MSI GT73VR BIOS: unlock, mod, factory restore, clear CMOS and prevent common issues

This guide is a walkthrough for my MSI GT73VR 6RF Titan Pro. Here I will explain how to unlock the BIOS, mod it, reinstall the stock BIOS, clear the CMOS ( NVRAM), and prevent and fix common issues which I've found along the way. Other MSI laptops may share similar or same steps.

The guide is based on the great post of @sirgeorge:
The Official MSI GT73VR Owners and Discussions Lounge post #7623

Unless stated otherwise, all commands and software will be run from Windows 10 Pro 64 bits. Some utilities are compatible with Linux and macOS as well.

Link to all the required files:
MSI_GT73VR_BIOS_TOOLS.zip

Spoiler: MSI GT73VR english keyboard layout. BIOS related keys are highlighted

1 - FLASH STOCK BIOS AND RESET CMOS
1.1 - BASIC BIOS INFORMATION


A basic BIOS consists on two main memories:

• ROM: it's the BIOS itself, the thing we change each time we flash a new one. A bad flash of the BIOS will remain the computer unbootable and it will require to be flashed physically on the motherboard. BIOS ROMs usually contain additional settings which are hidden to the end user.
• CMOS: also called NVRAM, it's a volatile memory which holds its values with a button battery. Every time we change some setting on the BIOS (like changing from RAID to AHCI or boot priorities for the devices) it's stored here. When you switch from integrated graphics to dedicated GPU using the physical button, MSI SCM changes the value on the same CMOS and prompts to reboot.
  If the computer doesn't boot due to a bad setting or we want to revert it to defaults, the CMOS can be deleted in several ways.

1.2 - CMOS RESET
If the computer doesn't boot after changing a BIOS setting (doesn't POST: Power-On Self-Test), we can clear the CMOS in three ways.

• Software, if we can enter the BIOS with the DEL key:
  • Inside the BIOS menu there's an option for that, to restore it to default values.
• Hardware, if we get a black screen when powering on the laptop and it doesn't boot to BIOS:
  • Keep the power button pressed for more than 30 seconds
  • Physically disconnect the CMOS battery for a few minutes and put it back in.

1.3 - STOCK BIOS FLASH PROCEDURE
Head the the official MSI support website and download:

• BIOS version E17A1IMS.10C
  • Release date: 2017-06-06
  • Size: 5.05 MB
  • Read the PDF inside: "[General Version] BIOS Update Instruction (BSU) v2.6_All.pdf"
• Intel ME FW Update Tool to patch vulnerability Intel SA-00086
  • Release date: 2017-12-12
  • Size: 75.66 MB
  • Check if your system is vulnerable: Intel-SA-00086 Detection Tool. Run as administrator "Intel-SA-00086-GUI.exe"
  • Update "Intel Management Engine Components" running "SetupME.exe" as administrator

Then, you need to put either the folder or the file E17A1IMS.10C inside any USB pendrive. It works with the NTFS filesystem too but FAT32 is recommended. You can do the step 2.2 first and include the BIOS inside afterwards.

Make sure you have enough battery power or plug the laptop to AC. It the update fails midway the computer will need a service.

- Now, insert the pendrive, restart the computer and hit DELETE until it boots to BIOS.
- Head to Advanced tab > UEFI BIOS Update > UEFI BIOS Update > choose the device with \USB string on it (probably the first one) and hit enter to browse the filesystem.
- After selecting the BIOS file and confirming update, the BIOS will reboot to Recovery mode, and ask you to confirm a second time. Then displays "Flash update completed. Press any key to reset the system." .
- Now you can unplug the usb pendrive and restart.

Spoiler: Example flashing BIOS E16F4IMS.705 on MSI GT70 One

Spoiler: Flashing BIOS E17A1IMS.10C on my MSI GT73VR 6RF Titan Pro

Spoiler: Install Intel Management Engine Components 11.7.0.1054

Considerations:
- Flashing a stock BIOS eliminates any mod, so those extra options will be missing until you unlock and mod the BIOS again.
- Before confirming flash on last step, two options are enabled by default: "Reset NVRAM" and "Boot Block Update". It's recommended to leave those options enabled, because that clears the CMOS of the BIOS, where your personal settings are stored. That way you make sure no incompatible options are selected when re-flashing. This is specially important if you had an unlocked BIOS before or if you are flashing a different BIOS version.

More BIOS information:

• Pixelbeat - Updating the flash ROM
  
• LifeWire: How to Clear CMOS

2 - BIOS UNLOCKING
A BIOS is locked when you can't write to it (flash ROM) directly from an operating system like Windows or Linux. Although older computers allowed to do that, modern ones block it, so malware can't break your computer in case you are running untrustworthy software as administrator.
Nevertheless, a locked BIOS can be read from Windows.

The MSI GT73VR, likewise, has a locked BIOS ROM too.

Unlocking the BIOS is a required previous step to flash a modded ROM later on, but just unlocking it doesn't mod anything.

