048 skip=4192256

$ python vtenable.py original_bios.fd vt_bios.fd

$ vbindiff original_bios.fd vt_bios.fd

$ bunzip2 freedos_flashit.img.bz2
$ mcopy -i freedos_flashit.img vt_bios.fd ::/vt_bios.fd

title=BIOS Update
root (hd0,0)
kernel (hd0,0)/boot/memdisk
initrd (hd0,0)/boot/freedos_flashit.img

lukas: Well, this was a very interesting article. I have a HP HDX Laptop and it also has an InsydeH2O BIOS, but the option to enable VT is fortunately visible. Would be great if you’d figure out how to make the other options visible too ;)

nbertram: Is there a difference between the bios you save with the dd if=/dev/mem … command and the .rom (flash binary) usually provided by the notebook vendor? I ran your dump script against the rom and it failed:

C:\Update\EP0000173550>vardump.py R3054M3.rom
Traceback (most recent call last):
File “C:\Update\EP0000173550\vardump.py”, line 71, in
raise ValueError(“Bad header”)
ValueError: Bad header

marcan: The vendor-supplied upate file is missing all the information specific to your laptop, such as OEM information (serial number, etc) and also all the setup settings.

But, on the other hand, you’re using vardump wrong ;). It’s meant to be used on an extracted firmware volume. Run fvdump.py first on the full ROM, then look at the files that it produces. vardump should work against one (the one at 00180000 for my 8930G BIOS), which is the variable storage volume. However, on the vendor ROM, this will be an empty store (vardump will run but show zero variables), while doing the same on a dumped ROM will show your actual settings.

vtenable just hardcodes the start of the variable area inside the entire file, and this is why it works on the full BIOS for this particular laptop.

alain: Thanks a lot for sharing all this material, I’ve got a 8930G as well and just discovered that VT was off. -10000 in my mind for mean Acer folks.
Just flashed 1.10 with the hope that the settings would show up.
I’m running Jaunty so things are clearing up a little. msrmagic confirmed the “Locked off” stuff.
The best way forward would be to enable the hidden menus. I’ll give it a try.
No way to set their subclass to 0 ?

marcan: The menus are part of the Setup executable, which is packaged through several layers including compression. I’m more than a little reluctant to try modifying that stuff, because the resulting BIOS image would change a lot since the entire blob is compressed.

It’s doable but I wouldn’t want to try it unless I can make sure I can recove from bad flash. It’s also more intrusive than just changing a variable.

I still think there must be a way of enabling those menus via some simpler means.

lukas: On some older laptops there were jumpers on the mainboard or under the keyboard pad, that enabled the special BIOS options. Couldn’t it be the same behaviour here?

alain: You know what ?
It works like a breeze !!!

I’ve used the InsydeFlash utility that comes with the official update instead of the FreeDos procedure (needed to rename the files).
Now both SecureAble (GRC) and MSR Magic report Locked ON.

Many thanks again Marcan !!!

marcan: @lukas:

I was unable to find any obvious jumpers or testpoints behind the user-serviceable cover (which covers a large chunk of the motherboard). It’s pretty hard to safely find such a thing.

FaithX: Hi Marcan,

Firstly thanks for all you’ve done to get around this issue.

I have an Acer 5720 which I bought for the VT-x capable CPU,
guess what…

When I follow the instructions that you have outlined it doesn’t work with my notebook.

I get the error from your vtenable.py script

Loading BIOS…
Loading VSS…
Traceback (most recent call last):
File “vtenable.py”, line 88, in
raise ValueError(“Invalid VSS signature”)
ValueError: Invalid VSS signature

The bios files from acer are only 1MB in size for my notebook, or is perhaps where we are looking in memory for the bios?

Perhaps the “skip=” is wrong for dd.

How can I tell where the bios begins and how big it is?

I appreciate any help you can afford me.
Thanks!

FaithX: I looked in hwinfo and found this if it helps?

01: None 00.0: 10105 BIOS
[Created at bios.176]
Unique ID: rdCR.lZF+r4EgHp4
Hardware Class: bios
BIOS Keyboard LED Status:
Scroll Lock: off
Num Lock: off
Caps Lock: off
Base Memory: 639 kB
PnP BIOS: SST2400
MP spec rev 1.4 info:
OEM id: “INSYDE”
Product id: “Napa CRB”
1 CPUs (0 disabled)
SMBIOS Version: 2.4
BIOS Info: #0
Vendor: “Acer”
Version: “V1.45”
Date: “11/10/2008”
Start Address: 0x00000
ROM Size: 1024 kB
Features: 0x0403000000004bfb9880

marcan: If you want to dump a 1MB BIOS, increase skip by 1024 and decrease count by 1024.

However, since the BIOS size is different, I wouldn’t trust that the Setup variable layout is the same. Be very careful here, or you might wind up bricking your laptop.

FaithX: Marcan,
I had a look and it would appear that adjusting the skip & count extracted the bios, but I think you are correct about the Setup variable.

Ufortunately, disassembling the code is beyond me, I am not a programmer.

Can I tempt you with some money?
I would not hold you accoutable to a brick.
But considering I bought my notebook with the view of building VMs on it, not having VT-x is like being shot in the foot.

You could sell these as “use at own risk” patches!

Anyway I am ready for the risk for the chance of a functional notebook and I am sure that there are others who would appreciate it too.

I’m not totally sure but I think these notebooks have an emergency bios recovery procedure.

So what do you think?
Do you have time for a small venture?

If you want to mail me you can find me at admin at linuxterminal dot com

Cheers

marcan: I’d much rather try to show you how to do it first :)

Disassembling is not strictly necessary if the Setup variable layout is the same. But you should get there first, which is fairly simple. Grab fvdump.py and vardump.py and run fvdump.py on your extracted 1MB BIOS. With any luck it should create a bunch of files. Then try vardump.py on all of them. One of them should work and show you your variables. Paste the output somewhere and I’ll compare it to mine. If the layout is apparently the same, then you can easily derive new offset and length variables to stick in vtenable.py and it should do the trick.

If the Setup layout is different then the process is more involved. Roughly it goes like this: extract the LZMA firmware volume, then run fvdump on that again, then fsdump to extract the filesystem. One of the files is the Setup tool. The only disassembly bit there would be finding the beginning of the Setup form layout tables, though I might be able to code some heuristic to try to automatically figure it out. Then you can use another tool on that to get a human-readable Setup menu dump where you can find the magic VT Enable offset. If there’s interest I can try to automate the whole thing as much as possible.

FaithX: Thanks so much for your help.

I am up for the challenge.

Firstly, let me confirm that I have a 1MB bios, from the info posted above that is correct yes?

Ok I haven’t got very far.

I piped fsdump.py output through grep “User Interface” to tell us the files fsdump.py created

User Interface name: PeiMain
User Interface name: PeiCpuIoPciCfg
User Interface name: CpuPeim
User Interface name: PlatformStage1
User Interface name: PeiVariable
User Interface name: IchInit
User Interface name: PlatformStage2
User Interface name: IchSmbusArpDisabled
User Interface name: ClockGen
User Interface name: CrestlineMemoryInit
User Interface name: S3Resume
User Interface name: DxeIpl

Does this mean anything to you?

Cheers

marcan: You’re going too fast and off course ;). You’ve run fsdump on the PEI volume. That’s not what you want to do - you might get to running fsdump on the uncompressed main volume later, but that’s not the first step. First you need to look at the variables, which is vardump, not fsdump. Try vardump on all the volumes created by fvdump, and see if you get anything.

FWIW, it seems you ran fsdump on the volumes created by fvdump, and it probably worked on the last one, which is the PEI volume, which is something like the early boot / “recovery” portion of the BIOS. Correct?

FaithX: Well at least you can see my eagerness.
The reason I was running ahead is that vardump doesn’t work, it spits out the error

IndexError: list index out of range

on each of the files

FaithX: Actually, that is incorrect.

Traceback (most recent call last):
File “../vardump.py”, line 71, in
raise ValueError(“Bad header”)
ValueError: Bad header
Traceback (most recent call last):
File “../vardump.py”, line 80, in
v = VAR(vdb)
File “../vardump.py”, line 50, in init
raise ValueError(“Checksum error”)
ValueError: Checksum error
Traceback (most recent call last):
File “../vardump.py”, line 71, in
raise ValueError(“Bad header”)
ValueError: Bad header
Traceback (most recent call last):
File “../vardump.py”, line 71, in
raise ValueError(“Bad header”)
ValueError: Bad header

FaithX: Well in the file that has “Checksum error”
I find

=S.e.t.u.p

at 0x123

marcan: Upload the file that has “checksum error” somewhere

FaithX: pbx.com.au/acer_5720_setup_chunk.tgz

marcan: Looks like you have an (older?) format for the variable store that doesn’t have a checksum. This, in fact, matches the exact format that Tiano uses for variable storage (it also lacks a checksum). Here’s an updated vardump that works for your format. Unfortunately, the Setup field has a different layout, so I need to have a look at your Setup stuff. Can you please upload your entire dumped BIOS somewhere? That way I can try a shot at making a more generic toolset.

FaithX: Thanks marcan,

pbx.com.au/original_bios.fd.tgz

Are we sure that it definately a 1MB bios, and that we’ve got it all in the dump?

FaithX: What python deps are required, the vardump.py wants to draw to X11 but fails?

marcan: vardump.py only uses built-in python modules. You must be doing something weird.

phoenix: Hey - many thanks for your hard work!

My Sony Vaio Z1 also uses InsydeH2o and although there are some things different (e.g. requires Sony modified flash utilities, of course Vista only), most are the same (especially, after the vendor ROM is flashed and dumped, it has the same layout like the Acer ROM) and thus your tools work great.

As the layout of my Setup variable in the VSS is surely different than yours, I need to dump the tables including the offsets from the ‘SetupUtility’. Do you also happen to have a handy tool for it? (this: http://marcansoft.com/uploads/insydehacks/setup.txt looks like you didn’t do it by hand ;) ).

Cheers,
-phoenix

marcan: I’m seeing some clear demand from people wanting to do this on other laptop models and brands, so I’m working on improved tools to try to make it less painful. I’ll write a new post about it soon :)

phoenix: Well, I certainly don’t have anything against improved tools - but I’ll be already very grateful, if you add your tool to dump the SetupUtility’s string table… apologies, if I’ve missed it, but it doesn’t seem to be in here:

http://marcansoft.com/uploads/insydehacks

Thanks again!

marcan: Main issue is that right now it’s got all the offsets hardcoded. The string and setup structure tables are just linked into the SetupUtility and you need to find their offsets inside the code. I’m going to try to add some heuristic to it to make it find them inside the executable, but for now you’re going to have to look for them yourself. In any case, I’ve uploaded the current dumper (dumpsetup.py)

phoenix: Great - I don’t know how many hours you’ve spared me :)

Here my string table: http://pastebin.com/f4413454

Seems like the Setup variable layout in VSS is not so different after all: many parameters share the same offset; even VT.

In case this is true for all (current) variations of InsydeH2o, you don’t need to improve your tools concerning finding the correct offset.

I’ll proceed now in finding a safe way to flash my modifications; I’d very much like to use flashrom - I’ll keep you updated about whether I am going to send my laptop in for repair or start enjoying VT ;)

FaithX: There is another guy who has hacked VAIO bios.

http://levicki.net/articles/tips/2009/02/20/HOWTO_Enable_Intel_VT_on_Sony_VAIO_notebook_with_AMI_Aptio_EFI_BIOS.php

phoenix: Yes - but AMI Aptio is not InsydeH2o (while it is also EFI, it’s a completely different implementation);
.. and his hack is rather intrusive: he patched out setting the MSR altogether, so it is only unlocked and not enabled after every system startup or wakeup (One can enable it later, but hibernate/suspend would surely kill any running VM).

phoenix: Good news everyone (well, every Sony Vaio Z[1-4] user who also likes to have VT),

I flashed my variable storage (and only this part, a single flash sector) by using flashrom successfully and … finally - VT is enabled on both CPUs :)

Again -many thanks, marcan!

If anyone (you need to have at least a basic Linux setup and are familiar with Linux) needs specifics, feel free to contact me on bfroemel@gmail.com. Unfortunately (due to the Sony customized flash utility) I’d rather not try to flash a dumped bios back: the original rom image (delivered with a bios update) contains a lot of unknown header information which is certainly used somehow…

I hope that we discover how the hidden menus can be accessed (and that this does not require manual modification of the flash content). The current solution is just not doable for the average user…

Sebas: Great Work Marcan! I’m trying to follow the steps in your article, but I’m unable to dump the BIOS. I’ve tried to dump the BIOS but get an error stating BAD address.

I have two Acer 8930G, 4GB with the InsydeH2O BIOS and not being able to turn on VT is really annoying.

Can someone help me out here. I have ubuntu 9.04 32-bits installed with PAE enabled. Maybe, thats the issue?

Thanks in advance.

marcan: I’ve gotten reports of 64-bit kernels working where 32-bit ones don’t. I only run 64-bit stuff so I’ve never tested with 32-bit kernels. You also probably need to have CONFIG_STRICT_DEVMEM off in the kernel - again, I’ve only tested it with it off, so it might or might not matter. If you use a 64-bit kernel with CONFIG_STRICT_DEVMEM disabled it should work.

Also, I managed to get direct hardware flashing to work for this laptop’s EC chipset, so in the near future I should be able to get it integrated into coreboot’s flashrom. This way we can safely flash only the variable page straight from Linux.

phoenix: > in the near future I should be able to get it integrated into coreboot’s flashrom
There I’ve been in better luck, because flashrom did already support my ICH9 southbridge and thus the SPI flash chip. I only needed to extend flashrom to support erasing and flashing of certain areas (or sectors) only, because the original flashrom (even when the layout option is used) always tries to read/write the whole chip. Note that your chipset may or may not (silently) permit this (e.g. on ICH9 the first flash section (descriptor) is always read only and others can be configured to read, write both or neither). If you are interested I could clean up my modifications and we start a “fork” on sf.net or somewhere else. The “project” could focus on modifying EFI firmware in general.

zchef2k: marcan, great article. All of your skills are beyond my comprehension.

I’ve been reading this and some other articles about Insyde bios editing. My interest is being able to enable vt-x on my laptop which I upgraded the dual core pentium to a c2d. Understandably, that option was not included in the BIOS, as that is not a feature of the dual penitum chip.

I can’t run the vtenable.py script, I get an invalid VSS signature error per line 88.

I want to stay tuned to what goes on here. Any help for me would be greatly appreciated.

-Z

marcan: To make myself clear: vtenable.py is ONLY FOR ACER ASPIRE 8930G. It has hardcoded offsets and will most likely not work for any other laptop or BIOS. Even if it does it is not safe to use if you are not certain that the Setup variable layout is the same.

I’m working (time permitting) on a better solution.

dhlacik: Hi Marcan,

just to let you know : I love this. I wish you many luck and success with developing tools, which will work for different Acers as well.

I have an Acer Aspire 5810T timeline ,which has H2O insyde bios too as well.

I have mannaged to dump bios via dd . As I second I have managed to do a fvdump tool on dumped bios.

But Next, same problem as phoenix had, vardump does not work. In one case at fv-00030000.bin it throws checksum error. So I have tried improved vardump, which you have provided to phoenix. I get something from this, but it is not what I am looking for.

I would be very thankful to you (milion times :) ) , if you can manage to have this working as well. Just for information, I have attached dump of my Acer Aspire 5810T bios at
http://power.polarion.com/_review/bios.zip

Wishing good luck, looking forward for hearing from you. I will be checking your blog hourly for updates about that. :)

zchef2k: marcan, understood. I likewise will be checking your blog out regularly for updates.

FYI, my laptop is a Ccmpaq c762nr. It’s bios is 1.2M, I believe. I have been reading about emergency BIOS restoring on this and other models and will see if it too follows the winkey+B method as I believe it does. In which case, I will offer up my platform to test any future Insyde modifications you may be able to derive.

-Z

dhlacik: Hi Marcan, sorry for bothering you. Is there any update?

In my previous post I have told you, that I have managed to get information using vardump (the one provided to phoenix). I can see a setup there, but it contains ascii characters instead of menu options. My question is, how to proceed further , i.e. how to get the content of the setup from fv-00030000.bin . Thank you very much.

dannyres: I’ve managed to get everything up to dumpsetup.py working but I can’t seem to get it going. I have now found the offset for the string table but it seems to choke on the Exit form. This is what it says:

String table:
Language: eng (English)
String count: 814

Reading form ‘Exit’
Traceback (most recent call last):
File “C:\Users\Daniel\Desktop\BIOS MOD\New Folder\dumpsetup.py”, line 278, in

f = Form(pe, off)
File “C:\Users\Daniel\Desktop\BIOS MOD\New Folder\dumpsetup.py”, line 236, in
init
op = FormOp(data)
File “C:\Users\Daniel\Desktop\BIOS MOD\New Folder\dumpsetup.py”, line 148, in
init
self.indent = self.INDENTS[self.opcode]
KeyError: 39

any ideas? Thank you for your great work!

dannyres: After more snooping about I’ve found that three of the ‘FORMS’ work fine. It seems some of them are of a slightly different format than what your tool is expecting.

dannyres: Sorry for all the comments in a row.. I’ve finally worked it out - my BIOS seems to have an extra opcode (0x27). I don’t know what it is but I’ve modified your tool to accept it and give it an indent level of zero.

dannyres: From the UEFI spec:

28.2.5.3.3 Visibility
Suppressed statements will not be displayed. Statements are displayed unless:
• The parent statement or question is suppressed.
• The statement is disabled (see Section 28.2.5.3.2)
Human Interface Infrastructure Overview
Version 2.3 May, 2009 1421
• The statement is nested inside an EFI_IFR_SUPPRESS_IF expression which evaluates to
false.
The suppression of the statements is evaluated during Forms Browser initialization. Subsequently, the suppression of statements is reevaluated each time a value in any question on the selected form has changed.

marcan: I’m going to be very busy for approximately the next 10 days, so please bare with me. When I get a chance after that I’ll update the crummy enable so it’s usable with any flash image and can dump variables and alter any of them, and I’ll see how well I can automate the setupdump.py to try to locate the setup forms.

iri: Great work here, marcan. Really excellent :)

My v1.05 6935 BIOS patched without any complaints, but I won’t try flashing it until I understand a bit better what exactly is going on :)

It would be really nice to have some way to recover from a fubar BIOS, but the best I have heard is shorting the CMOS battery for 30 seconds (someone said this worked on a lot of laptops they had to deal with), but I’m not sure I would trust that.

dannyres: The Insyde BIOS’s actually do come with a recovery procedure. See here:

http://forum.notebookreview.com/showthread.php?t=284686

This works on all Insyde BIOS’s that I have encountered. If Fn+Esc doesn’t work try WinKey+B (that is what my laptop uses). I suggest trying it before you start flashing (infact this is actually probably one of the safest ways to flash your BIOS!).

dannyres: Oh and I should mention you just need to use the latest version of your BIOS, not any special BIOS. Laptops seem to be quite picky about how it is named, however. For me I had to name it 3602.BIN (3602 is my board ID).

iri: @dannyres:

Cool. How does one know the name of the firmware?

Should this procedure work for a totally nuked BIOS? Would it erase stuff like serial information unique to the laptop?

@everyone:

We should set up a proper forum for this, and possibly a git/hg/bzr/whatever repo with tools? I’m having fun messing around with the tools (I have made a lot of improvements, including stuff like doing LZMA from python - it makes automation quite a bit easier).

iri: Question: Why do quite a lot of the VSS variables (such as setup) appear multiple times? I have five instances of “Setup”. Does the BIOS only ever use the first one? (seems that way from vtenable.py, since it only patches the first variable section it sees?)

dannyres: iri according to 0.0 here:

http://forum.notebookreview.com/showthread.php?t=393606

the last section is used until they are all used in which case they start over. I have not tested this myself but 0.0 appears to know his stuff. :) I think this may only occur in HP’s Insyde BIOS’s as marcan never mentioned there being more than one Setup section for him. When I did it it did not overwrite my serial number, etc. It still is possible to nuke your BIOS so badly that this will not work. What type of model are you running? If it is HP I can semi reliably tell you what you’d need to name the file to get it working. Acer seems to have a different naming scheme though. I agree that we should create some sort of forum/wiki so people can contribute. At the moment a lot of people are redoing each others work.

phoenix: ad VSS)
Indeed, old instances of variables are kept to save erase/program cycles. A flash device, when erased is all 0xffffffff - you can only write something to zero (or vice verce). So instead of wasting an erase/program cycle, they just change the flag of the variable (to deleted) and use fresh (erased) areas for the (modified) variable.
When all the fresh area is used up, it just copies all variables into memory, fully erases the VSS and write all the variables again. I witnessed it once or twice within the Setup Utility - it “hangs” for a second or two on exist then all is done. So just ignore all variables that are not in state: 0x7f.

May I let you know about: http://feature-enable.blogspot.com/2009/07/enable-vt-on-insydeh2o-based-sony-vaio.html
I do not have any reports of Acer owners that this works, but its worth giving a shot.

iri: I couldn’t get phoenix’s method to boot for me. Acer Aspire 6935. I don’t have an empty USB key to play with though, is there any reason it would fail with a bunch of other stuff on it?

dannyres: phoenix I took a look at the Sony BIOS and there doesn’t seem to be anything special about the way it is flashed.. the Sony Vaio BIOS flash tool simply runs the InsydeFlash utility in silent mode…

dannyres: Though now I look at the actual BIOS file itself I can see what you mean.. sorry! :) with your flashrom method is it possible to flash the entire BIOS (including protected regions)? If I want to do this do I need to worry about your modifications done to it at all? I am wanting to do a FULL flash and no matter what options I specify with flashit/InsydeFlash it just wont work (fully).

d6z: I’ve put some modifications to marcan’s code online: http://thechaw.com/insydecodr. If anyone wants commit access reply here and I’ll notice.

To marcan: I hope you don’t mind I’ve made some updates to your code. I have tried to give credit where credit is due :) Do you mind if I put the whole lot under MIT license?

bong: This has helped me out big time! Now I have Intel VT on my VAIO and my Acer.

If you need to enable Intel VT on you VAIO with AMI Aptio BIOS use;

http://www.jhangra.com/blog/2009/06/enabling-intel-vt-on-sony-vaio-notebook-with-ami-aptio-efi-bios/

d6z: I believe I have a way of programmatically locating the forms and string table, without requiring the aid of disassembling knowledge. Still a bit rough around the edges, pretty much works for all bioses that I could get my hands on.

If anyone replies with interest, I will push the code to the git repository.

hyc: d6z: sounds good, I’ve been working out how to locate the tables myself in my dv5z BIOS too but mebbe you’ll save me the trouble of finishing.

Unfortunately, you’re using this lzmadec library which I don’t seem to have a copy handy on my Linux box. Where did it come from?

zchef2k: d6z:

I wish I was as smart as you guys. Really. I am contributing to an extraordinary amount of hits on this page each day to see how things are developing. I regret I don’t yet have the technical skills to contribute.

As I stated earlier, I have an interest in enabling vt-x and c4 sleep on my c762nr Compaq, essentially the same as an hp g6000 series laptop. The most recent BIOS is here…http://rapidshare.com/files/258765065/30d9f34.fd.html

I have already swapped out the POST images to reflect it also being a osx86 box.

I can test for you guys if you like, my laptop boots x64 XP, leopard 10.5.7 and Ubuntu jaunty. I have enough know how to test, not so much develop.

marianob: My laptop is Sony Vaio CS11. I can not download bios under linux, but i unpack bios from sony site. It has 2MB, but your program is not working. Invalid VSS signature. Could anyone help me ?

d-angel2001: Hello,
sounds like great work! I have the “Acer Aspire 7720G” Model, that also has VT-X disabled (thanks acer). No surprise for me - the latest Bios didn’t change anything!

I tried to unlock it using your tutorial - but I failed :-(

I had to alter the dd-command to perform the dump (my model has 1 MB Bios). But even using the corrected offset mentioned above for 1 MB-Bios-Models dd throws me an “address not found” Error.

Also any other investigation about having any solution failed for my model. How did you find out the correct address to change for the VT-X in the bios-dump? How did you know, from which address to dump the CMOS/Bios data? Is there any way to debug a Bios-Dump without risking bricked Computer (VirtualBox? / Qemu?) just to make shure the computer will start?

I would be very glad to get some info from you hopefully to find any way to enable VT-X on the acer 7720G Notebook, too…

PS: I am not the only one missing this feature for the acer aspire 7720G model ;-)

d6z: Note: I haven’t yet dared to patch my BIOS yet. Don’t do it unless you know what you are doing!

Also, if you do patch your BIOS and you do screw things up (or succeed?), please post here so that people can assess the risk.

Current state of things: I’m pretty pleased with the decoder. It works on all the bios’s I’ve tested it on. Currently, though, I haven’t done anything about modifying the flag, only locating it. You can run it on your BIOS (just run main.py and it will download the BIOS automagically from /dev/mem. There are some configurables at the top of the file like the size of the BIOS).

I have tried to do away with as many magic numbers as possible.

The only real problem remaining is that some bioses don’t have a checksum. If you find your bios doesn’t work, try commenting out the “cs = SI(“H”)” line in main.py under the VariableHeader class. Then it might suddenly work.

If your BIOS doesn’t work, please let people know in this thread.

The main thing remaining now is the ability to write out a patched BIOS, which is basically written in vtenable.py

@hyc

LZMA: http://tukaani.org/lzma/download (It’s mentioned at the top of lzma.py)

@zchef:

The latest version of my tool successfully locates the flag in your BIOS :)

@marianob:

You need to be able to download your BIOS, because you have to patch a bit in your existing settings section. The BIOSes downloaded from the Mfr’s site do not have this settings section, so it is not possible to patch it.

You can still run main.py from my repository on your BIOS to locate the flag though - let me know if it doesn’t work.

@d-angel2001:

It would be great if you could debug this, but unfortunately you can’t without some fancy hardware as far as I am aware. Virtualization uses virtual hardware -> virtual BIOS.

-—————

I’m curious about these reports of some not able to dump their BIOSes. You are all running as root, right? My tool does the “dd” from within python, and you can talk in terms of the size of the BIOS in megabytes (see the BIOS_SIZE variable at the top of main.py).

Would anyone else like to help with the development of these tools? Not much knowledge is required about the BIOS at this point, mainly python really.

marianob: Thanks for answer.

I can not locate main.py on http://marcansoft.com/uploads/insydehacks/ Could You tell me correct path for your repository ?

p.s. It shouldn’t be a problem to download bios uder mandriva ?
Second question. You sad that bios downloaded from mfr’s site do not have settings site. It hasn’t it or has, hmmm, setting section with 0xFF values. I’m asking because when i unpack exec from mfr’s site i receive not only bios but also flasher. And I’m wondering, maybe I could use it to program bios with correct VT flag. Thanks for your all.

marianob: I found it. I receive error bad address :|
If I try dd… then i get too bad address. Maybe it’s because mandriva ?

petejk: Hi,
I have an Acer Aspire 5315 with 1mb Insyde BIOS, and 3GB RAM.
Output from dd:
sudo dd if=/dev/mem of=original_bios.fd bs=1024 count=1024 skip=4193280
dd: reading `/dev/mem’: Bad address
0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.000264908 s, 0.0 kB/s

I’ve played around with these numbers, and tried the dd command on a couple of different ubuntu installs, but no joy..

d6z - I tried using your modified tools, editing the main.py file to 1mb, and with and without the commented out line
output
sudo python main.py
Traceback (most recent call last):
File “main.py”, line 35, in
from lzma import get_lzma_chunks
File “/home/petejk/Desktop/lzma.py”, line 86, in
@ctypes_function(lzma, c_int8, [lzmadec_info_p, c_char_p, c_size_t])
File “/home/petejk/Desktop/lzma.py”, line 77, in call
f = getattr(self.lib, func_name)
File “/usr/lib/python2.6/ctypes/init.py”, line 366, in getattr
func = self.getitem(name)
File “/usr/lib/python2.6/ctypes/init.py”, line 371, in getitem
func = self._FuncPtr((name_or_ordinal, self))
AttributeError: python: undefined symbol: lzmadec_buffer_info

I really want to get my head around this hack! but it doesnt seem to be a smooth process…

Cheers,
Pete

d6z: petejk:

Yeah, this is still a big hack, and I think it should probably pretty much stay that way - this is semi-intentional because flashing your BIOS is risky.

At the top of lzma.py there is a link to the lzma package which you need.

Before you install the package, though, does anything happen if you type “lzma” at the command line?

petejk: Ok, might have made some progress,
Installed lzmautils using instructions here -
http://www.linuxfromscratch.org/blfs/view/svn/general/lzma-utils.html

and ran main.py again,
sudo python main.py
Reading BIOS data..
Unexpected error
Traceback (most recent call last):
File “main.py”, line 459, in
main()
File “main.py”, line 454, in main
bios = BIOS()
File “main.py”, line 221, in init
bios_data = self.load_bios(from_where)
File “main.py”, line 436, in load_bios
bios_data = self.retrieve_from_memory()
File “main.py”, line 418, in retrieve_from_memory
bios_data = read_with_progress(memory, BIOS_SIZE, 2**6*KB)
File “/home/petejk/Desktop/util.py”, line 79, in read_with_progress
data.append(file_handle.read(chunk_size))
IOError: [Errno 14] Bad address

Which seems like the same error as dd was giving me before..

it-neuro: Can someone interpret finished bios for Acer 8930, by the enabled VT.
Thanks.

d-angel2001: @d6z about Virtualbox / Qemu debugging:

Of course you are right saying that these enviroments use virtual hardware! Just thought it might be possible to emulate the bios stage using a patched “original bios” to ensure it might also run on a real PC ( to avoid bricking your BIOS ).

PS: Qemu doesn’t like any foreign BIOS even if it seems easy to include it (just replace with Qemu-Bios-Binary). Qemu throws an error when trying to start… but ok - it was just a lazy try ;-)

I think it could work, but fails because different bios sizes / offsets for Qemu. Just think about that Qemu is able to run MIPS / ARM enviroments for testing firmware modifications for Router-Devices (AVM FritzBox f.e.). So my thoughts was not very crazy about trying this :-)

Best regards

zchef2k: To all of you afraid to patch/flash your BIOS with a test version, rest assured….

Most OEM, or big box machines, regardless of brand are using the USB stick+ recent BIOS version+ winkey+B method of restoring a good BIOS for successful posting and booting. Upon the suggesting of certain forums, I can confirm I can restore my HP BIOS via USB key. I did so by patching the POST images with custom graphics and restoring the entire BIOS using the aforementioned methods. I know now how to at least replace a working BIOS with a different version of a working BIOS via the restore method.

No fear, just hack. Don’t do so without doing some simple research first. It’s out there.
-Z

d6z: petejk, and others with the “Bad Address”.

What architechture? 64bit?

What do you get if you do “zcat /proc/config.gz | grep CONFIG_STRICT_DEVMEM”?

d-angel2001:

I have wondered about emulation myself. The problem is that the code is a complex (and long) thing, which will do lots of different things which are dependent on the hardware itself. So whilst emulation might be useful to test a few things, if they can be found (such as maybe an unzip/checksum), I don’t think you can generally emulate the entire bootup.

zchef2k:

The question that comes to my mind is “what happens if your bios is really hosed?”. To take the most extreme case, if one flashed the entire thing with zeroes, would the WinKey method still work? I would be surprised, and I wouldn’t want to test it with my laptop.

marcan: The recovery bootup almost certainly depends on the EC firmware and the PEI section, at least. Those are the first and last chunks of the BIOS image, respectively (the EC firmware is before the first firmware volume, and the PEI section is the last firmware volume). PEI is where the CPU boot starts and the initial drivers, and the EC firmware is what drives the keyboard controller (good luck getting any key combination recognized without that). I wouldn’t touch those without a hardware recovery solution.

petejk: zcat /proc/config.gz | grep CONFIG_STRICT_DEVMEM
CONFIG_STRICT_DEVMEM=y

so I need to recompile kernel with this option =n i guess?

petejk: Apologies for cluttering this thread, but I’m really keen to solve this.
Now with a shiny new kernel:

zcat /proc/config.gz | grep CONFIG_STRICT_DEVMEM
CONFIG_STRICT_DEVMEM is not set

I’m running 64 bit Ubuntu

and I’m still getting Bad address -
Laptops with containing 2mb BIOS can be read at the top of the 4GB 32bit memory space - My laptop has 3GB memory, a 1mb BIOS, and Intel integrated (i.e using shared memory) graphics - could this mean BIOS is shadowed in a different address than expected? If so is there a memory space utility which I could run which would tell me where to look?

d6z: petejk:

I have no idea if this is even worth doing, whether it makes sense for the bios to be mapped anywhere else.

