MSI GT73VR BIOS: unlock, mod, factory restore, clear CMOS and prevent common issues

This guide is a walkthrough for my MSI GT73VR 6RF Titan Pro. Here I will explain how to unlock the BIOS, mod it, reinstall the stock BIOS, clear the CMOS ( NVRAM), and prevent and fix common issues which I've found along the way. Other MSI laptops may share similar or same steps.

The guide is based on the great post of @sirgeorge:
The Official MSI GT73VR Owners and Discussions Lounge post #7623

Unless stated otherwise, all commands and software will be run from Windows 10 Pro 64 bits. Some utilities are compatible with Linux and macOS as well.

Link to all the required files:
MSI_GT73VR_BIOS_TOOLS.zip

Spoiler: MSI GT73VR english keyboard layout. BIOS related keys are highlighted

1 - FLASH STOCK BIOS AND RESET CMOS
1.1 - BASIC BIOS INFORMATION


A basic BIOS consists on two main memories:

• ROM: it's the BIOS itself, the thing we change each time we flash a new one. A bad flash of the BIOS will remain the computer unbootable and it will require to be flashed physically on the motherboard. BIOS ROMs usually contain additional settings which are hidden to the end user.
• CMOS: also called NVRAM, it's a volatile memory which holds its values with a button battery. Every time we change some setting on the BIOS (like changing from RAID to AHCI or boot priorities for the devices) it's stored here. When you switch from integrated graphics to dedicated GPU using the physical button, MSI SCM changes the value on the same CMOS and prompts to reboot.
  If the computer doesn't boot due to a bad setting or we want to revert it to defaults, the CMOS can be deleted in several ways.

1.2 - CMOS RESET
If the computer doesn't boot after changing a BIOS setting (doesn't POST: Power-On Self-Test), we can clear the CMOS in three ways.

• Software, if we can enter the BIOS with the DEL key:
  • Inside the BIOS menu there's an option for that, to restore it to default values.
• Hardware, if we get a black screen when powering on the laptop and it doesn't boot to BIOS:
  • Keep the power button pressed for more than 30 seconds
  • Physically disconnect the CMOS battery for a few minutes and put it back in.

1.3 - STOCK BIOS FLASH PROCEDURE
Head the the official MSI support website and download:

• BIOS version E17A1IMS.10C
  • Release date: 2017-06-06
  • Size: 5.05 MB
  • Read the PDF inside: "[General Version] BIOS Update Instruction (BSU) v2.6_All.pdf"
• Intel ME FW Update Tool to patch vulnerability Intel SA-00086
  • Release date: 2017-12-12
  • Size: 75.66 MB
  • Check if your system is vulnerable: Intel-SA-00086 Detection Tool. Run as administrator "Intel-SA-00086-GUI.exe"
  • Update "Intel Management Engine Components" running "SetupME.exe" as administrator

Then, you need to put either the folder or the file E17A1IMS.10C inside any USB pendrive. It works with the NTFS filesystem too but FAT32 is recommended. You can do the step 2.2 first and include the BIOS inside afterwards.

Make sure you have enough battery power or plug the laptop to AC. It the update fails midway the computer will need a service.

- Now, insert the pendrive, restart the computer and hit DELETE until it boots to BIOS.
- Head to Advanced tab > UEFI BIOS Update > UEFI BIOS Update > choose the device with \USB string on it (probably the first one) and hit enter to browse the filesystem.
- After selecting the BIOS file and confirming update, the BIOS will reboot to Recovery mode, and ask you to confirm a second time. Then displays "Flash update completed. Press any key to reset the system." .
- Now you can unplug the usb pendrive and restart.