2.1 - FINDING BIOS LOCK VARIABLE
Steps to find the BIOS lock position inside the ROM (offset):

1) Download and extract the BIOS E17A1IMS.10C

2) Download and extract latest UEFITool for Windows, for example UEFITool_0.22.1.win.zip

3) UEFITool
- Open UEFITool > File > Open image file... > select "All files (*)" on the corner > choose E17A1IMS.10C

- File > Search > GUID > Leave selected "Header only" > Paste on the textbox: 899407D799FE43D89A2179EC328CAC21 > Ok

- A message will be displayed in the lower frame:
GUID pattern "899407D7-99FE-43D8-9A21-79EC328CAC21" found as "D7079489FE99D8439A2179EC328CAC21" in 899407D7-99FE-43D8-9A21-79EC328CAC21 at header-offset 0h

- Double click on the message. The entry/module called Setup should be selected displaying additional information

- Action > File > Extract as is... > save as setup.ffs

Spoiler: Processing E17A1IMS.10C with UEFITool 0.22.1

4) Download Universal IFR Extractor v0.5. Direct link to executable here.

- Run Universal IFR Extractor > Open setup.ffs > Extract > Save as "setup IFR.txt" > IFR extracted successfully.

Spoiler: Working with Universal IFR Extractor

5) Open "setup IFR.txt" with any text editor and search for "BIOS Lock". There should be only one coincidence.

"Variable:" will show the offset, respect to the Setup module, where the BIOS Lock value is stored. In my case the offset is 0x5AE. The value stored in that address is the actual BIOS lock, and if it's set to 01, it prevents the BIOS from being written directly from Windows or any other operating system. That's for a security reason so malware can't destroy your motherboard. If it's 00 the BIOS should not be locked.

Spoiler: BIOS Lock found

2.2 - CREATING BOOTABLE PENDRIVE WITH RU
To actually change the BIOS Lock, we can't do it directly from the operating system, we need an utility called RU:

• RU homepage: http://ruexe.blogspot.com
• Download latest version, example RU 5.20.0328 BETA. Extract with password: 174105371023
• There should be 3 files inside: RU.efi, RU.exe and RU32.efi

- Grab any USB pendrive (you can use the same from step 1.3), or a card reader with any card you don't need, very little space is required, 64 MB should be enough depending which filesystem you format it with. In my case I will use a generic USB 85-in-1 card reader with an old 2GB Sandisk Memory Stick Pro Duo.

- Download Rufus, for example Rufus 2.18 or Rufus 2.18 portable,and open it as administrator.

- Select from the device list your pendrive or card, with the following options, and hit Start. It will delete all the data on that device:

• Partition scheme and target system type: MBR partition scheme for UEFI
• File system: use FAT32. FAT (Default) will fail to format and NTFS will fail to save screenshots from RU itself.
• Quick format
• Uncheck "Make a bootable disk using"

- Now, browse to the unit with Windows explorer (in my case it's H: drive) and create the folder EFI on the root of the pendrive and another folder BOOT inside EFI.

- Copy the downloaded file RU.efi to H:\EFI\BOOT and rename it to bootx64.efi

Now you have a bootable USB pendrive with RU.

Spoiler: Creating RU bootable device with Rufus

2.3 - DISABLING SECURE BOOT AND SETTING UEFI MODE
To be able to use RU, we need to disable secure boot and set UEFI mode:
Reboot the computer and hit repeatedly DELETE key when powering on to enter to BIOS.

• Boot > Boot mode select > UEFI
• Security > Secure boot menu > Secure Boot > Disabled

Hit F10 and confirm to save changes.
If you don't disable Secure Boot you will see the following message:

Code:

Secure boot violation.
Invalid Signature detected. Check Secure Boot Policy in Setup

Spoiler: Disabling secure boot and selecting UEFI mode

Spoiler: Trying to boot RU with Secure Boot enabled

2.4 - BOOTING RU AND BASIC USAGE
Once secure boot is disabled and UEFI mode is selected, connect the pendrive with RU, and reboot the computer while you press F11 to enter the boot menu. Select the pendrive and hit enter. You should now see the RU first screen.

Basic RU usage:
All the key combinations are for the english keyboard, so if you want to use key shortcuts directly you must push the keys where they are placed in the english keyboard, not where the key is placed on your particular keyboard. For example, the "=" symbol on the english keyboard is placed 2 keys to the right of the number 0, and one key to the left of the backspace key, so you must press the key in that position if you want to enter a command containing the symbol "=".

• Press F12 in any screen to take a screenshot. It will be saved in BMP format to the root of the pendrive where RU is stored, provided that the pendrive or card is formatted in FAT32 filesystem. If it's in NTFS won't work.
• Press F1 on the main screen to display basic keyboard shortcuts table.
• Press CTRL+F1 to display the Universal Help.
• Press ALT + any of the letters in red in the menu bar to unfold that particular menu.
  • ALT+F: File options
  • ALT+C: Config options
  • ALT+E: Edit options
  • ALT+G: Go options
  • ALT+T: Tools options
  • ALT+S: System options
  • ALT+Q: Quit (close RU and reboot)
• In most dropdown menu items you will see a specific keyboard shortcut for each one, but just hitting enter on the item perform the action as well.
• CTRL+W: to save changes to the BIOS once you made some modification. If you don't want to save any random modification you made just exit from RU without saving. Changes are not automatically saved.