Try this python one liner at the command line. It reads /proc/iomem, which is a list of memory mappings. 0x200000 (2MB, you want to change this to 0x100000 for 1MB) is the size of the memory mapping to search for. It prints out a list of (address, size) tuples, where size should be whatever you put x[1] ==. If the list is empty, then no matching-sized blocks were found.

To test out a potential mapping, change BIOS_START in main.py to be 0xBLAH where BLAH is the (address) part of the tuple. The BIOS gets saved to “data/original_bios-mine.fd” and re-read from it for future runs, so you will need to delete this if you try a mapping which turns out to be wrong.

python -c ‘print filter(lambda x: x[1] == “0x200000”, map(lambda i: (i[0], hex(int(i[1], 16)+ 1 - int(i[0], 16))), map(lambda s:map(str.strip, s.split(”:“)[0].split(“-”)), open(“/proc/iomem”).read().split(”\n”))[:-1]))’

petejk: The one liner doesn’t run unfortunately - not sure if i’m doing something wrong:

python -c ‘print filter(lambda x: x[1] == “0×100000″, map(lambda i: (i[0], hex(int(i[1], 16)+ 1 – int(i[0], 16))), map(lambda s:map(str.strip, s.split(”:“)[0].split(“-”)), open(“/proc/iomem”).read().split(”\n”))[:-1]))’
bash: syntax error near unexpected token `(’

My /proc/iomem file reads as follows

00000000-00000fff : System RAM
00001000-00005fff : reserved
00006000-0009fbff : System RAM
0009fc00-0009ffff : reserved
000e0000-000fffff : reserved
00100000-bf4fcfff : System RAM
01000000-0151e685 : Kernel code
0151e686-017d06d7 : Kernel data
018b0000-019a794b : Kernel bss
02000000-09ffffff : Crash kernel
bf4fd000-bf507fff : reserved
bf508000-bf551fff : System RAM
bf552000-bf554fff : reserved
bf555000-bf5bafff : System RAM
bf5bb000-bf5befff : reserved
bf5bf000-bf66ffff : System RAM
bf670000-bf6befff : ACPI Non-volatile Storage
bf6bf000-bf6fffff : ACPI Tables
bf700000-bfffffff : reserved
c0000000-cfffffff : 0000:00:02.0
d0000000-d0ffffff : PCI Bus 0000:02
d1000000-d1ffffff : PCI Bus 0000:04
d2000000-d2ffffff : PCI Bus 0000:05
d3000000-d40fffff : PCI Bus 0000:06
d3000000-d30fffff : 0000:06:00.0
d4100000-d41fffff : 0000:00:02.0
d4200000-d52fffff : PCI Bus 0000:06
d4200000-d4203fff : 0000:06:00.0
d5300000-d63fffff : PCI Bus 0000:05
d5300000-d530ffff : 0000:05:00.0
d5300000-d530ffff : tg3
d6400000-d73fffff : PCI Bus 0000:04
d7400000-d83fffff : PCI Bus 0000:02
d8400000-d8403fff : 0000:00:1b.0
d8400000-d8403fff : ICH HD audio
d8404000-d84047ff : 0000:00:1f.2
d8404000-d84047ff : ahci
d8404800-d8404bff : 0000:00:1d.7
d8404800-d8404bff : ehci_hcd
d8404c00-d8404fff : 0000:00:1a.7
d8404c00-d8404fff : ehci_hcd
d8405000-d84050ff : 0000:00:1f.3
d8406000-d8406fff : Intel Flush Page
d8500000-d85fffff : 0000:00:02.1
e0000000-efffffff : PCI MMCONFIG 0 [00-ff]
e0000000-efffffff : reserved
e0000000-efffffff : pnp 00:01
fec00000-fec00fff : IOAPIC 0
fec00000-fec00fff : reserved
fed00000-fed003ff : HPET 0
fed14000-fed19fff : reserved
fed14000-fed17fff : pnp 00:01
fed18000-fed18fff : pnp 00:01
fed19000-fed19fff : pnp 00:01
fed1c000-fed1ffff : reserved
fed1c000-fed1ffff : pnp 00:01
fee00000-fee00fff : Local APIC
fee00000-fee00fff : reserved
fee00000-fee00fff : pnp 00:01
fff00000-ffffffff : reserved

Not sure if it will provide any clues.
Thanks again

d6z: Ah, the blog software formatted the post with lots of funky unicode characters in place of the quotes, the “x” in “0x100..” was replaced with a multiply symbol, the - sign was replaced with a dash and gotknowswhat.

Unfortunately petejk, the only address which makes sense (1mb in size and marked “reserved, rather than PCI or whatever”, is 0xfff00000, which is 4GB - 1MB. So if that doesn’t work for you then it could be that reading your BIOS is not supported for some reason :(. I wonder if maybe Acer’s flashing tool is capable of reading the your BIOS?

petejk: In the end I used a windows tool, HWdirect, to dump the BIOS, as for some reason I cant seem to use Ubuntu/Fedora to accomplish this part.

I renamed it to original_bios-mine.fd and placed it in the data folder referenced in main.py, and ran the script.

The file is here http://rapidshare.com/files/261516938/original_bios-mine.fd.html

sudo python main.py
Opened BIOS ‘data/original_bios-mine.fd’ with md5:b13e23e627abf3d7d111f74b1208b6ed
Operating on BIOS data/original_bios-mine.fd size = 0x100000
Loading compressed sections
.. found 1 compressed sections
Locating Firmware Volumes
.. found 8 FirmwareVolumes (4 compressed)
Wrote SetupUtility to data/SetupUtility-mine.pe
Size = 0x1b620 MD5: 506b8410601df938d69203c676c494d8
Location = 0x0ae, name=‘VT Support’ help=‘Vanderpool Technology Enable/Disable.’
Have vss_volume:
Creating variable at 0
Blah: 11 40 70 eb 02 14 d3 11 8e 77 00 a0 c9 69 72 3b

Have vss_volume:
Have vss_volume:
Done

So I guess this means that I’m halfway there now - next part is to modify the part of the file that enables VT

ms007: Thanks to marcman, dannyres, d6z and all the guys who are doing the great work.

On notbook review form, I read that if you open an fd file using ezh2o, it automatically decompresses everything correctly and therefore if you read/update the decompressed bios info via winhex ram access, you need not worry about compressing it correctly. I mean youjust need to update it in RAM via winhex and then save it via ezh2o and have it compress the BIOS fd file correctly. That fd file should be ok for flashing. You might already know this but I just thought of sharing the info I read. Marcman, you seemed to indicate that you could change the form type to zero and make it visible if you didn’t have to deal with compression and stuff. This method should work in this case and we could have an unlocked BIOS with all possible settings to play with. What do you say?

I have an acer 7720 and am interested in unlocking advanced features in BIOS so that I can change any setting I need to. I can try and overclock my laptop also that way if possible. My BIOS also is 1MB in size.

Please keep up the good work. Thanks.

marcan: ms007: nick’s “marcan”, nor “marcman” ;)

Indeed, changing the form type to 0 should enable the hidden menus. However, I don’t use Windows and I don’t think memory-editing ezh2o is such a good idea - I’d rather come up with something that can safely perform the edit and recompress the BIOS. Also note that there’s at least one CRC32 checksum in the way (inside the compressed image) and I doubt ezh2o correctly fixes that when you manually edit the contents.

To everyone working on much improved tools: Good work!

ms007: marcan,

Sorry about the mistake “marcan”.

Regarding ezh2o thing…people have successfully made changes to the contents of an fd file using winhex and ezh2o combo. The image is opened by ezh2o first and thereby it’s totally decompressed in memory and it’s ready to be edited in memory. Since winhex makes changes to the contents in the memory itself, the changes are available to ezh2o. ezh2o is the official tool so we should be able to trust it more to do the job right and as I said before I’ve read success stories for the said method. ezh20 is supposed to take care of appropriate compression and checksum and everything. People in other forum first started with lzma thing but then one guy came up with this great idea and bypassed the need of having lzma altogether by letting ezh2o do all the work. ezh2o internally seems to use lzma anyway.

marcan, thanks again for all the great work you’ve been doing!!!

marcan: EZH2O isn’t “the” official tool. It’s “an” official (leaked) tool used to apply hacky patches to BIOSes (it doesn’t seem to be able to build a new image). It’s definitely not legal to redistribute. It doesn’t work right on the 8930G BIOS unless you remove some sections (otherwise it hangs in an inifinte loop consuming RAM - the version that’s around seems to be fairly old). It requires Windows (or wine), and a memory editor to apply the patches. Mostly I’ve read about it being used to pirate Windows by changing the software licensing codes in the BIOS image.

It might be interesting for experimentation, but I wouldn’t count or rely on EZH2O for any proper tool. Besides, recompressing LZMA is easy, it’s just that getting it to work might be dangerous if you don’t have a recovery method.

ms007: marcan, If we were to experiment changing the form type, how could it be accessed? Could you share the method (like a search string or offset(s)) to access form(s)? That would be quite helpful. Hopefully this would apply to all Insyde BIOS’es especially if it’s a string to be searched for. What do you think?

I believe people have used ezh20 and memory editor combo to update the white list as well.

Thanks!

petejk: Hi,
I’m not getting anywhere further. Having commented out the checksum related line in main.py I get the following, and I’m hoping that from this there are some values I can put into vtenable.py to enable the BIOS mod?

sudo python main.py
[sudo] password for petejk:
Opened BIOS ‘data/original_bios-mine.fd’ with md5:ba94ac804b00a03e37fd31688063fd0e
Operating on BIOS data/original_bios-mine.fd size = 0x100000
Loading compressed sections
.. found 1 compressed sections
Locating Firmware Volumes
.. found 8 FirmwareVolumes (4 compressed)
Wrote SetupUtility to data/SetupUtility-mine.pe
Size = 0x1b620 MD5: 506b8410601df938d69203c676c494d8
Location = 0x0ae, name=‘VT Support’ help=‘Vanderpool Technology Enable/Disable.’
Have vss_volume:
Creating variable at 0
Blah: 11 40 70 eb 02 14 d3 11 8e 77 00 a0 c9 69 72 3b
Creating variable at 44
Blah: 4e ee a3 41 57 6d 8b 41 8f 8e c3 66 a5 b7 0c 4b
Creating variable at 244
Blah: f4 27 4a a0 00 df 42 4d b5 52 39 51 13 02 11 3d
Creating variable at 537
Blah: f4 27 4a a0 00 df 42 4d b5 52 39 51 13 02 11 3d
Creating variable at 832
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 877
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 932
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 989
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 1311
Blah: 67 fd 9f af 10 ec 8a 48 9d fc 6c bf 5e e2 2c 2e
Creating variable at 1385
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 1463
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 1537
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 1605
Blah: f4 27 4a a0 00 df 42 4d b5 52 39 51 13 02 11 3d
Creating variable at 1898
Blah: f4 27 4a a0 00 df 42 4d b5 52 39 51 13 02 11 3d

Variable u’Setup’
Attributes: 0x00000007
Status: 0x7f
VendorGUID: f4 27 4a a0 00 df 42 4d b5 52 39 51 13 02 11 3d
Value (0xf9 bytes):
00000000 00 00 00 00 00 00 00 00 00 00 00 03 04 00 00 00 |…………….|
00000010 01 03 00 03 00 00 00 00 00 00 00 01 00 01 00 04 |…………….|
00000020 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 01 |…………….|
00000030 00 00 00 01 00 00 00 02 01 42 00 10 00 67 bf 03 |………B…g..|
00000040 00 01 00 80 40 02 00 80 10 04 00 80 04 00 00 00 |….@………..|
00000050 05 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 |…………….|
00000060 01 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 |…………….|
00000070 00 00 00 01 02 00 00 00 01 00 00 00 06 19 03 03 |…………….|
00000080 01 01 01 01 01 00 00 00 00 00 00 01 00 00 00 00 |…………….|
00000090 00 00 01 00 46 55 01 01 01 01 01 01 01 01 01 01 |….FU……….|
000000a0 01 01 00 01 00 00 00 00 01 00 01 01 01 01 00 01 |…………….|
000000b0 00 01 01 01 01 00 01 00 01 00 00 00 00 00 00 00 |…………….|
000000c0 01 01 00 00 00 01 03 02 80 04 06 00 01 00 01 01 |…………….|
000000d0 00 00 00 01 01 00 00 00 00 00 00 01 00 02 00 00 |…………….|
000000e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |…………….|
000000f0 01 01 01 01 00 00 00 01 00 |……… |
Have vss_volume:
Have vss_volume:

Thanks again,
Pete

MaxL: Hello

MaxL: Hello,
first of all I want to say a big thanks to marcan and d6z for their exelent work.
I have successfuly patched my Acer 7720G bios (1MB bios v1.45 11/10/2008).
To do this I had to comment the “cs = SI(“H”)” line in d6z’s main.py to make it work with my bios.
After that I modified marcan’s dumpsetup.py and vtenable.py with my offsets.
After executing vtenable.py I have flashed bios with WinFlash tool
from Acer’s site (ftp://ftp.work.acer-euro.com/notebook/aspire_7720/vista/Bios/v1.45.zip).
Now I have VT-x enabled.
Here is modified setupdump.py and
modified vtenable.py;
and here is my result of main.py and
my setup dump setup.txt .

Thanks again for great work!

petejk: MaxL - this works for my BIOS!
AFAIK this BIOS v1.45 is for Acer Aspire 5315, 5320, 5715Z, 5720, 7320, and 7720, so a few models to knock off the list.

So BIG thanks to Marcan, D6z and yourself!

Pete K

ms007: MaxL, Great job! I have 7720 so it should work for me too. I was wondering if you could try changing the form type to 0 and see if the forms become visible in BIOS as that would be just totally awesome. Wish I knew Python.

I was looking at setupdump.py script and I noticed that forms had to be defined with their ID’s and then I also looked at “Storage map” section in setup.txt. I noticed that many other possible settings were not listed in that section e.g. settings related to CPU voltage and multiplier etc. Therefore, I’m wondering if some other form should be included in the list of forms that are scanned. Marcan, you might have a better idea as to what that form(s) could be. Wish we could just alter the form type so that they become visible. Can it be done just the way the settings are altered?

I’m happy to see the collaborative work that has been going on.

Thanks everyone!

nitrous: Hi MaxL, great job, I have to say too! - would you mind posting your patched BIOS somewhere? I have the same acer notebook (7720G, bios ver 1.45).
thanks in advance, nitrous

marcan: People, the patched BIOSes are specific to the laptop they were obtained from. They are NOT a BIOS update/code patch, they’re a modification to a setting and there are many other settings that would be cloned if you were to install someone else’s update. The images that we’re patching are extracted from a specific computer, not the generic image from the vendor (which doesn’t even contain the setting we’re trying to patch). Anything from cloning the serial numbers, service tags, and licenses to a brick due to a slight hardware/setting difference could happen if you were to install someone else’s BIOS, even if it’s from the same model laptop.

You need to extract your BIOS and patch it yourself.

d-angel2001: Hello,

I think I found something that might be interesting! In the german magazin’s homepage of “Heise.de” there is an article regarding VT/X. There has been also mentioned the tool “HWdirect” that were introduced in this blog by “petejk”. But the most interesting ist, that there seem to be an linux tool named “msr-tools”, that should do the same!

There are also some interesting explanations about the offsets and bios-addresses for the VT-X registers!

Original (german) article-link:
http://www.heise.de/ct/CPU-Virtualisierungsfunktionen-nutzbar--/hotline/132040

Direct Link to MSR-Tools:
http://www.kernel.org/pub/linux/utils/cpu/msr-tools/

@petejk:
By the way could please tell me how/what you dumped with HWdirect?
If I understand the article on heise right, I must dump MSR using the address “0xc0010114” and save it as “bios-something.fd”. Is that correct?

shi-ro: I succeeded in enabling VT my VGN-P91HS (R2060U3 BIOS)

1. Dump the BIOS
Use the FLASHIT.EXE (V1.2j) with /G option.
(newer V3.52 InsydeFlash.exe has /G option too.)

2. Run vtenable.py
VSS_OFFSET = 0x000a0048
PATCH_OFFSET = 0x138

3. Flash new BIOS
Use the FLASHIT.EXE or InsydeFlash.exe and modified platform.ini.

Thanks a lot!!!

marcan: @d-angel2001

You can only enable VT from the OS (using msr-tools or HWDirect) when the BIOS hasn’t locked VT in the disabled state. This works for BIOSes that don’t support VT at all (VT is originally disabled but you can enable it). It doesn’t work for BIOSes that do support VT but disable it, because they lock the setting and it can’t be changed without a reboot. That article only applies to computers with no BIOS VT support at all (e.g. some Macs AFAIR). It will never work for Insyde-based laptops.

petejk: d-angel2001:
For my Aver BIOS, in HWDirect, I clicked Memory Dump, and entered the value for 4096 -1mb in hex, fff00000, in the Physical Adress field; entered size as 100000.

You can then click save - it’ll save as a log file which you can rename to .fd . Verify the size of the file by looking at properties, should be 1MB.

I did this rather than using the Linux dd method in the main post because I couldn’t do the dump from my linux install for whatever reason.

d-angel2001: Hello,

@ petejk:
thanks for your answer! Sounds great!
I’ll give it a try next ;-)

@all
I discovered the “platform.ini”-File that belongs to the insydeFlash-Utility (usually inside the download for latest bios). There seem to be some interesting informations.

The Ini-Section “Update-block” contains the Physical BIOS Address (for me (0x)FFF00000.

Mabe it would be useful to integrate an “ini-reader” for the patch-utility that may read the correct BIOS-Offset out of the platform.ini provided with an original BIOS?

Also “HWinfo –bios” should provide some info about offsets / bios size that may be useful for an optional automated process of the bios-patcher.

There’s more about platform.ini:
There is another section named “ForceFlash” that seems to contain some extra options to be flashed with the new BIOS-File:

F.e.
-Password (for me set to “0”)
-Logo (also set to “0”).

and:
-Type#09=0
-Type#08=0
(and some other type# values).

May the type-values stand for “hidden”-BIOS options that can be overwritten using the InsydeFlash-Utility (usually preset by BIOS-File or Platform.ini shipped by the Notebook-Vendor)?

Best regards
Gabriel

d-angel2001: Hello again,

I found an insydeFlash Utility provided by Gigabyte (Notebook-Section) in version 3.56 (the one provided by acer is much older).

IMPORTANT:
!! - You should remove the Bios-Image provided with the download to avoid flashing a wrong Bios!

!! - You should replace the “platform.ini” File with the original file from your BIOS / Model / Vendor to provide correct offsets/informations for the flash-process!

This download also contains some interesting windows tools:

- FlashTester.exe
Maybe for pre-testing checksums?

- iFdPacker.exe
Untested - but looks like a dev tool for adding ROM-Modules to the
BIOS-File!

- InsydeFlashx64.exe
Looks like 64-Bit compatible Version (may also be better for Vists/x64),
but also untested!

All information without any warrenty by me ;-)

Download-Link:
http://europe.giga-byte.com/FileList/BIOS/nb_bios_t1028_fb.zip

I hope this tools can be useful for this projects!

Best regards
Gabriel

d-angel2001: Hello again again,

I hope this is not seen as SPAM for posting several times. Just want to keep you inform about my progress.

1.) the InsydeFlash-Utility provided by me above (Gigabyte Utility) doesn’t seem to work on my Acer7720G instead of replacing the BIOS-File and platform.ini with the original one for my model (from original BIOS-Zip).

2.) Dumping the BIOS using insydeFlash.exe:
Dumping using the command neither “InsydeFlash.exe /g” nor “/G”
does work for me!

Solution:
Edit platform.ini, search Ini-Section “FDFile” and set the value
“BackupName” to any desired filename.

f.e.
[FDFile]
FileName=
BackupName=acer7720G_dump.fd

On next run of the utility the BIOS will be dumped to that file!
Becareful not to hit “flash” after the dump has done, if you don’t really
want that! You should backup the original Dump to CD-R or USB-Stick
before processing!

Best regards
Gabriel

d-angel2001: Hello,

I tried vtenable.py for my Acer 7720G BIOS dump and it throws out “IndexError: list index out of range”.

I made a dump using insydeFlash.exe Utility and tried another made with hwDirect.

Any suggestions?

@maxL
I also tried your Version (we seem to have the same model), but it also failed with that error.

best regards
Gabriel

d-angel2001: … sorry postet too fast…

The original (by users) unmodified vtenable.py patcher gives me the following error:

“ValueError: Invalid VSS signature”

My model/hardware:
Acer7720G
1 MB BIOS
3 GB RAM

petejk: The vtenable.py that MaxL has modified is the one that I used for BIOS v1.45. Should be the same for your 7720G. A few posts up..

d-angel2001: Hello,

finally i’ve made it work! The last failes posted above were my mistake as I forgot to give ptenable.py the output-filename!

I’ll give flashing a try next time.
Best regards and great work!

Gabriel

FaithX: Ok guys, I’ve done it…

Acer Aspire 5720
BIOS 1.45

MSR Magic 1.0 © 2009 George Styles www.georgestyles.co.uk

cpud 0 is locked ON :)
cpud 1 is locked ON :)

I basically did exactly what MaxL did.

Commented out the section in d6z’s main.py … (cool tool!)

Saw that the output was exactly the same as MaxL’s

So I ran his modified, version of vtenable.py (now that was a bit scary, because I didn’t quite understand where he got the “VSS_OFFSET = 0x000c0048” from… MaxL?) I know everyone else knows ;-)

But I knew I had the same BIOS so I took the plunge.

Anyhow, another success story guys!!!

Thanks heaps, marcan, d6z, MaxL … everyone else who has contributed.

Tjeutje: Hello,

Thank you for this interesting information. I patched my 6935G bios 1.13 using the original vtenable.py without any problem and now can use VT-X. I guessed that the 6935 bios would be the same as the 8930.

At first I thought the script would work in a Linux environment only, but using Python 2.6 for Windows the script worked like a charm.

I used the insydeFlash.exe utility to backup the original bios, like Gabriel suggested. After patching my bios, I used vbindiff for Windows to check the differences between the original and the patched bios (2 bytes were different, like Marcan said).

After renaming the patched bios I flashed it using insydeFlash.exe. No problems at all. Thank Marcan for your great affords!

AngelFace: Tjeutje!

good you be so kind and send me your patched file please? it would save me the hasel :) email anglecorp@gmail.com

marcan: @AngelFace:

You can’t use someone else’s patched BIOS because, as I’ve said multiple times already, the patched BIOSes are unique to each laptop and using them on other laptops (even of the same brand and model) would at best destroy unique data and at worst brick it.

AngelFace: ok :( having a hard time with python….keep getting syntex errors. example:

$ dd if=/dev/mem of=original_bios.fd bs=1024 count=2048 skip=4192256

were the = after if is a syntex error. using python 2.6.2 for windows

marcan: dd is a linux/unix tool that has nothing to do with python. You need Linux if you want to dump your BIOS using /dev/mem. Otherwise, find a Windows-specific tool that can dump the BIOS for you.

ChupaCobra: Hi,

Just like Tjeutje I own an Acer 6935G. After reading about VT being diabled, I was afraid, I would never be able to do hardware virtualization, until I recently came across this site.
After reading Tjeutje’s reply, I decided to take the plunge and try it myself. It worked amazingly and I’m now able to use virtualization to the fullest.

I would like to thank you all for making this possible. It’s sad though, that we actually have to screw around with the bios in order to get this done, while acer could just as easily release a patch, enabling this (and perhaps more) option(s).

Many thanks again and keep up the good work.

bigted: I have managed to successfully mod my Acer Aspire 5720G using the instructions here.
Bios version 1.45. I can now run Windows Server 2008 R2 inside Vmware Workstation 6.5.2 which had previously refused to run due to no VT support.

I followed petejk, d-angel200 and MaxL’s comments with success, but thought I would add my own experience especially being able to perform this hack without installing Linux, i.e. being able to do all the work inside Windows. I did install Ubuntu to run the python script for patching but only to make sure the same result would occur in linux and windows.

So: Download the latest Acer bios installer ver 1.45. Open file with 7zip (or WinZip or WinRAR) and extract to a folder. Edit platform.ini, BackupName=acer5720Gdump.fd under[FDFile] section. Run Insydeflash.exe. CANCEL flash process. Make sure dump file is created. Install python for Windows http://dinsdale.python.org/download/releases/2.6.2/ Do not use version 3.x of Python. it will not work.
Copy MaxL’s vtenable.py (http://pastebin.com/f604e244a) into same folder as dump file. Run “vtenable.py acer5720Gdump.fd acer5720GdumpVT.fd”.
Download Vbindiff for windows http://www.cjmweb.net/vbindiff/. Run vbindiff from the command line “vbindiff filepath\acer5720Gdump.fd filepath\acer5720GdumpVT.fd” There should be only one difference. In my case located at 0x08DD. 00 changed to 01.
If all OK rename ICL50HW.fd (from the bios installer). Rename acer5720GdumpVT.fd to ICL50HW.fd. Edit platform.ini and remove the backupname previously added. Run Insydeflash.exe. Machine will shutdown. Restart machine. Test as you see fit.

Thanks to all who helped me get this far!

Tjeutje: Hello,

@ Angelface:

This is what I did in an Windows environment: downloaded the Bios from the Acer site. I downloaded the 1.13 bios, and ran the Insideflash utility. Don’t know what the differences are between 1.10 and 1.13, but the Windows Eperience Index gave higher rates on the CPU and the GPU parts.

After flashing I filled in a backup name (f.i. c:\backupbios.fd) in the platform.ini file and executed the Insideflash again, but did not flash the Bios this time. After exiting Indsideflash the backup file had appeared on the desired location.

Then I installed Python 2.6.2 for Windows. I copied the vtenbable.py script as well as the backup bios to the Python directory. After that I opened an elevated DOS prompt, went to the Python dir (cd c:\python26) and typed “vtenable.py backupbios.fd 6935gvt-bios”.

Finally I copied the 6935gvt-bios.fd to the Insideflash directory, erased the supplied bios file and renamed 6935gvt-bios.fd to KM2_113.fd. Then I executed Insideflash for the last time and flashed.

Best regards, Tjeutje

d-angel2001: APPROVED TO WORK FOR ACER ASPIRE 7720G!

Hello,
after some start problems I’ve managed to make the phe patch work and tried to patch my Notebook. Now VT-X also is enabled and the patched BIOS works without any problems!

Btw. The MaxL-Patched Version and the “original”-Patcher gave me identical files for my Acer-Model!

Because the “Dump”-Utility didn’t work I used the Acer-Flash utility to make a dump (see ini-file “hack” as written above by me).

Thanks!
Gabriel

atmadden: I have a 8930G laptop and have been trying to do this in windows as per Tjeutje instructions above on 1.13 bios in vista. I am ok until I do the vtenable command and I get VSS invalid at line 85. I have downloaded vtenable.py from http://pastebin.com/f604e244a as above is this the correct file? I can only do this in windows as have no knowledge of linux.

Thanks for any help

phlkb: Dear MaxL

I am a complete Linux illiterate and would appreciate if you could send me the final file that you used with Winflash so that I can flash my bios also.
I also have the 7720G.

Many thanks for all efforts

marcan: phlkb: That is not an option. I have explained why many times already, please read the comments.

7720G: thank you for great help how to activate vt on Acer notebook. I am no good at Linux but found good help here as well: http://wunger.spaces.live.com/blog/cns!9E6927A42561030E!1115.entry

thank you agin.

Tjeutje: atmadden:

you should download vtenable.py from this location:
http://marcansoft.com/uploads/insydehacks/vtenable.py

This version works for both 6935G and 8930G. The version that you downloaded is modified by MaxL for (among others) 7720G.

phlkb: marcan:

Thanks for the reply. Would this mean that if I use MaxL’s version of vtenable.py do the job as I have the same Laptop 7720G?

regards

AngelFace: hi marcan :) i managed to get the dump using insydes flash tool.
but when i run the vtenable.py this is the result?

C:\Python26>vtenable.py old.fd new.fd
Loading BIOS…
Loading VSS…
Old state:
Variable ‘Setup’
Attributes: 0x00000007
Status: 0x7f
VendorGUID: f4 27 4a a0 00 df 42 4d b5 52 39 51 13 02 11 3d
Checksum: 0x3e8d
Calculated: 0x3e8d
Value (0x2bc bytes): lots of hex or something after this.

then

Patched state:
Variable ‘Setup’
Attributes: 0x00000007
Status: 0x7f
VendorGUID: f4 27 4a a0 00 df 42 4d b5 52 39 51 13 02 11 3d
Checksum: 0x3e8d
Calculated: 0x3e8d
Value (0x2bc bytes): more hex :P

seems like nothing has changed, any advise?

thanks so far :D

atmadden: Got it working now !

Thanks for your help:)

phlkb: Managed to patch my 7720G and my 5720 successfully.

Thanks for the help.

SquirrelOfDoom: Hi all,

I’m trying to get this working for my 5810T… running into a very stupid problem tho :

Downloaded, built, and installed lzma-4.32.7 (configured with –prefix=/usr)
Running main.py gives me:

Traceback (most recent call last):
File “main.py”, line 35, in
from lzma import get_lzma_chunks
File “/home/phil/BIOS/gitstuff/lzma.py”, line 83, in
“Couldn’t find liblzmadec.so. Please install lzma_utils.\n”
AssertionError: Couldn’t find liblzmadec.so. Please install lzma_utils.
it can be found at http://tukaani.org/lzma/download

Any yet… file /usr/lib/liblzma.so gives:
/usr/lib/liblzmadec.so: symbolic link to liblzmadec.so.0.0.0' /usr/lib/liblzmadec.so.0: symbolic link toliblzmadec.so.0.0.0’
/usr/lib/liblzmadec.so.0.0.0: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, not stripped

Any idea what I did wrong?

Thanks,

SquirrelOfDoom: To answer my own post (sort of), this looks like some issue with my Python install… I’ve never programmed in Python (before), so this is a gross hack:

Changing
library_path = find_library(“lzmadec”)
To
library_path = “/usr/lib/liblzmadec.so”

did the trick.

I’m now trying to convert output from main.py into the relevant fields for vtenable.py

jeloma: Step by step with “Tjeutje Says:” the August 11th, 2009 at 1:25 pm , for my Acer Aspire 8930G the VT enabled it’s OK.

Thank you all for your comments, especially in my case to Macan, Tjeutje and Angelface.

¡¡GRACIAS!!.

paulo.santos: Hello. First of all, I would like to thanks all the people involved in this hack, which is very useful.

I have a problem finding my offset value and size, After runing main.py I have this results:
Opened BIOS ‘data/original_bios-mine.fd’ with md5:023f3ead7e0b468727df6cfadd03e1d9
Operating on BIOS data/original_bios-mine.fd size = 0x100000
Loading compressed sections
.. found 1 compressed sections
Locating Firmware Volumes
.. found 7 FirmwareVolumes (4 compressed)
Location = 0x1af, name=‘VT Support’ help=‘Vanderpool Technology Enable/Disable.’
Have vss_volume:
Creating variable at 0
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 67
Blah: 11 40 70 eb 02 14 d3 11 8e 77 00 a0 c9 69 72 3b
Creating variable at 113
Blah: 4e ee a3 41 57 6d 8b 41 8f 8e c3 66 a5 b7 0c 4b
Creating variable at 310
Blah: f4 27 4a a0 00 df 42 4d b5 52 39 51 13 02 11 3d
Creating variable at 1056
Blah: f4 27 4a a0 00 df 42 4d b5 52 39 51 13 02 11 3d
Creating variable at 1804
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 1851
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 1908
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 1967
Blah: 9e 48 20 c0 b2 6d f2 4e 9a a5 ca 06 fc 11 d3 6a
Creating variable at 2047
Blah: 2d fd 83 89 3c 11 2b 4e 8f 47 0a bf eb 20 a4 1a
Creating variable at 2111
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 2191
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 2281
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 2365
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 2589
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 2813
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 2871
Blah: db 74 60 a5 fe 65 f7 45 bd 21 2d 2b dd 8e 96 52

paulo.santos: Sorry, It seems the text is to big to put on a reply.

