4GHz+ Overclock i7 4xxxxmq/h to i7 extreme conversion Intel Haswell CPU Microcode bug hack

Discussion in 'Hardware Components and Aftermarket Upgrades' started by tpro, Apr 3, 2016.

  1. tpro

    tpro Notebook Consultant

    Reputations:
    57
    Messages:
    103
    Likes Received:
    75
    Trophy Points:
    41
    Hi all,

    After I saw this result: http://hwbot.org/submission/2830783_0.0_cpu_frequency_core_i7_4700mq_4550_mhz , I got interested to replicate it with a similar method and decided to share my steps to score higher than a desktop 4.4ghz 4770k (according to cinebench ;))

    My laptop model: Clevo P150SM

    Intel Stock microcode has a Turbo multiplier bin glitch that allows unlimited multiplier increase, I used prema's bios and removed a cpu microcode update to let the cpu run the stock glitched microcode.

    Note: steps vary with laptop brand/model, this is intended to share what I did |how it works maybe| with my P150SM.

    1) Download or dump your BIOS, if your bios is AMI (my case) then use AFUWINx64

    2) Get AMI Aptio UEFI MMTool v5.0.0.7 and UEFITool, HxD (or your fav hex editor)

    3) Open your BIOS image with UEFITool, then File>Search, in our case Haswell has the following ID: C3 06 03 , enter C3 06 03 in Hex pattern dialog click OK

    4) You can see the last four Hex pattern result(my case), double click the first result and a structure item in the main dialog will be highlighted, right click>Extract as-is to a folder (be sure it is organized or you will mess things up like i did XD)

    [​IMG]

    5) If you have an additional result with type RAW, do the same with the third(in my case) result and save it as a different name other than the first one.

    6) Now in the folder you have saved the 2 files from step 4&5, open the first one (second one too if present, see step 11) with HxD(any hex editor) and look for C3 06 03

    [​IMG]

    be sure to choose Datatype:Hex-values then hit search

    7) Press F3 to find again till you reach this pattern(highlighted):

    8) (1) Indicates the microcode version, 17 in this case, we want 00 (cpu stock), (2) the platform ID (the search context we reached at) (3) the microcode length = 5000 (in my case) in reverse (important to know when the microcode ends in order to remove later).

    9) Adjust the cursor on the beginning of the highlight text/microcode (01) right click>Select Block>Length>5000 or whatever in your case

    10) Delete the highlighted blocks (del button) (after step 9) then save the file

    11) Do the same with the second file (if present) from step 6 to 10 then save

    12) Go back to UEFITool, double click the first result like you did in step 4, right click the highlighted structure in the main dialogue > Replace as-is then choose the FIRST file you edited in HxD

    13) Double click the third (or whatever your case - if present) result and follow step 12 with the SECOND file you edited in HxD instead.

    14) You will see "Rebuild" in action row, File>Save image as> P15SM04.PM2 in my case (can be any name as long as your flashing tool recognize it)

    15) Open AMI Aptio MMTool > Load Image > your modified rom; go to CPU Patch Tab and verify there is no 06C3 in CPU ID

    16) Be brave and flash your BIOS [​IMG]


    Windows Mod to remove auto update microcode on boot:

    1) Remove mcupdate_GenuineIntel (and backup) from System32

    2) Done


    Overclocking:

    1) Check CPU MCID:Download AIDA64 , open AIDA64>Motherboard>CPUID and look at IA Brand ID, it should be 00h
    [​IMG]

    2) Download the latest beta ThrottleStop, used 810b2. TS 6 does not work.

    3) Make sure you don't have XTU installed or running (especially at startup) or it will reset any changes in Throttlestop.

