Monday, August 21st 2023

NVIDIA BIOS Signature Lock Broken, vBIOS Modding and Crossflash Enabled by Groundbreaking New Tools

You can now play with NVIDIA GeForce graphics card BIOS like it's 2013! Over the last decade, NVIDIA had effectively killed video BIOS modding by introducing BIOS signature checks. With GeForce 900-series "Maxwell," the company added an on-die security processor on all its GPUs, codenamed "Falcon," which among other things, prevents the GPU from booting with unauthorized firmware. OMGVflash by Veii; and NVflashk by Kefinator (forum names), are two independently developed new tools that let you flash almost any video BIOS onto almost any NVIDIA GeForce graphics card, bypassing "unbreakable" barriers NVIDIA put in place, such as BIOS signature checks; and vendor/device checks (cross-flashing). vBIOS signature check bypass works up to RTX 20-series "Turing" based GPUs, letting you modify the BIOS the way you want, while cross-flashing (sub-vendor ID check bypass) works even on the latest RTX 4090 "Ada."

The tools bring back the glory days of video BIOS modding using utilities the likes of NiBiTor (now discontinued). The possibilities of such utilities are endless. You can, for example, flash the BIOS of a premium factory-overclocked graphics card onto your close-to-MSRP graphics card. For cards up to RTX 20-series "Turing," in addition to clock speeds, BIOS modding lets you raise power limits, which have a more profound impact on performance, as they increase boost frequency residency. BIOS modding also gives you control over the graphics card's voltages, cooling performance, and fan-curve, so you can make your card quieter, as long as your cooler can keep the GPU away from thermal limits (which you can adjust, too). With cross-flashing (without modifying the BIOS or disturbing its signature), you are now able to restore a voltage of 1.1 V on your RTX 4090 GPU, if you've got one of the newer models, which ticks at 1.07 V only. You could also flash your FE with a custom-design vBIOS with high power limit, to go beyond NVIDIA's power limits.
OMGVflash author Veii posted a comprehensive thread on the TechPowerUp Forums, which announces the first public beta of the tool, its development history, usage instructions, and some troubleshooting support. Find the thread here. The author has expressed interest in working with TechPowerUp on publishing future versions.

NVflashk author Kefi posted a similar comprehensive thread on TechPowerUp Forums, which can be accessed here.

OMGVflash and NVflashk are independently developed of each other. We've hand-inspected the binary code of both tools and they are free of any viruses or trojans. There's only few code modifications to the original NVFlash tool, to activate the bypass. There's no additional malware payload or anything similar. The file sizes are identical to the unmodified files. VirusTotal also confirms that these patches are legit.

Tampering with the vBIOS will void your graphics card's warranty. As with all modding, graphics card BIOS modding is not without risk, and meant for power users. It is fairly easy to recover from a broken flash, as all current desktop processors come with iGPUs that you can boot from, so you could flash a working BIOS onto the bricked graphics card. Just do remember to back-up your BIOS. You can use either of these tools to extract your current BIOS, or better yet, use GPU-Z for the task.

TechPowerUp editor and author of GPU-Z, W1zzard, will be answering all your questions in the comments section of this post. He has extensive experience with vBIOS internals from his worth with GPU-Z and he has also developed a parser that decodes, processes and organizes the ROM files in our TechPowerUp GPU BIOS Database.

Update 16:44 UTC: Kefi is currently working on a GUI version that makes it easy to backup and flash the BIOS. You can also search our BIOS Collection from within the app and filter on various properties.
Sources: OMGVflash by Veii, NVflashk by Kefi
Add your own comment

209 Comments on NVIDIA BIOS Signature Lock Broken, vBIOS Modding and Crossflash Enabled by Groundbreaking New Tools

#51
Z-GT1000
Could this potentially be used to mod the 2XXX series to unlock Resizable BAR?
Posted on Reply
#52
Punkenjoy
dyonoctisFrom what I've understood the benefits of AI hardware on consumer device is not about "computing stuff that cannot be done with regular hardware" but being more efficient at doing it, and not using compute ressources that could be used for something else.
While XeSS doesn't need the XMX units, even Wizzard found that the "non- native" XeSS wasn't equal when it comes to performance gain and visuals.
Remedy also eventually stopped using the "2.0 prototype" in favor of the Tensor core accelerated one.

For DLSS3 an Nvidia engineer came out and said that DLSS 3.0 can work on ampere...But the end result will not be as good, and seeing how people like to trash talk the current "ideal" implementation, they might have avoided a bullet. :D If it was even more glitchy and had a higher latency impact, forums dwellers would have never shut up about how laughable the tech is

There is certainly a benefits of using unused portion of the dies (Tensor cores or XMX units) to run inference based upscaler since they are much faster to run inference and also, they don't use the standard compute units. So Any upscaling technique using inference/ML will run much better on those. (FSR 2.x is not a ML upscaler and would probably not benefits much of running on tensors cores. (It could even lead to lower quality since these ai cores are lower precision. AMD already wen't back from using lower precision for few step to increase quality.)