I’ve placed it in pastebin: http://pastebin.com/m5cba6376

My problem is that I have no idea how to read the values from this output (I’m not even sure if the dump worked correctly…).
If possible, could anyone give me some pointer on the values that I need or some directions on how to get there?

Thanks in advance :)
PS: My laptop is a Vaio VGN-CS11S.

NuttyLepus: Thanks everyone. I’ve flashed my Acer Aspire 4736G (P8700) last night and the VT-x is now enabled.

My machine is a Vista one, with Ubuntu 9.04 (32 bit) running as guest in Virtualbox.

Unfortunately, the dd command did not work from my Ubuntu LiveCD (neither the 32bit nor the 64bit version) – it gave the ‘bad address’ error. Nor does it work on Cygwin (‘OSError’ – so obviously blocked). And since I do not want to install Ubuntu into my main drive, I was limited to using the vendor-supplied Insyde utility to do the dumping. This was done by tweaking the platform.ini file as suggested by d-angel2001.

The DOS-mode python gave out some error on running some of the python scripts (couldn’t quite remember which one and what error); and althought most scripts ran well on Cygwin, the main.py also gave ‘OSError’ despite the presence of the dump file in the data directory. So I moved the bios dump into the Ubuntu (virtual) machine and did all the work from there.

I also had to modify the d6z’s lzma.py as SquirrelOfDoom had suggested. (Using ‘/usr/local/lib/liblzma.so’ in my case; on Cygwin this should be ‘/usr/local/lib/liblzma.a’).

Essentially, d6z’s main.py gave the variable offset as 0x1af and the VSS offset of 0x000c0000 and the VSS size of 0x3fb8. Unfortunately, I cannot seem to access the EFI using d6z’s method (I only have one flashdrive to try anyway). So I resorted to modify Marcan’s vtenable.py with the following:

VSS_OFFSET = 0x000c0048
VSS_SIZE = 0x3fb8

(Can I ask the same question as FaithX? Not sure where the number 48 came from, but MaxL’s main.py output seemed to be similar to mine in this regard so I presume some kind of local offset?). After patching, vbindiff confirmed the two versions differed in only two bytes: the checksum byte and the actual variable. Vtenable showed that the patch seemed to have been applied to the right place. This was also confirmed by running main.py over the patched image.

The patched image was again flashed using Insyde’s utility. And now the VT-x is enabled. No side-effect so far (fingers-crossed)!

This is the main.py output of my original bios: http://pastebin.com/m4c68dd18

And this is the main.py output of the patched bios:
http://pastebin.com/m714dc714

Thanks again everyone.

NuttyLepus: Oh, and just a thought: can we not automate the process by chaining d6z’s main.py to Marcan’s vtenable.py? All the parameters needed to correctly configure vtenable seem to be already contained in the output of main. But I’m not a python programmer, so I’m afraid I cannot be more specific.

paulo.santos: Well, thanks to NuttyLepus reply I’ve also solved my problem. Adding the 48 at the end of the offset worked like a charm :)

Thanks,

elmar: It’s a gread site an a greade tutorial, but i get a checksum error by patching biosfile with vtenable.py.
here the Message:
C:\Python26>vtenable.py original_bios.fd vt_bios.fd
Loading BIOS…
Loading VSS…
Traceback (most recent call last):
File “C:\Python26\vtenable.py”, line 95, in
var = VAR(vss[off:])
File “C:\Python26\vtenable.py”, line 58, in init
raise ValueError(“Checksum error”)
ValueError: Checksum error

Can everybody help me? Thanks

SquirrelOfDoom: I’ve now got VT working on my Aspire 5810T :)

As well as changing the variable/offset in main.py, I needed to comment out the code for variable checksums in vtenable.py (and main.py), and it seems to be working fine.

I’ve also played around with a few other setup variables, and found enabling ‘Intel Page’ (option 21c on my BIOS) enables access to a bunch of hidden settings.

The ‘User Access Level’ setting may also be worth playing with, as it seems to control what is editable.

elmar: i’ve edit the following code in vtenable.py:
#if self.ccsum != self.checksum:
#raise ValueError(“Checksum error”)
Is that correct? But the programm type that:
c:\Python26>vtenable.py original_bios.fd vt_bios.fd
Loading BIOS…
Loading VSS…
Variable not found!
Old state:
Variable ‘Setup’
Attributes: 0x00000007
Status: 0x7c
VendorGUID: f4 27 4a a0 00 df 42 4d b5 52 39 51 13 02 11 3d
Checksum: 0x40bb
Calculated: 0x8418
Value (0x2bc bytes):
00000000 00 00 00 00 00 00 00 00 00 00 01 03 04 00 00 00 |…………….|

has anyone an idea, or can anyone help with the problem?

SquirrelOfDoom: You need to do more to get rid of all the checksum code. Vars with a checksum have a bigger header size, so the references to 0x22 change to 0x20, all ccsum/checksum refs need to go, and the pack/unpack stuff changes.

Here’s my patch to do this all for you http://pastie.org/587747

massiveoni: heya, i am a work atm, but i am reading everything i can about editting my bios to allow for me to enable VT in my c2d, but what i would like to know, is before i go ahead and do all of this, is there a program, that will allow me just to load my bios, and unhide the hidden options? and then just reflash it to the laptop? cause that would make is a lot easier.
the reason i ask, is cause my gf’s laptop is a compaq cq61, and it had hard drive and ram testing options in it as well

if anyone can help me can you please msn me on joelswatson -at- hotmail -dot- com

thanks

elmar: @ SquirrelOfDoom

I think somehow my bios will not. I now get the message:
c:\Python26>vt2.py original_bios.fd vt_bios.fd
File “C:\Python26\vt2.py”, line 90
print ts+” VendorGUID: EFI_GLOBAL_VARIABLE (%s)“%’ ‘.join(’%02x’%ord© for
c in self.guid)
^
IndentationError: unexpected indent

Can you help me somehow? my email is elmarkraus [at] gmx[dot]de

acrosom: Hello everyone.

I have a rather banal question compared to enabling virtualization. It’s the dreaded BIOS setup password. The offender is HP and the model is the Best Buy ‘Blue Ribbon’ dv3510nr. BIOS version F.13.

Just to keep the kids out I set an admin password. The BIOS allowed me to set a password of four presses of the TAB key. After POST and the power-on password I attempt to enter setup. Dutyfully trying to enter four TABs into the password field, the key presses are ignored. (No asterisks in the field)

This is strange to me as the power-on password is four presses of the SPACEBAR.

I am assuming that I cannot set a different admin password without knowing and entering the current password. HP is no help as “ALL BIOS password problems are concidered user error. Hmm.

My question: I already know the password, how do I get the BIOS keyboard to send/recognize TAB presses into the setup password field?

Codially,
Acrosom

acrosom: Any information; good, how to fix; or bad, need to replace motherboard is appreciated.

Acrosom at live dot com.

marcan: That is clearly a BIOS bug and 100% HP’s responsibility to fix it. Messing with the BIOS might void the warranty and it’d be a great argument for them to legally claim no responsibility. Right now it’s their fault, not yours.

On the other hand, take note: most BIOSes are poorly coded and entering control characters into a password field was probably not a great idea.

TMS: Hi everybody, i’m following this thread for a while now. here is my story ^^
As all of you i want/need to activate the VT on my laptop. I own a Lenovo U330. My bios is an Insyde 2MB.

I manage to backup it using the insyde utility, then i ran fvdump.py on it and i got 3 files:
fv-001a0000.bin
fv-00030000.bin
fv-00050000.bin

on each i ran vardump.py
for 2 of them i got this message:
D:\drivers\BIOS\Bidouilles>vardump.py fv-001a0000.bin
Traceback (most recent call last):
File “D:\drivers\BIOS\Bidouilles\vardump.py”, line 71, in
raise ValueError(“Bad header”)
ValueError: Bad header

and for one (fv-00030000.bin) i have something but i don’t really know what, i should get the variable if i understood well. Here is the text file of what i get : http://kashogy.free.fr/vardumpOUTPUT.txt

what should i do next ?
i hope you can help me :)
thanx a lot for this tweak, you’re doing a wonderful job

acrosom: @marcan

I agree with everything you said. AFAIK the new world BIOS (EFI, UEFI) is just a way to build many models the same, and turn features on or off depending on the price you paid. That sounds like dirty pool but HP is a marketing firm, no so much technology anymore.

I found a 2008 service guide for my exact model online and there was NO mention of RTC batteries, BIOS reset, or anything along those lines. They want there $300 to reset the setup passsword

I then came across a service guide from 2007 for dv3 models. There it was in black and white. Remove power, remove battery, remove plastic cover, remove wifi card and un-plug RTC battery. Wait >5 minutes and everything will reset.

I left it overnight just to be sure. Today I rebuilt everything and I had a re-virginized BIOS. No passwords. Who’d of thunk.

No more control characters is wise advice. I am really glad to have found a discussion of like minded rebels who continue to prove that the off the shelf systems are poorly designed, poorly coded and ‘relatively easy’ to out-smart.

Maybe I’ll get an Aspire 8930G next time and brush up on my python skills.

All the best!

jbezdan: If anyone has any suggestions for modifying the vtenable.py for an Acer 3810T-6415 it would be greatly appreciated

arcticcorey: [corey@localhost ~]$ sudo dd if=/dev/mem of=original_bios.fd bs=1024 count=2048 skip=4192256
2048+0 records in
2048+0 records out
2097152 bytes (2.1 MB) copied, 2.34968 s, 893 kB/s
[corey@localhost ~]$ sudo python vtenable.py original_bios.fd vt_bios.fd
Loading BIOS…
Loading VSS…
Traceback (most recent call last):
File “vtenable.py”, line 95, in
var = VAR(vss[off:])
File “vtenable.py”, line 58, in init
raise ValueError(“Checksum error”)
ValueError: Checksum error
[corey@localhost ~]$

arcticcorey: i have a 8930G

qwertM3: Hello everybody.
Great blog, a lot of contributions, many ideas. Well done.

I have probably noob question but couldn’t find an answer here nor elsewhere. The question is simple: what advantage brings VT? I am running VMWare on 2 or 3 PCs and it runs just fine. Will it run better/faster with VT enabled? If yes how much better, or faster? How do 2 PCs compare while running VMWare one with VT, other without? Or I am completely wrong and VMWare is not the right SW to utilise VT enabled HW?

Please help me understand this on a high level or point me to right direction to find answers.

Wish you all success,
qwertM3.

marcan: VT speeds up 32-bit virtualization and enables 64-bit virtualization. You need VT if you want to virtualize 64-bit guests.

alain: @ qwertM3
To supplement Martin’s answer.
From the point of view of security also VT brings more security, stability and performance in Ring switches.
VMware/Software virtualised guest kernels run in Ring 1 (although they are convinced they run in Ring 0). With VT/Pacifica both the guest and host kernel truly run in Ring 0. The hypervisor software recycles ring 1. Context changes being hardware assisted are quicker. Most modern OS only use Ring 0 and 3. AFAIK, VMS uses all Rings. OS/2 uses 0, 1 and 2.
FWIW…

qwertM3: Thank you guys.

It made many things clearer. Do you have figures of speed increase for 32-bit guests? Roughly…2%, 10%, 20%?

TMS: Hi everybody, can someone help me ?
I’m still stuck with my vardump which i don’t understand …

I would be very glad if someone could point me to the right direction.
Thanks a lot

arcticcorey: corey@localhost:~$ sudo dd if=/dev/mem of=original_bios.fd bs=1024 count=2048 skip=4192256
2048+0 records in
2048+0 records out
2097152 bytes (2.1 MB) copied, 2.28793 s, 917 kB/s
corey@localhost:~$ python vtenable.py original_bios.fd vt_bios.fd
Loading BIOS…
Loading VSS…
Traceback (most recent call last):
File “vtenable.py”, line 95, in
var = VAR(vss[off:])
File “vtenable.py”, line 58, in init
raise ValueError(“Checksum error”)
ValueError: Checksum error

Why do I keep getting a Checksum error?
I have an 8930G

marcan: Maybe there’s an actual checksum error for one of your variables. Upload that dump somewhere.

piet: I’m trying to patch the BIOS of my Aspier 7720G (Intel T8300 CPU) and I followed the instruction on site
http://wunger.spaces.live.com/blog/cns!9E6927A42561030E!1115.entry?wa=wsignin1.0&sa=419679173
But when I run the command
“c:\Program Files\Python31\python.exe” vtenable.py dump.fd patched.fd
I alwas get the following response:
File “vtenable.py”, line 10
PATCH_VARIABLE = u”Setup”
^
SyntaxError: invalid syntax

Unfortunately I am not familiar with Python so I do not understand, what the error message means.

Could somebody help? Is there a step by step instruction for newbies available?

Thank’s a lot for your support :-))

marcan: Python 3.x is incompatible with Python 2.x. You should use 2.5 or 2.6 to run the program.

piet: Hi marcan,

I gave it a try - I used Python 2.6 and now I get a different error message:

C:\Downloads\Software\BIOS_v1.45>c:\Python26\python.exe vtenable.py dump.fd patched.fd
Loading BIOS…
Loading VSS…
Traceback (most recent call last):
File “vtenable.py”, line 88, in
raise ValueError(“Invalid VSS signature”)
ValueError: Invalid VSS signature

Any idea?

Regards

piet

marcan: vtenable.py is only for Aspire 8930G. It works for a few other models, but not most. You can try d6z’s tool, though you’ll need Linux for that.

piet: I used a modified vtenable.py from MaxL now (http://pastebin.com/f604e244a) an it seems to work now. No more error messages from vtenable.py.

The output file (patched.fd) was created now successfully.

BTW, I created the BIOS dump using the original Acer tool that comes with BIOS 1.45 (InsydeFlash.exe) whis was described some comments above.

A simple Windows file compare (fc.exe) finds just one differencebetween the input and output file:

C:\Downloads\Software\BIOS_v1.45>fc /B dump.fd patched.fd
Vergleichen der Dateien dump.fd und PATCHED.FD
000C0AF2: 00 01

Is there anybody who can confirm, that this seems to be OK?

The reason for asking so many questions is, That I am afraid to brick my laptop…

marcan: That looks okay, but if no one has tested your laptop yet or made sure that the patch offset is correct, then you can never be sure. However, chances are slim that you’ll brick your laptop, even if the patch offset is wrong.

piet: OK, thank’s for your comment.

I will backup the data and load the patched BIOS when the backup is finished…

Is there anything I can do in advance, to reduce the risk?

What, if the patched BIOS will not work - can it be repaired?

TMS: As i got no responses to my problem,maybe i didn’t explain myself clearly enough …
I own a lenovo U330 laptop which has an Insyde Bios of 2 MB.
Obviously i can’t use any vtenable.py that are available here, so i would like to find the offset of my BIOS to patch it in order to activate the VT feature.

so i backup my bios using the insyde utility, then i ran fvdump.py on it and i got 3 files:
fv-001a0000.bin
fv-00030000.bin
fv-00050000.bin

on each i ran vardump.py
for 2 of them i got this message:

Traceback (most recent call last):
File “D:\drivers\BIOS\Bidouilles\vardump.py”, line 71, in
raise ValueError(“Bad header”)
ValueError: Bad header

and for one (fv-00030000.bin) i got a big output. I’m supposed to get the variable of my Bios if i understood well, but not capable to say if it’s the case. Neither if it’s the case, to know what i should do next to carry on the procedure.

Here is the output of my vardump :
http://pastebin.com/f7223513

What i understand from this is that i actually got some variable, but i don’t know how to use them, or if the format is the same than for all of you, and if i need maybe to decompress the LZMA volume or something ….

I would be very thankfull if someone could point me the solution i need.
Ludovic

marcan: @piet

If VT doesn’t work you can just flash the old BIOS back on. If it bricks your laptop then there’s probably a recovery procedure that you can try, but I don’t know what it is. Worst case you’ll have to send it in for repair.

@TMS

Your VSS_OFFSET is 0x00030048, but you need to figure out the setup variable offset. This involves unpacking the LZMA volume, unpacking the filesystem within, extracting the setup binary, manually locating the table starts inside, and dumping the tables to find the offset. d6z’s tool does this for you, but it needs liblzmadec so you’ll have to use it under cygwin or Linux or figure out how to get Windows python to talk to liblzmadec.

TMS: Thanks marcan for your reply, i’ve decided to swith on my Debian machine,
I installed the lzma utils
I used d6z’s tools and it report this:

sudo python main.py
Opened BIOS ‘data/original_bios-mine.fd’ with md5:6d0f4b7b34948f7963243c86d6853a4f
Operating on BIOS data/original_bios-mine.fd size = 0x200000
Loading compressed sections
.. found 1 compressed sections
Locating Firmware Volumes
.. found 7 FirmwareVolumes (4 compressed)
Wrote SetupUtility to data/SetupUtility-mine.pe
Size = 0x48660 MD5: f5a3263fbbd5cc33d91f48e33d3bb9a9
Traceback (most recent call last):
File “main.py”, line 459, in
main()
File “main.py”, line 454, in main
bios = BIOS()
File “main.py”, line 264, in init
self.locate_packs(setup_utility_pe.data)
File “main.py”, line 342, in locate_packs
forms = find_all(setuputility_binary, form_magic, create_form)
File “/home/user/Desktop/Bidouilles/d6z/util.py”, line 40, in find_all
result.append(callback(position))
File “main.py”, line 338, in create_form
return Form(setuputility_binary, location, english_stringtable)
File “/home/user/Desktop/Bidouilles/d6z/dumpsetup.py”, line 262, in init
op = FormOp(data, stable)
File “/home/user/Desktop/Bidouilles/d6z/dumpsetup.py”, line 168, in init
raise RuntimeError(“Undefined opcode: 0x%x” % self.opcode)
RuntimeError: Undefined opcode: 0x27

This problem has been encoutered last month by dannyres , and i’m currently browsing a thread on forum.notebookreview.com where dannyres talked about it, but i don’t see the clue right now.

what i’ve understood :
the opcode 0x27 is EFI_IFR_VARSTORE_DEVICE_OP
dannyres patched your dumpsetup.py to ignore it or something but i don’t understand how.

what i don’t understand is how can i patch d6z’s dumpsetp.py to accept it
(maybe in the class FormOp(object) ??)
and does it have any consequences for the procedure ? do i need to modify other files ?

Thanks a lot for the job !!

marcan: Under “EFI_IFR_VARSTORE_SELECT_PAIR_OP = 0x26” in dumpsetup.py, add “EFI_IFR_VARSTORE_DEVICE_OP = 0x27”. Then under “EFI_IFR_VARSTORE_SELECT_PAIR_OP : 0,” add “EFI_IFR_VARSTORE_DEVICE_OP : 0,“. That should do it. Ignoring that opcode is fine.

TMS: Indeed thanks to you it works now
here is the output of d6z’s main.py http://pastebin.com/f482865b2

i guess i need to modify your vtenable with
my VSS OFFSET : 0x030000
and my VSS SIZE : 0x3fb8

is that right ?

marcan: VSS OFFSET should be 0x030048 (+0x48), and also set PATCH_OFFSET = 0x1af (0x1af comes from the “VT Support” line in main.py output), but it seems that matches the value that was already there.

TMS: Thanks again !!
In your file i see
VSS SIZE : 0x4000 - 0x48

should i write for my bios
VSS SIZE : 0x3fb8 ? or
VSS SIZE : 0x3fb8 - 0x48 ?

TMS: well i tried with VSS SIZE : 0x3fb8 and i got an error

here is the output : http://pastebin.com/d14deb21f
as it an out of range index; can it be because my bios is 2MB large ?

marcan: You need to pass the output filename as the second argument

TMS: silly me ….
many thanks, i’ll keep you posted, when i flash my bios

piet: I flashed the patched BIOS and…
… it works :-)

MANY THANKS!! to marcan for the support and to MaxL for the modified vtenable.py for the Acer Aspier 7720G (Mod. 833G32Bn, Intel T8300 CPU).

Now I will start installing Windows 7 and the XP Mode…

Piet

NuttyLepus: Acer Asia-Pacific has released a new bios (version 1.07) for Aspire 4736G last week.

Flashing the new bios with the default platform.ini resetted the VT-x setting.

The offset for the VT-x setting in this version is similar to version 1.05, therefore I was successful (again!) with the unlocking.

For anyone who owns an Aspire 4736, the correct settings for vtenable.py are:

VSS_OFFSET = 0x000c0048
VSS_SIZE = 0x3fb8
PATCH_OFFSET = 0x1af
PATCH_VALUE = 0x01
PATCH_VARIABLE = u”Setup”

The bios image was in fact for “AS4336_AS4736”, therefore I presume this would work with Aspire 4336 as well. Of course anyone who wish to try this on the 4336 should try to verify the offset first.

BTW, there were some typos in my previous post: the correct path for liblzmadec in the lzma.py should be “/usr/local/lib/liblzmadec.a” for cygwin and “/usr/local/lib/liblzmadec.so” for linux.

highlandernut: I was curious if anyone knew of something similar to allow the bios on a Travelmate 8210 to allow its VT to be used.

bonald: Wow!!

I got VT working on my TOSHIBA Satellite Pro A300-01V !

My insydebios is only 1MB.

This is the offset i’ve used with vtenable

VSS_OFFSET = 0×000c0048
VSS_SIZE = 0×3fb8

Thanks!

bonald: I was wrong!
Bios now says Hardware Visualization Enabled but it seems to be turned off on the CPU anyway…

main.py output — http://pastebin.ca/1553122

Any help is appreciated !

marcan: This isn’t a magic program to enable VT on CPUs that don’t support it. As far as I can tell, yours doesn’t.

bonald: You are correct it’s a T4200 and VT is not supported. I’ve just wasted a couple of hours! But i’ve learned a couple of tricks anyway.

NuttyLepus: Oh well, at least we have now been confirmed that setting the VT option in a machine with a VT-incapable CPU doesn’t seem to have caused too much problem – apart from that it just (rightly) keeps refusing to do the VT!

william lee: will anyone help me.
my system is acer 4730g with 2 mb bios and win vista.
i managed to dumped the bios and do fvdump.
still got error on vss size….
any help would be nice.

william lee: i managed to make it enable. but when i check it using securable it says locked on. any comments? although before i flash it it says locked off

marcan: “locked on” is what you want. It means VT is on and locked (so you can’t turn it off, but that doesn’t matter).

william lee: this is what the program described for “locked on”
Virtualization Locked On

This processor’s advanced hardware support for virtualization has been enabled and “locked on” to prevent virtual machine penetration compromise. This was probably done by your system’s BIOS or by whatever desktop virtual machine system you are using, if any. But if neither are the case you may wish to determine what has done this since it could be a sign of an advanced root kit compromise.

anyway thanks marcan

pixsta: @all acer timeline owners: the latest bios 1.28 support VT by default. It works like a charm in Windows 7.

zrbarnes: Just posted this: http://forum.notebookreview.com/showpost.php?p=5300618&postcount=65

Values for the new Acer 1410 are:

VSS_OFFSET = 0x00180048
VSS_SIZE = 0x3fb8

PATCH_OFFSET = 0x1af
PATCH_VALUE = 0x01

Successfully got VT enabled!

Thanks!

adipolle: Hi Marcan,
I want to modify my BIOS so I can enable Intel VT to run a 64 Bit Guest OS in VMware/Sun Virtual Box. Currently, the Phoenix BIOS hides this feature. I have a HP Pavillion DV2842SE with an Intel Core 2 Duo T 5600 running Vista Home Premium 64 Bit. I had installed XP Prof 64 Bit on this laptop earlier and got Intel VT turned on, but cannot do it when I returned to factory installed Vista (some software was not available in XP like Youcam and Multi-Touch scrolling,etc and so I had to (sigh) return to Vista). The mobo is Wistron 30CD, Intel Chipset GM 965, BIOS is Phoenix version F2E(¹²⁄₂₀₀₈).
Any help/workaround is appreciated-just need to run 64 Bit (Guest)virtual machines. Thanks!

fonzy: First, thank you all for this excellent stuff.

I have three Acer Aspire 7720 notebooks, two with identical and one with a slightly different hardware configuration. I was looking for a way to enable VT.

When I could not find any Insyde tools, I want ahead and disassembled major parts of the bios which is version 1.45 (http://support.acer-euro.com/drivers/notebook/as_7720.html). But I had not yet gone as far as the SETUP program since I was not sure what decompression was used. I was disassembling that from the bios code itself.

The good news is that your work and all that posted here has now saved me a lot of time. I used the vtenable.py script modified by maxL. I just succesfully patched three notebooks. I have an interesting observation here. The offsets of the SETUP variable are different for each notebook even though the original bios is the same and the hardware configuration is identical. They are in the same region, but the exact offset is different. It is not entirely clear to me what is going on here. Any ideas, please, welcome.

The setupdump script did not work, however, it crashed but I did not investigate further since the vtenable script seemed worked fine.

I strongly support the comments above regarding modifying the setup so that the hiddden menus can be accessed. You have a much better understanding than me regarding the SETUP program, so I will stop spending time on the disassembly since that became too time-consuming anyway. If I can be of help somewhere, let me know, please. For now I have three notebooks with VT enabled, thanks to you all.

weco: Thanks everyone. I’ve flashed my Acer Aspire 6935G (T9400) last night and the VT-x is now enabled.
My machine is on Vista-Ultimate x64, used the same procedure as Tjeutje, I used marcan’s vtenable.py because MaxL’s version only gave me error’s

Aakhunaten: Thanks everyone, especially Marcan. I followed the instructions given on my Aspire 8930G with BIOS v 1.13 and now I have VT enabled. Yeay!!!!!

I used the Flash utility provided by Acer to backup the existing BIOS and then ran vtenable.py on that. I used the same flash util to update the BIOS. and voila! i have VT enabled.

Thanks again everyone!

sebih: Hello, I have an Aspire 8930G. I tried enable Intel VT but without success. I have Windows 7 64 bit installed and I followed the steps described by Tjeutje. I patched the BIOS version 1.10 and also 1.13 without any error, and after that I flashed the new BIOS with InsydeFlash utility. After I rebooted the system Intel VT is still disabled. I checked that with Windows Virtual PC that require hardware-assisted virtualization. Can you help me with extra tips, I red all the comments and I saw that everyone succeded with enabled this function.
Thanks!

weelkin: H there,
thanks to you all, i finally enabled VT on my Acer Travelmate 8371 Timeline
I used MaxL’s vtenable.py mod from http://pastebin.com/f604e244a to avoid the checksum errors and found these values for the vtenable.py script:

VSS_OFFSET = 0x180048
VSS_SIZE = 0x3fb8

PATCH_OFFSET = 0x1af
PATCH_VALUE = 0x01
PATCH_VARIABLE = u”Setup”

I flashed the new bios using a usb stick which i prepared with free dos using unetbootin.
Now i can use VirtualBox with VT enabled and have 64Bit Guest OS!

fonzy: For all of you who are worried about bricking their notebook because of a wrong patch:

There are many reports from users that did brick their notebook because of a faulty flash but that recovered succesfully. Acer Aspire models with an Insydeh20 BIOS have a robust flash procedure built in. There are many reports from Aspire 5315 users, e.g. There is a CRISIS Recovery disk required. This disk (USB flash drive or CD) must contain 1 file (the fd to flash). A CD must not be bootable. A cold power on without battery and with the Fn + key pressed will enter into the Flash procedure built inside the BIOS. This is a safe procedure and avoids the use of the InsydeFlash or FLASHIT program. The flash takes place in the blind (no screen).

I suspect that other models and brands use a similar procedure. The keys to press may vary, however.

I have not tried myself but I will also not hesitate to do it. If we have a patch to enable all forms in the Setup, I will be happy to try it.

fonzy: erratum: the edit bos deleted my text. The keys to press are Fn + ESC.

sebih: Any ideas ?

Tjeutje: Sebih, I guess you did something wrong. Did you use vbindiff to compare the original backuped bios with the modified bios?

nero001: I can’t get this working on a Compaq C771us.
The vtenable did make a change but vt isn’t enabled.

vtenable.py
main.py output

I used:

VSS_OFFSET = 0x000c0048
VSS_SIZE = 0x3fb8

PATCH_OFFSET = 0x0bd
PATCH_VALUE = 0x01

Are these correct based on my main.py output? Thanks.

nero001: Hmm, maybe I’m doing it right, but my processor doesn’t support it. Oh well.

elmar: Hello,
I hope I can still help someone. I have flashed my BIOS on a 8930G. Unfortunately, something went wrong when flashing. Laptop went out, and only the fan was still running. black screen. I tried to reset the bios as I have moved the battery from the bios. nothing changed. To Power on the notebook is not working. I tried the notebook using a USB stick to boot (BIOS recovery FN + ESC, press power, etc.). Does not go. Have taken a different USB stick, does not work. What I can do yet. Request for help please : (

sebih: Hello Tjeutje, the vbindiff application show me the fallowing changes:
1. 40 -> 3F – is right in front of “S.e.t.u.p.” string – at line 0018 0160
2. 00 -> 01 – at line 0018 0320
Thank again for your interest. I need badly this option to be enabled. I take into account also posibility to buy another processor, because I saw the new P7350 specification on Intel site, and those did’nt contain VT tehnology enabled on this model. What do you suggest me about this option ?

Tjeutje: P7350 doesn’t support VT technology indeed, so that seems to be the problem. You need a P8400/P8600 or a T9400 processor.

fonzy: @elmar
Do you see that the USB is accessed? The USD led comes on? If you prepare a CD with the BIOS file you can hear the CD motor spin. The CD must be ISO standard, mastered, session closed. If you hear the CD drive spin up then wait several minutes and the flash procedure should be finished. If the CD is accessed but the flash does not work it could be that the file name is wrong. For my 7720 model, the file name of the recovery disc is ICL50HW.fd Don’t know for your 8390. Check the name in the oldest BIOS release that you have. Before flash, make sure you remove battery and power cable. Wait 10 minutes. The press Fn + ESC, hold and plug in power cable.

Exotic Hadron: Hi, Hector!

First, let me say a few words to thank you for sharing the idea and implementation. You don’t know how happy I am to see this problem solved! At least, I see you and guys over there have solved this naughty 8930G ‘bye bye Hyper-V’ PITA…

You will be laughing but I am having difficulties with patching the BIOS dump file. I believe that partly it is due to peculiarities of python implementation on Windows, partly due to a fact that I am an absolute layman in programming and in Python as well.

There are several problems I faced with during my trials to patch the dump of my current 8930G BIOS and BIOS v1.10 file downloaded from ACER’s support site.

1. The first trouble came with line termination and different implementation on various OSes. All the *.py files I downloaded from your site were saved as a binary file. I tried both IE8 and latest Firefox all to no avail. Thus there weren’t any on the ends of script lines and all the expressions in the py file looked as concatenated if you’d opened them. Since I don’t know Python syntax that wasn’t easy task to tackle… The modded file on the pastebin archive helped a little, since the script file there has the line terminators.

Could you please upload a zipped archive with all the python scripts? This would help those of us who would try downloading them on their Windows machines?

2. Now there’s a yet more itching problem here. I am running this on 32-bit Vista deployed with the latest Python IDE/runtime. The User Account Control feature is turned off. The import sys; sys.version returns the following

sys.version
‘2.6.2 (r262:71605, Apr 14 2009, 22:40:02) [MSC v.1500 32 bit (Intel)]’

3. Since the import os; os.getcwd() being run in IDLE returns that the current working directory is
>>> import os; os.getcwd()
‘C:\\Python26’

I placed the vtenable.py into the C:\Python26\ folder. I placed the old.fd (which is the renamed KM2_110.fd shipped by ACER with the BIOS version 1.10) into the C:\Python26\ folder as well.

I started the python.exe to open the commanline python compiler and typed the following at the prompt >>>

vtenable.py old.fd new.fd

And this is what I got in the stdout:

Python 2.6.2 (r262:71605, Apr 14 2009, 22:40:02) [MSC v.1500 32 bit (Intel)] on
win32
Type “help”, “copyright”, “credits” or “license” for more information.
>>> vtenable.py old.fd new.fd
File “”, line 1
vtenable.py old.fd new.fd
^
SyntaxError: invalid syntax

What could it be? It seems like the python’s (or OS’s) stdin does not want to accept the passed old.fd?!?

Okay, now that I decided to start the IDLE Python GUI IDE. In the Python IDE started I typed

IDLE 2.6.2
>>> import os; os.getcwd()
‘C:\\Python26’

To certify if the IDE would see the script.