Spoiler: RU: Selecting boot device with F11

Spoiler: RU: first welcome screen

Spoiler: RU: F1 quick help

Spoiler: RU: CTRL+F1 Read Universal Help examples

Spoiler: RU: Unfolding menu bar items with ALT+letter combinations

2.5 - FINDING AND DISABLING BIOS LOCK
- Hit ALT+ C to expand the Config menu, then select UEFI variable (you can shortcut with ATL =) and hit enter.

- A list of UEFI variables will be displayed in alphabetical order. Use the keyboard arrows to move down until you see "Setup". There will be two of them, one if the one we are looking for and the other not. In my case, it's the second one, which has much more data, because we need to reach the address 0x5AE in hexadecimal. The other is way smaller.

- Once you are on the right Setup, the first page of the module will be displayed. Use the arrow keys to move along bytes of the current page, and use CTRL+ PAGE UP or CTRL+ PAGE DOWN to switch to further pages of the Setup module. Skip pages until you reach the page starting at 0500, and then with the arrow keys move to row 05A0, and then to the column 0E, until you are at position 05AE. The current cursor position will be displayed at the top left corner of the hexadecimal table. That is the position where BIOS Lock is stored on my computer. We will see that the value is 01, which means that the BIOS is locked.

- Now, just type 0, and the value in that position will change to 00 in red, meaning that it's in edit mode. Type Enter to accept the new value.

- Finally, CTRL+ W will save changes permanently to the BIOS. You should see a "Updated OK: Setup" message.

- Now, quit RU with ALT+ Q and enter again to check that the BIOS Lock is preserved to 00. Sometimes you may need to repeat the steps several times until it's actually preserved between reboots, RU is beta and may have some issues. With the version 5.20.0328 used in this tutorial, it worked at the first attempt.

- Reboot Windows twice.

Spoiler: RU: steps to browse to Setup and edit BIOS Lock byte

RU: entering list of UEFI variables


RU: UEFI variables in alphabetical order


RU: first Setup


RU: First Setup data. This is not what we are looking for


RU: second Setup


RU: second Setup data. This is the one.


RU: moving to 0x05AE


RU: changing BIOS Lock from 01 to 00 in edit mode


RU: the new value 00 for BIOS Lock is accepted


RU: changes saved to BIOS.

3 - BIOS MODDING
The BIOS of the MSI GT73VR 6RF contains additional settings which are not displayed to the end user when you buy a new computer. That's done to play on the safe side. There are some settings which may physically damage the computer, like overvolting or overclocking the CPU, GPU, etc. Also, no matter how many BIOS settings you change and to what parameter, you will be able to re-enter the BIOS again with the DELETE key. With a modded BIOS, you are able to enable or disable additional parameters in combinations that are not meant to be chosen together. If you do that, you won't be able to boot to BIOS with the DEL key, forcing you to perform a hardware CMOS reset.

Once the BIOS is unlocked, you can dump it, mod it, and flash it back directly from the operating system. A modded BIOS can display hidden options and change default values for settings, depending on how you mod it. In the following chapters will take a peek about that. Obviously there are thousands of modifications you can make later on.

Note that Secure Boot, either enabled or disabled, does not affect BIOS dumping or flashing, it's only to prevent booting devices that are not signed/certified with a trusted signature.

3.1 - DUMPING CURRENT BIOS
Note: you can dump the BIOS even if it has the BIOS Lock but you can't write to it.

- Download Intel Flash Programming Tool 11.0.15.1000 (FPT11) and extract for example to C:\temp

- There are several versions, I'll use "WINDOWS64\FPTW64.exe".

- Open, as administrator, a command prompt or Windows Powershell where FPTW64.exe is located.

- Run the following command to dump the current BIOS:

Code:

.\FPTW64.exe -D unlocked.rom -BIOS

- Make a copy of the file to preverse the original. Mod the modded.rom onwards don't touch stockbios.rom

Code:

cp .\unlocked.rom .\modded.rom

- If FPT throws the error 366, even running it as administrator, try rebooting the computer. At least for me worked:

Spoiler: FPTW64: dumping stock unlocked BIOS and making a copy

Code:

PS C:\temp\FPT11\WINDOWS64> .\FPTW64.exe -D unlocked.rom -BIOS

Intel (R) Flash Programming Tool. Version:  11.0.15.1000
Copyright (c) 2007 - 2016, Intel Corporation. All rights reserved.

Reading HSFSTS register... Flash Descriptor: Valid

        --- Flash Devices Found ---
        GD25Q64 ID:0xC84017     Size: 8192KB (65536Kb)


- Reading Flash [0x0800000]  6144KB of  6144KB - 100 percent complete.
Writing flash contents to file "unlocked.rom"...