For your exemple between DLSS 2.x and 1.x, it's not about hardware at all. It's just that DLSS 1.x was a spacial upscaler (like FSR 1.x) and DLSS 2.x is a temporal upscaler. For DLSS 3.0 and Ampere, the main problem is not the hardware support, but how quickly the hardware can do it. My understanding is Ampere tensors cores are not fast enough to perform both DLSS upscaling + Frame generation. There would be no benefits to run DLSS3 if it doesn't actually increase your framerate.
Posted on Reply
#53
Tomorrow
JismEven Polaris works with Rebar if i'm correct. Just never bothered to actually implement it. Users had to hack around it. It's nothing special - it's a PCI-E sig and it's bin there for many years.

2000W bios is'nt going to harm your card - only when you raise crazy amount of power through the chip and not having sufficient cooling.
Well my hotspot temp in games is under 75c even at 380W. Much lower when looking at the GPU temp itself but i prefer hotspot as it's the hottest.
I suppose i could still set a software limit of 88c like it is currently. Naturally the voltage itself would be the limiting factor way before power consumption or even temp becomes an issue.
Posted on Reply
#54
Assimilator
Z-GT1000Could this potentially be used to mod the 2XXX series to unlock Resizable BAR?
That's not how anything works.
Posted on Reply
#55
Raiden85
P4-630Great, so we can see many more "Fake" Gpu's in the near future....
First thing I thought of. The scammers are going love this.
Posted on Reply
#56
TheDeeGee
I would only use this to change power limit table (lower it) so i don't have to use Afterburner. But it's not worth the risk.
Posted on Reply
#57
W1zzard
TheDeeGeeso i don't have to use Afterburner
You could use the nvidia-smi command line utility, set a batch to run on startup, done
Posted on Reply
#58
Tomorrow
AssimilatorThat's not how anything works.
Many things are deemed impossible, until they are done. Take this topic for example. Nvidia's LHR was beat as has been Denuvo DRM numerous times.

I was laughed at as insane person when is suggested translating Direct3D calls ten years ago. An now we have DXVK, Proton, CrossOver etc.
Posted on Reply
#60
Beginner Macro Device
I'm 100% sure this Q has already been asked but how do I edit the BIOS itself if no existing BIOS meets my needs? I mean, without HEX editors or other shamanisms.
Posted on Reply
#61
mouacyk
Will it be possible to disable Boost 3.0/2.0/1.0 now, and return to the g'olden days of Maxwell custom BIOS editing where WYSIWYG?
Posted on Reply
#62
ARF
You can now play with NVIDIA GeForce graphics card BIOS like it's 2013!
You can, for example, flash the BIOS of a premium factory-overclocked graphics card onto your close-to-MSRP graphics card.
Tampering with the vBIOS will void your graphics card's warranty.
I see that the stock is not moving, and clearly this looks like a poor and cheap PR attempt to call for some attention.
Except that it is not 2013, even in the slightest, and instead of guiding the users to try to brick their cards at their own responsibility and risk, maybe it's better to reanalyse the pricing structure and offer some very deep discounts.

Current nvidia lineup:

RTX 4090 24GB: 1600 - 3772 - sky is the limit
RTX 4080 16GB: 1100 - 2310 - sky is the limit
RTX 4070 Ti 12GB: 800 - 1600 - sky is the limit
RTX 4070 12GB: 600 - 1265 - sky is the limit
RTX 4060 Ti 16GB: 500 - 625 - sky is the limit
RTX 4060 Ti 8GB: 390 - 600
RTX 4060 8GB: 290 - 392

Lower limit is the cheapest available model, the higher limit is the most expensive available model at time of writing. Source: newegg.
Posted on Reply
#63
PK1
ZoneDymoman...I honestly did not know Nvidia even (tried to) locked this out....what a crappy move.
has AMD locked this out as well?
Yes AMD is even more restrictive. Newer 7000 series AMD gpus require a CH341A bios programmer to flash different vbios. Perhaps in the future people will figure out a way to use AMDVB Flash on newer AMD gpus.

This is sooooo awesome! I can't wait to see what interesting new programs and mods develop from this.
N3utroDLSS3 uses hardware fourth generation tensor cores and Optical Flow Accelerator that do not exist on 3xxx series, it's not just software

Cool news! I'm wondering if removing TDP limit on my 4070 could change anything performance wise.

