Razer BIOS Mods - Potential to Unlock All Hidden Options

Discussion in 'Razer' started by stranula, Nov 10, 2019.

  1. stranula

    stranula Notebook Consultant

    Reputations:
    33
    Messages:
    112
    Likes Received:
    77
    Trophy Points:
    41
    Before we begin, a few important points.

    In this guide I will specifically instruct how to enable Memory overclocking in the Razer Blade BIOS. These methods, however, are easily adapted to enable any hidden or grayed out options in the BIOS menu.

    ***Standard disclaimer***
    Everything presented below is for informational purposes only. Carrying out any of these modifications to your computer likely has implications regarding the status and validity of your warranty. Making mistakes in your BIOS could potentially leave your device in an unusable and irreparable state (bricked). Neither I nor anyone else, other than yourself, is responsible for damages to your device. If you are uneasy or uncertain about any of the information, feel free to ask the community, and don't proceed until you have a thorough answer.

    ***Credit where credit is due***
    None of the following modifications were originally conceived of, found by, or initially described by me. They are just a culmination of things I found in these forums or from googling. I will provide links to original information I used. Due to the overlapping nature of this thread and the details of those threads, some instructions will be worded similarly. I mean no disrespect by repeating other people's efforts below, just trying to provide the clarity they did in their original posts.

    @David Kirchik post http://forum.notebookreview.com/thr...f-your-razer-blade-w-no-pl-throttling.827919/ is a great place to start for getting the best from your Razer Blade CPU.

    Those changes are a great start, but they don't quite go far enough for getting memory overclocking up and running. For that, we need to get deeper into the BIOS and change some settings via hex editing.

    @NeuAscension pointed me toward this site https://lukegb.com/posts/2016-11-11-secure-boot-shenanigans/ that talks about enabling hidden BIOS options that cannot be turned on via AMIBCP

    @hackness provides a couple of great tutorials for optimizing your BIOS and windows 10 settings. This thread http://forum.notebookreview.com/thr...trol-of-the-i7-8750h-advanced-version.823065/ has a lot of optimization settings for the 8750h, which can still be applicable to the 9750h, but of particular use is this post about memory overclocking http://forum.notebookreview.com/thr...advanced-version.823065/page-13#post-10898033

    ***And this is where we begin***
    Have your AC adapter plugged in at all times
    Do not proceed if you do not have the appropriate drivers to open your laptop. A bad MemOC may require pulling the CMOS battery to reset.

    Software needed
    1. AMIBCP (you will need to find for yourself)
    2. AfuWinGuix64 5.x or higher (you will need to find for yourself)
    3. EUFITool 0.21.5
    4. Universal IFR Extractor
    5. A hex editor. I used an online version at https://hexed.it/?hl=en

    BIOS Extraction and Initial Modification
    1. Open AFUWINGUIx64
    2. Select "Save" and name your rom
    3. Make a copy of the exported rom, naming it "Original_BIOS.rom". Do not Make changes to this file, this is your failsafe if you need to revert back to the original
    4. Open AMIBCP
    5. Select File>Open, select your BIOS.rom image
    6. In the left pane, select Setup>Advanced
    7. In the right pane, change "Access/Use" Column to "User" for "OverClocking Perfomance Menu"
    8. In the left pane, select Setup>Advanced>OverClocking Performance
    9. In the right pane, change "Access/Use" Column to "User" for:
    • OverClocking Performance Menu
    • OverClocking Feature
    • Uncore
    • Memory
    10. In the left pane, select Setup>Advanced>OverClocking Performance>Memory Overclocking
    11. In the right pane, change "Access/Use" to "User" for all options
    12. Save the modified BIOS as "Modified_BIOS.rom"


    At this point, if you were to flash the BIOS, you should have access to the "OverClocking Performance" menu and "Memory Overclocking" within that option. You would not, however be able to set a custom profile therein.

    Within here, you can try setting any setting you are interested in having access to to "User" and see what it does. Any that do not work can be enable in the next steps.

    BIOS Binary Extraction and Interrogation
    1. Open UEFITool
    2. Select File>Open Image File
    3. Select Modified_BIOS.rom
    4. Select File>Search>Text Tab
    5. Search for "Memory Overclocking" with unicode checked
    6. In the bottom "messages box" you should see something like "Unicode test "key management' found in PE32 image..."
    7. Double click this line
    8. Right click the binary and select "Extract Body" and save it as "MenuBinary"
    9. Open Universal IFR Extractor
    10. Point it to MenuBinary.bin and select extract
    11. You will not have a text file called "MenuBinary IFR.txt", open this

    This text file is only a readout of the hex file so that we can interpret it. Making changes here will do nothing.