Memory Dump Complete
FPT Operation Successful.

Spoiler: FPTW64: error 366

Code:

Error 366: Fail to load driver (PCI access for Windowws).
Tool needs to run with an administrator priviledge account.
PMxdll.dll DebugMsg: Call to PMXDestroy()

- The file unlocked.rom contain the stock BIOS but with the Lock byte off, if that's the only thing that was touched.

3.2 - MODDING BIOS FILE
- Download and extract AMIBCP_v5.0.1.zip

NEWER version:

- Launch AMIBCP64.exe and open modded.rom

- Open folder Setup, there is where most modification will take place.

Spoiler: AMIBCP64.exe: opening modded.rom

Welcome screen


Most modifications will happen in Setup module

- Example modification: display graphics toggle on BIOS menu. With that toggle you can choose which graphics card will use the operating system, either the integrated graphics or the discrete nvidia gpu. By default, to switch from one to another, we must use the physical button on the side of the computer and then reboot, but with this mod it can be selected directly from the BIOS menu.

• Root folder
  • Setup > Show: Yes (default)
  • Setup > Access/Use: Supervisor
• Root > Setup folder
  • Advanced > Show: Yes (default)
    
  • Advanced > Access/Use: Supervisor
• Root > Setup > Advanced folder
  • MSI VGA MODE > Show: Yes (default)
  • MSI VGA MODE > Access/Use: Supervisor
  • MSI VGA MODE > Failsafe: MSI IGPU MODE (default)
    
  • MSI VGA MODE > Optimal: MSI IGPU MODE (default)

Save and flash the modded rom.

Spoiler: AMIBCP64.exe: modding rom to display graphics toggle

BIOS Setup without any mod


Displaying MSI VGA MODE


MSI VGA MODE toggle

As you can see, to display an item on the BIOS menu, the procedure is to set Show to Yes, and Access/Use to Supervisor. Also, for all folders containing that item, up to the root, its visibility must be changed to each one as well, since they are nested.

WARNING ABOUT INCOMPATIBLE SETTINGS
Failsafe and Optimal, as a general rule, should not be changed, since those are the fallback values when a CMOS reset is performed. If you set a combination of these values for several entries which are not meant to be chosen together, you will not be able to boot anymore the computer even resetting the CMOS, and a hardware flashing will be required.
Example of settings that didn't allow me to boot the computer once (note that it only happened once, afterwards could not reproduce the issue anymore):

• Setup > Advanced > MSI VGA MODE: MSI IGPU MODE
• Setup > Advanced > System Agent (SA) Configuration > Graphics Configuration > Internal Graphics: Enabled

If you change the settings on the BIOS menu to those values, the system may not boot, however you can perform a CMOS reset, provided that Failsafe and Optimal are default, thus it's extremely important that default values are not touched so the CMOS reset can disable Internal Graphics again which is how it is by default.
If you set both to enabled by default (Optimal, Failsafe) and you perform a CMOS reset you may not be able to boot again because the default values are used.
That means that when you want Internal Graphics enabled, use MSI DGPU MODE.

- BIOS Lock location: Setup > Advanced > PCH-IO Configuration > BIOS Security Configuration > BIOS Lock

3.3 - FLASHING MODDED BIOS
- Flashing a modded BIOS is the same as dumping it but changing "-D" with "-F".

Code:

.\FPTW64.exe -F modded.rom -BIOS

Spoiler: FPTW64: flashing a modded BIOS

Code:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\WINDOWS\system32> cd C:\temp\FPT11\WINDOWS64
PS C:\temp\FPT11\WINDOWS64> .\FPTW64.exe -F modded.rom -BIOS

Intel (R) Flash Programming Tool. Version:  11.0.15.1000
Copyright (c) 2007 - 2016, Intel Corporation. All rights reserved.

Reading HSFSTS register... Flash Descriptor: Valid

        --- Flash Devices Found ---
        GD25Q64 ID:0xC84017     Size: 8192KB (65536Kb)

PDR Region does not exist.
GbE Region does not exist.

- Reading Flash [0x0800000]  6144KB of  6144KB - 100 percent complete.
- Verifying Flash [0x0800000]  6144KB of  6144KB - 100 percent complete.
RESULT: The data is identical.

FPT Operation Successful.

Spoiler: Flashing another modded BIOS

Code:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\WINDOWS\system32> cd C:\temp\FPT11\WINDOWS64
PS C:\temp\FPT11\WINDOWS64> .\FPTW64.exe -F .\modded.rom -BIOS

Intel (R) Flash Programming Tool. Version:  11.0.15.1000
Copyright (c) 2007 - 2016, Intel Corporation. All rights reserved.

Reading HSFSTS register... Flash Descriptor: Valid

        --- Flash Devices Found ---
        GD25Q64 ID:0xC84017     Size: 8192KB (65536Kb)

PDR Region does not exist.
GbE Region does not exist.