Now I typed vtenable.py old.fd new.fd and got the following:

Python 2.6.2 (r262:71605, Apr 14 2009, 22:40:02) [MSC v.1500 32 bit (Intel)] on win32
Type “copyright”, “credits” or “license()” for more information.

IDLE 2.6.2
>>> import os; os.getcwd()
‘C:\\Python26’
>>> vtenable.py old.fd new.fd
SyntaxError: invalid syntax
>>>

The ‘old’ part of the old.fd was highlighted in red.
Heck! The same pb.

Okay, let it be. I placed the vtenable.py to the module folder of the python environment to make it possible for the environment to load the vtenable.py as a module. After that I tried to load the py-script as a module:

import vtenable
Loading BIOS…

Traceback (most recent call last):
File “”, line 1, in
import vtenable
File “C:\Python26\Lib\idlelib\vtenable.py”, line 82, in
bin = open(sys.argv[1], “rb”).read()
IndexError: list index out of range
>>>

Okay, that looked pretty clear: we loaded the module but haven’t passed anything to the stdin. I changed the strings so that ‘in’ and ‘out’ would directly get the fd files:

Changing the input parameter to directly load the BIOS binary:

ORIGINAL: bin = open(sys.argv[1], “rb”).read()
CHANGED: bin = open(‘C:\\Python26\\old.fd’, “rb”).read()

The same with output:

ORIGINAL: ofd = open(sys.argv[2], “wb”)
CHANGED: ofd = open(‘C:\\Python26\\new.fd’, “wb”)

Now that we import the module again… and…

import vtenable
Loading BIOS…
Loading VSS…
Variable not found!
Old state:

Traceback (most recent call last):
File “”, line 1, in
import vtenable
File “C:\Python26\Lib\idlelib\vtenable.py”, line 106, in
var.showinfo()
NameError: name ‘var’ is not defined
>>>

Bummers!

I believe this is because if this code block:

off = 0x10

found = False

if not found:
print “Variable not found!”

The problem was that I used the renamed KM2_110.fd shipped with the BIOS package. However, I should have used the dumped BIOS from the current BIOS flashed in my 8930G. Correct?

So BEFORE patching the BIOS you have to flash the BIOS version 1.10 to your notebook? Correct?

The second question is: is there any way to patch the dump using vtenable oldbios.fd newbios.fd so that I DON’t have to use import vtenable and directly load the fd files like I did so?

Thank you!

marcan: Okay, step back for a bit. You’ve got it all wrong.

First, about the line termination issue: I always use UNIX line termination, because it’s the only sane termination and it’s what everyone uses, except Windows. What you use to download the files or whether they’re zipped or not is irrelevant. Every decent Windows editor supports them just fine, except Notepad, which I assume is what you were trying to use. I recommend downloading Notepad++.

Now, you’ve got the calling python scripts thing totally backwards. This is a python script that behaves as a command line program, not a python module meant to be imported. I assume you started by opening up the Python interactive interpreter from the Start Menu - that’s useless. That interactive interpreter is meant to be used to run short snippets of literal python code and try things on the fly, you’d never use it normally, and it certainly isn’t the right way of running standalone scripts. What you need to do is open a cmd prompt (“dos box”) (that is, your operating system’s command prompt, NOT a Python command prompt!), then run “C:\Python26\python.exe vtenable.py old_bios.fd new_bios.fd”. This is exactly what the “$ python vtenable.py original_bios.fd patched_bios.fd” line in the blog post represents, except it’s showing a UNIX bash prompt ($) instead of a cmd prompt (C:>) and under UNIX/Linux Python is usually in the system’s PATH so you don’t need to type the full path.

Finally, yes, you cannot patch vendor-supplied BIOS updates. You need to flash the update (I recommend the latest, 1.13), dump it, then patch it, then flash it again. The patch doesn’t patch anything inside the BIOS code, only a setting. BIOS update files don’t come with settings, so there’s nothing to patch.

ayarbee: Great script, worked first time, saved me a lot of effort with my 8930. Thanks very much!

NuttyLepus: An update on Aspire 4736G: Another version of bios (v1.09) was released on Sep 15, in a rather short time period following v1.07.

It seems that changing the VT enable byte to 1 has no effect in this version. In fact, when I flashed with the default setting, my VT enable byte still kept its value (i.e. 1), unlike what had hapenned when I flashed v1.07 over v1.05 when it lost its value. Program-based identification (main.py) still pointed to the same offset for this variable, so it looks like this new bios might be ignoring the VT enable byte.

I have not looked properly at the string table, but I would think if anyone has a problem enabling the VT-x on their Aspire 4736G with bios version 1.09, downgrading to v 1.07 might be an answer.

NuttyLepus: Oh, I forgot to say this (although you might have already guessed from the above message): despite the VT enable byte set to 1, the actual VT-x was still disabled in v1.09.

monte: Doesnt work for me. I used the util (changed the ini file) to get a backup, ran the vtenable.py script. Compared (via UltraCompare) No change, no VT enabled. Acer 8930G Notebook, Windows 7.

TMS: hi everybody, hi marcan
I applied succesfully my patch, and updated my bios, but like other people from the forum of the Lenovo U330, nothing changed …
We all used the Insyde flash utility and it looks like there are some protected area in the bios, and that this way of flahing ignore where the modifications are located.
I’m not familiar with all the settings in the ini file of the insyde flash utility, but i know some people succesfully patch their bios using this method.
I would like to get those ini file in order to compare.

I not that easy with linux, so could you point me another method to flash my bios ?
Thanks a lot

TMS: i jumped … i reflash my bios with the option “force flashing all rom part” and i’ve got the VT locked On…^^

laserburn: I’ve tried this on my Aspire 8930G and i can’t get VT. It seems i have a T6600 cpu which doesn’t support VT. What cpu have other 8930 owners got?

I think i might change the cpu if i can find out which one is fitted to other machines. I did see a T9550 which theoretically would work as Acer US website lists 1066 FSB cpu’s on some of the 8930 machines.

One other thing, CPU-Z reports the cpu as T6600, then later on the same info screen as T6670. Which is correct???

Any info would be helpfull.

weelkin: Ive successfully patched my bios (see http://marcan.st/blog/2009/06/enabling-intel-vt-on-the-aspire-8930g/#comment-306 ). But there is a side effect: Now the Laptop hangs sometime during startup. Sometimes i get only the a cursor in the upper left corner, and sometimes i get the bios startup screen but nothing more. The solution is to reboot the Laptop with pressing "ctrl alt del". If anyone knows how to solve this id be happy if he posts it.

regards
weelkin

cntse: i can’t get the configure for lzma utils to work. i have very limited coding expertise, so anyone with the patience to help me out would be greatly appreciated. the autoconf (configure file?) is telling me there is no c++ compiler to use but i got xz utils to compile successfully, so i’m confused.

the machine is a Lenovo Y730 and the OS is ubuntu 9.04.

confuse: Can anyone help me to do my bios..my laptop is acer aspire 4935…and the bios version is v1.06…can any help??

elkin: +1 Aspire 5720G.
Thank you all for the research.
10x to “bigted” for providing the exact steps and modification, for Windows.

cntse: Figured out my problem…I actually DIDNT have a compiler installed, go figure.

But i’ve hit another wall…

this is the output when i run main.py:

Traceback (most recent call last):
File “./main.py”, line 35, in
from lzma import get_lzma_chunks
File “/home/jaunty/temp/vt/Tweak it/lzma.py”, line 86, in
lzma = CDLL(library_path)
File “/usr/lib/python2.5/ctypes/init.py”, line 348, in init
self._handle = _dlopen(self._name, mode)
OSError: liblzmadec.so.0: cannot open shared object file: No such file or directory

netrolller3d.wordpress.com/: +1 for 5720G. VT now “locked on”.

However, a different subject: I have managed to extract the setup executable from the BIOS - what needs to be changed to reveal the hidden menus? The initial post suggests changing the “subclass” from 5 to 0 - but where is this subclass located?

Also, one of the files in the FS part of the BIOS makes a reference to \EFI\BOOT\BOOTIA32.EFI; but putting a valid EFI executable with this name on a FAT32 pendrive doesn’t seem to boot - have anyone had success with this?

AS4930G: works for Acer Aspire 4930G
bios: Insyde 1.16

AS4930G: VSS_OFFSET = 0x000c0048
VSS_SIZE = 0x3fb8

PATCH_OFFSET = 0x1af
PATCH_VALUE = 0x01
PATCH_VARIABLE = u”Setup”

Here is the screenshot after patching: http://i35.tinypic.com/1zdbp2.jpg

Clayton: Hi Marcan,

I’m trying to use these procedures to hack BIOS of my VAIO VGN-CS120.

! made a DUMP of my BIOS using FLASHIT.EXE /G, DD comand and main.py, and when I compared them using VBINDIFF, I got some diffs between BIOS extracted with FLASHIT and other. Do you have any idea ? I probably will use the BIOS extracted with main.py when running VTEnable.py.
Before, I’d like to run Setupdump.py but I have no idea what value I have to put in STRING_TABLE variable. Could you give me the direction?

Tks, and congratulation for you great job.

NuttyLepus: Aspire 4736G: Another version of BIOS (2.03) was released at about the same time as the retail launching of Windows 7.

Direct flashing using unmodified vendor-supplied utility (actually, I did modify the platform.ini so that it created backup image of the previous BIOS, but this is not relevant for our purpose) on top of the previously VT-enabled BIOS retained the VT-enabled and locked status (MSR 0x3A = 5).

Given the release date, another possibility could be that this version actually enable the VT-x on its own, but since my previous BIOS has already been patched, I could not confirm this.

Anyway, the bottom line is that anyone wishing to upgrade to this version need not worry about having to re-patch their BIOS.

sintax: Can someone let me know if there is a way to determine if my BIOS is EFI-based ? I doubt it is but am not fully sure, as my laptop is fairly new Gateway P-171S FX - The BIOS is PhoenixBIOS I believe, i’m 100% sure that my CPU is vt-capable but my bios has almost no features/settings sadly.. just boot order, legacy USB, AHCI enable/disable and that’s about it lol.

Once I figure out if it’s EFI based maybe I can make some progress. thanks in advance.

boogaloo: I have an Acer Aspire 5610. I’ve dumped th BIOS, but need to find the offset for vtenable. I have a 1mb BIOS and have tried running d6z’s main.py to obtain the values, however I get an error:

File “origmain.py”, line 124
hasvss = “ [VSS]” if self.has_vss() else “”
^
SyntaxError: invalid syntax

I’m running Python from a Knoppix Live CD which contains Python 2.4.4

Obviously using vtenable gives me the Invalid VSS Signature error. Any advice, pointers, or explanation as to what I’m doing wrong would be appreciated.

langostino: Help, please. I have an acer 8930g. I fashed bios with latest version (1.13 from acer support website) with no problems using Insideflash utility. Then, I did a flash copy using the same utility specifing that in platform.ini file.

Then, I ran Insideflash without bios flashing and I got a new file on specified folder named “bios.fd”.

Then, I installed python 2.6.4 for windows and copied bios.fd and vtenable.py (from http://marcansoft.com/uploads/insydehacks/vtenable.py) to python installation folder.

Then I executed vtenable.py bios.fd bios-vt.fd and I get a new file named bios-vt.fd with same size.

I installed vBinDiff (http://www.cjmweb.net/vbindiff/VBinDiff-3.0_beta4.zip) and typed vBinDiff bios.fd bios-vt.fd and two files are IDENTICAL. No changes between these.

Of course, If I flash this new image, VT-X is just DISABLE.

What is not right?

PD: My CPU is a Q9000.

Thanks!

abarcza: FYI: bios 1.45 acer 5720z
I followed Bigted’s post quoted below and it worked.
NOTE: I had to power off my computer with battery removed to get the new bios to take and for VT to turn on.

Quoted from Bigted:
I have managed to successfully mod my Acer Aspire 5720G using the instructions here.
Bios version 1.45. I can now run Windows Server 2008 R2 inside Vmware Workstation 6.5.2 which had previously refused to run due to no VT support.

I followed petejk, d-angel200 and MaxL’s comments with success, but thought I would add my own experience especially being able to perform this hack without installing Linux, i.e. being able to do all the work inside Windows. I did install Ubuntu to run the python script for patching but only to make sure the same result would occur in linux and windows.

So: Download the latest Acer bios installer ver 1.45. Open file with 7zip (or WinZip or WinRAR) and extract to a folder. Edit platform.ini, BackupName=acer5720Gdump.fd under[FDFile] section. Run Insydeflash.exe. CANCEL flash process. Make sure dump file is created. Install python for Windows http://dinsdale.python.org/download/releases/2.6.2/ Do not use version 3.x of Python. it will not work.
Copy MaxL’s vtenable.py (http://pastebin.com/f604e244a) into same folder as dump file. Run “vtenable.py acer5720Gdump.fd acer5720GdumpVT.fd”.
Download Vbindiff for windows http://www.cjmweb.net/vbindiff/. Run vbindiff from the command line “vbindiff filepath\acer5720Gdump.fd filepath\acer5720GdumpVT.fd” There should be only one difference. In my case located at 0×08DD. 00 changed to 01.
If all OK rename ICL50HW.fd (from the bios installer). Rename acer5720GdumpVT.fd to ICL50HW.fd. Edit platform.ini and remove the backupname previously added. Run Insydeflash.exe. Machine will shutdown. Restart machine. Test as you see fit.

Thanks to all who helped me get this far!

cntse: symbolically linked the proper library file, ran main.py with success, ran vtenable with success, vbindiff showed two bits changing, flashed the bios and the machine booted! this is using the exact same procedure as a lenovo U330 on a Y730

win

confuse: How to find my VSS_offset can any body help me pls…my laptop is acer aspire 4935 and a insyde-bios…
Can anybody help me please on the guide to do the enabling vt on my acer aspire 4935..
Help me in a sense of telling me from the first step to the last and what to type all that…
if anybody wanna help me..pls contact me in my email :
jossovible@yahoo.com

stingus: What can I say? Many thanks to Marcan and users (especially Tjeutje) who did a really great job. Works on AS6935G.

thanutpong_c: I’m using acer 4736G over Windows7x64 every thing look good. but I can not enable VT-x. So, I try as “NuttyLepu” said, still do not work even use bios v105,107,109,203. Always show message “Variable not found!”. Please help me how to fix????

NuttyLepus: Hi, thanutpong_c. Can you be more specific? I’m sure people here would try to help if they can, but you’ve given just too little information.

- What is the CPU in your machine? Aspire 4736G comes with several CPU models: mine is P8700.

- You said you were using your 4736G with Win7x64, I presume this meant you were not using any Unix/Linux variant OS on your system? Cygwin? Ubuntu/Fedora on a virtual machine or on another machine by any chance? If so, would this mean you are trying to patch your bios using Windows alone? This can be done, but your method will have to be differed from mine as I did my patching in 32-bit Ubuntu (a Linux distro) running as a virtual machine on Windows (so it was actually done in Linux, not Windows).

- If you are using just Windows, how did you get your bios image? I presume using the Insyde utility? (I might be wrong, but it occurs to me that you might have run d0z’s utility over the bios image downloaded from Acer’s website – this won’t work: the variables are not there, as Marcan has already emphasised. You have to dump your own bios and work on the dumped image.)

- What version of Python are you using?

- Have you somehow installed and ensured the lzma library is working properly?

- Exactly what steps have you taken, and from which step did the error message appear?

- Just out of curiosity, have you tried flashing with v2.03 (without any modification)? I have a hunch that it might work straight “off the box”, but I might be wrong.

boogaloo: Can someone (Marcan maybe) confirm what is needed to perform this process, or at least what has worked.

1) You need to flash your BIOS with the latest version
2) You need to dump the BIOS from your PC so the settings are included in the BIOS backup - this can be done using dd or the standard BIOS falsh utility set to backup
3) You need to the load Linux (which Distro’s work?) and install Python (which version minimum is required?)
4) You need to download a number of .py files (list of what and from where?)
5) If it’s not a machine that has already been listed, and therfore has the settings to tweak (offset, etc.) in vtenable - you run main.py (from d6z) to obtain offset values - then amend vtenable with these values
6) Take the output from vtenable and flash back to your PC - assume again (using standard flash utility?)

I list these steps as my understanding of the process (but as I say previously mine fails trying to run main.py) so I just think for everyone, if we could clarify the steps, and what we know works (versions, distro’s, etc) it will give everyone a better chance of succeeding and probably a lot less NOOB questions. I’m still not quiting on this, so anyone/everyone who can clarify this, it will help me, and probably lots of others too. Thanks!!

peterba: Dear Folks! william lee (early september), had the same laptop as I did a TM 4730G. Does anyone have his hacked BIOS somewhere, or can someone help me contacting him for it? My other question is, what can you do IF you flashed whitht the wrong BIOS (precautions) Thank You! You did here an amazing job.

culchie: Hello everybody!

First of all thank you marcan for sharing your knowledge and the python tools, d6z and maxL and everybody else for further developing/tweaking them and giving useful hints.

I am trying to enable VT in my Benq Joybook S73u which has a 1MB insyde BIOS.

I dumped my BIOS.ROM using flashit.exe, ran fvdump and was able to successfully run the vardump marcan modified for FaithX which gave me the following output:
http://pastebin.com/m12eb5b1e

Then maxL’s modified vtenable.py did alter something. vbindiff showed only two differeces - one in the “version”-section and one in the following “setup”-section.
However, running vardump again on the modified file, the output was much shorter, the sections about booting are missing, at least.
http://pastebin.com/m58c1f2b8
Shouldn’t there only be two differences as well?

After that I switched to ubuntu and tried d6z’s tools (lzma installled correctly). Main.py runs with the line maxL mentioned commented out but tells me it can’t find the setup-section:
http://pastebin.com/m6892b943

Im I doing something wrong? Is there a way to find out what the vtenable actually did to the BIOS-dump?

Any help is very much appreciated,
Thanks!

NuttyLepus: ** Hi, boogaloo,

Perhaps I can try to answer from a non-expert standpoint:

1. Flashing with the latest bios is not absolutely necessary, but it is recommended. (Apart from to ensure the correct operation of the computer, also consider this: imagine if one discovers a month after all the working hacking this VT-x the need to upgrade to the newer bios – all the work again!) An exception could be that if there is a reported VT-x variable parameters on a similar model with the not-so-latest version of bios and you don’t want to look for the parameters in the latest version yourself, then I’d say stick with the reported version might be safer. (I guess it would be unlikely that the manufacturer will change the offset of the variable in different version of bios, but I would be quite reluctant to blindly apply the patch without verifying first.)

2. Yes, the dumped bios image is absolutely necessary for this method to work. There is an alternative method mentioned on d6z’s website which does not require dumping the bios, but you need to be able to boot into the EFI console.

2a. Now, if I may reiterate this point, the dumped image cannot be shared (otherwise people would already have posted their patched bios!) – it contains, among other things, the serial number of your computer.

3. Python is also an absolute necessity for this method; Linux might not be so, depending on the availability of the reported VT-x enable offsets. My understanding is that you need version 2.x (I know 2.5 and 2.6 work); version 3.x won’t work. Python can be run under Windows or Linux, except when you also need lzma. You’ll need Linux in that case.

4a. If you are lucky and the VT-x offsets for your machine has already been reported, then you’ll need just Python and Marcan’s vtenable.py. Modify vtenable.py with the appropriate offsets and just run it over the dumped (not vendor-supplied) bios image. You may also need to tweak the checksum line in vtenable – see what works for you. This will work in both Windows and Linux (and whatever Python can run in.)

4b. If your VT-x enable offsets has not been reported, then I’d suggest you try d6z’s main.py. For this you’ll need Linux (mine was 32-bit Ubuntu 9.04 – it has been upgraded since; but really any distro should work), lzma, and Python. The main.py can actually access your bios directly; but if you are like me running the operation in a virtual machine (mine was 32-bit Ubuntu running as a virtualbox guest on a Vista x64 host), you’ll have to supply the dumped bios image to main.py. Hopefully it should give you the correct VT-x enable offsets, which you can in turn used to modify vtenable.py to patch your bios. This won’t work on a Windows machine – I don’t think we have yet figured out how to make Python communicate with lzma on Windows; the alternative I can think of is Cygwin, but then (a) main.py (without further modification) does not seem to like it, and (b) installing a Linux virtual machine might actually be easier than setup Cygwin.

4b1. main.py itself may need some tweaking: the two common sites may be the checksum line and the path to lzmadec. See the previous comments.

4c. If main.py also fails to find the offsets for you, then you’re going to need a more serious hacking. In this case, you’ll probably need the full suite. Marcan has outlined the steps required. Unfortunately, the actual procedure is beyond me so I cannot provide a simplified instruction. It is also my opinion that if you still don’t know what to do after reading all the above comments, then it will be much safer to wait until someone else has reported the VT-x offset of your machine.

5. Yes, these are the steps I would recommend.

6. Yes, but I would also suggest you do these verification steps before flashing. You may also wish to do some other verification. Generally speaking, you should be as confident as you can that the patching has been done correctly before flashing it:

6a. Firstly, vtenable.py should give you the comparison of the setup are before and after the modification, make sure it occurs only at the location reported or given by main.py.

6b. Vbindiff the original and modified image. There should be only two changes: the actual variable and the checksum bit.

** Hi, culchie,

Probably not the best person to help you, but since I’m here:

- Are you sure the VT-x enable variable in your computer is at the same offset as MaxL? His seems to be a different model from yours.

- Did you run the main.py on the original or patched bios? If you have not run it on the original bios image then perhaps you might want to try that and compare the output with your vtenable.py.

Good luck.

thanutpong_c: Hi NuttyLepus, First I would like to say thanks…..
I sorry that told very little information, my laptop is Acer 4736G CPU P8700, BIOS Insyde V1.09. I used Windows 7 x64 and try to use Microsoft Virtual PC. I cannot used VTx option on Virtual PC. Then I went to see on CMOS setup, don’t have any option to enable. I tried again with BIOS V2.03, then looking at the CMOS setup ,still don’t have option to enable!!! (I did not back to Virtual PC to check, is it can used?) Finally, you remind, then I open Virtual PC to look at VTx option !!! Can using now!!!

- I’m using Python2.64

Thanks

NuttyLepus: Hi thanutpong_c,

Thanks for getting back, and particularly for letting me know that you can use the VT-x feature after upgrading to bios v 2.03.

A few points here for others who may also be using Aspire 4736G:

- I also had problem trying to patch v1.09. The older bios (v1.05 and 1.07) worked.

- I suspected (from the release date, which coincided with the release of Win7) that v2.03 might enable the VT-x without requiring any modification from our part. Thanutpong_c’s reply above seems to have confirmed this. (Do I understand you correctly?)

- So I would suggest anyone with this machine who wish to use the VT-x feature to try upgrading to the vendor-supplied (i.e. unmodified) v2.03 first and see if it works.

- Now, a very important point: if you patch your bios using the method in this blog, it is not going to give you the option to enable or disable the VT-x feature in the bios setup menu. What it will do is to enable the VT-x and keep it locked in that state. There is no way you can check this from the bios menu. The proper way to check is to use a utility (such as CrystalCPUID) to look at the Model-Specific Register (MSR) 0x3A. Its value should be 5 (enabled and locked) instead of 1 (disabled and locked). The alternative is of course to just run the virtualisation software you want to run and see if it works.

culchie: Hi NuttyLepus,

thank you for your quick reply!

I did run the main.py on the original bios-dump. Actually, I tried that before I took a chance by running MaxL’s vtenable on it because I figured I would need to know my own offsets - at least to confirm they fit. After the unmodified main.py failed, I just ran vtenable to see whether something would happen or not. I then got a litte excited when vbindiff showed only two differences close to or even within the setup-section - I thought this could by chance be the mentioned changes in the vt-offset plus checksum. To somehow confirm this I ran fvdump and vardump on the modified bios again and obviously there is something wrong.

As my laptop is a completely different model and brand, apparently the layout of my bios is somewhat different from everything I read about so far.

That is why I came back to linux and main.py, to find the right offset. However, the output of main.py is always the same, regardless of commenting out the mentioned checksum line or not.
http://pastebin.com/m6892b943
(BTW, I renamed my bios-dump to original_bios-mine.fd and put it into the data folder, because the automatic dump failed earlier)
As d6z’s tools don’t work for me, I will have to go through the procedure marcan mentioned, I guess.
>If the Setup layout is different then the process is more involved. >Roughly it goes like this: extract the LZMA firmware volume, then run >fvdump on that again, then fsdump to extract the filesystem. One of the >files is the Setup tool. […] Then you can use another tool on that to get >a human-readable Setup menu dump where you can find the magic VT >Enable offset.

Now - how do I do that, with close to zero python-knowledge so far, obviously?

I tried unpacking my dumped BIOS.ROM (may it be important that my bios file format is a *.ROM rather than a *.fd?) using
$lzma -d BIOS.ROM
which failed, telling me ROM was an unknown suffix. Changing the suffix to *.fd did not help.

My CPU is VT-capable, BTW, I upgraded to a T5600.

I’m stuck finding the right offset. So if anybody could help me with this, that would be awesome.

boogaloo: NuttyLepus - Thanks for the guide - following this I’ve found it was a problem with the version of Python installed. So I dumped the Live CD idea, and have an Ubuntu install instead. Now I have a different issue - same as cnt5e had on October 26th “OSError” - and then on November 5th says he’s fixed it “symbolically linked the proper library file…” - can you tell me what library file you properly linked and how cnt5e??

boogaloo: I’ve found the “trick” for linking the library. But still not working….
I have a 1Mb BIOS (the size of my BIOS backup file in Windows!)

Tried:
sudo dd if=/dev/mem of=original_bios.fd bs=1024 count=1024 skip=4193280

But get:
dd: reading `/dev/mem’: Bad address
0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.00142229 s, 0.0 kB/s

So I tried main.py on the Acer BIOS Flash utility Backup Dump of my BIOS but get another error:
Opened BIOS ‘data/original_bios-mine.fd’ with md5:9c69a386563045b471b68e790c4a5a02
Operating on BIOS data/original_bios-mine.fd size = 0x100fdb
Loading compressed sections
.. found 0 compressed sections
Locating Firmware Volumes
.. found 0 FirmwareVolumes (0 compressed)
Traceback (most recent call last):
File “main.py”, line 459, in
main()
File “main.py”, line 454, in main
bios = BIOS()
File “main.py”, line 248, in init
setup_utility = self.locate_setup_utility(vol_compr)
File “main.py”, line 396, in locate_setup_utility
raise RuntimeError(“Shouldn’t get here, seems we couldn’t ”
RuntimeError: Shouldn’t get here, seems we couldn’t find the SetupUtility :/

I’m baffled now, unless someone can assist, I’m up for the challenge but not being a Linux person I’ve struggled at some obvious points - get better FAST :-)

Clayton: Hi boogaloo,

What distro of Linux are you running ?

I got the same issue as you, with Ubuntu 9.04 32 bits, and it worked property with Ubuntu 9.04 64 bits LiveCD.

I guess, it is because the amount of RAM memory (4 Gb) installed in our computer.

culchie: Hi boogaloo,

did you notice that this is exactly the same problem I encountered earlier? I am still stuck at the same point (see my main.py output here: http://pastebin.com/m6892b943).

One thing about your main.py output is strange, though.
It appears to me that something is wrong with your BIOS dump size.
(> Operating on BIOS data/original_bios-mine.fd size = 0×100fdb)
BIOS size should be 0x100000 for 1MB or 0x200000 for 2MB BIOSes, AFAIK.

How exactly did you perform the dump? What was the filetype and size of the orininal dump? And did you run main.py inside linux or windows? With your dump-file renamed to original_bios-mine.fd and put to the “data”-subfolder?

Were you able to run fvdump.py, then the modified vardump.py (see my post from ¹¹⁄₁₁) and get some output at all?

@ Clayton:
which of boogaloo’s issues are you talking about? Did you solve the problem with main.py not finding the SetupUtility - or rather with creating the dump because of the “Bad adress”-message?
Also, did you successfully dump your modified BIOS with VT locked on?

I hope we will be able to solve this!

dxluong: Hi everyone,

Could anyone read my main.py output and tell me how to do the patching? It seem that “Setup” variable is not found.
http://pastebin.com/f5a95f604

So when I run vtenable.py, it gives me this:
http://pastebin.com/f1f618653

dxluong: Ah, and my laptop is Lenovo Y730 with latest BIOS.

stingus: I just want to confirm that Acer BIOS 1.14 (for 6935G) doesn’t have VT enabled so I had to re-patch the BIOS to unlock it.

thanutpong_c: Hi NuttyLepu,

For Aspire 4736G, I used bios 2.03, that ok, the VT-x that work without any modification. But, in bios setup still no menu to change for enable/disable. And I checked with CrystalCPUID, the (MSR) 0x3A is 5.

Thanks for your suggestion…

peterba: Acer TravelMate 4730G. New BIOS with VT-x support. v2.04. (no switch in Bios) They made it after I think lots of us furiously protested.

Clayton: @ culchie

I´m talking about “Bad Address” message.
Running main.py over Ubuntu 64 bits, solve this problem.

Also, I did the same change as SquirrelOfDoom did (post 216), in main.py

Changing
library_path = find_library(“lzmadec”)
To
library_path = “/usr/lib/liblzmadec.so”

Since Sony released a new one (R0290Q2) for my VAIO VGN-CS120J enabling it, I didn´t need to flash my changed BIOS.

culchie: Thank you, Clayton, for clarifying this.
Too bad you didn’t have the solution to get the main.py running (i.e. to find the SetupUtility) with either boogaloo’s dumped BIOS or mine.

I am still stuck finding the right offset for the vt-enable feature in my dump. As vtenable.py does change something inside and close to the “setup”- section I might be close - but still the setup layout of my BIOS seems to be different from everything else and I don’t know how to proceed.

Any hints are still much appreciated.

Clayton: Hi, dxloung

You can try change the following, in vtenable.py:

VSS_OFFSET = 0×030048
PATCH_OFFSET = 0×1af

yumemi: Acer Aspire 4925G, success.
BIOS version 1.15

BIOS dump acquired by using official 1.15 updater, see other comments for details. Also I compared the dump with HWDirect dump, they had identical MD5.

BIOS dump patched under windows 7 using vtenable.py modified with the offsets provided by 4930G (search “4930G” in this page).

Thanks 4930G and everyone related for the offset!

After patching, 1 byte before the somewhat “S.e.t.u.p” string decreased by 1, and a byte turned 01 from 00.

The patched bios was flashed by replacing the .fd file in official patcher.

After patching the effect is confirmed with securable.

And again thank marcan and everyone who helped! It’s a wonderful piece of code.

PS: I have a question: the VT byte should be ok, but I worry about the byte before the S.e.t.u.p string. Is it really totally ok to modify it? Won’t it cause side effects such as frying some hardware? Pls forgive me for my silly question since I have virtually no knowledge about BIOS…

marcan: The byte before the setup string is part of the checksum, changing it is required for this to work. It’s just a check byte, it doesn’t do anything on its own.

hanog: Thank You fellows!

Great Work!

Acer Aspire 6935G-944G32Bn Bios: v1.14

Patched with original vtenable.py. It works like a charm!

Thanx again!

cbr: Hi there,

Acer Aspire 5720G, Windows 7 -> can’t enable VT

Thank you all for the the great job! Unfortunately it didn’t work for me.
I followed the steps from Bigted (http://marcan.st/blog/2009/06/enabling-intel-vt-on-the-aspire-8930g/#comment-203).
I achieved to flash the Bios, with the modifyed CL50145A.fd file (just 1 byte changed value). But as I restart the computer, VT is still locked off. I tried to power off the computer, but it still didn’t worked for me.
Am I missing some step?

Could someone give me some help?

Thanks a lot

apocolipse: I’ve been having a bit of trouble figuring out which offsets to use. my bios files can be found here http://www.apocolipse.com/ApocBiosFiles.zip Included is the dump from mem, original fd from bios update, and setupUtility.pe. I ran d6z’s scripts, modified them because i couldnt find “Vanderpool Technology” but i did find “Intel Virtualization technology” in string table. Looked at the offset that his tool said and that bit was enabled, but no VT. (proc supports it, c2d t6670). Whats weird is the previous bios update’s release notes says its “default enabled”. Anyhow if anyone could look at those files and shoot me an email at apocolipse@gmail.com i’d be greatly appreciative :)

sherl0k: No dice here with an AS8930G. The outputs looked correct, there was a couple differences in the files. Rebooted, flashed. Nothing in the BIOS, VT is still disabled. BIOS version is 1.14.

marcan: You aren’t going to see anything in the BIOS Setup. If you save BIOS settings, VT will be disabled again. You need to flash the modified file and then go straight to checking the state of VT under your operating system; do not go into Setup.

wimke: I did not manage to enable VT on my acer aspire 7720G with an intel T7300. If someone managed to get it enabled for a T7300 please tell me how you managed to do it…..