Spoiler: Example flashing BIOS E16F4IMS.705 on MSI GT70 One

Spoiler: Flashing BIOS E17A1IMS.10C on my MSI GT73VR 6RF Titan Pro

Spoiler: Install Intel Management Engine Components 11.7.0.1054

Considerations:
- Flashing a stock BIOS eliminates any mod, so those extra options will be missing until you unlock and mod the BIOS again.
- Before confirming flash on last step, two options are enabled by default: "Reset NVRAM" and "Boot Block Update". It's recommended to leave those options enabled, because that clears the CMOS of the BIOS, where your personal settings are stored. That way you make sure no incompatible options are selected when re-flashing. This is specially important if you had an unlocked BIOS before or if you are flashing a different BIOS version.

More BIOS information:

• Pixelbeat - Updating the flash ROM
  
• LifeWire: How to Clear CMOS

2 - BIOS UNLOCKING
A BIOS is locked when you can't write to it (flash ROM) directly from an operating system like Windows or Linux. Although older computers allowed to do that, modern ones block it, so malware can't break your computer in case you are running untrustworthy software as administrator.
Nevertheless, a locked BIOS can be read from Windows.

The MSI GT73VR, likewise, has a locked BIOS ROM too.

Unlocking the BIOS is a required previous step to flash a modded ROM later on, but just unlocking it doesn't mod anything.

2.1 - FINDING BIOS LOCK VARIABLE
Steps to find the BIOS lock position inside the ROM (offset):

1) Download and extract the BIOS E17A1IMS.10C

2) Download and extract latest UEFITool for Windows, for example UEFITool_0.22.1.win.zip

3) UEFITool
- Open UEFITool > File > Open image file... > select "All files (*)" on the corner > choose E17A1IMS.10C

- File > Search > GUID > Leave selected "Header only" > Paste on the textbox: 899407D799FE43D89A2179EC328CAC21 > Ok

- A message will be displayed in the lower frame:
GUID pattern "899407D7-99FE-43D8-9A21-79EC328CAC21" found as "D7079489FE99D8439A2179EC328CAC21" in 899407D7-99FE-43D8-9A21-79EC328CAC21 at header-offset 0h

- Double click on the message. The entry/module called Setup should be selected displaying additional information

- Action > File > Extract as is... > save as setup.ffs

Spoiler: Processing E17A1IMS.10C with UEFITool 0.22.1

4) Download Universal IFR Extractor v0.5. Direct link to executable here.

- Run Universal IFR Extractor > Open setup.ffs > Extract > Save as "setup IFR.txt" > IFR extracted successfully.

Spoiler: Working with Universal IFR Extractor

5) Open "setup IFR.txt" with any text editor and search for "BIOS Lock". There should be only one coincidence.

"Variable:" will show the offset, respect to the Setup module, where the BIOS Lock value is stored. In my case the offset is 0x5AE. The value stored in that address is the actual BIOS lock, and if it's set to 01, it prevents the BIOS from being written directly from Windows or any other operating system. That's for a security reason so malware can't destroy your motherboard. If it's 00 the BIOS should not be locked.

Spoiler: BIOS Lock found

2.2 - CREATING BOOTABLE PENDRIVE WITH RU
To actually change the BIOS Lock, we can't do it directly from the operating system, we need an utility called RU:

• RU homepage: http://ruexe.blogspot.com
• Download latest version, example RU 5.20.0328 BETA. Extract with password: 174105371023
• There should be 3 files inside: RU.efi, RU.exe and RU32.efi

- Grab any USB pendrive (you can use the same from step 1.3), or a card reader with any card you don't need, very little space is required, 64 MB should be enough depending which filesystem you format it with. In my case I will use a generic USB 85-in-1 card reader with an old 2GB Sandisk Memory Stick Pro Duo.

- Download Rufus, for example Rufus 2.18 or Rufus 2.18 portable,and open it as administrator.

- Select from the device list your pendrive or card, with the following options, and hit Start. It will delete all the data on that device:

• Partition scheme and target system type: MBR partition scheme for UEFI
• File system: use FAT32. FAT (Default) will fail to format and NTFS will fail to save screenshots from RU itself.
• Quick format
• Uncheck "Make a bootable disk using"

- Now, browse to the unit with Windows explorer (in my case it's H: drive) and create the folder EFI on the root of the pendrive and another folder BOOT inside EFI.