- Reading Flash [0x0800000]  6144KB of  6144KB - 100 percent complete.
- Erasing Flash Block [0x231000] - 100 percent complete.
- Programming Flash [0x0231000]     4KB of     4KB - 100 percent complete.
- Erasing Flash Block [0x23A000] - 100 percent complete.
- Programming Flash [0x023A000]    16KB of    16KB - 100 percent complete.
- Erasing Flash Block [0x2A9000] - 100 percent complete.
- Programming Flash [0x02A9000]     4KB of     4KB - 100 percent complete.
- Erasing Flash Block [0x498000] - 100 percent complete.
- Programming Flash [0x0498000]   456KB of   456KB - 100 percent complete.
- Verifying Flash [0x0800000]  6144KB of  6144KB - 100 percent complete.
RESULT: The data is identical.

FPT Operation Successful.

- If FPTW64 throws error 368, it can be for several reasons:

• The BIOS was not unlocked as described at STEP 2.5.
• FPTW64 is not being run as administrator
  
• If the BIOS is already unlocked, try rebooting again the operating system

Spoiler: FPTW64: error 368

Code:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\WINDOWS\system32> cd C:\temp\FPT11\WINDOWS64
PS C:\temp\FPT11\WINDOWS64> .\FPTW64.exe -F modded.rom -BIOS

Intel (R) Flash Programming Tool. Version:  11.0.15.1000
Copyright (c) 2007 - 2016, Intel Corporation. All rights reserved.

Reading HSFSTS register... Flash Descriptor: Valid

        --- Flash Devices Found ---
        GD25Q64 ID:0xC84017     Size: 8192KB (65536Kb)


Error 368: Failed to disable write protection for the BIOS space.
FPT Operation Failed.

**WARNING**: DON'T FLASH THE DOWNLOADED BIOS E17A1IMS.10C, OR ANY OTHER OFFICIAL, WITH FPTW64, OR WILL BREAK THE COMPUTER. DO IT FROM THE BIOS MENU DIRECTLY AS EXPLAINED IN SECTION 1.3. FPTW64 CAN ONLY FLASH ITS OWN DUMPS NOT THE ONES DOWNLOADED FROM MSI.

4 - EXTERNAL LINKS

• GUIDE FLASHING GPUS
  
• GUIDE EASY FLASH SYSTEM BIOS RECOVERY
• BIOS/UEFI Utilities for Aptio and AMIBIOS
• MSI VGA Switch for Linux
• Official support & downloads website for the GT73VR 6RF Titan Pro

 

@Paloseco

I have a Gt72VR-7RE, and im trying unlock the Bios but dont have sure if im in the right adress on RU program...This is my offset from the msi bios website for my model:

RU 5.20.0328

If this adress is right its strange since the value 00 is set since the beginning

EDIT:

Already unlocked.​

 

@Paloseco
Find out the key combination to make the "Hybrid Power" and "Battery Voltage" options appear and you'll have a nice big donation of $50 to your paypal.
(this is NOT in the APTIO MENU capsule! You can't unlock it with AMIBCP. It's some strange combination or sequence even more "obscure" than the Bios unhide key combination. It seems to be some hidden developer extra sequence and PROBABLY has to be done on an exact menu, at the right time, with the right keys).

 

Nicely done!!

 

The guide is complete.

 

What are exactly those options for?

 

Apparently for completely disabling battery boost (NOS / hybrid battery power) or (I'm assuming) how much of the battery gets used.
But only one person has ever seen those options appear in the bios (not as part of a standard menu you can even unlock, in some "Extra" EC menu) and it never appeared again.

 

@Shehary was the only user here to have ever seen this option. But it's not in the APTIO capsule and cannot be unlocked this way. But my offer still stands---$50 USD to anyone who can find how to access this "Developer" option. I hate hybrid power !

 

Ok but what does exactly do hybrid power?

 

Drains from the battery at high CPU+GPU load.

 

Yes but why is that an issue ? This power drain is on purpose to not reduce performances, it's IMHO a good thing since it allows higher power draw.
Did you face specific issues about this ? Or are you afraid of battery wear ?

 

3 questions for @Paloseco :
- I will try to unlock my GT72 2QE bios. My BIOS Lock offset is 0x09, so I would go to 00 column and 09 row ?
- After using RU, after modding and flashing modded Bios and rebooting, can I set Secure Boot to on again ?
- You mention that after flashing modded Bios, we can't press DEL anymore to go to Bios at boot, is that really the case ? Then how to access Bios on boot ? By pressing the clear CMOS button under the laptop only ?

Thanks !

 

No it does NOT allow higher power draw!
It only allowed higher power draw back when there was just a 180W power supply available. Then you could draw up to 210W total power.
The Delta 230W PSU can draw 250W to the system directly, by itself before it shuts down, and the 330W PSU can draw at least 350W to the system. There is NO need for battery boost. In addition, if 230W of power draw is ever exceeded (which is virtually impossible without a TDP modded video card), the EC firmware will hard throttle the CPU to 45W, then to 25W (on 230W systems).