Thnx,
Wimke

jtk-spaceman: Hi,

Thanks all for the info.

I’ve managed to enable VT on the 8930G using BIOS 1.14 -

Sherlok and others - for BIOS 1.14 you need to use the Insyde flash that comes with BIOS 1.13 to dump the original BIOS and to flash the modifoed (vtenable.py) BIOS. The Insyde flash utility that comes with BIOS 1.14 doesnt dump the variables (hence vtenable.py gives var not found) and doesnt flash the variables (so it doesnt help your system).

Hope this helps,

Andrew

BrgyTanod: Hello,

I have been a silent reader for quite a while now, but still does not have the courage to try this on my laptop since I do not have any programming capabilities.

I have an ACER Aspire 6935 T6400 2.0ghz with BIOS version InsydeH20 Version 1.13 running Windows Vista Ultimate 32bit SP2. I am not sure of the exact steps on how I can be able to do enable Hardware Assisted Virtualization in my BIOS via the Windows environment. And what are ALL THE FILES I needed to use/download. I would appreciate any detailed steps on how to do these.

I plan to install Windows 7 in the coming days and make full use of all it’s features. Thank you so much and Happy New Year to you all!!!

AS4930G: Latest BIOS v1.20 (link: http://url.ie/4l6b ) for Acer Aspire 4330 / 4730 / 4925 / 4930 does NOT have VT enabled by default.
I’ll have to do all the hacking stuffs again.
Acer SUCKS!!!

AS4930G: For Acer Aspire 4330 / 4730 / 4925 / 4930
BIOS InsydeH2O v1.20 (link: http://url.ie/4l6b )

VSS_OFFSET = 0×000c0048
VSS_SIZE = 0×3fb8

PATCH_OFFSET = 0×1af
PATCH_VALUE = 0×01
PATCH_VARIABLE = u”Setup”

Screenshot: http://img694.imageshack.us/img694/7034/140m.png

confuse: anyone can help to find the variable of ACER ASPIRE 4935…the bios version is 1.08…can anyone help me please?????

robinvanleeuwen: I hope someone can help me here. As i understand there are two types of utilities. 1. the dumpsetup.py & vtenable.py , and 2. the d6z utilities: main.py etc…

My setup is: Acer Aspire 7720, 4GB, bios 1.45

I downloaded the main.py utils and run main.py. It runs and gives the output below, and makes two files in the data directory. (original_bios-mine.fd and SetupUtility-mine.pe).

-— THE OUTPUT OF MAIN.PY —–
Opened BIOS ‘data/original_bios-mine.fd’ with md5:a27f0f9a712e44bb3d281b0c2b410563
Operating on BIOS data/original_bios-mine.fd size = 0x200000
Loading compressed sections
.. found 1 compressed sections
Locating Firmware Volumes
.. found 8 FirmwareVolumes (4 compressed)
Location = 0x0ae, name=‘VT Support’ help=‘Vanderpool Technology Enable/Disable.’
Have vss_volume:
Creating variable at 0
Blah: 11 40 70 eb 02 14 d3 11 8e 77 00 a0 c9 69 72 3b
Creating variable at 44
Blah: 4e ee a3 41 57 6d 8b 41 8f 8e c3 66 a5 b7 0c 4b
Creating variable at 244
Blah: f4 27 4a a0 00 df 42 4d b5 52 39 51 13 02 11 3d
Creating variable at 537
Blah: f4 27 4a a0 00 df 42 4d b5 52 39 51 13 02 11 3d
Creating variable at 832
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 877
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 932
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 989
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 1311
Blah: 67 fd 9f af 10 ec 8a 48 9d fc 6c bf 5e e2 2c 2e
Creating variable at 1385
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 1463
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 1543
Blah: 61 df e4 8b ca 93 d2 11 aa 0d 00 e0 98 03 2b 8c
Creating variable at 1617
Blah: 39 e9 b5 60 cf 0f 27 42 ba 83 6b be d4 5b c0 e3
Creating variable at 1670
Blah: f4 27 4a a0 00 df 42 4d b5 52 39 51 13 02 11 3d

Variable u’Setup’
Attributes: 0x00000007
Status: 0x7f
VendorGUID: f4 27 4a a0 00 df 42 4d b5 52 39 51 13 02 11 3d
Value (0xf9 bytes):
00000000 00 00 00 00 00 00 00 00 00 00 00 03 04 00 00 00 |…………….|
00000010 01 03 00 03 00 00 00 00 00 00 00 01 00 01 00 04 |…………….|
00000020 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 01 |…………….|
00000030 00 00 00 01 00 01 00 02 01 42 00 10 00 e7 bf 00 |………B……|
00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |…………….|
00000050 00 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 |…………….|
00000060 01 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 |…………….|
00000070 00 00 00 00 02 00 00 00 01 00 00 00 06 19 03 03 |…………….|
00000080 01 01 01 01 01 00 00 00 00 00 00 01 00 00 00 00 |…………….|
00000090 00 00 01 00 46 55 01 01 01 01 01 01 01 01 01 01 |….FU……….|
000000a0 01 01 00 01 00 00 00 00 01 00 01 01 01 01 00 01 |…………….|
000000b0 00 01 01 01 01 00 01 00 01 00 00 01 01 00 00 00 |…………….|
000000c0 01 01 00 01 00 02 03 01 80 04 06 00 01 00 01 01 |…………….|
000000d0 00 00 00 01 01 00 00 00 00 00 00 01 00 02 00 00 |…………….|
000000e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |…………….|
000000f0 01 01 01 01 00 00 00 01 00 |……… |
Have vss_volume:
Have vss_volume: <FirmVol position=0x000010 size=0x1fffb8
-——— END OUTPUT ————

What do i do now? And please bare with me, this is the first time i messed around bios firmware etc…

robinvanleeuwen: Since it helped me a great deal I tried to streamline the info on this page. I could only provide info about how it worked in my case. And my knowledge about this subject isn’t that great. Any tips or comments are welcome.
http://www.rldsoftware.nl/acervt/acervt.html

BrgyTanod: @STINGUS and @HANOG

Sir/s I am also an ACER Aspire 6935 T6400 2.0ghz with BIOS version InsydeH20 Version 1.13 running Windows Vista Ultimate 32bit SP2.

I really want to enable VT on my bios and make full use of Windows 7 and I have no knowledge with bios modding/hacking whatsoever. But I am familiar with other computer applications in general even in DOS.

Please give me the exact steps you did from download up to the point of flashing. I would greatly appreciate any help you can provide a fellow Acer user.

Thank you so much and looking forward for your reply. You can also email me at BrgyTanod@gmail.com

mb666: I just tried to enabled vt on acer aspire 5720.
First try - no luck.

Then I retried - I made the bios backup again, patched that again and then it started to work.

Tjeutje: @BrgyTanod:

Unfortunately your CPU doesn’t support VT, so hacking the Bios won’t do anything. You can check this for yourself on this page:

http://ark.intel.com/VTList.aspx

BrgyTanod: @Tjeutje

Thank you for your reply.
I just ran the Utility and it appears that it’s a dead end as far as my CPU is concern.

Thanks and More power!!!

dwkor: Good morning,

Wonder if somebody found a way to enable hidden submenus in BIOS. Quite a few people with 1410/1810T/1810TZ experience extensive battery discharge (5-8% per day) when laptop is off or hibernated. We’re suspecting wake-on-* settings enabled in BIOS.

Thank you very much!

dddaaa: @mb666

Hi there, i’ve got an aspire 5720 as well.. Would you mind telling how did you manage to dump the original bios to a file? The dd command doesn’t work from me and i haven’t really understood where exactly the bios resides in RAM so as to mess around a bit with the numbers in the commands parameters.

fonzy: @dwkor
No, cannot help you with hidden menu’s. But I can show you the complete storage map from the Setup utility in my Insyde BIOS (Acer Aspire 7720G, v 1.45). It will give you an idea of what the submenu’s provide:

Storage map:
0x00: ? 00
0x01: ? 00
0x02: PCI Slot3 IRQ Priority 00 ‘Auto’
0x03: PCI Slot4 IRQ Priority 00 ‘Auto’
0x04: ? 00
0x05: ? 00
0x06: ? 00
0x07: ? 00
0x08: Numlock 00 ‘Off’
0x09: Zip Emulation Type 00 ‘FDD’
0x0a: Serial Port A 00 ‘Disabled’
0x0b: Base I/O Address 03 ‘3F8’
0x0c: Interrupt 04 ‘IRQ4’
0x0d: ? 00
0x0e: ? 00
0x0f: Infrared Port(FIR): 00 ‘Disabled’
0x10: Base I/O Address 01 ‘2F8’
0x11: Interrupt 03 ‘IRQ3’
0x12: ? 00
0x13: DMA Channel 03 ‘DMA 3’
0x14: ? 00
0x15: ? 00
0x16: ? 00
0x17: ? 00
0x18: ? 00
0x19: ? 00
0x1a: ? 00
0x1b: Azalia 01 ‘Auto’
0x1c: Lan 00 ‘Disabled’
0x1d: IDE Controller 01 ‘Enabled’
0x1e: Primary IDE Cable Type 00 ‘Auto’
0x1f: SATA Mode: 04 ‘AHCI Mode’
0x20: ? 00
0x21: ATA/IDE Mode 01 ‘Legacy’
0x22: SATA Port 0 HotPlug 00 ‘Disabled’
0x23: SATA Port 2 HotPlug 00 ‘Disabled’
0x24: SATA Port 0 ILS 00 ‘Disabled’
0x25: SATA Port 0 ILS 00 ‘Disabled’
0x26: ? 00
0x27: ? 00
0x28: ? 00
0x29: ? 00
0x2a: ? 00
0x2b: ? 00
0x2c: ? 00
0x2d: ? 00
0x2e: ? 00
0x2f: ? 00
0x30: ? 00
0x31: ? 00
0x32: ? 00
0x33: ? 00
0x34: ? 00
0x35: ? 00
0x36: ? 00
0x37: PEG Aperture Size 02 ‘256 MB’
0x38: IGD - Pre-allocat Memory: 01 ‘8 MB’
0x39: Clock Chip Initialize: 42 ‘66MHz’
0x3a: Enabled CK SSC: 00 ‘Disabled’
0x3b: ? 00
0x3c: ? 00
0x3d: ? 00
0x3e: ? 00
0x3f: ? 00
0x40: ? 00
0x41: ? 00
0x42: ? 00
0x43: ? 00
0x44: ? 00
0x45: ? 00
0x46: ? 00
0x47: ? 00
0x48: ? 00
0x49: ? 00
0x4a: ? 00
0x4b: ? 00
0x4c: ? 00
0x4d: ? 00
0x4e: ? 00
0x4f: ? 00
0x50: ? 00
0x51: ? 00
0x52: ? 00
0x53: ? 00
0x54: USB Driver Select 01 ‘Legacy USB’
0x55: EHCI 1 01 ‘Enabled’
0x56: EHCI 2 01 ‘Enabled’
0x57: UHCI 1 01 ‘Enabled’
0x58: UHCI 2 01 ‘Enabled’
0x59: UHCI 3 01 ‘Enabled’
0x5a: UHCI 4 01 ‘Enabled’
0x5b: UHCI 5 01 ‘Enabled’
0x5c: Pre-Port Control 01 ‘Enabled’
0x5d: Usb Port0 01 ‘Enabled’
0x5e: Usb Port1 01 ‘Enabled’
0x5f: Usb Port2 01 ‘Enabled’
0x60: Usb Port3 01 ‘Enabled’
0x61: Usb Port4 01 ‘Enabled’
0x62: Usb Port5 01 ‘Enabled’
0x63: Usb Port6 01 ‘Enabled’
0x64: Usb Port7 01 ‘Enabled’
0x65: Usb Port8 01 ‘Enabled’
0x66: Usb Port9 01 ‘Enabled’
0x67: Power on display: 01 ‘Auto’
0x68: ? 00
0x69: ? 00
0x6a: ? 00
0x6b: ? 00
0x6c: ? 00
0x6d: ? 00
0x6e: ? 00
0x6f: ? 00
0x70: ? 00
0x71: ? 00
0x72: ? 00
0x73: ? 00
0x74: Video Memory: 02 ‘256MB
0x75: ? 00
0x76: ? 00
0x77: ? 00
0x78: PCI Latency Timer 01 ‘64’
0x79: Extended Configuration 00 ‘Default’
0x7a: System Memory Frequency 00 ‘Auto’
0x7b: RAM Timing Control 00 ‘Auto’
0x7c: RAM RAS Act. to Pre. 06 ‘6’
0x7d: RAM CAS# Latency 19 ‘2.5’
0x7e: RAM RAS# to CAS# delay 03 ‘3’
0x7f: RAM RAS# Precharge 03 ‘3’
0x80: FACP - C2 Latency Value: 01 ‘Enabled’
0x81: FACP - C3 Latency Value: 01 ‘Enabled’
0x82: FACP - RTC S4 Wakeup: 01 ‘Enabled’
0x83: APIC - IO APIC Mode: 01 ‘Enabled’
0x84: HPET - HPET support: 01 ‘Enabled’
0x85: Base Address select 00 ‘FED00000h’
0x86: ? 00
0x87: ASF Support 00 ‘Disabled’
0x88: ASF Boot Target 00 ‘Legacy’
0x89: Enable AMT Extensions 00 ‘Disabled’
0x8a: AMT Setup Option 00 ‘Silent’
0x8b: Enable AMT IDER 01 ‘Enabled’
0x8c: Enable AMT SOL 00 ‘Disabled
0x8d: Energy Lake 00 ‘Disabled’
0x8e: ? 00
0x8f: ? 00
0x90: ? 00
0x91: ? 00
0x92: IST Configuration 01 ‘Enabled’
0x93: Thermal Mode 00 ‘Disabled’
0x94: Fan On Temperature 46 ‘70 °C’
0x95: Throttle On Temperature 55 ‘85 °C’
0x96: Use NX capability 01 ‘Enabled’
0x97: PCI Clock Run: 01 ‘Enabled
0x98: _CST - C4 Latency Value: 01 ‘Enabled
0x99: C4 on C3 - Deeper Sleep: 01 ‘Enabled
0x9a: EMTTM 01 ‘Enabled’
0x9b: Bi-directional PROCHOT# 01 ‘Enabled’
0x9c: Dynamic FSB Switching 01 ‘Enabled’
0x9d: Turbo Mode 01 ‘Enabled’
0x9e: ACPI 3.0 T-States 01 ‘Enabled’
0x9f: Boot performance mode 01 ‘Max Performace’
0xa0: ACPI S1: 01 ‘Enabled’
0xa1: ACPI S3: 01 ‘Enabled’
0xa2: ? 00
0xa3: Wake on Modem Ring 01 ‘Enabled’
0xa4: Auto wake on S5 00 ‘Disabled’
0xa5: Wake on S5 Time 00 0
0xa6: Wake on S5 Time 00 0
0xa7: Wake on S5 Time 00 0
0xa8: Day of Month 01 1
0xa9: ? 00
0xaa: Crestline PM Support 01 ‘Enabled’
0xab: POPUP Support 01 ‘Enabled’
0xac: POPDOWN Support 01 ‘Enabled’
0xad: ? 00
0xae: VT Support 00 ‘Disabled’
0xaf: ? 00
0xb0: ? 00
0xb1: C-State support 01 ‘C-States enable’
0xb2: Enhanced C-States Enable: 01 ‘Enabled’
0xb3: DeepC4 01 ‘Enabled’
0xb4: Hard C4E 01 ‘Enabled’
0xb5: ? 00
0xb6: CMP Support 01 ‘Auto’
0xb7: CST Support 00 ‘Enabled’
0xb8: DTS Enable 01 ‘Enabled’
0xb9: DTS Calibration Enable 00 ‘Disabled’
0xba: ? 00
0xbb: Quick Boot: 01 ‘Enabled’
0xbc: Network Boot: 01 ‘Enabled’

linunuxium.blogspot.com/: I modified dumpsetup.py so it can figure out where the string pack and forms reside, removing the hard coded offsets. I only have one BIOS to test it with (Acer Travelmate 8371G). See if it works on yours as well.
Here it is http://zaapaas.googlecode.com/svn/trunk/hack/bios/insydeh2o/dumpsetup.py

FADE: ALTHOUGH NOT QUITE RELATED TO THE TOPIC DIRCTLY BUT SOME THE PROF HERE CAN HELP ME I GOT ASPIRE 6935G TWO DAYZ AGO I UPDATED ITS BIOS FROM 1.05 TO 1.13 SO TO GIVE BETTER PERFORMANCE AND UPTILL YESTERDAY IT WAS RUNIN SMOOTH. GOT A RESTART AND NOW ONLU ACER +INSYDE H20 BIOS LOGO SHOW IF PRESS F2 OR F12 NOTHIN HAPPEN JUST THE CURSOR APPEARS AND THE PROCESS LOOPS BACK AGAIN. AFTER SOME RESEARCH I FOUND THAT I THINK 6935G HAS BRICKED BIOS FOUND MANY SOLUTION LIKE RENAME THE .FD FILE TO BIN BOOT FROM USB IT READS NOTHING HAPPEN. I HV A SERIOUS DATA RELATED TO MY FINAL YR ELEC ENGR PROJCT RUNIN OUT OF TIME PLZ PLZ HELP IF SOMECAN AT ONEVARELIVE@yahoo.com thanx.

sethiyur.blogspot.com/: I too has a 7720g with T7300 processor. The steps I did (with MaxL changes). But it does not seem to work. I tested it by trying to run 64-bit guest in VirtualBox and also the SecurAble.exe program.
Any help is much appreciated. Thanks

nuked: hello

i have acer 5315 and usb EFI boot disabled and i want to enable that future but i dn’t know how i

1.45 bios setupdump shows can be enabled

One Of [0x54] ‘USB Driver Select’
\Help text: ‘EFI USB: Access USB devices in Shell. Legacy USB: USB devices boot and access in DOS’
Option ‘Disabled’ = 0x0 Flags 0x0 Key 0x0
Option ‘Legacy USB’ = 0x1 Flags 0x1 Key 0x0
Option ‘EFI USB’ = 0x2 Flags 0x0 Key 0x0
End One Of

default legacy mode bt i wan’t to EFI mode

help

athanas: Thanks a lot! I hacked successfully my 8930G. I’ll also try to hack my old 5720.

Great job!!!!!!!!

fbabkin: Patched perfectly on acer 6935g with BIOS 1.13 - everything done inside windows 7 ultimate, using python 2.6 and Tjeutje hints. Thanks marcan, thanks guys.

nestav: I’m tried to apply your path on my Aspire 2930 P8400/ bios v1.17
and I’m get following error:

D:\Python26>python.exe vtenable.py bios_cur.fd bios_mod.fd
Loading BIOS…
Loading VSS…
Traceback (most recent call last):
File “vtenable.py”, line 88, in
raise ValueError(“Invalid VSS signature”)
ValueError: Invalid VSS signature

Could you please help how to get it right? I can upload my saved Insydeh2O image saved from my note.

Thank you before your hang your assistance.

nestav: Here is my vardump.py output
http://www.megaupload.com/?d=RCHCC0F5
could you please clarify how to find out required offset here etc…

.NetRolller 3D: nuked: You need to patch the BIOS with vtenable.py, compare the original & patched files, subtract 0xAF from the offset of the only difference to get the offset of the Setup variable (for me, this was 0xC07FA), and add the offset of the variable you want to change (in this case, 0x54). This is the address of the byte you need to modify - write the code corresponding to your selection here (in this case, it is 0x02).

However, I tried “EFI USB”, and it didn’t work, all it did was completely break pre-boot recognition of USB devices. Probably the real EFI shell never gets executed, rather, the legacy BIOS emulator is called directly on boot.

I wonder if it is possible to “undo” fsdump.py, e.g. rebuild a filesystem, and using that, a BIOS image, from a dump… that would allow enabling the EFI shell (hint: replace the PE binary for the F12 boot menu with the binary for the EFI shell, and you get the shell if you press F12 on boot!).

nuked: .NetRolller 3D
thanks for reply
sorry about my poor english

a EFI shell application called http://luna.vmars.tuwien.ac.at/%7Efroemel/insydeh2o_efi/BOOTX64.EFI
maybe this can boot efi way
full link about efi boot :http://feature-enable.blogspot.com/2009/07/enable-vt-on-insydeh2o-based-sony-vaio.html

for rebuild filesystem i don’t know which lzma compration option was used with bios then i can patch bios for F12 boot menu with this application “bootx64.efi”

second way:
a tool can decompress bios but i don’t know which module for f12 bootmenu
tool called : http://slics.myftp.org/Tools/Phoenix_SLICTool/phoenixtool124.zip
full detail for tool link:http://forums.mydigitallife.info/threads/13194-Tool-to-Insert-Replace-SLIC-in-Phoenix-Insyde-Dell-EFI-BIOSes

thanks

mk: Hi,

1) Has anybody succeeded in enabling VT-x on Aspire?
I have 4937 with bios 2.03 which is vt-x capable.
And tried to turn on vt-d by running vtenable.py against
0x1c1 (0x00 -> 0x01)
but had no effect.

2) Has anybody succeeded in showing Advanced form with Aspire Insyde bios? If yes, how did you make it? (what offset should we change?)

regards,
mk

mk: Correction. I meant:

“1) Has anybody succeeded in enabling VT-d on Aspire?”

I would like to use application that leverages VT-d feature.

Gaeo memory seting in my biosbix: hi there

can anyone help me? I have an Acer 4736z and cannot modify my vid

Gaeo memory seting in my biosbix: hi there

can anyone help me? I have an Acer 4736z and cannot modify my vid

gabix: sorry it posted before i wanted…

I was saying I cannot modify my video memory in the acer 4736z, and its pissing me off… can anybody hal me??

I’m new on this…

Thanks a lot

mk: According to advan20092 at http://forum.notebookreview.com/showthread.php?p=5864378 , we may be able to unlock Advanced and Power forms even in the bios versions that suppress these menus.

This might be related to the each form’s class-subclass:
Advanced and Power forms have “1-5” while Main, Security and Exit forms have “1-0”.

Can we somehow hack these class configuration?

AS4930G: Hi mk, this is my reply to your comment http://marcan.st/blog/2009/06/enabling-intel-vt-on-the-aspire-8930g/#comment-887

I have successfully enabled VT on my Aspire 4930G, you can see the details here http://marcan.st/blog/2009/06/enabling-intel-vt-on-the-aspire-8930g/#comment-543 or search for my comments.

I’m also interested in the hidden BIOS options, please leave your comment when you find anything new.

Infidel: Any solution for 1.19 bios ?

.NetRolller 3D: Greetings, Aspire ⁵⁷²⁰⁄₅₃₁₅ users!

I have managed to hack the ICL50 BIOS to show the Advanced menu! Unlike Marcan’s hack, this is an actual code mod, so you do not need to do it yourself - just grab the BIOS @ http://ifile.it/rdntjsc/icl50-1.45-slic21-advmenu.fd. (As the name suggests, this is also SLIC2.1-modded - that was not done by me, I merely used a SLIC2.1 BIOS as my base. If you want a version based on the official 1.45, request it here.)
The file can be flashed using InsydeFlash, FlashIt, and probably also the Fn+Esc way.

Once flashed, go to Setup and press the Right Arrow key to replace the Information menu with Advanced :-) I haven’t figured out how to add a new menu item (that would require changing the size of the form data table, in turn requiring a size change of SetupUtility.pe, which means I need to recompile the FS from dumped files, which is AFAIK unsolved - not to mention the changes needed to the PE header when a PE file is resized), but replacing one with another can be done easily.

So, enjoy! :-)

P.S. I have the 5720ZG with the T2330 CPU (no VT support at all), and for me, the VT option is grayed out. Someone with a more decent CPU please test if it can be changed with this BIOS, or further hacking is required!

P.P.S. Please mirror this file, as ifile.it will only host it for 90 days!

nuked: .NetRolller 3D

thanks for mod

how you did can you tell us maybe another mods can be done this way

.NetRolller 3D: Hi!

What I did was use d6z’s main.py (modded for Windows support - I will release the mod once I figure out how to reproduce it) to extract SetupUtility.pe, dumped the result using MaxL’s dumpsetup.py (patched to also print the raw string table - you can find my version @ http://pastebin.com/LRE7i27n), and using a hex editor, changed the “Reference” instructions of all forms but Information (ID 0xFFF1) so that the first entry points to form ID 0xFFF4 (Advanced) instead of Information (0xFFF1). Finally, I loaded the BIOS in EzH2O, replaced the in-memory copy of SetupUtility.pe with the version I made, did a picture swap of the Intel logo to say “Advanced Menu Edition” (and to activate the Save menu item :-) ), and saved the BIOS.

(I tried doing the same procedure with the Acer 4930 BIOS, only this time I needed to set the form subclasses of the 2 hidden menus to 0 from 5, but EzH2O locks up when loading the BIOS file… if you have an idea how to circumvent this, then please respond!)

BTW I’m now working on an even bigger mod, which enables the remaining hidden menus, and possibly the EFI shell; so stay tuned!

BTW I’m now working on an ever better

nuked: ezh2o load bios file on memory with a hex editor open the memory can be edit bios like this way
a new version ezh2o also shared on web version number 2.1.0.13

.NetRolller 3D: Thanks! With the new EzH2O, I could finally mod the 4930 BIOS. You can find the modded version @ http://ifile.it/2zuiaf7/jal90_1.20_hpslic21_advmenu.fd.

Also, here is a newer version for Aspire 5315/5320/5715/5720/7320/7720 (ICL50/ICK70) machines: http://ifile.it/fh59snj/icl50-1.45-slic21-advmenu-v2-beta.fd. This uses a completely different approach to reveal the missing menu items (basically I overwrote the Information menu with a custom-built menu with submenu links to the previously hidden menus - again, I still can’t grow - or shrink - the setup utility file, so I had to overwrite something). Please keep in mind that this is just a preview/beta of what I am working on, and it has a few known issues (like scrolling below the last menu item in the modded menu going haywire, pressing left/right arrow in the Advanced menu exiting it, etc.). It doesn’t yet include the EFI shell - it will take some time for me to figure that out, please bear with me.

Enjoy! ;-)

.NetRolller 3D: And now one for the 8930G, given that this post is about the 8930G after all: http://ifile.it/forgpjd/km2_114_slic21_advmenu.fd

AS4930G: Hi .NetRolller 3D,
Can you please give me some more details about the modded BIOS for 4930? Is it version 1.20? I’ve heard that v1.20 can make the system unbootable, therefore Acer has released v1.21 to fix this issue http://url.ie/5ep8
What are the other changes that you’ve made?
Can I recover my laptop in case there is something wrong?
…
Thank you in advance.
VNK

.NetRolller 3D: Yes, it is v1.20 - I used the latest available SLIC2.1 BIOS. Apparently there is a v1.21 with SLIC2.1, but it can only be found on some Chinese site where you need a minimum post count (all posts have to be written in Chinese) to download. If you want, I can probably make an image based on 1.21 SLIC2.0, though.

AS4930G: @.NetRolller 3D
I see @_@
Did you mention this post? http://benyouhui.it168.com/thread-1087350-1-1.html
I’ve struggled to register a nick and post something there (using Google Translate). Finally, I could download the attachment. Here it is http://dl.dropbox.com/u/1608891/4.fd

.NetRolller 3D: Here it is! :-)
http://ifile.it/2jgdvyr/jal90_1.21_slic21_advmenu.fd

AS4930G: Did you test it?

.NetRolller 3D: I haven’t tested this exact version (since I have no 4930G), but the 5720G version works fine.

If it messes something up, you can always go back using the Fn+Esc trick.

AS4930G: I’ve just flashed the BIOS with this version. Here are the details:

Model: Acer Aspire AS4930G
BIOS version: 1.21
Hardware Virtualization: Locked OFF
BIOS menu: normal - No Advanced menu
The BIOS boot logo changed (Intel Advanced Edition)

Maybe I will re-flash with my customized v1.20 BIOS to re-enable VT :(

p.s. The logo you’ve created is very interesting. Can you tell me how to make it?

.NetRolller 3D: Sad to hear that - looks like the form subclasses are not responsible for the hiding; or maybe I did something wrong.

About the logo: it can be done using EzH2O; it allows you to replace all 3 logos. I replaced the 3rd logo (the Intel logo) with one that says “Advanced Menu Edition”. The latest EzH2O does not rebuild the image on Save As if it does not detect a change; so I need to replace the image before I can save for my SetupUtility changes to take effect.

With that said, here is the V2 final advanced-menu BIOS for the 5720: http://ifile.it/vwrkob4/icl50-1.45-slic21-advmenu-v2.fd. The “Lan” option has been removed in this release from the Peripheral Configuration menu, as enabling it made my machine unbootable. If you do want to enable it (and brick your laptop probably), set offset 0x1c in your Setup variable to 1 the same way you would do to 0xae when enabling VT. All it did for me was brick my laptop to the point where only Fn+Esc helped, so it’s best not to experiment with it. The serial and infrared config options also appear to be dummies, but these didn’t brick my machine, so I left them in.

AS4930G: Thank you for your information!
I haven’t installed Linux on my VMWare machine yet, besides, I’m currently having a school project, so I’ll not touch the BIOS menu now.
If I have time, I’ll change the BIOS logo and let you know the result.
Cheers!

bunder: .NetRolller 3D
Thank you! The last BIOS works excellent. Acer Aspire 5720G.

NY152: Version 1.20 of the BIOS Acer Aspire 8930G is out! Could someone patch it to enable VTx?

andrew: i have enabled the VT on the 1.20 bios on acer 8930g……glad to help..
i’ve used the vtenable.py that was created by macaran.

andrew: what’s new in the acer 8930g 1.20 bios version??????
acer 6935,6935G uses the same motherboard and bios as the 8930g…

andrew: if anyone want to know how to recovery insyde h2o bios.tested on acer 8930g

i learned on the hard way..

with the battery in and plugged to AC,format (FAT32) a usb drive(tested

with verbatim 4gb flash memory)and copy the latest bios for your

notebook(.fd file with the originaly name,i used the 1.20 version

KM2X64.fd)to the root of the usb drive. insert the usb drive,wait

2-3sec,press and hold FN+ESC for 3-4 sec and power on.keep holding the

FN+ESC keys till the usb drive’s led start blinking ;).wait 30sec-1min and

the computer will automaticaly power off.manualy power up(if doesn’t do

it automaticaly)and your notebook should be ALIVE….this guide should

work with all the inside h20 bios-es….(acer 6935,6935g,…….)

i’m also working on making all the options visible for acer 8930g and raid support for this model.

by the way what is the max amount that acer8930g can handle????

On some site it says that is 4gb,and on the other it says its 8gb.

Everset and SISoftware Sandra says its 8gb…the hardware supports 8gb

but i think that the bios is locked at 4gb.

ANYONE TRIED TO UPGRADE TO 8GB DDR3 1066????

thanks to macaran and all the guys that make this possible for all of us…
thanks to macaran and all the guys that make this possible for all of us…
thanks to macaran and all the guys that make this possible for all of us…

NY152: @andrew : Unfortunately, no chanlog is available. I am using version 1.13 patched VTx and as I use the XP mode, I want to be sure to have the virtualization available. Version 1.20 of the BIOS is available here: http://www.acer.fr/acer/service.do?LanguageISOCtxParam=fr&miu10einu24.current.attN2B2F2EEF=291&sp=page15e&ctx2.c2att1=8&miu10ekcond13.attN2B2F2EEF=291&CountryISOCtxParam=FR&ctx1g.c2att92=25&ctx1 . att21k = 1 & CRC = 1143633635

NY152: Andrew, keep me posted on your progress. The main one being VTx ^ ^

andrew: @NY152 :
i’ve download the 1.20 from the italian site :

http://www.acer.it/acer/service.do?LanguageISOCtxParam=it&miu10einu24.current.attN2B2F2EEF=400&sp=page15e&ctx2.c2att1=11&miu10ekcond13.attN2B2F2EEF=400&CountryISOCtxParam=IT&ctx1g.c2att92=27&ctx1.att21k=1&CRC=2360020043

i’ve used the original vtenable.py maked by macaran(WIN7 64BIT python 2.6 amd64)
it seems that the 1.20 bios version is not very different than 1.13 or 1.14 bios version…. I have got the VT enabled in 1.20 by using vtenable without any change or mod…I’m using same as u the XP Mode with 1.20 bios…
Try patch your bios,flash it and if anything is go bad use the bios recovery that i wrote up….keep posting……..

andrew: @NY152

see this picture : http://img410.imageshack.us/i/41558633.jpg/

NY152: Personally, I use 32-bit in OS. Much more flexible for me under Linux (and especially complete). Does the BIOS patch vtenable.py 32 bit without error? Or using the BIOS 64 bit, I could continue to use my operating system without problems? I have a Pentium Core Quad Q9000 2.00GHz.