- Copy the downloaded file RU.efi to H:\EFI\BOOT and rename it to bootx64.efi

Now you have a bootable USB pendrive with RU.

Spoiler: Creating RU bootable device with Rufus

2.3 - DISABLING SECURE BOOT AND SETTING UEFI MODE
To be able to use RU, we need to disable secure boot and set UEFI mode:
Reboot the computer and hit repeatedly DELETE key when powering on to enter to BIOS.

• Boot > Boot mode select > UEFI
• Security > Secure boot menu > Secure Boot > Disabled

Hit F10 and confirm to save changes.
If you don't disable Secure Boot you will see the following message:

Code:

Secure boot violation.
Invalid Signature detected. Check Secure Boot Policy in Setup

Spoiler: Disabling secure boot and selecting UEFI mode

Spoiler: Trying to boot RU with Secure Boot enabled

2.4 - BOOTING RU AND BASIC USAGE
Once secure boot is disabled and UEFI mode is selected, connect the pendrive with RU, and reboot the computer while you press F11 to enter the boot menu. Select the pendrive and hit enter. You should now see the RU first screen.

Basic RU usage:
All the key combinations are for the english keyboard, so if you want to use key shortcuts directly you must push the keys where they are placed in the english keyboard, not where the key is placed on your particular keyboard. For example, the "=" symbol on the english keyboard is placed 2 keys to the right of the number 0, and one key to the left of the backspace key, so you must press the key in that position if you want to enter a command containing the symbol "=".

• Press F12 in any screen to take a screenshot. It will be saved in BMP format to the root of the pendrive where RU is stored, provided that the pendrive or card is formatted in FAT32 filesystem. If it's in NTFS won't work.
• Press F1 on the main screen to display basic keyboard shortcuts table.
• Press CTRL+F1 to display the Universal Help.
• Press ALT + any of the letters in red in the menu bar to unfold that particular menu.
  • ALT+F: File options
  • ALT+C: Config options
  • ALT+E: Edit options
  • ALT+G: Go options
  • ALT+T: Tools options
  • ALT+S: System options
  • ALT+Q: Quit (close RU and reboot)
• In most dropdown menu items you will see a specific keyboard shortcut for each one, but just hitting enter on the item perform the action as well.
• CTRL+W: to save changes to the BIOS once you made some modification. If you don't want to save any random modification you made just exit from RU without saving. Changes are not automatically saved.

Spoiler: RU: Selecting boot device with F11

Spoiler: RU: first welcome screen

Spoiler: RU: F1 quick help

Spoiler: RU: CTRL+F1 Read Universal Help examples

Spoiler: RU: Unfolding menu bar items with ALT+letter combinations

2.5 - FINDING AND DISABLING BIOS LOCK
- Hit ALT+C to expand the Config menu, then select UEFI variable (you can shortcut with ATL =) and hit enter.

- A list of UEFI variables will be displayed in alphabetical order. Use the keyboard arrows to move down until you see "Setup". There will be two of them, one if the one we are looking for and the other not. In my case, it's the second one, which has much more data, because we need to reach the address 0x5AE in hexadecimal. The other is way smaller.

- Once you are on the right Setup, the first page of the module will be displayed. Use the arrow keys to move along bytes of the current page, and use CTRL+PAGE UP or CTRL+PAGE DOWN to switch to further pages of the Setup module. Skip pages until you reach the page starting at 0500, and then with the arrow keys move to row 05A0, and then to the column 0E, until you are at position 05AE. The current cursor position will be displayed at the top left corner of the hexadecimal table. That is the position where BIOS Lock is stored on my computer. We will see that the value is 01, which means that the BIOS is locked.

- Now, just type 0, and the value in that position will change to 00 in red, meaning that it's in edit mode. Type Enter to accept the new value.

- Finally, CTRL+W will save changes permanently to the BIOS. You should see a "Updated OK: Setup" message.