    This text file contains the full outline of the BIOS menu system. Within it, you will find lines such as:
    0x308C5 Form: Main, Form ID: 0x2711 {01 86 11 27 09 00}
    0x308CB Suppress If: {0A 82}
    0x308CD Variable 0xD39 equals 0x0 {12 06 39 0D 00 00}
    0x308D3 Text: Access Level {03 08 17 00 02 00 18 00}
    0x308DB End If {29 02}
    0x308DD Suppress If: {0A 82}
    0x308DF Variable 0xD39 equals 0x1 {12 06 39 0D 01 00}
    0x308E5 Text: Access Level {03 08 17 00 02 00 19 00}
    0x308ED End If {29 02}​
    The left is the location within the binary, then an interpretation of the line, and the hex code for that entire line in { }.

    From here we can find the information that we want to get access to options that we cannot otherwise turn on. Of note in my example, lines 0x308CB - 0X308DB say that if Variable 0xD39 equals 0x0 don't show (Suppress) the access level data. Lines 0x308DD - 0x308ED say that if Variable 0xD39 equals 0x1, don't show the access level data. When you boot into your BIOS menu, you are logged in as Administrator (on Razer Blade 15, at least) and 0x308CD is true, so suppressed. Line 0x308DF is false, and thus "Access level" is shown. The MenuBinary.bin is full of these checks, and forcing the outcomes from True to False will let them show.

    You can easily spend hours making changes to this binary to get every option available, and if you want to do that, great, but here I will only give you one example so that we can enable custom profiles in the "Memory Overclocking" menu.

    BIOS Binary Modification
    1. Search your "MenuBinary IFR.txt" for "Memory overclocking"
    2. Inspect the following lines to find where Custom, XMP profile 1, and XMP profile 2 are being suppressed.

    Here is mine:
    0x390ED Setting: Memory profile, Variable: 0xA53 {05 91 3F 14 40 14 84 27 01 00 53 0A 14 10 00 03 00}
    0x390FE Option: Default profile, Value: 0x0 {09 07 41 14 30 00 00}
    0x39105 Suppress If: {0A 82}
    0x39107 Variable 0x3FD equals 0x0 {12 06 FD 03 00 00}
    0x3910D Option: Custom profile, Value: 0x1 {09 07 44 14 00 00 01}
    0x39114 End If {29 02}
    0x39116 Suppress If: {0A 82}
    0x39118 Variable 0xE11 equals 0x0 {12 06 11 0E 00 00}
    0x3911E Option: XMP profile 1, Value: 0x2 {09 07 42 14 00 00 02}
    0x39125 End If {29 02}
    0x39127 Suppress If: {0A 82}
    0x39129 Variable 0xE11 equals 0x0 {12 86 11 0E 00 00}
    0x3912F Variable 0xE11 equals 0x1 {12 06 11 0E 01 00}
    0x39135 Or {16 02}
    0x39137 End {29 02}
    0x39139 Option: XMP profile 2, Value: 0x3 {09 07 43 14 00 00 03}
    0x39140 End If {29 02}
    0x39142 End of Options {29 02}​


    3. Here we have 3 lines where our options are being suppressed
    4. In your favorite hex editor (I will be using an online version at https://hexed.it/?hl=en) open MenuBinary.bin
    5. Navigate to the lines where the first variable is checked (in my case 0x39107). Double check that the hex at that line matches what is shown in your text file (in my case 12 06 FD 03 00 00).
    6. Change the check from 0x0 to 0xF (in my case "12 06 FD 03 00 00" to "12 06 FD 03 FF 00")
    7. Repeat this for each of the remaining checks
    8. Export your modified binary as "MenuBinary_Mod.bin"
    9. Return to UEFITool where you have the Modified_BIOS.rom open
    10. Right click the binary location where "key management" was found and select "Replace Body"
    11. Replace with MenuBinary_Mod.bin
    12. Save the new rom as "Final_BIOS.rom"

    We now have your original BIOS in which we have enabled the ability to view the overclocking menus by setting them as User access and enabled the ability to select custom and xmp profiles there within.

    Moving a hidden menu to your main screen
    The Razer Blade 2018 (and probably some other versions) don't have the "Overclocking and Performance" menu under the "Advanced" header, and there is no easy way to turn it on. So lets just make a new link to it in the main menu.

    1. Open UEFITool
    2. Select File>Open Image File
    3. Select Modified_BIOS.rom
    4. We need to find the section titled "AMITSE"
    Mine is under these sections:
    [​IMG]
    and here is the section:
    [​IMG]
    5. RIght click the PE32 image under AMITSE
    6 Select "Export As Is"
    7. Save as "AMITSE"
    8 . Open AMITSE.sct in your favorite hex editor
    9. Refer back to your "MenuBinary IFR.txt" file. We are looking for the highlighted section. Yours is likely the same as mine. Copy this portion of your text
    [​IMG]
    10. in Your hex editor, search for this hex code in AMITSE.sct
    11. You should find several references, the first one is unrelated, we are looking for the block with several in a row. As such:
    [​IMG]
    This block of six references creates our main screen menu options in the BIOS. The next 4 numbers reference back to our MenuBinary IFR.txt to determine what to displayed. In my case, the first is 11 27, and if we search MenuBinary IFR.txt for "2711" we find "0x308C9 Form: Main, Form ID: 0x2711 {01 86 11 27 09 00}"

    If we are lucky, such as I am, we have some empty space immediately following our last entry

    12. In MenuBinaryIFR.txt find the form id for overclocking performance menu. In my case, it is 0x2794
    13. In your hex editor, in the empty space following the last entry, type the meny entry exactly as the previous one, but this time the next 4 numbers will point to overclocking form id (in reverse, such that my form id - 2794 becomes 94 27)
    [​IMG]
    14. Save this as AMITSE_MOD.sct
    15. In UEFITool, right click the AMITSE PE32 and select "Replace as is"
    16. Replace with AMITSE_MOD.sct
    17. Save you modified rom.