Otherwise if the version 1.20 does nothing, I prefer to stay on my current version. I remember that on the patched version 1.12, I had to reboot nuisance, something I had on version 1.13. I prefer to be very cautious now …

NY152: @ Andrew

It seems to me that the installation of XP mode that detects whether or not VTx is enabled. If it is not active, it will not install. Once it is installed, it assumes that VTx is active and will start anyway. It would be nice to know if the VTx is really active because in case of relocation, it will go before a big concern …

andrew: I haven’t tested on 32 bit OS but it should work.the vtenable.py patch works under ubuntu 9.10 amd64.beleve me the VTx is enabled in 1.20 bios version…use ubuntu 9.10 32bit live os and try to patch your BIOS.
I’ve also have Q9000 Quad and my notebook works without any problems.
The 1.20 K2X64.FD BIOS works good,and any 32bit os is supported by this BIOS.the

BACKUP YOUR CURRENT BIOS INTO A FAT32 USB FLASH MEMORY AND IF ANYTHING IT GOES BAD USE THE RECOVERY PROCEDURE TO REFLASH YOUR BIOS…KEEP ME POSTED……..

andrew: I haven’t tested on 32 bit OS but it should work.the vtenable.py patch works under ubuntu 9.10 amd64.beleve me the VTx is enabled in 1.20 bios version…use ubuntu 9.10 32bit live os and try to patch your BIOS.
I’ve also have Q9000 Quad and my notebook works without any problems.
The 1.20 K2X64.FD BIOS works good,and any 32bit os is supported by this BIOS.the VTx on 1.20 is enabled and loked ON

BACKUP YOUR CURRENT BIOS INTO A FAT32 USB FLASH MEMORY AND IF ANYTHING IT GOES BAD USE THE RECOVERY PROCEDURE TO REFLASH YOUR BIOS…KEEP ME POSTED……..

NY152: Command for backup don’t work

NY152: Command for backup don’t work

dd if=/dev/mem of=original_bios.fd bs=1024 count=2048 skip=4192256

I don’t know he BIOS adress

Result :

dd: lecture de `/dev/mem’: Mauvaise adresse
0+0 enregistrements lus
0+0 enregistrements écrits
0 octet (0 B) copié, 0,00475675 s, 0,0 kB/s

andrew: try backup your bios using flashit.exe under dos,or use insyde flash utility that comes with the 1.13 bios under the windows(witch I used).be sure to modify the platform.ini like this(add only the name):

;The file is Insydeflash utility configuration file

[Version]

Version=00

;Insydeflash utility will display the value at top

[FDFile]

FileName=

BackupName=backupbios.fd
Utility always load this file.

;BackupName -> Utility will backup current BIOS to the file

BLA BLA
BLA BLA
BLA BLA
BLA BLA……
……..
……
….
………….
…………
………
………..
……..
….
BLA……..

KEEP POSTING……

andrew: and do not continue with the flash.the backup it will be found in the bios folder

NY152: vtenable.py don’t work for me …

result :

$ ./vtenable.py KM2X64.fd vt_bios.fd
Loading BIOS…
Loading VSS…
Variable not found!
Old state:
Traceback (most recent call last):
File “./vtenable.py”, line 105, in
var.showinfo()
NameError: name ‘var’ is not defined

marcan: Read the instructions. You need to run vtenable on a backup. It will not work on a BIOS update file. It does not patch the BIOS, it patches a setting.

andrew: i’m agree with macaran…you must patch the backup bios not the bios that you download from the acer site…vtenable.py patches the settings in the backup bios…….

andrew: you must flash your bios with 1.20 version that you download from acer site,after use flashit.exe or the inside utility that comes with the bios using the modified platform.ini and backup the bios that you just flashed..
now patch the BACKUP BIOS using vtenable.py and python 2.6 under linux or windows.
after a succesfuly patch,flash again the patched bios with FLASHIT.EXE or INSIDE FLASH UTILITY.and you are done…enjoy the VT…

keep posting

NY152: So it is imperative to switch to 1.20 …

And if it not work, I’d be stuck: (

andrew: its your decision…

NY152: I managed the process, thank you:)

andrew: you welcome.but all the credit go to macaran…..
so you have your VT enablet and working?
ill try to get working some other bios function…..

NY152: The VTx is active and functional, it’s perfect.

I wonder why Acer does not offer the option in the menu VTx their BIOS, especially since its utility in Windows 7.

The ideal would be to find a way to make all the hidden options (or disabled) visible. But I think it must be very complicated and long. In addition, it is a rework from scratch each version comes out.

psyq321: I’m trying to dump the new Vaio Z’s setup…

I successfully extracted the setup binary: http://forum.notebookreview.com/showpost.php?p=6101365&postcount=1 but it looks like Insyde (or Sony?) added many new opcodes…

Or, am I doing something wrong - I think the string table location is: 0xF050

Could someone else check the PE binary - it is attached in NR post.

NY152: @ Andrew:

You spoke of RAID but I think it can cause trouble. Why? Because personally I install 2 Seagate 500GB 7200 rpm and when the 2 disks work long, the temperature rises very quickly and turns off the PC. Oddly, this worries occurs on Windows and not Linux.

andrew: @NY152

u’re right its complicated to permanently show hidden options.as for the RAID I’m also using WIN7 and Linux on 2x320 7200rpm 16mb WD Scorpio Black without any problems.I want to upgrade to the same HDD that you use(2x500gb 7200.4 Seagate Momentus).tell me more about the problems that occurs…perhaps seagate needs more power than WD SC Black and as known Windows uses more resources(memory,CPU,GPU,HDD)and also needs more power.perhaps the power drops down(voltage,amps) and windows shutsdown.
probably the power adapter or battery cannot handle this power consuption….

keep me posted…….

andrew: @psyq321

if you are trying to enable the VTx vor your Sony Vaio Z here’s a guide..

http://feature-enable.blogspot.com/

psyq321: Actually no, i want to enable the advanced menus - new Z (VPC-Z11) has VT option in normal bios setup.

I am now able to “poke” in the options by using .py script, and so far I have enabled VT-D and Quick Boot… however, without dumping the setup I am not able to find what VSS register is used for suppression.

0x25A is not working anymore, and if I try to dump the setup utility with dumpsetup.py I am getting tons of unsupported opcodes :(

psyq321: I just managed to dump the setup… so that question is now solved

I needed to add opcode 0x27 and use one of the modified dumpsetup.py scripts!

NY152: @Andrew

I had a Seagate Momentus 5400 original. I just replace it with 2 Seagate Momentus 7200. For the problem, I can not say anything more than what I already said. The computer turns off completely because of a rise in temperature measurement of security therefore. What is certain is that Windows handles very poorly the temperature rise of discs and PC in general. Under Linux, management must be better managed because the PC much less heat (always below 50 ° C against more than 60 ° C on Windows). If I had not needed in Windows programs (wine does not handle these applications, damage), I should have already fired a final Windows because I do not like. The only problem with Linux is that the biometric reader is not handled it all.

psyq321: For people that need the VPC-Z11 setup option list:

http://pastebin.com/bg3At2rt

andrew: @NY152
what linux distro do you use?
Have you get working the IR remote?

NY152: I use Ubuntu 9.10 32 bit.

For the remote, my model does not (model no tuner)

Zmei_gorini4: Hi all!
Help please include support for Intel-vt on Acer 2930 (p8400)
Thank you.

C:\Users\Администратор>C:\Python26\python.exe H:\BURN\vtenable.py H:\BURN\BIOS_CURE.FD H:\Bios_mod.fd
Loading BIOS…
Loading VSS…
Traceback (most recent call last):
File “H:\BURN\vtenable.py”, line 88, in
raise ValueError(“Invalid VSS signature”)
ValueError: Invalid VSS signature

Zmei_gorini4: This is the correct vtenable.py for acer 2930 users http://ifolder.ru/17157199

Zmei_gorini4: sorry my bad, after patch intel vt don’t turning on. :(

nestav: Does anyone can help in putting correct offset for 2930 model?!!!! Or were to find out how to?

mk: Hi NetRolller 3D,

Is it possible to mod KAL90*** bios (for Aspire 4937) to include Advanced menu?

http://global-download.acer.com/GDFiles/BIOS/BIOS/BIOS_Acer_1.08_A_A.zip?acerid=633977522779406837&Step1=Notebook&Step2=Aspire&Step3=Aspire%204937&OS=V10&LC=ja&BC=Acer&SC=AAP_3

Thanks,

mk

.NetRolller 3D: Hi mk,

Unfortunately the Setup Utility in the 4937 BIOS is similar to the 8930 one: there are 7 separate form sets, of which 2, namely “Power” and “Advanced” (the hidden ones) have form subclass 5, while others have 0. For 4930 AFAIK, merely changing the sublasses didn’t help, and I am still working on the real solution.

The 5720 has a completely different Setup Utility, with a single form set, named “SetupEngine”. The “Advanced” menu is hidden by simply not linking to it anywhere. Here, it is easy to reveal a hidden menu, by merely adding a reference to it somewhere in an already visible menu. For this, I had to remove the Information menu, to gain space for the extra references (as I haven’t yet known how to change file size without breaking the BIOS - since then, I’ve solved this; so a new version of the 5720 BIOS with the Information menu back is planned).
For the 4937, the same thing is impossible, as you can’t link/reference across form sets.

I will soon post a test BIOS; but it will be completely untested (I have no 4937), and may even brick your machine - if this happens, you can use the Fn+Esc trick to recover. (Note: you can also burn KAL90HW.FD to a CD, not just an USB drive - at least for the 5720, this works better than the USB solution.)

mk: Thank you for your efforts & time, and I also appreciate the detailed description.

.NetRolller 3D: Hi,

Here is a test BIOS:

http://ifile.it/kxjhtb6/kal90-1.08-advmenu-test.fd

In this one, I have used 2 different methods to unlock “Power” and “Advanced”:
-For “Power”, I merely changed the subclass.
-For “Advanced”, I swapped the form header with the “Information” form. As a result, the “Advanced” menu, if unlocked, will show up as “Information” and vice versa. (It is possible that due to this, “Information” will disappear.)

Unlike my other BIOSes, this is probably not SLIC2.1, unless the BIOS you gave me for a start already had SLIC2.1 support.

Please write back with your results!

Thanks,
Gábor

mk: Thanks Gábor,

Here are the results:

1) Applying the test BIOS over the original BIOS 1.08 (KAL90108.fd).
* To audience: What I did; first I applied the original BIOS 1.08 and then used Option - Update FV - Update FV by file, specified kal90-1.08-advmenu-test.fd and clicked the Update Now! button in InsydeFlash.exe

2) Thought the BIOS menu did change, the Advanced and Power menu did not show unfortunately.

The BIOS menu after applying the test BIOS looks:
Main - Information - Security - Boot - Exit (from left to right)

- Main menu equals to Main as in the original BIOS, not editable though.
- Information menu has sub menu ASF Configuration (Mini WatchDog Timeout/BIOS Boot Timeout/OS Boot Timeout/Power-on wait time all editable) only.
- Security menu equauls to Security as in the original BIOS (editable).
- Boot menu equals to Boot as in the original BIOS (editable).
- Exit menu equals to Exit as in the original BIOS (editable).

Hope this assists your research…

Regards,
mk

.NetRolller 3D: Hi,

Just as I feared. Apparently the BIOS is looking at the strings associated with the menus, and doesn’t care about form classes. If you look closely, your “Information” menu is actually the Advanced menu - the name change is due to my swapping the headers. (Note that for some weird reason, your BIOS has Intel VT in the Power menu…)

If you are lucky, my next test BIOS will produce the following BIOS menu:
“Information - Main - Information - Manual - Security - Boot - Exit” (perhaps in a different order). “Manual” will be the real Information menu, while the two menus called “Information” will be Advanced and Power.

Get it @ http://ifile.it/8ghqonx/kal90-1.08-advmenu-test2.fd

Good luck!
Gábor (.NetRolller 3D)

mk: Thank you again!
Here is the quick feedback:
The menu now looks “Manual - Main -Information - Security - Boot - Exit”
I understand now that this showing Information is actually Advanced with all sub forms suppressed except ASF Configuration. Maybe I can manage changing the flags to work around Suppress If conditions by myself.
As you can see the 2nd Information “=Power” is not still showing. For this we could switch it with Security if possible.

Anyway Thank you very much for the works. I will further try modding based on your test2 fd.

Best Regards, - Masahiro Kawasaki

nuked: Hi all
for Aspire 5720/5315/7720g

lastest version v1668 video bios file i founded somewhere but how can be insert intro to bios and it will it work fine i don’t know if someone help
there is link : http://ifile.it/x8tfvzp/vbios_gm965.zip

Sandoner: Hi there, is there any solutions for Acer 5930? I would be grateful for any advice. THX for help

AC: Hi, I need help.
Acer disabled both Switchable Graphics and Intel X.D Capability in the laptop AS4740G.
Anyway I can enable both feature?

Stuart: Hi. Aspire 5720 with Win 7x64 on Duo T7300 on BIOS 1.45.

Edited platform.ini with Notepad++
Cancelled InsydeFlash to dump backup
Python 2.6 to run MaxL’s vtenable.py
Used WinMerge to compare .fd files, it highlights one line but if I click on the “Difference in the current line” button it says “No difference” and when I flash the BIOS with CL50145A.fd (renamed from file generated by vtenable.py) Win XP mode says VT still not enabled :(
May not be relevant, but CPUZ64, CPU tab, “Instructions Section” includes VT-x and the app “Securables” also says VT-x is enabled (but notes it can’t be sure on an x64 OS).

Did I use the correct vtenable.py? The one with VSS_OFFSET = 0x000c0048 & VSS_SIZE = 0x3f58.

Many thanks to all posters who have managed to get me this far - 2 weeks ago I’d never even flashed BIOS!

Stuart: Update to previous post. VBinDiff has found a single change in the 4th bit of the 2nd byte at 000C 0B10 from 00 to 01.

I’ve also changed platform.ini [Option] Flag=1 to force an interactive GUI that allows me to confirm I’m flashing with the new file and there’s also a check box to ‘Flash All’, but still to no avail :(

I sense I’m very close, if anyone could help me over the line I’d be extremely grateful…

Stuart: As per someone’s earlier suggestion, and in desperation, I removed the Aspire 5720’s battery before flashing and when it rebooted I had VT-x enabled :)

Notagooner: Unfortunately, my Vaio VGN-NS20J doesn’t have the VT but is there anyway to adjust that python script to enable the FULL EFI menu?

Thanks

Josh: Hey mk,

Did you have your 4937 VT enabled? I’ve look through the posts and don’t really understand if 4930 means 493X series.

Regards,
Josh

Josh: sorry for the newb post there, 4930 =/= 4937…..
however, upon reading up more, i realise that many are using the processor P8700 and found that someone did successfully unlock VT on bios 2.03, 1.05 and 1.07 (but not 1.09 somehow).

i’m now stuck with dumping bios with Insydeflash.exe, got this error
“new image do not have platform information” when i run Insydeflash.exe
My aim is to use the platform.ini available with Insydeflash to dump the bios using

[FDFile]
FileName=
BackupName=C:\downloads\InsydeFlash\dump.fd

to create the dump.fd, can anyone help me out on this? =x

Regards,
Josh

Josh: Sorry for posting at all…. Bios V2.03 of Acer aspire 4937G has VT enabled by default.. i think, mine has been enabled when I flash it accidentily.

Weinter: Hi guys after struggling with the code I got the offset of switchable graphics control.
Location = 0x20a, name=‘Display Mode’ help=‘Set Display Mode Configure Type.’
Originally the BIOS have it at Discrete Graphics Mode
I looked at the help string and Find 3 Modes in the following order.
Integrated (Intel HD Graphics)
Discrete (Nvidia 310M)
Switchable
Is it safe to assume Integrated, Discrete, Switchable?
Of Course I will backup my Firmware before attempting the change.
My question is how can I patch the bit ? Using which script and changing which values?
Thank You

Weinter: Sorry the site seems to have ignore tags.
So currently I am on discrete (default) and the value is 1.
By following the sequence of the help text logically speaking 0 should be Integrated, 1 should be discrete and 2 should be switchable which is what I am trying to get.

qwertM3: Hi.
I managed to enable VT on Acer 8930G for BIOS 1.20. Thank you marcan for making this posible.

Strange thing is how different tools report Intel VT-x status. Securable always says “YES”. The only indication for me was VMWare. When it was not enabled my install of 64-bit guests failed.

Are there 2 bits? One is enabling VT-x the other one does some kind of locking. Securable showed “Locked ON” for my desktop PC.

Why is that?
Thank you.

Snake: I have Acer Aspire 5745G. How do I enable the VT option on my insydeH2O Bios?
Thanks

Snake: Please help me!

André: PPL how do unlock a advance menu in insyde bios? should be great unlock to get more live on a q9000

cavrac: I am trying to unlock / unhide my Advanced Menu on an Emachines E525. I was able to get the vardump.txt and the SetupUtility-mine.pe but I can not figure out how to get the setup.txt that everyone else seems to be getting. From what I understand you have to run the dumpsetup.py on the SetupUtility-mine.pe, but when I do I get this error

C:\Python\App>python dumpsetup.py SetupUtility-mine.pe
lnoff: 15021600, plnoff: b4090502, attr: 9090242, count: 2410101
Traceback (most recent call last):
File “dumpsetup.py”, line 280, in
strings = StringTable(pe, STRING_TABLE)
File “dumpsetup.py”, line 44, in init
offsets = struct.unpack(”<%dI”%count, self.data[16:16+count*4])
struct.error: unpack requires a string argument of length 151258116

I am using the dumpsetup.py that .NetRolller 3D posted and I changed this line STRING_TABLE = 0xD920

I can not figure out what to do next, if anyone can help it would be greatly appreciated, thanks in advance.

Snake: How do I see my offsets to put in vtenable.py???

Dan: @marcan, I’m curious about your description of the flash interface as “flash-behind-EC hardware” in the main article? What does this mean?

I’m trying to read my Insyde BIOS on an Acer 1410 notebook, and getting lots of errors when I try to poke around in that region of /dev/mem :-(

tilla: Hi,
has anybody a solution for the Sata-I-only issue on Acer 4810TG?
The sata bus is limited to sata i (150) and the integrated ssd intel x-25 performs not at its best (max. 130MB/s seq. etc.).
I’ve also flashed the modded bios from here
http://forum.ixbt.com/post.cgi?id=annc:17:35660
But no difference in this issue.
Thx

golgi: So I am a little confused where to go from here.

I have successfully extracted setup-utility.pe. What I am I supposed to do now to make the hidden menus available? I have read and re-read this blog and a few others and I’m a little miffed.

avian: Just want to thank marcan, MaxL, and petejk. Their posts helped me enable VT-X on a 5315. I dont have windows installed (just hackintosh), but the procedure I used was really simple. I grabbed freedos.dmg (google it) which creates a bootable usb stick with freedos on it straight in osx - but with a partition that is only 1.4mb in size, clearly not large enough. I used another usb stick and formatted it with a fat partition to place the flashit tool etc on. When booting into freedos, freedos itself is on drive A:, the second usb stick is drive B:

Downloaded ftp://ftp.work.acer-euro.com/notebook/aspire_7720/vista/Bios/v1.45.zip , extracted the CL50145A folder onto the second usb stick, it contains bios v1.45 and a flashit tool that can also extract the firmware.

Used the freedos usb stick to boot into dos, used FLASHIT to upgrade to 1.45. rebooted back into freedos and then used it to extract the firmware - “FLASHIT ORIG.FD /g”.

Booted into osx (or any OS with python installed will do), ran MaxL’s vtenable script from post #177 above. “python vtenable.py ORIG.FD VT_BIOS.FD”. Place the VT_BIOS.FD onto the second usb stick where flashit is. Reboot into freedos, run command “FLASHIT VT_BIOS.FD”, and thats it.

Really couldnt be any simplier. And now virtualbox, vmware etc works perfectly. Thanks!

Abelardo: Hi everyone,

Thanks a lot for this great blog.

Please

Can someone tell me how to use the ‘dd /dev/mem’ command on an acer aspire 7720. My machine doesnt have windows so im stucked an i dont know what to do.

I only have windows on a virtual machine so my only possible solution is to use ‘dd’ command.

but when i try the dd command as showed at the beginning of this post, it shows”

“bad address” please can someone help me.. please

Abelardo: Thank you a lot Michel..

but that solution requires to use windows for reading back the flash and i dont have windows :(

only in a virtual machine

seems that only solution in linux is to use /dev/mem but i dont know how to get the offsets for acer aspire 7720,

can someone help me please?

avian: Hey Abelardo,
Use linux or windows in your virtual machine to create a freedos boot usb stick, and use “flashit /g orig.fd” to extract the firmware, its a very painless solution that works well.

.NetRolller 3D: @Abelardo: The 7720 AFAIK uses the same BIOS as the 5720. So, you can just use my patched 5720 BIOS (the “Advanced Menu Edition”) to get VT support (and more). You can find it @ http://ifile.it/vwrkob4/icl50-1.45-slic21-advmenu-v2.fd - hopefully it haven’t been taken down yet due to no downloads.

BTW for all other BIOS modders out there: you can create a distributable BIOS mod (as opposed to one that has to be done individually on each machine) by editing the form set data in SetupUtility.pe to make VT default to Enabled. You can find some help doing this @ http://forum.notebookreview.com/hp-pavilion-notebooks/393606-insyde-bios-modding-dv4-dv5-dv6-dv7-least-19.html#post6165204 (this is a post by me describing steps to patch SetupUtility.pe). You can find the definitions of the individual form opcodes in the EFI spec; this was how I did the ⁵⁷²⁰⁄₇₇₂₀ mod. I plan to release a (dis)assembler for EFI form sets later, to make this work easier.

jungleflow: Hey there,

so I was able to change the User Access Level (0x85) on my TravelMate 8471G, now I’m looking for some information on how to unlock the hidden menus in my BIOS.

Well, I know that this won’t solve my actual problem.. gaining control over that annoying fan “insyde” my laptop. There has to be some way to control fanspeed, especially in AC mode (always spinning).

Any help is appreciated! :)

dummy: Hi everyone,
I fixed VT on Aspire 7720G thanks to all good work here. Now I found out that there is no microcode in the BIOS that can be loaded at boot time. This is an issue when waking up, since the ACPI implementation or drivers are not perfect. I am now looking into how to update the microcode in the BIOS. Acer has the Int15/D042 method disabled. I cannot even find the microcode in the file. Any help on how to find it is most welcome. Also if anyone knows how to construct an FDF file for the BIOS, …

AS4930G: It seems that the latest BIOS for AS4930G (http://url.ie/7bht) have a different pattern. The vss size, vss offset and patch offset have change. I have run main.py, got the new offset, recalculated the vss size but I still got the Invalid VSS signature error.

dummy: My microcode problem is solved. I updated it in the distribution BIOS with a hex editor and updated the live BIOS (FLASHIT /FM). That worked fine. The weird thing is that Acer provided a microcode update in the latest BIOS distribution to support newer CPU models, but they did not bother to update the existing microcode for CPU models already sold. Strange, since Intel provides a complete file with actual updates for all CPU models. Acer support just turned the cold shoulder …

dummy: @.NetRolller 3D: OK. The problem of the ‘Advanced’ Menu not appearing is solved. I got it all working without any compromise. It’s all a matter of adding the missing references to the forms that are not appearing in Setup. The I found out that the ‘Advanced’ menu is not so advanced, since there are about ten other forms or so that are not even referenced by the Advanced menu. I added those as well. Then I found out that some forms have so many options that the form browser needs to scroll but is not doing that correctly. So, I reorganised many items and distributed them appropriately over other forms to avoid scrolling. I even had to split one existing form (USB Configuration), creating one new form alltogether.

So a form assembler/disassembler would be a useful thing to have. By the way, most forms contain obsolete ‘Suppress If’ opcodes that can safely be removed. That created more than enough space for me to add all the missing reference. Even though I did assemble the whole Setup binary, it is not even necessary, since in there is enough space now to patch the forms directly. Also good is to improve the strings, correct some common translation artefacts and spelling mistakes. If your assembler/disassembler can do that as well, would be good. I did all this by hand which is tedious.

Only thing now, I don’t know how all this can be automated or scripted so that everyone can benefit …

dummy: @jungleflow: The trip temperatures can be set in hidden forms. These forms are not available even in the ‘Advanced’ menu, but they can be added manually. See my post above. Alternatively, you can just change the values in the VSS variable.

tony: @dummy: just wondering, how did you remove the “suppress if” option? I’ve opened my bios using ezH2O and tried to use Winhex to modify opcodes(e.g., change opcode 0x27 to 0x47 which is EFI_IFR_FALSE to bypass the detection), but the changes won’t save. any help would be appreciated.

dummy: @tony
I made a complete disassembly of the setup executable, but you don’t need to do that if you can free up sufficient space by removing redundant code (suppress if is used a lot without any real effect). When you spot such redundant code, you delete all bytes until the next end-op opcode. All bytes following until the end of the form set will be moved up. You can do that with WinHex (I used HxD by the way), but it is more convenient to do that in a separate file that you can edit (and perhaps disassemble/reassemble for ease of interpretation). I have an Acer Aspire 7720. I you need the same you could use my version, but I don’t know how to post that here.

dummy: @tony,
Forgot to say that for each edit you need to add the same number of null bytes after the end-for-set opcode in order not to change the offsets of the data that is after the form set! An external edit is best, you can then copy/paste the correct number of bytes.

tony: @dummy: Actually I’m using HP dv5t so that I cannot use your BIOS. I’ve already disassembled the setup utility and got the setup.txt. The thing is that from the text there are quite a lot of opcode 0x27 (2) which is EFI_IFR_VARSTORE_DEVICE suppressed the option. I want to patch it to 0x47 (EFI_IFR_FALSE) so that the detection of value would be void and menus would not be suppressed. Just wondering by what means you disassemble the BIOS? Uncompressed it with LZMA and use vardump? And how do you reassemble it? Thanks.

jungleflow: @dummy
I followed your suggestion and checked the themal trip temperatures:

Fan On Temperature (0x19e) is set to 70 °C (0x46)
Throttle On Temperature (0x19f) is set to 85 °C (0x55)

Those are the default values. Nevertheless my cpu fan starts spinning at exactly 35 °C (medium speed). So there has to be some hidden mechanics someone might know about.

Thanks for any further help.

dummy: @tony: my observation about obsolete ‘Suppress If’ statements is true for my (Acer) bios, based on InsydeH2O. Not sure how HP have built there formset. In my case, the ‘Advanced Menu’ and other missing forms were not appearing because of missing references (IFR_REF_OP), not because of a check on a variable value. It meant in my case that you cannot just patch. You need to add the IFR_REF_OP statements. Look in the link of the post above by .NetRoller3D for a complete description of how to reassemble the modified bios.

dummy: @jungleflow: The Fan-On is a trip value, I believe. It means full fan speed as from that temp. The fan speed is probably controlled by some ACPI table, but I do not have more precise info. I am presently looking into the ACPI table for the CPU power management. I want to undervolt the CPU’s to generate less heat. I have the tables, but I don’t understand them yet.

dummy: Ok. I fixed the undervolting as well. I now have a redistributable bios for the Acer Aspire 7720G, based on v1.45 with all setup menu’s and modified CPU voltages (150 mV lower) for T7300 & T7500 Cpu’s. These mods are not so trivial and do include real code modifications. no easy way to script this, I’m afraid. But if anyone want to know details, let me know.

.NetRolller 3D: dummy: Does your BIOS version include any Setup options that my “Advanced Menu Edition” doesn’t have (with the exception of “Lan”, which I intentionally removed, as it prevented booting the laptop when set to Enabled)?

Also, what code did you modify exactly to modify CPU voltages? I think it can be extended to actually read CPU voltages from the Setup variable, making them user-configurable, with a little more hacking.

lexa: dummy: Can you give your modified BIOS?

dummy: .NetRolller 3D, lexa: I must admit, I did not load your BIOS, so I am not sure whether we have the same. My BIOS shows every form in the formset plus an additional form I had to create to rearrange existing options to avoid scrolling. No additional options were added by me. However, the original advanced menu only showed 3 forms, far less than actually available. I did not remove the Lan option, but it is disabled indeed.

I also replaced the microcode since the T7500 is totally absent in the microcode tables. I contacted Acer and they bluntly refused to issue a new BIOS update. It happens occasionally that upon resume the microcode does not get loaded by Windows. Don’t know about Linux, but that’s dangerous. The BIOS does not load it and the OS also not. I sometimes ended up with a running windows without any microcode load.

We owe it to Linux that Intel released the microcode in the first place. For Windows users there is still officially no microcode available from Intel.

The voltage can be modofied only in a code module called PowerManagement2. I believe it is provided as is by Intel since it contains very detailed info of CPU models and steppings, even many historical CPU’s are mentioned. It is a generic code module for all historical CPU’s that are still relevant. The calculations are quite complex. Many undocumented MSR’s are used. Info on those is hard to find and only available officially from Intel after an agreement and signing an NDA. Don’t have that I’m afraid.

I tested on T7300 and T7500. I could see that voltage interpolation was also quite different on different steppings. There is no use of any table. The ACPI table is built totally by calculation, unless for very old CPU’s (Pentium 4, D). To replace this by table lookups would require quite a lot of space, since each stepping for every CPU model used in the Aspire 7720 range would need to be calculated and stored. That’s quite a lot, since the 7720 has also been sold with T5xx and Penryn CPU’s.

I reduced voltage by 150 mV for high frequencies down to 85 mV for low frequencies. These values are reasonably safe. The cooling in the Aspire range is totally insufficient to use 100% intensive load on both kernels for anything more than a few minutes. Throttling would start quickly. With this undervolting it is a lot better. At least one CPU can sustain intensive calculation load at 100 % The other would start to throttle again.

Be careful when experimenting: The Thermal Monitors in the BIOS are disabled by default! Only the hard throttle limit is operational which causes temps to reach above 95 degrees!

If you’re interested, I can post my BIOS somewhere, but I cannot post it in the notebook review forum, since the allowed size is not enough. We can also not exchange pm’s here … Perhaps Marcan would be so kind to forward a pm? Or should we switch to a forum?

lexa: dummy: Can your upload your file on http://ifile.it/ , for example, and post link here?

nando4: CQ41 has had switchable graphics disabled as explained: http://forums.mydigitallife.info/threads/7033-Insyde-bios-mod-requests.?p=322758#post322758 .

EzH2O gives a “Discete/Integrated/Hybrid” option, but changing from gGPU to iGPU doesn’t enable the integrated graphics.

Can anyone give a pointer as to how to enable the Intel graphics?

dummy: Ok. I figured it out. Here is the package: http://ifile.it/65938vi/Aspire7720BiosMod.zip
Please check the readme.txt file carefully. If you like this new bios, please make a comment here. If you don’t, please throw away the file, your BIOS, your computer or anything you like, but do not leave a comment here. If you care to contact me directly, please tell me how that can be done, since we cannot bother Marcan with that. It is his blog we are using here.

Kamal: I have a problem to understand something.

What program do i USE to enable the VT support i tryed Python but the dollar character it does not understand.???

Is it another program?

Or are thinking wrong?

Best Regards

Kamal

lx: Confirmed that the instructions in the post work with Acer Aspire 6935g,bios 1.2. Great job. Thanks heaps!

.NetRolller 3D: dummy: I have started merging your release with mine, to “gain the best of both worlds” (mine has scrolling issues, yours has problems with e.g. setting SATA mode), but can’t find where you put the microcode updates. Where are they?