The problem is, when you are pulling just 170W, with a 230W system, it will drain the battery. And the MORE you get closer to 230W, the higher the battery will drain. If you are pulling 220W to the system, the battery will drain about 10%/hour.

That's a good thing? No, it's not, not on these current laptops!

 

You can press DEL to get to the Bios anytime at boot. I think you misunderstood him. He was talking about changing an" internal graphics"setting, which caused a black screen. Yet this setting does not cause me any problems at all. It seems his system "soft bricks" itself instead of boot looping, when he enables "Internal graphics" when the Nvidia GPU is still enabled. He was also talking about changing other settings, that might cause a failure to boot, and forcing a CMOS clear. (examples: messing around with RAM timings, enabling a setting that is not meant to be enabled, etc etc).

But he didn't know how to force a CMOS clear without opening the laptop and removing the CMOS battery. You can just hold the power button down for 45 seconds, then release it, then wait 60 seconds, then you will get a LED boot loop, then a MSI logo boot loop after another 45 seconds, which is the way to clear CMOS.

 

Allright, didn't know about this.
But you are saying that when you use a 230W PSU, and that the load is only around 170W, the battery drains ? Why would it drain ? (I guess this is exactly what you want to avoid) MSI coded it that way ? This is a design flaw then as one would understand that battery is only drained when you reach the PSU limit...
On my GT72 2QE, I didn't notice this behaviour with a 980m (have to check my PSU though).

Ok I misunderstood as you mentioned, that's good then, no drawback at all to unlock

 

Design flaw or whatever you prefer call the ****y... It is designed this way on purpose. On top of MSI, brag about it in their propaganda/advertising @Phoenix

" NOS is the MSI unique feature to use both battery and adaptor power at same time, combine the cooler boost 2.0 system and Nvidia GPU boost 2.0, this feature could help users to have GPU boost with higher frequency to get extreme graphics performance. When the system total usage power is over the maxima limitation of adaptor supply, system will auto turn on the “NOS” automatically to apply more currents and watts to support GPU to keep the boost work. It could let user get 10% more benefits on benchmarks and gaming performance.
When the battery capacity is under 30% or the power consumption of system request goes under the maxima limitation of adaptor, system will turn off the NOS automatically."






What MSI don't tell people... The power adapter will push out higher wattage than what MSI <state aka Scam> is psu's maximum limitation, when firmware signal start charge up battery again after the draining. Nice!!

 

Add mine $50 and raise the bar to $100 total...

Hybrid Option is there, I know what I saw just don't know how to access it again, first time access was total accidentally, I don't remember in which order i used the key combo or number of keys are default or less or more.

I enabled an option which is hidden inside the hidden BIOS settings

 

-In the corner you should see 09 position as you move with arrow keys
- yes you can set Secure Boot again with a modded BIOS.
-you could not boot enter to bios with del key if you make weird changes specially if you flash a modded bios with default settings changed I think is thoroughly explained.

 

I already knew how to clear cmos it's explained on the guide.

Actually I made a mistake it's the opposite
Could you do the following:
- use dgpu nvidia
-enable internal graphics on bios
-switch to igpu using the physical button from Windows (from bios menu should work too I guess)

Confirm that you get a software brick and you have to force a cmos reset

 

I set internal graphics from auto to enabled.
Saved, exited.
Laptop turned off, turned on, turned off 3 seconds later, turned on again, booted to windows.

I pressed the GPU button to switch to iGPU, rebooted.
Laptop rebooted, turned off, turned on with GPU light off, then turned off 3 seconds after reboot sequence started (no MSI logo), turned on, booted to windows.

Sounds like yours isn't doing the boot loop properly?

BTW did you set PEG port 1 from auto to enabled? There have been black screen (laptop isn't frozen but no display output) bugs with the eDP port becoming inactive in the past, if this is set at auto, when switching from dGPU->iGPU->dGPU, but that only happens if the dGPU is active, not iGPU, and I don't know if that was fixed in the .31B Bios, but I do know that all previous bioses had this bug. The only way to prevent that from happening is to set PEG port 1 from Auto to Enabled. (this is not a soft brick issue, its some bizarre bug where eDP doesn't get initialized when switching from iGPU to dGPU, forcing you to switch to iGPU again "Blind" in windows (GPU button ->alt tab -->tab-->space bar) to switch and reboot blindly, and then to load bios defaults (which doesn't always recover). The "Enabled" peg port 1 has no drawbacks at all, the NVGPU will never be active if iGPU is primary, and fixes that bug fully).

 

I tried again with both Internal graphics and IGPU enabled, and wasn't able to reproduce the issue anymore. Even tried both latest versions E17A1IMS.10A and E17A1IMS.10C, and the system boots properly. Maybe it was a glitch or something weird.

 

yes better let it be unknown.

 

The last time someone posted that keystroke here, their post had to be removed.
I'm really not sure if it's wise to post engineering codes here. If MSI knows everyone knows the engineering code, they may remove them completely later.