    4) Open throttlestop, click FIVR and look at "[checkbox] Overclock [DIALOG] Max" and note it down

    5) Now here is the magic! close FIVR and open it again, [DIALOG] Max value should increase by 2 (up to 80x max ~ 8ghz) everytime you open and close FIVR aslong as long as you increase one of the cores, in my case I have gone with 42x on all cores with 4700mq on stress testing. Seems to be the stable frequency, system uptime is 34 days as of latest post edit, with some Adobe Premier work aswell.[​IMG]

    6) Increase "Set multiplier" to maximum after your final changes in FVIR (Iv set mine to 42x all cores, so I increased set multiplier to 42 aswell - note voltage ID is messed up ignore it, multiply by 2 to get the actual voltage)[​IMG]

    7) Increase voltage in FVIR for stability by using Cinebench run 3-10 times instead of prime95, as it stresses FPU to a non-realistic level which increases heat and tdp. (Although it ran stable temps were ridiculous, got throttled down to 2.8ghz in seconds)

    My experience/opinion: no real world optimized software puts the same load, at least in personal computing (rendering video, compiling software). Cinebench, aida64 and premier rendering all running at the same time resulted in ~78 watt, prime alone = 100 watt. Get a server if you are going to utilize the entire CPU functions at the same time and as efficiently as possible.
    (Not to mention, p95 @stock frequency/voltage with no Turbo boost power limit (48 watt with 4700mq) reached 92c, and downclocked to 2.4ghz with stock TDP XD)
    I think IBT and P95 are useful for detecting issues with stock settings, (e.g 99% server stability/uptime for data redundancy) Would be happy to be proven wrong as a desktop/laptop user and test as well.


    8) Unlock maximum TDP and turbo wattage in TPL, in my case:

    [​IMG]

    9) Done! Changes should be persistent as long as you dont save and exit from BIOS(in my case), h̶e̶r̶e̶ ̶i̶s̶ ̶m̶y̶ ̶r̶e̶s̶u̶l̶t̶ ̶i̶n̶ ̶C̶i̶n̶e̶b̶e̶n̶c̶h̶ ̶w̶i̶t̶h̶ ̶t̶e̶m̶p̶ ̶t̶h̶r̶o̶t̶t̶l̶i̶n̶g̶ ̶(̶f̶r̶o̶m̶ ̶4̶.̶3̶ ̶t̶o̶ ̶3̶.̶9̶ ̶g̶h̶z̶)̶,̶ ̶r̶o̶o̶m̶ ̶t̶e̶m̶p̶ ̶2̶5̶-̶2̶7̶ ̶X̶D̶:̶ ̶(̶n̶o̶.̶1̶ ̶a̶t̶ ̶4̶.̶2̶g̶h̶z̶,̶ ̶n̶o̶.̶7̶ ̶s̶t̶o̶c̶k̶ ̶l̶a̶t̶e̶s̶t̶ ̶m̶i̶c̶r̶o̶c̶o̶d̶e̶)̶

    UPDATE: OCed RAM from 1600 to 1866, cpu@4.3Ghz, +200mV adaptive vcore and used CLU TIM (no more throttle):

    [​IMG]

    I'm also getting 852 with 4.5ghz,t̶h̶o̶u̶g̶h̶ ̶i̶t̶s̶ ̶u̶n̶s̶t̶a̶b̶l̶e̶ ̶a̶s̶ ̶t̶h̶e̶ ̶f̶r̶e̶q̶u̶e̶n̶c̶y̶ ̶s̶c̶a̶l̶e̶s̶ ̶d̶o̶w̶n̶,̶ ̶(̶m̶a̶y̶b̶e̶ ̶d̶u̶e̶ ̶t̶o̶ ̶h̶i̶g̶h̶ ̶v̶o̶l̶t̶a̶g̶e̶)̶
    Static voltage table like on load method using TS:




    Post your results and I'll quote it here.



    Tips:
    • I highly recommend lapping heatsink and use liquid metal thermal paste or any decent tp ( I used collaboratory liquid ultra) before doing this
    • -If your cpu throttles no matter what, try decreasing dynamic voltage in FVIR and look at maximum value the package power indicate while stressing, decrease the value by 10% in order to avoid rapid throttling (happens with bad TP) [​IMG]
    • -Do not attempt the OC if you are looking after long service life wear&tear (I expect 2 years from now if I stress the cpu everyday for an hour, which i never do :p)
    Happy overclocking, and don't melt your laptop[​IMG]

