BIOS UEFI variable CpuSetup is write-protected. How to remove write-protection?

[Fadel_Victus]

Hello everyone,

I am using the HP Client Management tools to modify UEFI variables. I want to modify only 2 bytes in the CpuSetup UEFI variables whose GUID is B08F97FF-E6E8-4193-A997-5E9E9B0ADB32 so that I can turn off CFG Lock at 0x043 and Overclocking Lock at 0x10E so I can unlock full undervolting on my i7-14700HX cpu (YES IT IS AN HX PROCESSOR BUT HP PREVENTS YOU FROM UNDERVOLTING OR OVERCLOCKING IT LIKE WTTTFFFF, anyways).

In the screenshot I am running the following command:

Set-HPUEFIVariable -Namespace "{B08F97FF-E6E8-4193-A997-5E9E9B0ADB32}" -Name CpuSetup -Value $customValues -Verbose

Does anyone know how to remove the write-protection on the CpuSetup variable?

The CpuSetup variable only has 3 attributes:
-VARIABLE_ATTRIBUTE_NON_VOLATILE = 0x00000001
-VARIABLE_ATTRIBUTE_BOOTSERVICE_ACCESS = 0x00000002
-VARIABLE_ATTRIBUTE_RUNTIME_ACCESS = 0x00000004

It definitely does NOT have the VARIABLE_ATTRIBUTE_AUTHENTICATED_WRITE_ACCESS attribute or the VARIABLE_ATTRIBUTE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute.

This means that the write-protection is applied in a different way. From the UEFI documentation I was able to find the following:

EFI_FILE_PROTOCOL_SetInfo():

"The SetInfo() function sets information of type InformationType on the requested file. Because a read-only file can be opened only in read-only mode, an InformationType of EFI_FILE_INFO_ID can be used with a read-only file because this method is the only one that can be used to convert a read-only file to a read-write file. In this circumstance, only the Attribute field of the EFI_FILE_INFO structure may be modified. One or more calls to SetInfo() to change the Attribute field are permitted before it is closed. The file attributes will be valid the next time the file is opened with Open()."

For context, the Omen Gaming Hub and the open source tool OmenMon CAN modify the CpuSetup UEFI variable through WMI calls when you apply the OGH undervolting. Unfortunately, this only allows us to modify the addresses 0x1E0 and 0x1E2 inside of CpuSetup (which correspond to Core Offset Voltage and Core Offset Voltage Prefix (+ or -) respectively). Thus the CpuSetup UEFI variable is DEFINITELY modifiable.

Please if anyone is a BIOS engineer, or has expertise in UEFI, their help would be much much appreciated.

Please help.

This problem can be solved in two possible ways:

1 - Removing write-protection from the CpuSetup variable.

2 - Exploiting WMI calls such as (ExecuteBiosWmiCommand()) to modify the values at addresses 0x043 and 0x10E, instead of 0x1E0 and 0x1E2.

After spending weeks on possible solution 2, I am starting to lose hope in it, so maybe possible solution 1 could be more promising.

Please if anyone has any insight or expertise help.

Thank you for reading this long question 🙂

[BeemerBiker]

 I do not think you can do that using that ClientManagement app.

Your board is probably not in factory setup mode.

I also noticed the warning about Legacy instead of UEFI

There is probably a setting for allow (unlock) that undervolting option

checkout this and this

possibly this also

I have an HP Shire motherboard that is in factory setup mode and there are still items that cannot be changed.  The board also has an option (jumper) to restore the original bios which is nice to use if I mess too much with factory setup.

How did you determine the locations and values to be used? 

If you get it to work, please post back here.

I have a  somewhat similar problem with my Shire motherboard in a 30L case: the Led lighting is Obelisk instead of Omen 30L as determined by a BIOS setting.  I have not figured out how to spoof the bios to make the lighting studio think I have a real 30L

https://youtube.com/shorts/EcxafA7CWJk?feature=share

[Fadel_Victus · Accepted solution]

Hello, thank you for your reply. My board is in manufacturing programming mode, but as far as I can tell, this MPM only allows me to change my Device's name and serial number and such things.

I determined the location and values to be used using UEFITool and IFRExtractor, basically you can use UEFITool on the official BIOS file from hp's website, and then using IFRExtractor you turn the file into text to see which variable addresses correspond to which setting.

Anyways, for your specific problem check OmenMon on github, it has direct BIOS controls for the lights. It basically has all the features of Omen Gaming Hub + some more + more freedom

Regarding the links you suggested, yea I am trying to do the same thing as them, but I am stuck exactly on the step to change the variable because I get the error that CpuSetup is write-protected, and I am only interested in removing this write-protection to continue with what everyone else is doing. I have done this on many laptops before, none of them had such a write-protection.

[BeemerBiker]

Thanks, I will look at Omen Mon.

I have several different systems.  One used mystic lights but MSIRGB at Github was better.

Another is an Area51 case with a non-D.ell  motherboard but I got the lights working by spoofing the bios.

I am looking at using OpenRGB on the HP motheboard but have never used QT Creator before.  Supposedly it will work with VS2022. 

----

you might try registering at the HP developer portal and ask over there

https://developers.hp.com/hp-client-management/forum/client-management-solutions