You can contact me @ ɯoɔ˙lıɐɯƃ@pƐ˙ɹǝllloɹʇǝu (written in flip-text to avoid spam - mind the 3 “l”s!) to synchronize our efforts.

giuliano: Hello,
I’ve got a gateway ec19c-n52 with insyde h2o bios 1.11 (no signs of the bios on the website… I’ve asked the support but it seems I have to ask to the japanese team because US one has no visibility on japanese notebooks…). When I try to dd the bios I get the bad address error. I’ve tried with ubuntu 10.10 x86_64, I’ve recompiled the kernel with config_strict_devmem=n, I’ve tried other linux distros, both 32 and 64 bit (fedora 12 and 13, ubuntu 9.10 and 10.04, slax, clonezilla live cd, parted magic live cd, gentoo 2007 and 2008) with the same result. Even windows 7 (home premium 64bit) with hwdirect doesn’t work (can’t load the drivers) but I have no other versions to try. Can someone recommend a linux distro that worked ? Or some other software to dump the bios in freedos ?

thanks

giuliano

giuliano: I’ve found a BIOS to download. It’s the same I have installed. Will try to use this instead of the one I should dump myself :)

http://global-download.gateway.com/GDFiles/BIOS/BIOS/BIOS_Gateway_1.11_A_A.zip?acerid=634141710399392927&Step1=Notebooks&Step2=EC%20Series&Step3=EC19C&OS=722&LC=ja&BC=Gateway&SC=AAP_3G

btw fd file is 4mb

giuliano: It seems I cant get anywere :( I’ve uploaded the file to

http://www.megaupload.com/?d=Z87HC7QW

If you have some spare time, can you give it a look ? I’ll keep trying but it’s a shot in the dark :( I’d like to enable VT and NX

thanks

giuliano: it seems the BIOS is exactly the sam as aspire 1430 (same hardware and sam JV10V111.fd file)..

l630: Hi,
I want to disable F12 boot menu in Insyde BIOS so I tried Marcan’s method.
I edited vtenable.py source code to make changes that suit setting and save file as f12disable.py.
Then, I ran the file against a backup BIOS but it failed:

python f12disable.py backup.fd test.fd
Loading BIOS…
Loading VSS…
Traceback (most recent call last):
File “f12disable.py”, line 88, in
raise ValueError(“Invalid VSS signature”)
ValueError: Invalid VSS signature

Then I ran fvdump.py against the backup BIOS, it produced 3 files.
Next, I ran vardump.py against fv-00390000.bin and it failed :

python vardump.py fv-00390000.bin
Traceback (most recent call last):
File “vardump.py”, line 80, in
v = VAR(vdb)
File “vardump.py”, line 50, in init
raise ValueError(“Checksum error”)
ValueError: Checksum error

It seems it’s the good file since running the command against the 2 others gives:

python vardump.py fv-00282000.bin
Traceback (most recent call last):
File “vardump.py”, line 71, in
raise ValueError(“Bad header”)
ValueError: Bad header

Here is the original BIOS: http://www.sendspace.com/file/dr3b5z
Here is the f12disable.py: http://www.sendspace.com/file/00gt5w
Here is the fv-00390000.bin: http://www.sendspace.com/file/z45xfm

Please, can someone can help to mod the BIOS?
Thank you very much.

-=Daemon=-: Hi. I’ve read all what you are wrote.Cool. But my notebook is Acer 5739G. Is it possible with your method enable VT function?
Thanks

Agus Suhanto: Confirmed worked for Acer Aspire 4935G, using the value for Acer Aspire 4930G posted by some comments above:

VSS_OFFSET = 0x000c0048
VSS_SIZE = 0x3fb8

PATCH_OFFSET = 0x1af
PATCH_VALUE = 0×01
PATCH_VARIABLE = u”Setup”

I did all the patching stuffs using Ubuntu 10.10 (Maverick Meerkat) 64 bit, then flashed the BIOS using memdisk as described by Marcan in this posting.

AS4930G: What is your BIOS version?

Agus Suhanto: My BIOS version for Acer Aspire 4935G is: 1.08

Jorgen: It didnt work on my Acer 5315… Dumped the bios.. ran the script vtenable.py on the dumped file… flashed the modified file back… Everything said it worked, but the vmware checker said 64 bit guest failed. Help

Ed: I have over 300 Sony VGC-JS220NB ALL-IN-ONE desktops

Ed: sorry trying again.

I have 320 of these Sony desktops below is the output from SiSoftware Sandra showing BIOS and MB information and much more. I need to enable Wake on LAN rather than VT (well maby 1 of them needs VT ;-)> ).

Can you give me a step-by-step on what you need to know so I can fix these? I have been trying for 8 months to get SONY to give me a BIOS flash but monday they gave me contact information for the legal department, corp. speak for go pound sand / F-off.

Please help
these computers are scattered all over the state, 9 offices plus work-from-home. I just want to be able to reload the disk image without sitting at every keyboard.

Thank you

Computer
Model : Sony VGC-JS220N
Domain : MMHC-INC
Host Name : K2225T
User : Ed McKnight

Processor
Model : Pentium® Dual-Core CPU E5200 @ 2.50GHz
Speed : 2.5GHz
Cores per Processor : 2 Unit(s)
Threads per Core : 1 Unit(s)
Type : Dual-Core
Integrated Data Cache : 2x 32kB, Synchronous, Write-Thru, 8-way, 64 byte line size
L2 On-board Cache : 2MB, ECC, Synchronous, ATC, 8-way, 64 byte line size, 2 threads sharing

Computer
Mainboard : Sony VAIO
BIOS : AMI R0283T4 01/15/2009
Bus(es) : ISA PCI PCIe IMB USB FireWire/1394 i2c/SMBus
Multi-Processor (MP) Support : No
Multi-Processor Advanced PIC (APIC) : Yes
Total Memory : 1.86GB DIMM DDR2

Chipset
Model : Sony P45/P43/G45/G43 DRAM Controller
Front Side Bus Speed : 4x 200MHz (800MHz)
Total Memory : 2GB DIMM DDR2
Shared Memory : 128MB
Memory Bus Speed : 2x 400MHz (800MHz)

Memory Module(s)
Memory Module : Hynix (Hyundai) HYMP125S64CP8-S6 2GB DDR2 SO-DIMM PC2-6400U DDR2-800 (5-6-6-18 3-24-6-3)

Video System
Video Adapter : Intel® G45/G43 Express Chipset (8 SM4.0, 128MB DDR3, Integrated Graphics)

Storage Devices
ST3320813AS (320GB, SATA300, 3.5”, 7200rpm, NCQ, 8MB Cache) : 298GB (C:)
RICOH R5C822 : N/A (F:)
RICOH R5C592 : N/A (H:)
USB Flash Disk 1GB (USB) : 956MB (E:)
Optiarc DVD RW AD-7590S (SATA150, DVD+-RW, CD-RW, 2MB Cache) : N/A (D:)

Logical Storage Devices
Recovery : 9GB (NTFS)
Hard Disk (C:) : 289GB (NTFS) @ ST3320813AS (320GB, SATA300, 3.5”, 7200rpm, NCQ, 8MB Cache)
Optical Drive (D:) : N/A @ Optiarc DVD RW AD-7590S (SATA150, DVD+-RW, CD-RW, 2MB Cache)
Removable Drive (F:) : N/A @ RICOH R5C822
Removable Drive (H:) : N/A @ RICOH R5C592
Removable Drive (E:) : 947MB (FAT32) @ USB Flash Disk 1GB (USB)

Peripherals
LPC Hub Controller 1 : Sony LPC Interface Controller
Audio Device : Sony HD Audio Controller
Audio Codec : Realtek Semiconductor High Definition Audio
Disk Controller : Sony 4 port SATA IDE Controller
USB Controller 1 : Sony USB UHCI Controller #4
USB Controller 2 : Sony USB UHCI Controller #5
USB Controller 3 : Sony USB EHCI Controller #2
USB Controller 4 : Sony USB UHCI Controller #1
USB Controller 5 : Sony USB UHCI Controller #2
USB Controller 6 : Sony USB UHCI Controller #3
USB Controller 7 : Sony USB EHCI Controller #1
FireWire/1394 Controller 1 : Sony R5C832 IEEE-1394 Controller
SMBus/i2c Controller 1 : Intel 801xx/63xx SMBus

Printers and Faxes
Printer : Microsoft XPS Document Writer (600x600, Colour)
Printer : Microsoft Office Document Image Writer Driver (200x200)
Printer : CutePDF Writer (4000x4000, Colour)
Printer : HP Color LaserJet 3600 (600x600, Colour)
Printer : HP LaserJet 5Si (600x600)
Printer : HP LaserJet 4050 Series PCL (600x600)
Printer : HP Color LaserJet 3700 PCL 6 (600x600, Colour)
Printer : HP LaserJet 4050 Series PCL (600x600)
Printer : HP LaserJet 4000 Series PCL (600x600)
Printer : HP LaserJet 4050 Series PCL (600x600)
Printer : HP LaserJet 4 Plus (600x600)

Scanners and Cameras
Digital Camera : RICOH R5C592 (Digital Camera, USB)
Digital Camera : RICOH R5C822 (Digital Camera, USB)

Peripherals
Media Player : ()
Media Player : ()
Media Player : USB Flash Disk (947.25MB)

Network Services
Network Adapter : Intel® 82567V-2 Gigabit Network Connection (Ethernet, 100Mbps)

Power Management
Mains (AC) Line Status : On-Line

Operating System
Windows System : Microsoft Windows Vista Business 6.00.6002 (Service Pack 2)
Platform Compliance : x86

Windows Experience Index
Current System : 3.4

.NetRolller 3D: Jorgen: For the 5315, there is a better solution - use either the bios posted by me or the one by Dummy earlier in this thread (don’t worry, the Acer 5315, 5715, 5720, 7320, 7720, and the eMachines e510 all use the same BIOS). Both will give you access to the Advanced menu containing the VT config option.

.NetRolller 3D: Ed: Unfortunately the VGC-JS220N/B seems to have a legacy 16-bit AMI BIOS, as opposed to an EFI. I don’t know much about modding legacy BIOSes - try asking on Wim’s BIOS.

Tjeutje: Few weeks ago I decided to try if a memory upgrade to 8GB is possible for my 6935G. So I bought 2 4GB modules. However….no go, the BIOS freezes on startup. Too bad.

Then I tried 1x2GB + 1x4GB. Working! Now my 6935G is running 6GB. By the way, 1x4GB, leaving the other memory bay empty is working also. I suspect that running 8GB is restricted by BIOS in some way, because the PM45 chipset should support it. Who has an idea if an 8GB patch for the BIOS could be possible?

happyle: I could not find main.py in http://marcansoft.com/uploads/insydehacks/

Can you give me~

djbarney: I’ve been wanting to enable vt on my aspire 7720g for ages, but never really got to it because of the first instructions not working for me. Just got my laptop “upgraded” with Netrolller’s patch though, thanks a million for that one m8! Finally able to use vt for virtual pc and proper vmware support, Really appreciate the work u’ve put in to this!

AS4930G: Hi .NetRolller 3D,
I’ve just tried your BIOS (again). (Link http://marcan.st/blog/2009/06/enabling-intel-vt-on-the-aspire-8930g/comment-page-9/#comment-1114)
In your post, you said that:
”…Once flashed, go to Setup and press the Right Arrow key to replace the Information menu with Advanced :-) …”
but when I pressed the right arrow key, it switched to the next tab “Main” (date/time, SATAmode, F12 boot, etc.). Maybe I’ve done something wrong. Could you give me some advice? Thanks.

.NetRolller 3D: AS4930G: That BIOS is waaaay outdated. Try the “advmenu-v2” BIOS, it provides a much better solution for revealing the extra menu. Or, see Dummy’s BIOS for an even more decent solution (though his release does have a few glitches - he privately sent me fixed versions, but I need to ask him about releasing them here.)

AS4930G: Hi .NetRolller 3D,
Thanks for your reply, I’ve downloaded the file http://ifile.it/2zuiaf7/jal90_1.20_hpslic21_advmenu.fd from your post ( http://marcan.st/blog/2009/06/enabling-intel-vt-on-the-aspire-8930g/comment-page-9/#comment-1107 ), flashed successfully. My BIOS start up screen shows the white logo Intel Advanced edition but I do not know how to get to the Adv menu. Could you please show me the steps? Thank you very much.

.NetRolller 3D: Oh, sorry, you are using a JAL90. That’s still a work-in-progress; the JAL90 (e.g. 4930) uses a different way of hiding the menus, apparently based on their name (or perhaps the string ID of the name). Unfortunately for me, the JAL90 has a 64-bit EFI (ICL50 has 32-bit), for which I’ve only very recently found reverse-engineering tools. The BIOS you downloaded was just an experiment - it doesn’t actually reveal the advanced menu.

AS4930G: Thank you for your detailed reply. I wish you can find the solution soon.

bananaEgg: Hi, im 4935G user. I don’t really understand on how to dump my bios. Can someone guide?

OS: win7+ubuntu 10.10

cpmprofit: First time, i see such a good website :) Fantastic posting and cool informations.

djpety: @dummy: Can you reupload your bios? NetRolllers is nice, but the scrolling is buggy :).

djpety: I forgot to say Happy New Year! And I have Acer Aspire 5720Z, your bios with undervolt will works? (I have DualCore T2370, and I bought a T7300, so I will upgrade next week:)

aksuda: OK so I’ve been trying to get anywhere with this and basically here’s the problem I’m stuck with.

When trying to run main.py, it keeps giving me this:

python main.py

Traceback (most recent call last):
File “main.py”, line 39, in
from dumpsetup import StringTable, Form, FormOp
File “/media/10CE-F156/bios hack/dumpsetup.py”, line 271, in
pe = open(sys.argv[1], “rb”).read()
IndexError: list index out of range

Apparently it’s not getting past the dumpsetup.py call for the Form class - like its expecting another argument - but I’m not seeing anyone on here passing a second argument to main in order for it to run… what am i missing?

Go4: hy
i’ve a acer aspire one aoa 110 ( aoa 150 zg5 )
whit the “same” insyde h2o bios
i tried to enable the adv.menu but gives me error:
Quote:
Loading BIOS…
Loading VSS…
Traceback (most recent call last):
File “advanced_menu.py”, line 82, in
raise ValueError(“Invalid VSS signature”)
ValueError: Invalid VSS signature
so i opened the bios file (3310.fd downloaded from acer site) in winhex
found the VSS but there are 2 of them
starting at different offsets

first ($Vss) 24 is to c0048
the yy after is to c004c

the second ($Vss) 24 is to e4608
the u after is to e460c

(i’m going wild with all this numbers)
please help me to set:

VSS_OFFSET = ?
VSS_SIZE = ?

PATCH_OFFSET = ?
PATCH_VALUE = ?

do i need to dump the bios or its good that from the support site?

dummy: @djpety: Happy New Year to you too. Here is the newer version:

http://ifile.it/2vh5781/Aspire7720BiosModVersionG.zip

Please check the readme file carefully. Undervolting will work for all T7xxx CPU’s (CPUID 6Fx). Note that the SLIC has also been updated.

dummy: Forgot to mention that we have worked on this version together, NetRoller3D and myself. Many thanks to NetRoller3D!

auxtin: @dummy

Know anything about the 5742Z? I’d like to try your bios but I don’t want to brick anything.

In fact, has ANYONE had any luck trying any of this on an Aspire 5742Z?

dummy: @auxtin
Looking at the hardware configuration, I would not flash the bios of 7720 on a 5742Z. Better follow the procedures above to modify the setup variables. If you want to enable hidden setup menus you may need to redo the same work as we have but for your model. In all likelihood, your bios and setup browser are quite different and most likely much more recent.

SteveECrane: Dummy,

Hello! 03:40 in the UK - I have a (laptop) problem!!!

I have an Acer 7720G which I dual-boot for work and to use as a Music DAW. It has Vista Ultimate (yeah, I know) and Windows XP O/Ss installed (both at their very latest SP and MS patches).

I bought it as I knew I would be filling it with VSTi plug-ins with humongous sample libraries (for use in Steinberg’s Cubase v5) and it was one of the few (reputable) laptops at the time which could have a second hard-drive installed.

Anyways, it has always had problems with DPC Latency issues which, via MS’s RATTv3 analysis tool, appeared to be predominantly down to the ACPI.sys interrupting the system.

Regardless, after a LOT of trial and error (disabling services and removing drivers and any other recommended ‘tweaks’), I still had a laptop which suffered from audio drop-outs and crackles due to excessively high DPC’s.

As such, after finding that suspending the ACPI thread (using SysInternals’ “Process Explorer”) yielded significant (audio) performance benefits, I decided to go the whole hog and give this a go:

http://www.cubase.net/phpbb2/viewtopic.php?p=846884&sid=5d2d7f05e59fa7d6b5ae71f0b8c4bd1b

by employing MPS instead of ACPI. Unfortunately, my laptop will no longer boot into the WinXP partition as, I believe, the Insyde BIOS is hard-coded to expect an ACPI-based O/S (or the BIOS simply does not allow access to the menu items to ‘disable’ ACPI as, say, a desktop with Phoenix or AMIBIOS would!).

So, is it worth me installing this BIOS:

http://ifile.it/2vh5781/Aspire7720BiosModVersionG.zip ?

In other words, will it allow me any significant/relevant control over the ACPI mode from within the BIOS’s ‘additional’ menus? If not, are there any other menu items in there which might help with my audio performance issues (just thought I’d ask!)?

My only concern here is that whatever I do to the BIOS for the WinXP partition I will have to accept that it will affect the Vista one (unless I manually configure the BIOS each time I boot into a different O/S; however, given I only ever use this for work (MS Office, Photoshop, SWiSH, Firefox, et al) and browsing from home, there shouldn’t be any real issues with the compromises I’m likely to have to make.

Thanks for such an excellent blog - I’m no Systems Analyst … but it’s self-evident a lot of work has gone into resolving Insyde’s/Acer’s BIOS shortcomings. I too tried both Acer and Insyde for a solution to my specific problems … and, after an all-too-brief series of exchanges, they simply said, “..you’re on your own - use what you’ve got or go elsewhere”!!!

Ah well, no more Acers for me then.

Cheers,

Steve.

dummy: @SteveECrane,
In your case, I would load the Aspire7720 Bios published here (version G). It should not affect anything regarding OS compatibility.

I did not experience any DPC issues myself and I have no complaints about audio. Earlier bios versions, especially before v1.32 had a lot of audo issues, but these seem to be gone now for me. I think you should experiment with the PCI latency. That option is in the setup menu. The default is fairly high (64). Regarding ACPI you can have a choice of ACPI level (1 or 3), but I think you cannot switch it off alltogether.

I think you should try to solve your problem by tweeking the PCI latency. I believe that ACPI should not really be the issue in this notebook.

I share your frustration with Acer but in all fairness most other manufacturers seem to follow the same trend as Acer regarding BIOS options. I have a recent AMIBIOS on another notebook and it is even worse than Acer’s Insyde!

Rizwan: Hi,
Anyone enabled VT-X on emachines E732 (Insyde H20 Ver 1.06) noteboot? if so please let me know.

Thanks in Advance

Regards,
Rizwan

nikka: [quote]
Tjeutje Says:

November 26th, 2010 at 9:46 am
Few weeks ago I decided to try if a memory upgrade to 8GB is possible for my 6935G. So I bought 2 4GB modules. However….no go, the BIOS freezes on startup. Too bad.

Then I tried 1x2GB + 1x4GB. Working! Now my 6935G is running 6GB. By the way, 1x4GB, leaving the other memory bay empty is working also. I suspect that running 8GB is restricted by BIOS in some way, because the PM45 chipset should support it. Who has an idea if an 8GB patch for the BIOS could be possible?
[\quote]
I have the same problem with my acer aspire 8930g core2 quadcore…!!!!
Please if someone has the same trouble, and have fix it, put new post

thanks in advance

mortifactor: Hi, i have eMachines E642G laptop, it is very similar to acer aspire 5551/5552/etc. It has AMD Athlon cpu (i have athlon II x2 p340).
I’m interested in unlocking advanced menus in bios.
Bios files for theese laptops are 2mb size, and has latest 2.07 version (all of them are available on acer website)

Maybe anyone have this kind of laptops?
thanks in advance.

xmm: Thanks to dummy and NetRoller3D for greate work!
Image Aspire7720BiosModVersionG works on 5720G cpu T7100.
VTx tested using KVM.

jguernsey: I have an HP G72-262nr, the BIOS is Insyde, ID is 1484, version F.32 I’m currently trying to get VT-x enabled and not having any success. Has anyone enabled VT-x on this model or something similar?

Michael: Hi Marcan,

After I have installed the Windows 7 Ultimate x 64 in my Aspire 8930G and run the VMware player to open a win7 virtual machine, a pop up window warned me that the VT had been disabled in the BIOS.

Since I am not a software engineer as you, I don’t know how to edit the BIOS. Can you send your BIOS to me so that I can replace my BIOS by yours ?

Thank you for your help.

Michael

AS4930G: Hi Michael,
Please search the above comments to see whether some 8930G user has successfully patched the BIOS. If yes, you can ask him to send you the patched BIOS; otherwise, it is not possible to grab other model’s BIOS, since every model has a slightly different hardware configuration.
Many people who have successfully patched their BIOS are not software engineers. They are just enthusiastic people who read the instruction carefully enough to do it themselves. Hopefully, you could be one of them, too.

Michael: Hi AS4930G,

Do you mean that if I follow the steps which Marcan listed out in the article, I can enable the VT ?
Do I need some special hardware tool to edit the BIOS ?
There are many points that I don’t understand what he said in the article.
Will I damage my computer if I do something wrong in the step ?
Can I restore the old BIOS if I find I have done something wrong in the step ?

Thank you for your help.

Michael

AS4930G: Hi Michael,
Here is a patched BIOS for 8930G http://marcan.st/blog/2009/06/enabling-intel-vt-on-the-aspire-8930g/comment-page-9/#comment-1109 , which is done by .NetRolller 3D.
You should fully understand the risk you may take when doing this hacking stuff. All the information is posted in the article and the comments above.

Michael: Hi AS4930G,

Sorry to trouble you again.

Do you mean that the file in the below URL is the correct BIOS which enable VT in 8930G ?
http://ifile.it/forgpjd/km2_114_slic21_advmenu.fd

Do I only replace my BIOS by it and everything will be alright ?

Anyway, no matter whether it can work or not, I really appreciate your help.

Michael

AS4930G: Hi Michael,
I’m not sure, maybe you should wait for .NetRolller 3D’s reply.
The major drawback when using this BIOS is that your laptop’s serial could be cleared.
Anyway, I’m just a novice; and I’m feeling shameful for talking so much without enough knowledge.

.NetRolller 3D: AFAIK it does not clear the laptop serial (it is a modified factory BIOS, and was not built from a backup/dumped BIOS); however IIRC it doesn’t actually reveal the advanced menu, it was just an experiment. I will post a proper version soon, once my exams are over.

Charkow: Great work, thank you very much. This worked with my 7720G. I ran the python scripts on Windows with Python version 2.7 and verified them on a virtual SUSE Linux 11.2 installation (MS Virtual PC). As the main.py gave me the same output as MaxL, I used his vtenable.py script to generate the new BIOS file.
Thanx again.

Beastman: Hi there,

does not work with my ACER Aspire 6935G T6400 and bios version 1.20

vbindiff shows the differences between original 1.20 bios and pythonscript-modified 1.20 bios, but after flashing the modified bios, securable.exe shows as red NO for hardware virtualization…

weinter: Hi, BeastMan
According to Intel http://ark.intel.com/Product.aspx?id=40479
T6400 does not support VT. You need a Processor Upgrade to enable VT.

Beastman: @weinter:

arg, damn. thanx for the info. my google-foo seems bad…

Shrek: Just reporting that I finally worked up the courage to try the procedure on my 8930G. It worked without a hitch. I am now running BIOS v1.20 and a 64-bit VM under VMware. Marcan, thank you very much.

To be honest, I knew nothing about virtualisation when I bought the machine so it was not a consideration. Nothing turned up during my research, probably because it was a brand new model at the time. Now that I know, I will be certain to check whether Intel VT can be set in the BIOS menus before I buy. I am not certain whether I will ever buy another Acer, even if the machine is not crippled like this.

Has anyone upgraded his machine’s RAM to 8 GB? I believe that that question has been asked here (or maybe on another site) but I have not seen an answer.

.NetRolller 3D: Can you post a stock 8930G BIOS v1.20 (or perhaps a SLIC-modded one)? I believe I’ve found a way to perma-patch 8930G, but I only have the 1.14 image.

Michael: Hi all,
A good news to all of us, Acer has upgraded the Aspire 8930G BIOS from v1.2 to v1.21 which supports VT-x. Today, the technical staff of Acer upgrades my BIOS and I can run the VMware player to open a win7 64-bit virtual machine. Later, all of us can download this new version BIOS from Acer web site.
The only disappointment is that the Aspire 8930G cannot support 8GB RAM. I try to upgrade the RAM size from 4GB to 8GB. Finally, the notebook can only recognize 6GB !! My notebook CPU is T9600, 2.8GHz , with GeForce 9700M GT.

moraes.alvarez: I’ve got an aspire 5532 with a tl-58 turion I put myself (came with tf-20). I dumped the bios (1 MB) and fvdump it, then I used vardump provided to faithx on the correct file and got the output to a text file. I don’t quite figure how to find the offset to change in vtenable.py though.

Not sure I should be doing this anyway.

Seems I have to extract the LZMA firmware volume, then run fvdump on that, then fsdump to extract the filesystem.

I tried lzma on the bios I extracted with no result (is my bios not compressed).

Then I understand I should find Setup tool file, then find the beginning of the Setup form layout tables (which I should recognize easily, i think), then use another tool (which would it be?) on that to get a human-readable Setup menu dump where I might find the AMD-V Enable offset.

After that should I change the offset value in vtenable.py ans use it?

One more question? Where can I find main.py? A few strategies I didn’t try for the lack of this file.

NotAGooner: Unfortunately, my Vaio VGN-NS20J doesn’t have the VT but is there anyway to adjust that python script to enable the FULL EFI menu?

Thanks

emperor03: Hi guys, hurmm, i was wondering whether u have the vt-enabling BIOS for acer 4925?

Kain: Can someone see tif they can enable the bios for the Aspire 5551(Non-G) I need the power options, basically the 5551’s have a problem where the ACPI tables are calibrated wrong and I have heard that using the Advanced menu you can correct this but acer won’t help and I have no idea how to do it.

thx

Alphading: Can you send a modded bios version of Acer aspire 4930??

I can enter into bios and I cant get access to the advanced menu, when I try to run AHCI SATA mode, the windows starting up half way then it crush into a blue screen and then restart again. Only the IDE mode can successfully get into the windows 7. It happened after i update my bios to 1.22 from acer website.

please helppppp

Mihailo: Dear Marcan,

Can you please provide me with GENERIC Insyde H2O bios.
I have sony vaio tt notebook.
Would be great if I can change option like AHCI mode, Enable or Disable device and all other advance options.

thanx in advance

Forags Li: Hi AS4930G,

I new in this field.
Could you share the BIOS for 4930G which patch by you for me.
I do need the enable the vt-x.
You may send me an email to me or upload to any website.
My email is forags[#]gmail.com.
(replace [#] with @).
Thanks.

marcan: I’ve updated the post with a link to a clean 1.21 update file for the 8930G, which already has VT enabled natively.

Remember guys: there is NO such thing as a generic BIOS. And you should NOT install dumps from one laptop onto another laptop, even of the same model, because it will overwrite your serial numbers and other settings. You should only ever install official update files. If you need to patch a setting to enable VT, install a clean BIOS update FIRST, then dump YOUR OWN BIOS (don’t use someone else’s dump and don’t use a vanilla update file), then patch the VT setting, then flash YOUR own patched BIOS. vtena.py (and derivatives) does NOT patch the BIOS, it patches a setting, so it will NOT work on BIOS update files (only on a dump) and it is impossible to make a generic “VT-enabled” BIOS file that works the same way as official updates.

The 1.21 update I uploaded has been cleaned up from the dump to behave like an original update and won’t overwrite your serial numbers, so you can flash that directly. It does not rely on any patch as it supports VT natively.

arthur: do you help me?open vt on the acer4745G?thankyou very much!!!

arthur: my email:nx001001@163.com
thank you!!!

Romeo: Hi

Im using Acer Aspire 2930z, Intel® Pentium® dual-core mobile processor T3400. Windows 7 x64bit

i upgrade my BIOS to 1.17 but still my VT is showing disabled.

How can i enable my VT??

Thanks

alterpeople: Hi folks!
thanks alot , it worked 4 me 2.

just run this to solve liblzmadec.so missing issue under ubuntu 11.04 64bit

sudo apt-get install alien

wget ftp://mirror.switch.ch/pool/2/mirror/fedora/linux/development/rawhide/x86_64/os/Packages/lzma-libs-4.32.7-5.fc15.x86_64.rpm

sudo alien -i lzma-libs-4.32.7-5.fc15.x86_64.rpm

Sjoeter: i have an 6935G
if i download the latest bios file (v1.20) from acer for my laptop and extract it the directory the update’s in has 8930 on the end (BIOS_Acer_1.20_Windows_AS8930) does this mean that i can run the 1.21 update for the 8930?
I checked the ID’s and there booth KM2/TT2 on v1.20 & v1.21

Sjoeter: Works like a charm :)

cmarslett: Mihailo, I cannot agree with marcan more. Not only is there no generic BIOS (or generic Insyde BIOS), but even for a single company doing their own thing, the BIOSes change enough from release to release that they often will not let you downgrade the BIOS because occasionally they change something that is not easily reversible.

Follow marcan’s advice. He’s right on!

.NetRolller 3D: I have to counter Marcan’s April 7th post a bit: the 5720G BIOS I posted earlier is essentially generic, because it was made by directly modifying the SetupUtility so that it defaults to VT-enabled (and also exposes the VT setting to the user). Other “generic” mods can also be made he same way (by editing the Forms data in SetupUtility.pe so that VT defaults to On) - quite likely the 1.21 update for 8930G was patched by this method.

However, any BIOS that was patched using vtenable.py will be tied to the machine it was made on, due to the serial numbers included in it.

DiablilloNet: Hello.
I have a Aspire 2930 and i changed the CPU P7300 for a T7300 with Intel VT support, but it is deactivated and i can’t switching to on in bios. Please i need help.
I’ve folllow the instructions and i have the next error:

ubuntu@ubuntu:~/Desktop$ python vtenable.py original_bios.fd vtenable.fd
Loading BIOS…
Loading VSS…
Traceback (most recent call last):
File “vtenable.py”, line 100, in
raise ValueError(“Variable not found!”)
ValueError: Variable not found!

Any ideas?

CyberWalrus: Hi,
Has anyone got any info on how to work out the offset for the string table? I am trying to enable the advanced menu in my vaio SA’s bios, I have extracted the setup utility section, but none of the offsets for STRING_TABLE in the various versions of dumpsetup.py here work.
http://www.mediafire.com/?zem3bm5ll9pzn46
There’s the bios and all the things I have managed to get out of it so far, if any of the experts here are kind enough to take a look

DoZe: Hi :)

Where to find the modded version G of 7720 v1.45 please ?
Regards :)

.NetRolller 3D: 7720G is the same as 5720G. “MXM Edition” is the latest release available.

DoZe: Ok.

http://ifile.it/2vh5781/Aspire7720BiosModVersionG.zip

This one is older than the “MXM edition” version ?

toast: Marcan, think you could show us how to hack the 1.21 BIOS to allow 8GB of RAM??

Tony: hello,

i have an Aspire 6935
updated to 1.20
This is what I get when I try to use python with this vtenable.py

C:\Python32>python vtenable.py KM2X64.fd KM2X64VT.fd
File “vtenable.py”, line 10
PATCH_VARIABLE = u”Setup”
^
SyntaxError: invalid syntax

How can I fix this?
Does anyone have a Modified file for me to download of the version 1.20?

Sjoeter Says:
May 4th, 2011 at 2:43 pm

i have an 6935G
if i download the latest bios file (v1.20) from acer for my laptop and extract it the directory the update’s in has 8930 on the end (BIOS_Acer_1.20_Windows_AS8930) does this mean that i can run the 1.21 update for the 8930?
I checked the ID’s and there booth KM2/TT2 on v1.20 & v1.21

Where can I download it if it works?