Well now that THAT engineering code is "out of the bag", what about the OTHER engineering code, @majster msi
The one that brings up a "hidden" EC menu that has two options: "Hybrid Power" and "battery voltage", allowing enabling and disabling of hybrid power?
Shehary said he found it only ONCE, by accident and never again (it doesn't appear in the unlocked bios). MSI CLAIMS there is no such menu at all. But Shehary saw it. ONCE. Only by accident.

Do you know about this hidden option? (it is NOT in the APTIO user capsule!!)

 

I think it is better to share it to power user than fail with bios unlocked by 3rd part softwar whitch can provide to brick unit ... If you think its is ... usless I will clear my post .
Yes there is more however Intel can sue me because 7700hq can be unlocked...
Keystrokes has been changed several Times by msi however there is no problem to get it when you know how to ... It is like cracking a game .
Msi claimed also that gt72 (ms-1782/83) and gt80 can`t be upgraded to gtx 1070

 

I know about the HQ processors being able to be unlocked, but the multipliers can't. Only the TDP. And it requires hacking the EC *AND* the MMIO. And if you hack the MMIO you usually just get a system service exception error...

 

What???????? Is possible unlock 7700HQ? I just need all cores on 3.8GHZ

 

If you can somehow hack the ME or microcode then the processor can be unlocked and perform like one.

 

Seems some really knowledgeable people here, quick question for anyone who might know, I am using this guide with my GE72-6QD
found the bios lock, changed it, that's all fine and was the easy part

HOWEVER, I am a bit concerned with how I am going about this, the BIOS was downloaded from the MSI website, then modified (not by me, by someone with experience whos done a few desktops for me) to update the modules, I did NOT do a backup of the BIOS already on the laptop, then have it modified.
Shown below is output from UBU, but it was not used to modify it (again, person who did it has experience , at least with desktops):

Intel RST(e) OROM and EFI SataDriver
OROM IRST RAID for SATA - 16.0.1.3339 (was 14.7.0.2341)
EFI IRST RAID for SATA - 16.0.1.3339 (was 14.7.0.2341)
EFI AMI NVME Driver present
Intel OROM VBIOS and EFI GOP Driver
OROM VBIOS SkyLake - 1030 (was 1026, settings where copied from MSI downloaded BIOS)
EFI GOP Driver SKL-KBL - 9.0.1074 (was 9.0.1039)
LAN OROM PXE and EFI UNDI - Intel, RTK, BCM, QCA
OROM Intel Boot Agent CL - 0.1.13 (was 0.1.05)

So my question is, with how the first post is worded about flashing from the flash tool, and flashing from the BIOS, whats the prevailing thought, could I flash this file from the BIOS, or is that still locked/block or worse, will that cause issues, and I should go back and follow the prevailing method of backing up the BIOS from the unit and having it modified?

 

Bumping and making a note:

You do *NOT* have to download the official bios from MSI in order to do this mod!
All you have to do is dump the Bios region with FPTW64 -d biosbackup.rom -bios which should work regardless of whether Bios Lock is on or off.
If you do not get a "CPU does not have read access to the host descriptor region" error, then mission accomplished. Then you can just open that file in UEFItool and follow the instructions and move on. e.g.: Open UEFItool on your backed up image, search for "Bios Lock", double click the bottom result it finds, then click extract as is, then go to Universal IFR extractor and extract it and get the hex offset you need to access the variable when you boot into RU later.

With this method (of course this method of getting the hex offset still works on the official MSI file too btw), you don't need any GUID's to disable Bios Lock. Then once you unlock menus, you can flash your backup back (just make another backup of it before running AMIBCP on it).

Basically, doing this is a shortcut and is much simpler, since ASSUMING you don't get a descriptor error when reading the bios with FPT to back it up, you don't need any machine specific guid's or anything. and this same method can be applied to other laptops that have an APTIO 5 bios, as @Vistar Shook did with his laptop (eVGA).

http://forum.notebookreview.com/threads/evga-sc17-1080-finally-available.807895/

WARNING: if you get errors or AMIBCP randomly crashes (when a few changes are made) when you try opening the bios in it, do, do NOT attempt to continue modding or that bios! You will need an AMIBCP which does not crash like that (if one exists). @Vasudev ran into this problem when he dumped his Alienware bios and AMIBCP randomly crashed, and made a corrupt image.

 

Well that is supposing that your BIOS has never been modified or that being modified you are aware of the changes. If you've changed so much things and want it stock, the best way is just to re-download the official and flash it.

 

Well I mean that you don't need to download the original Bios to get the bios lock from it. That was the point. They can just flash the dump and do it from there, and they won't need to look for any GUID or anything. It's much simpler the way I posted.

BTW new AMIBCP. You may want to update that into your original file.
This AMIBCP works on the 8th gen GT75 and GT83 bios. The 5.01 version crashes on some menus. (this can cause a corrupt bios capsule).

http://www.mediafire.com/file/jocdttwdwf32cff/AMIBCP5020023.zip

 

Thanks added to first post.

 

As a note (It may have been already discussed): If you do perform a CMOS Reset, and you had your drives encrypted with bit locker, it will detect the hardware reset as a change in hardware, and may require the bitlocker key to unlock the drive. Make sure you have your key handy in such case!