    IF YOU DO NOT HAVE EMPTY SPACE AFTER THE LAST ENTRY
    Decide which menu item you like the least (likely security) and change that reference to your overclocking.

    Flashing Modified BIOS
    1. Open AFUWINGUIx64
    2. Select Open and open Final_BIOS.rom
    3. This should open your rom in the Setup tab and only have Main BIOS Image checked. No other options should be selected.
    4. Click Flash

    Congrats, you now have a modified BIOS in which you can set custom memory profiles.

    Overclocking RAM

    Please take caution if you decide to try any of this, you could seriously brick your expensive computer with no means of recourse.

    Results of my Memory Overclocking
    I've got my memory OC'd nicely on my RB15a mid 2019. My 2666MHz is running stably at 3200MHz and showing some great improvements. Took a couple of days of messing around with the BIOS for this system, but glad to finally have it all figured out and working correctly.

    In AIDA64 benchmarks
    .................Original...............MemOC'd..............Improvement
    Read........34544 MB/s.........45405 MB/s...........31.4%
    Write........39478 MB/s.........48871 MB/s...........23.8%
    Copy.........34022 MB/s........44450 MB/s...........30.7%
    Latency.....85.2 ns................57.1 ns..................33.0%

    Before Mem OC:
    [​IMG]

    After Mem OC:
    [​IMG]
     
    Last edited: Nov 19, 2019
    No0B, Dennismungai, jellygood and 3 others like this.
  2. HandsomeGhost

    HandsomeGhost Notebook Enthusiast

    Reputations:
    0
    Messages:
    40
    Likes Received:
    5
    Trophy Points:
    16
    Thank you so much for this guide and helping the community. I'm having trouble when I search for Key Management with unicode checked I get nothing in the message box. Would you know why?
    Screenshot (9).png
     
  3. stranula

    stranula Notebook Consultant

    Reputations:
    33
    Messages:
    112
    Likes Received:
    77
    Trophy Points:
    41
    I just checked your BIOS, you are right, Key Management did not bring anything up. Search memory overclock instead
     
  4. HandsomeGhost

    HandsomeGhost Notebook Enthusiast

    Reputations:
    0
    Messages:
    40
    Likes Received:
    5
    Trophy Points:
    16
    Yes that worked. Thanks
     
  5. HandsomeGhost

    HandsomeGhost Notebook Enthusiast

    Reputations:
    0
    Messages:
    40
    Likes Received:
    5
    Trophy Points:
    16
    Are you able to do a CMOS reset using that guide it didn’t work for me? The hold down power button for 45 sec on boot up


    Sent from my iPhone using Tapatalk
     
  6. stranula

    stranula Notebook Consultant

    Reputations:
    33
    Messages:
    112
    Likes Received:
    77
    Trophy Points:
    41
    That works for MSI laptops. For the Razer, I noticed that if you have it plugged in and make a bad memory OC, and let it boot over and over, it will after a couple boots reset the CMOS. If not, you can unplug from power brick, open the bottom, disconnect the battery, and remove the CMOS battery for 30 secs, and it will reset. Most of the time, however, it reset itself when I made a bad OC
     
  7. HandsomeGhost

    HandsomeGhost Notebook Enthusiast

    Reputations:
    0
    Messages:
    40
    Likes Received:
    5
    Trophy Points:
    16
    Okay thanks for the info.
     
  8. stranula

    stranula Notebook Consultant

    Reputations:
    33
    Messages:
    112
    Likes Received:
    77
    Trophy Points:
    41
    Sounds like you got the options enabled? Just optimizing now?
     
  9. HandsomeGhost

    HandsomeGhost Notebook Enthusiast

    Reputations:
    0
    Messages:
    40
    Likes Received:
    5
    Trophy Points:
    16
    Yes been testing my ram overclock and checking if its stable. I got my ram running at 3467MHz I have the G.SKILL Ripjaws Series 32GB 2666Mhz
    Before
    .[​IMG]
    After
    [​IMG]

    Very pleased with my results. Thanks @stranula
     

    Attached Files:

  10. stranula

    stranula Notebook Consultant

    Reputations:
    33
    Messages:
    112
    Likes Received:
    77
    Trophy Points:
    41
    Looks like a nice improvement, glad you were able to get it working.
     
    HandsomeGhost likes this.
Loading...

Share This Page