Rex: can anyone help?
Model: HP DV4-2145DX
BIOS VERSION: F18
Released :2010-07-23
Bios Type : Insyde
Bios Link: ftp://ftp.hp.com/pub/softpaq/sp49501-50000/sp49543.exe

Problem: When installing windows7, it doesn’t show the HDD drive to install. (even though ATI 11-7_win7_32-64_AHCI drivers are loaded properly)

Need SATA - IDE advacned menu.

7720g_user: Hi guys!
Link http://ifile.it/2vh5781/Aspire7720BiosModVersionG.zip broken : (
Somebody can upload file again, please.

Thanks

CZ: Acer Aspire 4935G
Fully-Unlock Insyde BIOS Request

May I request to unlock the said BIOS into fully functional firmware that shows all available menu for this type of system model.
For example: I’m looking for the Advance, Power, Diagnostic, and System Configuration Menu. And also the option to enable/disable the Hardware-Assisted Virtualization or the Intel VT.

- Manufacturer: Acer
- Model : Aspire 4935G
- Bios Type : InsydeH20 Rev.3.5
- Bios Version : V1.08
- Bios Link : http://global-download.acer.com/GDFiles/BIOS/BIOS/BIOS_Acer_1.08_A_A.zip?acerid=633977522779406837&Step1=Notebook&Step2=Aspire&Step3=Aspire%204935G&OS=V10&LC=en&BC=Acer&SC=AAP_7

Thank you for the assistance!

Dummy: @7720g_user
You have probably found it somewhere by now. If not, let me know by replying here. There is just one minor update I would like to incorporate and I can then release a successor version.

DoZe: DoZe Says:
July 21st, 2011 at 11:13 pm

Hi

Where to find the modded version G of 7720 v1.45 please ?
Regards

.NetRolller 3D Says:
July 23rd, 2011 at 4:53 pm

7720G is the same as 5720G. “MXM Edition” is the latest release available.

DoZe Says:
July 24th, 2011 at 2:47 am

Ok.

http://ifile.it/2vh5781/Aspire7720BiosModVersionG.zip

This one is older than the “MXM edition” version ?

@Dummy :

No response from Netroller, if you could resolve this too. :o)

DoZe: @7720G :

the last one i know fully functional (fully unlocked and slic2.1 too)
seems to be this one :

http://ifile.it/gphdn85/icl50_1.45_slic21_advmenu_mxmfix_v3.fd

For more details , see this thread by Netroller here :

http://forum.notebookreview.com/acer/575866-possible-fix-acer-x920g-vs-geforce-9600m-gt-issue.html

DoZe: @CooLZero (CZ) :

you have a new version here xOD :

http://www.bios-mods.com/forum/Thread-RE-MOD-Request-Acer-Aspire-4935G-Fully-Unlock-Insyde-Bios-Request

dummy: @DoZe, 7720g_user

Please describe your CPU model and graphics model.

Here is the newest version: http://ifile.it/tc0padq/Aspire7720BiosModVersionH.zip

Make sure you check the readme file!

DoZe: @Dummy :

Thanks a LOT ! :OD
Mine have a T8100 and 8400M GS.

I flash it with versionH (the “MXM Edition” disappear from logo screen)
Can you tell me i you have a Forum ,who explain the change inside Version
G & H ?

Regards !

CZ: @DoZe

RE: http://marcan.st/blog/2009/06/enabling-intel-vt-on-the-aspire-8930g/comment-page-10/#comment-57586

thank you. but the new version of that mod is still not working.

hope you can help me too… thanks!

dummy: @DoZe
The only difference between version G and H is the voltage curve for the T7500 cpu. Voltage curve for T7300 cpu is unchanged betweem version G and H. Since you have a T8100, there is no undervolting so version G and H would be the same for you. You have 8400M GS graphics, then you don’t need an MXM patch. Enjoy.

DK: I followed your instructions about 2 years ago on my 8390G with BIOS 1.10. All worked fine but I did lose my serial number and UUID (other variables seem to have been unaffected). I have tried to use various versions of “dmi” to put them back but they never worked (either because they are 16-bit applications that won’t run on my 64-bit Windows 7 [which only supports ³²⁄₆₄-bit applications] or they run and don’t do anything and don’t say why not!).

Does anyone know how to reinstate these values?

Can I use some program/python script to add them into the clean 1.21 update file mentioned above, so that when I flash it, they get put back?

Can I use a modified “platform.ini” file that comes with Acer’s BIOS and is used by “InsydeFlash.exe” to put them back? If so, how do I dump all the variables to ensure I put everything back as it should be?

Many thanks in advance.

Eric: @DK
Have you ever backed up the bios which involved the UUID and SN infomation.
If you did that , please send me and will help you find it . My email address funfee19@163.com

Doze: @dummy :

I suppose the latest “H” version contains the MXM patch from Netroller3D too ? Probably i want to update my VideoCard with 9600 or 9650m GT

I want to ask too, to you and Marcan if i can put some link to “olarila.com” forum.
They make Perfect DSDT.aml to have a fully functional Hackintosh. It helps a lot to make it, without tons of Kext to use, when DSDT is perfect.

Obviously, the latest “H” version have some errors after IASL compilation,
i suppose the DSDT is slightly different and i want to ask him to debug the existing Patch for all Acer who used the ICL50 and KAL10 (7720G,etc..) motherboard (same bios).

In case of the “H” version doesn’t contain the MXM patch is it possible
to make one ? i think it’s the best way to use the “ultimate modded” bios to avoid some correction at each time.

Hope you accept this request :O)

Regards,Ray

DK: @Eric

Many thanks for your help. Your DMI172 program did the trick whereas other DMI programs didn’t.

Agent_Pumuckl: Acer Aspire 6935G with BIOS 1.20 - No Problems at last

I followed the instructions given above. At first I tried to do this under Linux (64 bit) but Python (3.2) did not work with vtenable.py. That’s why I had to download Python 2.7 for Windows. Now everythink worked fine. (It is possible to boot the Freedos-image with Grub2 as well…)

Thanks to all of you!

Agent_Pumuckl: Fix for the following error message:

File “vtenable.py”, line 10
PATCH_VARIABLE = u”Setup”
^
SyntaxError: invalid syntax

I had this problem too: For me it was fixed when I used Python 2.7 for Windows (it probably works with the Linux version too).
With Python 3.2 “vtenable.py” does not work!

Good luck!

marcan: Python 3.x is not compatible with Python 2.x. In general it is not possible to write complex scripts that run on both. 3.x isn’t a direct upgrade to 2.x; you are expected to have both versions and use the right one. That’s why the python.org website prominently features both for download. Most people still use 2.x, and vtenable.py is written for Python 2.x.

Agent_Pumuckl: @marcan: Thank you for your explanation. I did not know this. Arch Linux (which I use) has per default python version 3 installed. It might be a good idea to mention the demanded version of python within the instructions above.

Best regards, Agent_Pumuckl

marcan: Arch Linux probably comes with both, it’s just that it probably defaults to 3.x. Try typing “python2.7” or “python2.6” or “python2” instead of just python.

dummy: @Doze
Version H does not contain the MXM patch. Please be patient a little. Work is in progress.

DoZe: @dummy

Ok, No problem to wait for your excellent work :O)

i’d prefer to wait (probable all people who comes here too) to have
the “Ultimate Top Notch” release as possible and make a perfect DSDT.aml
from “your” Bios (Perhaps you work with Netroller ? No ?)

If i could help you for beta testing (if bios failed, i have all the needed stuff (hot air soldering, SOIC eeprom programmer,etc…)

THANKS for all :O)

ipatch: Well, I guess I’m two years late to join the fun but oh well. I have an Acer laptop and was hopping to get UEFI boot option switched/turned on in the BIOS/EFI but it looks like there isn’t a switch for it, or I am looking for the wrong feature. I scanned over several of the text files but didn’t see anything related to UEFI The reason I ask about UEFI boot option is because I want to be able to load/boot Windows on a GPT formatted disk, and have read that this can be done if UEFI boot option is enabled in the firmware of the computer. I have an Acer 5336 laptop and it is using the Insyde EFI, so I don’t understand how difficult it would be to get a UEFI boot option enabled in the firmware.

Right now as it stands Windows 7 will complain about the disk being formatted with a GPT partition table and not install on the disk. Any thoughts?

DoZe: @Dummy :

Hi :o)

Do you know where is located the Firewire MaC address in your latest Bios ?
I know the Mac address is on a sticker. I need to know Because, apparently
the Mac adress seems to be filled with 0000000000 ;O(

Regards

PS : Have you finished your Bios ?

Aphexx: Tnx Dummy, your work’s much appreciated.
I was in need of activating VT mode on my 7720G…

Jhonny: Hello,
I hope you can help me, and you would also…
Here`s my problem:
I have a notebook Acer Aspire 4410 with H2O bios. I wanted to do a bios update from Acer site, but something went wrong (very).
Now my laptop is stuck on startup on “press F2 to enter setup” screen, and no button is working
Please, if there is something else to do beside replaceing BIOS chipset, teach me!!
My entire work is on this laptop!
HELP ME PLEASE!
Thank you in advance!
Jhonny (Nelu in Romania)

Jhonny: I forgot to tell you:
My OS: Win7 Ultimate
anny other detail you need for solving my problem, I`m here!
Thanks!

DoZe: @jhonny :

Please read this :

http://forums.mydigitallife.info/threads/13095-Undocumented-INSYDE-BIOS-recovery-method.-Use-andy-s-tool-to-obtain-possible-names.

petete20: Thank you very much for the help has been vital to enable it, because ACER had told me not to BIOS and nothing else, I’ve uploaded the modified BIOS for ACER ASPIRE 6935G to megaupload, http://www.megaupload.com/?d=JF86JB06 . I hope they serve.

Chris: Hi all,

I have the same problem with my newly bought Acer Aspire 4830TG. The hardware supports VT, but I can not do this more active in the BIOS, it is also hidden.
I followed the instructions of Marcan’s blog but unfortunately I have bollger the same problem like many others.

My mistake:
C: \ Python26> vtenable.py original_bios.fd vt_bios.fd
Loading BIOS …
VSS Loading …
Traceback <most recent call last):
File “C: \ Python26 \ vtenable.py”, line 88, in
raise ValueError (“Invalid signature VSS”)
ValueError: Invalid signature VSS

My system data:
OS: Windows 7 H / P x64
Python 2.6 for Win7

Furthermore, it is included for the new Aspire series platform.ini unfortunately no longer in the bios. The structure of the Bios or Bios update was unfortunately changed. You do not direkteen no relationship between the blog and the new drag and drop files. In this update, there is unfortunately only one mp.ini entries with others. :-(.

I tried a lot and I would answer a very meaningful look. I need the VT mode’m sorry for my studies really set on this device due to financial need. For your answers in advance thank you!

Regards
Chris

DoZe: @chris :

Check & Try this, i suppose VT option are unhidden too. Hope you a have a CPU who support VT function.

http://forums.mydigitallife.info/threads/7033-Insyde-bios-mod-requests./page693?p=443260&viewfull=1#post443260

starpc.nl: i wan’t to know if this is a 100% good and save bios update// let me know

starpc.nl: i want whit out the n’t

starpc.nl: already do it works fine. but i haven’t Enabling Intel VT. in that update i can hit F2 for setup but still no Intel VT ??

Stomp: For those having problems dumping memory on Ubuntu:

On most recent versions of Linux you cannot ‘dd’ /dev/mem anymore.

You need /dev/fmem. You can download the kernel module. Check out http://blogs.gnome.org/muelli/2010/04/imaging-ram-using-windd-devfmem-or-qemu/ for more infos.

viktor: I am modded VT - directly in VSS in my dump. I use vtenable.py. IT.s WORK !!!

VSS_OFFSET = 0x000C0048
VSS_SIZE = 0x3fb8

PATCH_OFFSET = 0x85
PATCH_VALUE = 0x10

PATCH_OFFSET = 0x1af
PATCH_VALUE = 0x01

But need flash from windows , from DOS flasher no flash my VSS data in bios or make some default value.

Alse i add value fot Suppress If

PATCH_OFFSET = 0x85
PATCH_VALUE = 0x10

But no open hidded menu. need some help ?

Some theard in - http://www.bios-mods.com/forum/Thread-Request-Emachine-E520-advanced-menu?pid=41946#pid41946

viktor: It be:
Emachine e520 - advanced menu or need open VT-x menu.
CPU:T7250

BIOS Info:
Name: Insyde H20
Bios Version: 1.06
Rev: 3.5

OIZHYY: Please help me!
I have a Quanta OEM machine,and use insyde bios also,and it has the “Andvance” menu but no “Power” menu,and it usually shutdown automaticly.So I want to change the Fan control.I use Insyde utility on windows backup the bios but it has a size of 4MB,So,how large is my bios?how to modfy it?

merxa: Succeeded on a Presario C700 laptop! These are the modifications I had to perform on the process:
- Used fmem, since I couldn’t read from /dev/mem on the specified address.
- dd parameters for 1MB BIOS (dd if=/dev/mem of=original_bios.fd bs=1024 count=1024 skip=4193280).
- Used MaxL modified “vtenable.py” script with the following parameter changes:
VSS_OFFSET = 0x000C0048
VSS_SIZE = 0x4000 - 0x48
PATCH_OFFSET = 0×bd <- this is the offset for the C700 BIOS
- Used the hidden BIOS recovery feature instead of flashing with the provider tool (read this: http://forums.mydigitallife.info/threads/13095-Undocumented-INSYDE-BIOS-recovery-method-Use-andy-s-tool-to-obtain-possible-names), with Windows+B key combination and using “IBL80HW.FD” as the BIOS file name.

Thanks a lot marcan and all of you people who posted your personal experiences!

RichardK: On the insyde bios version 17 for the amd 8 based HP laptop version dv7-6c20us is there any way to unlock the hidden advanced option in the bios it seems absurd not to be able to allocate memory or any other adjustments on a laptop one purchases

RichardK: also thanks in advance for any response what I feel is these new laptops by these vendors are suspect because many of the advertised processor speeds and features are apparently disabled via bios on system boards so that one never really experiences the full benefits of the newer processor speeds and functionalities can anyone ellaborate on this. Also if there is any looming class action suits being filed

manzamanna: Hi all, I know this topic is very old, but I’m trying to enable VT in my acer aspire one D255E.
The problem is, when it type
Code:

python main.py original_bios.fd

I get:
Code:

File “main.py”, line 39, in
from dumpsetup import StringTable, Form, FormOp
File “/home/you53r/Bios/hack/dumpsetup.py”, line 272, in
strings = StringTable(pe, STRING_TABLE)
File “/home/you53r/Bios/hack/dumpsetup.py”, line 41, in init
offsets = struct.unpack(”<%dI”%count, self.data[16:16+count*4])
struct.error: total struct size too long

My main.py and dumpsetup.py are these:
http://thechaw.com/insydecodr/source/main.py
http://thechaw.com/insydecodr/source/dumpsetup.py

My dumped bios file is this one:
https://rapidshare.com/files/3583042751/original_bios.fd.tar.gz

Can you please help me?

quizar: Thx guys for all yr comment i hav enabled nx on my insyde h2o v1.02 for upgrading win dev to win8 rlse prw

mike: Hi,

I hope that this topic is still alive!

I have got an ACER 1830T with (I think) a 4 MB BIOS v1.24 and want to enable the VT Option.

First Question: Do I really have to dump the bios, or can I use the update bios file from the acer website (http://global-download.acer.com/GDFiles/BIOS/BIOS/BIOS_Acer_1.24_A_A.zip?acerid=634529493491091869&Step1=Notebook&Step2=Aspire&Step3=Aspire 1830T&OS=721&LC=de&BC=Acer&SC=EMEA_8). This should be same, or not?

Second: running vtenable.py with the original bios file from the acer website fails with Invalid VSS signature. - Yes I noticed theat the script does not work on all bios, but does someone has a helping hand for me?

thanks in advance
regards mike

AS4930G: Hi Mike,

This is a reply from a normal user like you, I hope it helps.

1. You do have to dump the bios. They are not the same. If I remember correctly, you can find the reason in the above comments (yes, I used to read all of them before doing)

2. The original vtenable.py is not for your model (the vss offset, vss size, patch offset… are hard-coded in that python script). You have to determine these values by using the helper scripts provided (sorry I forgot which one, it’s been 3 years since I last patched my bios).

You can wait for some expert to reply; in the mean time, it’s good to read all the comments.

mike: hi as4930g,
thanks for your reply. It seems i have to keep on reading ;-)

I am a bit confused, because the original bios seems to be 4mb, while the backup - using the universal backup toolkit - says 2mb.

in the meantime i found a website with a modified original bios with open submenus. i would prefer modifing the bios on my own, instead of using a probably malicious bios. So I wait for some experts to reply.

Steve: I have an Acer 8930G Quadcore. I was searching for a way to enable VT and came across your blog. I used the posted 1.21 Bios which you had cleaned up and posted a link to. I used the Insydeflash utility that came with my previous 1.20 Bios and updated the Laptop to 1.21 in a snap.

No Problems, no hassle and 1 Minute duration (not counting the reboot). Everything went smooth. VT enabled. Config and Serial remained unchanged.

Thanks a million!

Mio Taalas: Hi!

I have Aacer aspire 8930g and I spent few days of looking an unlocked bios to get better performance when i’m upgrading to windows 7. It led me here and then… the links are dead :(

All links to the file: km2_114_slic21_advmenu.fd are dead and I can’t fnd the file from anywhere else.

This could be my only hope after many days of research. Can someone re-upload them?

Thank You.

stefanct: hello,

you have been asked if licensing your code under the MIT license is ok, but afaics you did not answer this. i have not checked if and how much your code influenced the code of “d6z” (http://thechaw.com/insydecodr) and trotsky (https://github.com/trotsky/insyde-tools). we (the coreboot project) are thinking about redistributing the (refined) code, but we want to make sure that the original author is ok with the license. are you?

marcan: I am (I think I missed the original question). I’ve updated all of the python scripts at http://marcansoft.com/uploads/insydehacks/ with the MIT header. d6z, feel free to do the same :)

darkwyvurne: Hi marcan,

I have an Acer 8930g which came with a T5800 which did not support VT-X, but I have replaced that with a T9300. Searching for a way to enable VT-X led me here and I have downloaded the 1.21 BIOS which you had cleaned up, and upgraded my system using the InsydeFlash utility available on Acer’s driver page.

Upon rebooting and entering BIOS, I can see that the BIOS version is 1.21 now. However, I am unable to find the option to enable/disable “Intel® Virtualization Technology (VT-x)” under Advanced.

Do you have any suggestions as to how I can get VT-X enabled on my laptop?

I should note, the T9300 came from a Dell Latitude that I had VT-X enabled on and was running 64-bit virtual machines from via VMware… until the motherboard died.

Thanks!
Thomas

stefanct: thanks marcan for your quick reply!

the other authors actually did add the MIT license to their files a long time ago, but without your (public) consent (hence the license was not really legitimate). thanks to your response i can prepare the existing source for inclusion in our bios_extract repository that contains various other tools related to x86 firmware dissection. if you are interested you can follow the review process here http://review.coreboot.org/#/q/project:bios_extract,n,z and the authoritative repository is located here: http://review.coreboot.org/gitweb?p=bios_extract.git

marcan: @darkwyvurne
v1.21 doesn’t have the menu option, but it should be hardcoded to enabled instead of disabled as before. You may have to clear your BIOS settings for it to reset to the right state, then just try a virtualization app and see whether it reports that VT is enabled.

@stefanct
Glad you found the tools (and d6z’s changes) useful. BTW, I’d appreciate it if you added my copyright line to the headers too, after the link to the blog post that d6z used :) (for dumpsetup.py and others with no copyright header that derive from the tools that I originally posted, you might have to add the whole header). No big deal, just want to make sure that the license is taken care of correctly.

uncleroxk: Hi,

I have a Acer 4935.
I need to have VT in order to run VM/Virtual box

- Manufacturer: Acer
- Model : Aspire 4935G
- Bios Type : InsydeH20 Rev.3.5
- Bios Version : V1.08

When i run sudo kvm-ok

INFO: /dev/kvm does not exist
HINT: sudo modprobe kvm_intel
INFO: Your CPU supports KVM extensions
INFO: KVM (vmx) is disabled by your BIOS
HINT: Enter your BIOS setup and enable Virtualization Technology (VT),
and then hard poweroff/poweron your system
KVM acceleration can NOT be used

I have tried to dump the BIOS using:
sudo dd if=/dev/mem of=original_bios.fd bs=1024 count=1024 skip=4193280

Able to tun main.py and get he necessary offset for the vtenable.py

But I am having error on the while loop…
Seems like there is a unicode character at the front of the var.name.

print “Hex: “ + strAsHex(var.name[0:1]) + “, Var: “ + var.name[1:] + “, status: “ + hex(var.status)

// Change by me, to skip comparing of the first byte
if var.name[1:] == PATCH_VARIABLE and var.status == 0x7f:
found = True

vtenable.py output:

Loading BIOS…
Loading VSS…
Hex: \xC1, Var: MTC, status: 0x7f
Hex: \x4E, Var: SmbiosPolicy, status: 0x7f
Hex: \x56, Var: Custom, status: 0x7c
Hex: \x27, Var: Lang, status: 0x7f
Hex: \x2F, Var: LangCodes, status: 0x7f
Hex: \xC5, Var: BackupLang, status: 0x7f
Hex: \x6E, Var: AcpiGlobalVariable, status: 0x7f
Hex: \x46, Var: SmmS3NvsData, status: 0x7f
Hex: \x51, Var: S4ResumeFlag, status: 0x7f
Hex: \x31, Var: ConIn, status: 0x7f
Hex: \x63, Var: ConOutDev, status: 0x7f
Hex: \x88, Var: ConOut, status: 0x7f
Hex: \x83, Var: BootDevice, status: 0x7d
Hex: \xE5, Var: Boot0000, status: 0x7f
Hex: \xD9, Var: Boot0001, status: 0x7f
Hex: \xDD, Var: Boot0002, status: 0x7f
Hex: \xE0, Var: LegacyDevOrder, status: 0x7f
Hex: \x8E, Var: Setup, status: 0x7c
Hex: \xC1, Var: Setup, status: 0x7c
Hex: \x83, Var: BootDevice, status: 0x7f
Hex: \xAE, Var: Boot0003, status: 0x7f
Hex: \xD0, Var: BootOrder, status: 0x7c
Hex: \xD0, Var: BootOrder, status: 0x7f
Hex: \xBE, Var: Setup, status: 0x7c
Hex: \x52, Var: Custom, status: 0x7f
Hex: \x6F, Var: CustomBootOrder, status: 0x7f
Hex: \x8E, Var: Setup, status: 0x7f
Old state:
Variable ‘\x8eSetup’
Attributes: 0x00000007
Status: 0x7f

So I have change the code to skip the first byte above…
then I got the error on var.update.

Then I have modify the VAR.update method:

FROM:
self.data += self.name.encode(‘utf-16le’) + “\x00\x00”

TO:
//I get the “\xFF” from the vbindiff…
self.data += self.name[0:1] + “\xFF” + self.name[1:].encode(‘utf-16le’)

Then on the ouput of the program, I get a bios with 1 byte different.
From 0C to 0E.
VT is still not enabled.

Does anybody know how do i fix it? and why do i get the extra byte at the front of the var.name?

Thanks

uncleroxk: To Add on:

My Offset in vtenable.py

VSS_OFFSET = 0x000c0048
VSS_SIZE = 0x3fb8

PATCH_OFFSET = 0x1af
PATCH_VALUE = 0x01
PATCH_VARIABLE = u’Setup’

faiz: Can someone unlock vt for hp CQ42-457TU laptop with Intel P6300 processor, because I’m still very new to understand it

DavideDG: Hi,
here: https://www.dropbox.com/sh/ugkoro10zf303cq/xUfmW-lsAc
there are some files of my laptop I’m trying to enable VT on.

acer-travelmate-6594_109_website.fd is the original BIOS rom from Acer’s website

jbios-original_bios-mine.fd is my bios dumped with jakobheinemann’s j-bios+fmem module (bs=2M count=1 skip=4094M).

fv-00151000_vardump_nochecksum.txt : I had to use the alternative vardump.py (no checksum) -> it can decode some variables…

Variable ‘Setup’
Attributes: 0x00000007
Iteration: 0x7c
VendorGUID: f4 27 4a a0 00 df 42 4d b5 52 39 51 13 02 11 3d
Value (0x323 bytes):

and (note the Iteration value changes):

Variable ‘Setup’
Attributes: 0x00000007
Iteration: 0x7f
VendorGUID: f4 27 4a a0 00 df 42 4d b5 52 39 51 13 02 11 3d
Value (0x323 bytes):

How should I proceed now? Should I change vtenable.py … with what?
Please help :D

TY - Davide.

Davide: I took time to read most of the comments and proceeded this far:

I dumped bios with a LIVE Fedora 17 with recompiled fmem.
Despite what platform.ini says (0xFFF00000), my /dev/mtrr says my only 2MB write-protected region is at 0xFFE00000
Also, the flash file from Acer’s site is 2112*1024 bytes, instead of 2MB.
Comparing the output of different dumps with the downloaded bios, I decided to trusted what mtrr was saying about size and offset.
So I dumped with:

dd if=/dev/fmem of=dump.fd bs=1 count=2097152 skip=4292870144

Davide: >>
Then compiled lzma utils for Ubuntu, replaced the find_library with static .so file and ran d6z’s main.py (after patching for the 0x26 EFI opcode).

(I cut some of the Blah: parts):

davide@ubuntu:~/biosmod/Insydecodr$ sudo python2.7 main.py
Opened BIOS ‘data/original_bios-mine.fd’ with md5:0ac91f2797a24e39891f053271dbf55c
Operating on BIOS data/original_bios-mine.fd size = 0x200000
Loading compressed sections
.. found 1 compressed sections
Locating Firmware Volumes
.. found 9 FirmwareVolumes (5 compressed)
Wrote SetupUtility to data/SetupUtility-mine.pe
Size = 0x7c940 MD5: ef1fcd78281a5f2fbc789b0d159388b7
Location = 0x1a1, name=‘VT Support’ help=‘Vanderpool Technology Enable/Disable.’
Have vss_volume:

Have vss_volume:
Have vss_volume:
Done

Davide: >>
I so used these parameters in MaxL vtenable.py:

VSS_OFFSET = 0x00151048
VSS_SIZE = 0xffb8
PATCH_OFFSET = 0x1a1
PATCH_VALUE = 0x01

and ran vtenable
sudo python2.7 vtenable.py data/original_bios-mine.fd MOD-VT.fd

It reassembled a new bios into MOD-VT.fd
Problem is … this file is bit-by-bit IDENTICAL to my dump.

I then checked, with EFI modified grub2 (
http://feature-enable.blogspot.it/2009/07/enable-vt-on-insydeh2o-based-sony-vaio.html )

with:

setup_var 0x1a1

and… the value is ALREADY 0x1 :(

Now I don’t know what to do… were the tools I used unable to get the correct offset for the VT variable… or did I miss smth?
I read on Intel and Wikipedia that my Intel i5-560M should be capable of both VT-x and VT-d … but VMWare Workstation says its not available.
Also, even NX seems to be disabled (only software DEP on Win7).

Any help?
Thanks!
Davide.

Davide: Sorry, main.py output has been cut, here it is:
http://pastebin.com/xthfe1R3

Pradeep: I am very delighted to see this forum and need some help. My machine is Acer Aspire V3-771G-9441 with windows 8 and want to know

1. How to check if Intel VTX is enabled by default (BIOS is of no help)
2. If it is not enabled how to enable it.

Thanks in Advance
Pradeep.

ibizara: I’m trying to patch my BIOS to enable the Advanced form but I’m uncertain how to continue, I tried main.py/dumpsetup.py but I don’t know how to find the STRING_TABLE or FORMS. I want to do all the work myself but how do you find the 0x00 references?

Python extract of “fe3542fe-c1d3-4ef8-7c65-8048606ff670-SetupUtility.sec0.sub1.pe”

Decompressed + Dump of everything (work-in-progress)
http://www.4shared.com/zip/EPLShpW8/AIO-Decompressed.html

Many thanks
ibiza_rave [at] hotmail [dot] com

Nurlan: 1. Dumped full bios from motherboard
2. Run fvdump.py, got dome files

fv-0002dfc0.bin
fv-003a3000.bin
fv-003d3000.bin
fv-00770000.bin
fv-00771000.bin

3. python ../fsdump.py ../FV/fv-00771000.bin
generated a lot of files

4. each file, generated by fsdump, feed to dumpsetup,
find ./ -type f -exec python ../dumpsetup.py {} \; 1>log.txt

5. log.txt shows nothing

6. Next what?

Nurlan: I downloaded Acer’s old bios and tried to dump fv, sv and then var and setup - nothing

what i’m doing wrong?

topnuker: Hi !
I’m trying to patch my BIOS, and I stuck in the solution.
Antecedent: http://forums.mydigitallife.info/thr...l=1#post755103
I read a lot on every evenings how to enable VT in Acer Aspire 5940G bios, I think this project will be done shortly in my 5940G…

You can find my attempts in this file: https://www.box.com/s/fmfj6sdeltqvj1yy3hl2
Now, I can’t get the variables with vardump.py.

Read the bios_mod_Acer_Aspire_5940G.txt in tha package - I wrote my steps…

Can you help me to finish this bios patching?
Thank you in advanace.

tarekounet: I have an Acer 7720Z with a Core2Duo T7300. I followed the procedure but I still do not have VT enabled.

OnyX: Sjoeter Says:
May 4th, 2011 at 2:43 pm

i have an 6935G
if i download the latest bios file (v1.20) from acer for my laptop and extract it the directory the update’s in has 8930 on the end (BIOS_Acer_1.20_Windows_AS8930) does this mean that i can run the 1.21 update for the 8930?
I checked the ID’s and there booth KM2/TT2 on v1.20 & v1.21

Sjoeter Says:
May 4th, 2011 at 3:25 pm

Works like a charm :)

Can confirm this, flashing 1.21 Update for 8930 works on 6935G, VT activated.

BDMaster: I found this one !
Acer Aspire 8930G 1.21 VTx SLIC 2.1 MENU + EIST active

http://rapidgator.net/file/037313aa925163cca792a55c3fbcb94f/Acer_Aspire_8930G_VT_Slic21_7Menu_EIST.rar.html

Raúl: Hi guys,

I have an Acer Aspire S7 with Ubuntu. No Windows at all. Acer rolled out some interesting BIOS updates for my laptop (S7-391) which improve the fan noise (2.18, more info here: http://global-download.acer.com/GDFiles/BIOS/BIOS/BIOS_Acer_2.18_A_A.zip?acerid=635277828259424282&Step1=ULTRA-THIN&Step2=ASPIRE&Step3=ASPIRE%20S7-391&OS=ALL&LC=es&BC=ACER&SC=EMEA_11).

I have been trying to update my BIOS using FLASHIT.EXE through FreeDOS. I have been googling a lot and I was able to 7zunzip the .fd file (isflash.fd) from the update binary that Acer supplies only for Windows 8 (.EXE).

The point is that after booting with FreeDOS and try to flash isflash.fd I get the following error from FLASHIT (1.4b, got it from http://24.dl6sg-narod.yandex.ru/disk/19264321001/h6e30115e6212d900e43df9617b7d36cb/Insyde%20Flash%20Utility%20DOS%201.4b.zip):

D:> FLASHIT.EXE ISFLASH.FD
Insyde Flash Utility for InsydeH2O

Error: This ROM file size isn’t correct.
Error: ROM size: 4728c0 Current BIOS size: 100000

Any ideas? Do I need any specific parameter? Some people say to use /ALL in order to flash the whole area. I know that flashing BIOS can be very dangerous, so that is the reason because I want to ask before proceeding.

Any help will be appreciated.

Best regards,
Raúl

Manuel: Hello,

Thanks for the post and all the comments.
I really need to enable VT on my Acer 5315, but I will not have enough time to do the hard tweaks until summer.

I thought that maybe the 1.21 BIOS for the 8930G would do the trick, but this is not my model of laptop. However, I have seen people mixing BIOSes from different models across the comments, so I would like to ask if you think that this 8930G BIOS would run on a 5315.

This laptop already has the 1.45 BIOS that I think is the one that people is talking about in the comments.

Any secure option to test if that BIOS is compatible with my model?

Thanks.