    Updates:
    -Tested on desktop i5 4430 without altering reference clock, OCable 3.2 to 3.6ghz max (high voltage monster cpu :D.just look at the stock TDP : 84 W)
    -To add: This mod has been done and discovered by Asus with desktop on haswell launch aswell, though BIOS updates were pushed asap, steps should be similiar with desktop mobos, though there is a decent advantage of applying this on non-extreme mobile due to the insane cost. getting a K processor with desktops is a wiser choice for cheap extra and more thermal headroom.
    -Intel has done the same mistake again with Skylake this time, would be interesting to see how far 6700HQ can go.:D


    Just to clarify, only Throttlestop works with the OC, since in my case, XTU/BIOS does not read the [secret]MSR register, as reading it increments max bin with mc <v6 and set all core clocks to default single core clock with mc v7 with no increment. However TS version 8+ does; aswell as with UEFI/BIOS menus with some desktop motherboards (after mc mod) Asus is an example.

    Thanks to Intel if they leaked this on purpose, kinda futureproofed my machine XD
     
    tiliarou, James D, jaug1337 and 3 others like this.
  2. Starlight5

    Starlight5 So what if I'm crazy? The best people are.

    Reputations:
    287
    Messages:
    2,431
    Likes Received:
    999
    Trophy Points:
    131
    @tpro if I put 4712MQ into notebook with no microcode for it, only for 4702MQ, chances are it will behave the same without any need to modify BIOS?
     
    tpro likes this.
  3. tpro

    tpro Notebook Consultant

    Reputations:
    57
    Messages:
    103
    Likes Received:
    75
    Trophy Points:
    41
    no, all 47xx are under 6c3 platform id. (share the same microcode)
     
    Starlight5 likes this.
  4. Mobius 1

    Mobius 1 nͫiͤcͫeͤ

    Reputations:
    3,198
    Messages:
    8,543
    Likes Received:
    5,957
    Trophy Points:
    681
    I wish this was possible on Alienware 18, but this laptop can't flash a custom bios :|
     
    tpro likes this.
  5. matchbox2022

    matchbox2022 Notebook Enthusiast

    Reputations:
    0
    Messages:
    24
    Likes Received:
    6
    Trophy Points:
    6
    Modding level = Extreme :p
     
    jaug1337 and tpro like this.
  6. Qing Dao

    Qing Dao LORD OF THE UNDERWORLD

    Reputations:
    1,587
    Messages:
    1,779
    Likes Received:
    300
    Trophy Points:
    101
    Wow, thank you! I need to try this on my Clevo.
     
    tpro likes this.
  7. SzopenRapsu

    SzopenRapsu Newbie

    Reputations:
    0
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    5
    hey! someone done this on y510p ? i need help
     
  8. MiSJAH

    MiSJAH Notebook Deity

    Reputations:
    113
    Messages:
    1,203
    Likes Received:
    950
    Trophy Points:
    131
    [​IMG] Hi,

    I'm stuck at stage 6. Where your 1st highlighted value is '17' mine appears to be '1C' and your third highlighted value is '00 50' mine is '00 54'.

    Is this correct? Where exactly do I place the cursor and/or start to highlight before I right click>Select Block>Length>5000?

    Using MSI GT72 with a i7-4720HQ.

    Cheers.
     
    tiliarou likes this.
  9. tpro

    tpro Notebook Consultant

    Reputations:
    57
    Messages:
    103
    Likes Received:
    75
    Trophy Points:
    41
    00 50 translates to 5000 which is the length, yours is 00 54 which translates to 5400 use that, 1C is the uC version, 2nd value is important if it matches then you are good to go.

    Though just my opinion, this is not simple guide, its just a thorough non-detailed steps taken to achieve the result, I would advise to not continue modding if you are unsure of the basic stuff to avoid brick.
     
  10. Mobius 1

    Mobius 1 nͫiͤcͫeͤ

    Reputations:
    3,198
    Messages:
    8,543
    Likes Received:
    5,957
    Trophy Points:
    681
    @tpro

    Hi,

    Got some time to have fun with the i7-6600U? I could use your help for the surface book :)
     
Loading...

Share This Page