- Now, quit RU with ALT+Q and enter again to check that the BIOS Lock is preserved to 00. Sometimes you may need to repeat the steps several times until it's actually preserved between reboots, RU is beta and may have some issues. With the version 5.20.0328 used in this tutorial, it worked at the first attempt.

- Reboot Windows twice.

Spoiler: RU: steps to browse to Setup and edit BIOS Lock byte

RU: entering list of UEFI variables


RU: UEFI variables in alphabetical order


RU: first Setup


RU: First Setup data. This is not what we are looking for


RU: second Setup


RU: second Setup data. This is the one.


RU: moving to 0x05AE


RU: changing BIOS Lock from 01 to 00 in edit mode


RU: the new value 00 for BIOS Lock is accepted


RU: changes saved to BIOS.

3 - BIOS MODDING
The BIOS of the MSI GT73VR 6RF contains additional settings which are not displayed to the end user when you buy a new computer. That's done to play on the safe side. There are some settings which may physically damage the computer, like overvolting or overclocking the CPU, GPU, etc. Also, no matter how many BIOS settings you change and to what parameter, you will be able to re-enter the BIOS again with the DELETE key. With a modded BIOS, you are able to enable or disable additional parameters in combinations that are not meant to be chosen together. If you do that, you won't be able to boot to BIOS with the DEL key, forcing you to perform a hardware CMOS reset.

Once the BIOS is unlocked, you can dump it, mod it, and flash it back directly from the operating system. A modded BIOS can display hidden options and change default values for settings, depending on how you mod it. In the following chapters will take a peek about that. Obviously there are thousands of modifications you can make later on.

Note that Secure Boot, either enabled or disabled, does not affect BIOS dumping or flashing, it's only to prevent booting devices that are not signed/certified with a trusted signature.

3.1 - DUMPING CURRENT BIOS
Note: you can dump the BIOS even if it has the BIOS Lock but you can't write to it.

- Download Intel Flash Programming Tool 11.0.15.1000 (FPT11) and extract for example to C:\temp

- There are several versions, I'll use "WINDOWS64\FPTW64.exe".

- Open, as administrator, a command prompt or Windows Powershell where FPTW64.exe is located.

- Run the following command to dump the current BIOS:

Code:

.\FPTW64.exe -D unlocked.rom -BIOS

- Make a copy of the file to preverse the original. Mod the modded.rom onwards don't touch stockbios.rom

Code:

cp .\unlocked.rom .\modded.rom

- If FPT throws the error 366, even running it as administrator, try rebooting the computer. At least for me worked:

Spoiler: FPTW64: dumping stock unlocked BIOS and making a copy

Code:

PS C:\temp\FPT11\WINDOWS64> .\FPTW64.exe -D unlocked.rom -BIOS

Intel (R) Flash Programming Tool. Version:  11.0.15.1000
Copyright (c) 2007 - 2016, Intel Corporation. All rights reserved.

Reading HSFSTS register... Flash Descriptor: Valid

        --- Flash Devices Found ---
        GD25Q64 ID:0xC84017     Size: 8192KB (65536Kb)


- Reading Flash [0x0800000]  6144KB of  6144KB - 100 percent complete.
Writing flash contents to file "unlocked.rom"...

Memory Dump Complete
FPT Operation Successful.

Spoiler: FPTW64: error 366

Code:

Error 366: Fail to load driver (PCI access for Windowws).
Tool needs to run with an administrator priviledge account.
PMxdll.dll DebugMsg: Call to PMXDestroy()

- The file unlocked.rom contain the stock BIOS but with the Lock byte off, if that's the only thing that was touched.

3.2 - MODDING BIOS FILE
- Download and extract AMIBCP_v5.0.1.zip

NEWER version:

- Launch AMIBCP64.exe and open modded.rom

- Open folder Setup, there is where most modification will take place.