Is there a tool which allows to modify the existing bios of our own cards? I had 2 cards dying on me quickly after I used an xoc bios on another model in the past while they were properly cooled so now i wont flash anything that has been specifically designed for a specific model.
Just flash the highest power limit vbios available for the 4070. Typically Galax and Asus have them. I use Galax 666w vbios on my MSI 4090 since December 2022 with no issues.
Posted on Reply
#64
dyonoctis
PunkenjoyThere is certainly a benefits of using unused portion of the dies (Tensor cores or XMX units) to run inference based upscaler since they are much faster to run inference and also, they don't use the standard compute units. So Any upscaling technique using inference/ML will run much better on those. (FSR 2.x is not a ML upscaler and would probably not benefits much of running on tensors cores. (It could even lead to lower quality since these ai cores are lower precision. AMD already wen't back from using lower precision for few step to increase quality.)

For your exemple between DLSS 2.x and 1.x, it's not about hardware at all. It's just that DLSS 1.x was a spacial upscaler (like FSR 1.x) and DLSS 2.x is a temporal upscaler. For DLSS 3.0 and Ampere, the main problem is not the hardware support, but how quickly the hardware can do it. My understanding is Ampere tensors cores are not fast enough to perform both DLSS upscaling + Frame generation. There would be no benefits to run DLSS3 if it doesn't actually increase your framerate.
1.9 was a special case apparently, Control was the only game to use it. HUB said that it was temporal, and it had a bigger performance uplift vs 1.0. It was a "transitional" DLSS.
Nvidia DLSS in 2020: Stunning Results | TechSpot
Posted on Reply
#65
heavyarms2112
ZoneDymoman...I honestly did not know Nvidia even (tried to) locked this out....what a crappy move.
has AMD locked this out as well?
yep. they've locked it from 6000 series.
Posted on Reply
#66
JAKra
W1zzardWhich you still cannot, because the cores are disabled through on-die fuses. Unlocking through BIOS modding was possible on older ATI cards until they figured that using the BIOS to lock shaders is too easy to circumvent. It's how I got interested in the hardware scene over 20 years ago (ATI Radeon 9500 to 9700 mod, web.archive.org/web/20030118032341/http://www.maxdownloads.com/~ian/wizzard/)
Those where the times... :)
20 years ago, following your guide I've moded my Radeon 9800SE (4 pipelines) to Radeon 9800Pro (8 pipelines). It was 128 bit card though... still made a huge difference. So thanks for bringing back these memories! :D
Posted on Reply
#67
PanosX
Ι remember old days on GTX 9XX series i can speed up more fan rpm than stock biosflash!!can i with this tool?i not say about fan curve but more rpm on 100%
Posted on Reply
#68
ir_cow
So RTX 20 series and below now get to enjoy voltage BIOS mods while 30 and 40 series still have cross flashing like before?
Posted on Reply
#69
Luke357
KARMAAADoes this mean I could flash a 3090 BIOS onto a 3080 Ti and unlock the extra CUDA Cores that were disabled?
I hope so. I also hope my 3080TI FE is actually binned well enough for it to work!
Posted on Reply
#70
Double-Click
Man it has has been a while...

The last card I flashed was a 5850 ref to an unlocked 5870.
Also an extremely late thanks to TPU for the VGA BIOS Collection lol.
Posted on Reply
#71
Frozenlord
ir_cowSo RTX 20 series and below now get to enjoy voltage BIOS mods while 30 and 40 series still have cross flashing like before?
Is there some tool for modding voltages on Paacal? My 1080 could use a bit of help and I have not thought it possible that we might finally be able to mod a Pascal vBios.
Posted on Reply
#72
PanosX
Luke357I hope so. I also hope my 3080TI FE is actually binned well enough for it to work!
yes but only cuda cores not VRAM
Posted on Reply
#73
kefi
Design preview of the nvflashk UI I'm working on.. feel free to make suggestions - release later this week!
Posted on Reply
#74
ir_cow
FrozenlordIs there some tool for modding voltages on Paacal? My 1080 could use a bit of help and I have not thought it possible that we might finally be able to mod a Pascal vBios.
You could always flash it to a XOC BIOS with unlimited power, but the voltage was still locked without shunt mods. Now it seems BIOS modding is back. So the this news post makes it seem.
Posted on Reply
#75
Frozenlord
ir_cowYou could always flash it to a XOC BIOS with unlimited power, but the voltage was still locked without shunt mods. Now it seems BIOS modding is back. So the this news post makes it seem.
Well, this is a bit awkward, but I am trying to reduce my voltage. I have been running my rig with Windows and an undervolted GPU - after switching to Linux I have lost the undervolting and want to reduce the voltage via the vBIOS. My 1080 is a mobile one and the heatsink is not perfect, which is why the stock voltage causes it to thermal throttle under load, with the undervolt giving me better performance.
Posted on Reply
Add your own comment
May 21st, 2024 09:02 EDT change timezone

New Forum Posts

Popular Reviews

Controversial News Posts