I had a long day with this, a couple of weeks ago.

 

@ryzeki how have you been? Send me a PM !

 

Maybe that happens on Windows, did not test, but with linux and dislocker you can unlock the encrypted drive on a different computer, provided you know the password (key file not needed). I've tested encrypting a pendrive with Bitlocker AES-XTS on the MSI GT73VR, then unlock it with dislocker on the Vaio Z13 (no idea if it has TPM). It's weird that you can't access Bitlocker from Windows anymore, if it's the same motherboard and same drive, your password should work.

 

It's possible it is something that only happens in windows, but yeah it happened to me. I just needed to input my key to unlock it, but it was a bit of a nightmare because I had stored my key inside, and the backup key in another drive so it took me some time.

Then I was struck with a particular windows update that made me unable to boot properly from time to time, with a windows error of unable to find bootable media. I had to uninstall it.

At the end of the day, it's all about how easily things can go south, so it is a good idea to have a backup. And more importantly (in my case) how my boot drive is more or less strictly a boot drive and I tend to have as little information as possible, so in the worst case I can reinstall the OS from scratch.

Anyways, nothing particularly breaks, its just the extra hassle of having the key handy to unlock the drive.

 

(this was supposed to be in PM. oops)

 

here was the proof:

 

Please please contact headquarters.
You are the ONLY person left who seems to even care that I exist....please?
Tell them i am going for world record overclocking!!!!!!!!!!!!!!!!

 

Maybe you got some checksum error? Does this sound familiar?

• SSD with Bitlocker not booting after CMOS being cleared
• Bitlocker recovery key after every reboot

I think that even if you remove the drive from the computer and put on another one with Windows it will allow to unlock it, even with USB to SATA adapter or M.2 to USB adapter too.

 

you can actually skip the whole part about finding the BIOS LOCK if you know the secret hotkey for BIOS adminstrator mode.

 

@dzpliu
do you know anything about modifying the EC firmware without bricking the laptop?

namely:
These strings:

CPU_CrtT = 1.CPU_ThtlT = 1.CPU_ThtlT = 0.SYS_CrtT = 1.SYS_ThtlT = 1.SYS_ThtlT = 0

I need to change the CPU_Crt = 1 to 0 to avoid the ec shutting off the laptop, then i can do 5 ghz cinebench runs.

Do you know anyone who knows how to edit without breaking checksum validation? Hex editing this will cause a brick (checksums, you know?)
If anyone has a SPI programmer and can find the 128k EC flash chip and verify it (is it the PLcc8 chip behind the motherboard?)

I attached the EC here btw

 

The bitlocker unlock key will also be required if you disable Secure Boot, but re-enabling if again in the BIOS it's just ok no need to touch anything. With linux you can use dislocker to unlock the partition with the password even with Secure Boot disabled.

 

So what is the "secret hotkey" for MSI bios ?
The whole point of the thread is that we are not MSI engineers and we have to use what's available to us (unless this hotkeys are easy to find ?)...

 

It's been posted over on Baidu somewhere many months ago. And no one knows if it still works in the GT75 anyway. And it's easy and safe to unlock menus anyway. Just buy a SPI programmer if theres a problem and you can just force reflash the bios anyhow.

 

it is the same hotkey for every tested MSI laptop so far. (
tested on G25, 16L1, 16L3, GT72, GT72S, G65.

It is completely safe if you only edit out the parts that YOU KNOW WHAT YOU ARE DOING.

Just like what the OP said, editting functions like the internal graphics will brick your machine, unlesss you do a NVRAM reset with holding the power on button for 30sec or removing the CMOS battery physically.

 

I can confirm it works. You need to press 4 keys: 3 at the same time and then a 4th to switch basic/advanced view while the others are still pressed. The keys are not numbers or symbols.

 

Thanks to both of you, but then why not posting the actual key sequence ? lol
Or it isn't allowed here ? Can you send it by private message then ?
I have a GT72 2QE and would like to try.

 

We are afraid that if it's made public future computers won't use the same combination or disable it at all.

 

Yeah that's pretty much it. Plus that's the only way (besides manually unlocking menus which poses some risk but zero if you have a SPI flasher like a Skypro) to remove MSI's vid boosting and stop the laptops from overheating (although bad Lairdtech paste jobs and convex heatsinks may still need repasting or sanding; because MSI uses the EXACT SAME heatplate block ever since the GT72 (only heatpipe patterns and directions are different but the same 3 main heatpipes for several years. The GPU plate is nice and flat but the CPU plate is extremely convex).

As I said you can find it on baidu. (the fourth key on the GT72 2QE is different than on newer laptops) Just don't post the key combination when you do.
Then go to CPU VR Settings and set core IA AC DC loadline to 1 to remove MSI overvoltage boosting, but you will then have to fine tune your adaptive and static voltages again as your old settings will now be unstable.

(6820HK systems should set this to 5, apparently there is massive vdroop that 7820HK systems dont have).