Spoiler: AMIBCP64.exe: opening modded.rom

Welcome screen


Most modifications will happen in Setup module

- Example modification: display graphics toggle on BIOS menu. With that toggle you can choose which graphics card will use the operating system, either the integrated graphics or the discrete nvidia gpu. By default, to switch from one to another, we must use the physical button on the side of the computer and then reboot, but with this mod it can be selected directly from the BIOS menu.

• Root folder
  • Setup > Show: Yes (default)
  • Setup > Access/Use: Supervisor
• Root > Setup folder
  • Advanced > Show: Yes (default)
    
  • Advanced > Access/Use: Supervisor
• Root > Setup > Advanced folder
  • MSI VGA MODE > Show: Yes (default)
  • MSI VGA MODE > Access/Use: Supervisor
  • MSI VGA MODE > Failsafe: MSI IGPU MODE (default)
    
  • MSI VGA MODE > Optimal: MSI IGPU MODE (default)

Save and flash the modded rom.

Spoiler: AMIBCP64.exe: modding rom to display graphics toggle

BIOS Setup without any mod


Displaying MSI VGA MODE


MSI VGA MODE toggle

As you can see, to display an item on the BIOS menu, the procedure is to set Show to Yes, and Access/Use to Supervisor. Also, for all folders containing that item, up to the root, its visibility must be changed to each one as well, since they are nested.

WARNING ABOUT INCOMPATIBLE SETTINGS
Failsafe and Optimal, as a general rule, should not be changed, since those are the fallback values when a CMOS reset is performed. If you set a combination of these values for several entries which are not meant to be chosen together, you will not be able to boot anymore the computer even resetting the CMOS, and a hardware flashing will be required.
Example of settings that didn't allow me to boot the computer once (note that it only happened once, afterwards could not reproduce the issue anymore):

• Setup > Advanced > MSI VGA MODE: MSI IGPU MODE
• Setup > Advanced > System Agent (SA) Configuration > Graphics Configuration > Internal Graphics: Enabled

If you change the settings on the BIOS menu to those values, the system may not boot, however you can perform a CMOS reset, provided that Failsafe and Optimal are default, thus it's extremely important that default values are not touched so the CMOS reset can disable Internal Graphics again which is how it is by default.
If you set both to enabled by default (Optimal, Failsafe) and you perform a CMOS reset you may not be able to boot again because the default values are used.
That means that when you want Internal Graphics enabled, use MSI DGPU MODE.

- BIOS Lock location: Setup > Advanced > PCH-IO Configuration > BIOS Security Configuration > BIOS Lock

3.3 - FLASHING MODDED BIOS
- Flashing a modded BIOS is the same as dumping it but changing "-D" with "-F".

Code:

.\FPTW64.exe -F modded.rom -BIOS

Spoiler: FPTW64: flashing a modded BIOS

Code:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\WINDOWS\system32> cd C:\temp\FPT11\WINDOWS64
PS C:\temp\FPT11\WINDOWS64> .\FPTW64.exe -F modded.rom -BIOS

Intel (R) Flash Programming Tool. Version:  11.0.15.1000
Copyright (c) 2007 - 2016, Intel Corporation. All rights reserved.

Reading HSFSTS register... Flash Descriptor: Valid

        --- Flash Devices Found ---
        GD25Q64 ID:0xC84017     Size: 8192KB (65536Kb)

PDR Region does not exist.
GbE Region does not exist.

- Reading Flash [0x0800000]  6144KB of  6144KB - 100 percent complete.
- Verifying Flash [0x0800000]  6144KB of  6144KB - 100 percent complete.
RESULT: The data is identical.

FPT Operation Successful.

Spoiler: Flashing another modded BIOS

Code:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\WINDOWS\system32> cd C:\temp\FPT11\WINDOWS64
PS C:\temp\FPT11\WINDOWS64> .\FPTW64.exe -F .\modded.rom -BIOS

Intel (R) Flash Programming Tool. Version:  11.0.15.1000
Copyright (c) 2007 - 2016, Intel Corporation. All rights reserved.

Reading HSFSTS register... Flash Descriptor: Valid

        --- Flash Devices Found ---
        GD25Q64 ID:0xC84017     Size: 8192KB (65536Kb)

PDR Region does not exist.
GbE Region does not exist.

- Reading Flash [0x0800000]  6144KB of  6144KB - 100 percent complete.
- Erasing Flash Block [0x231000] - 100 percent complete.
- Programming Flash [0x0231000]     4KB of     4KB - 100 percent complete.
- Erasing Flash Block [0x23A000] - 100 percent complete.
- Programming Flash [0x023A000]    16KB of    16KB - 100 percent complete.
- Erasing Flash Block [0x2A9000] - 100 percent complete.
- Programming Flash [0x02A9000]     4KB of     4KB - 100 percent complete.
- Erasing Flash Block [0x498000] - 100 percent complete.
- Programming Flash [0x0498000]   456KB of   456KB - 100 percent complete.
- Verifying Flash [0x0800000]  6144KB of  6144KB - 100 percent complete.
RESULT: The data is identical.

FPT Operation Successful.

- If FPTW64 throws error 368, it can be for several reasons:

• The BIOS was not unlocked as described at STEP 2.5.
• FPTW64 is not being run as administrator
  
• If the BIOS is already unlocked, try rebooting again the operating system

Spoiler: FPTW64: error 368

Code:

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\WINDOWS\system32> cd C:\temp\FPT11\WINDOWS64
PS C:\temp\FPT11\WINDOWS64> .\FPTW64.exe -F modded.rom -BIOS

Intel (R) Flash Programming Tool. Version:  11.0.15.1000
Copyright (c) 2007 - 2016, Intel Corporation. All rights reserved.

Reading HSFSTS register... Flash Descriptor: Valid

        --- Flash Devices Found ---
        GD25Q64 ID:0xC84017     Size: 8192KB (65536Kb)


Error 368: Failed to disable write protection for the BIOS space.
FPT Operation Failed.

**WARNING**: DON'T FLASH THE DOWNLOADED BIOS E17A1IMS.10C, OR ANY OTHER OFFICIAL, WITH FPTW64, OR WILL BREAK THE COMPUTER. DO IT FROM THE BIOS MENU DIRECTLY AS EXPLAINED IN SECTION 1.3. FPTW64 CAN ONLY FLASH ITS OWN DUMPS NOT THE ONES DOWNLOADED FROM MSI.

4 - EXTERNAL LINKS

• GUIDE FLASHING GPUS
  
• GUIDE EASY FLASH SYSTEM BIOS RECOVERY
• BIOS/UEFI Utilities for Aptio and AMIBIOS
• MSI VGA Switch for Linux

 

@Paloseco

I have a Gt72VR-7RE, and im trying unlock the Bios but dont have sure if im in the right adress on RU program...This is my offset from the msi bios website for my model:

RU 5.20.0328

If this adress is right its strange since the value 00 is set since the beginning

EDIT:

Already unlocked.​

 

@Paloseco
Find out the key combination to make the "Hybrid Power" and "Battery Voltage" options appear and you'll have a nice big donation of $50 to your paypal.
(this is NOT in the APTIO MENU capsule! You can't unlock it with AMIBCP. It's some strange combination or sequence even more "obscure" than the Bios unhide key combination. It seems to be some hidden developer extra sequence and PROBABLY has to be done on an exact menu, at the right time, with the right keys).

 

Nicely done!!

 

The guide is complete.

 

What are exactly those options for?

 

Apparently for completely disabling battery boost (NOS / hybrid battery power) or (I'm assuming) how much of the battery gets used.
But only one person has ever seen those options appear in the bios (not as part of a standard menu you can even unlock, in some "Extra" EC menu) and it never appeared again.

 

@Shehary was the only user here to have ever seen this option. But it's not in the APTIO capsule and cannot be unlocked this way. But my offer still stands---$50 USD to anyone who can find how to access this "Developer" option. I hate hybrid power !

 

Ok but what does exactly do hybrid power?

 

Drains from the battery at high CPU+GPU load.