Monday, August 21st 2023

NVIDIA BIOS Signature Lock Broken, vBIOS Modding and Crossflash Enabled by Groundbreaking New Tools

You can now play with NVIDIA GeForce graphics card BIOS like it's 2013! Over the last decade, NVIDIA had effectively killed video BIOS modding by introducing BIOS signature checks. With GeForce 900-series "Maxwell," the company added an on-die security processor on all its GPUs, codenamed "Falcon," which among other things, prevents the GPU from booting with unauthorized firmware. OMGVflash by Veii; and NVflashk by Kefinator (forum names), are two independently developed new tools that let you flash almost any video BIOS onto almost any NVIDIA GeForce graphics card, bypassing "unbreakable" barriers NVIDIA put in place, such as BIOS signature checks; and vendor/device checks (cross-flashing). vBIOS signature check bypass works up to RTX 20-series "Turing" based GPUs, letting you modify the BIOS the way you want, while cross-flashing (sub-vendor ID check bypass) works even on the latest RTX 4090 "Ada."

The tools bring back the glory days of video BIOS modding using utilities the likes of NiBiTor (now discontinued). The possibilities of such utilities are endless. You can, for example, flash the BIOS of a premium factory-overclocked graphics card onto your close-to-MSRP graphics card. For cards up to RTX 20-series "Turing," in addition to clock speeds, BIOS modding lets you raise power limits, which have a more profound impact on performance, as they increase boost frequency residency. BIOS modding also gives you control over the graphics card's voltages, cooling performance, and fan-curve, so you can make your card quieter, as long as your cooler can keep the GPU away from thermal limits (which you can adjust, too). With cross-flashing (without modifying the BIOS or disturbing its signature), you are now able to restore a voltage of 1.1 V on your RTX 4090 GPU, if you've got one of the newer models, which ticks at 1.07 V only. You could also flash your FE with a custom-design vBIOS with high power limit, to go beyond NVIDIA's power limits.
OMGVflash author Veii posted a comprehensive thread on the TechPowerUp Forums, which announces the first public beta of the tool, its development history, usage instructions, and some troubleshooting support. Find the thread here. The author has expressed interest in working with TechPowerUp on publishing future versions.

NVflashk author Kefi posted a similar comprehensive thread on TechPowerUp Forums, which can be accessed here.

OMGVflash and NVflashk are independently developed of each other. We've hand-inspected the binary code of both tools and they are free of any viruses or trojans. There's only few code modifications to the original NVFlash tool, to activate the bypass. There's no additional malware payload or anything similar. The file sizes are identical to the unmodified files. VirusTotal also confirms that these patches are legit.

Tampering with the vBIOS will void your graphics card's warranty. As with all modding, graphics card BIOS modding is not without risk, and meant for power users. It is fairly easy to recover from a broken flash, as all current desktop processors come with iGPUs that you can boot from, so you could flash a working BIOS onto the bricked graphics card. Just do remember to back-up your BIOS. You can use either of these tools to extract your current BIOS, or better yet, use GPU-Z for the task.

TechPowerUp editor and author of GPU-Z, W1zzard, will be answering all your questions in the comments section of this post. He has extensive experience with vBIOS internals from his worth with GPU-Z and he has also developed a parser that decodes, processes and organizes the ROM files in our TechPowerUp GPU BIOS Database.

Update 16:44 UTC: Kefi is currently working on a GUI version that makes it easy to backup and flash the BIOS. You can also search our BIOS Collection from within the app and filter on various properties.
Sources: OMGVflash by Veii, NVflashk by Kefi
Add your own comment

210 Comments on NVIDIA BIOS Signature Lock Broken, vBIOS Modding and Crossflash Enabled by Groundbreaking New Tools

#76
evernessince
N3utroDLSS3 uses hardware fourth generation tensor cores and Optical Flow Accelerator that do not exist on 3xxx series, it's not just software

Cool news! I'm wondering if removing TDP limit on my 4070 could change anything performance wise.

Is there a tool which allows to modify the existing bios of our own cards? I had 2 cards dying on me quickly after I used an xoc bios on another model in the past while they were properly cooled so now i wont flash anything that has been specifically designed for a specific model.
3000 series cards do have an optical flow accelerator. It's just not as good.

This is straight from NVIDIA Vice President of Applied Deep Learning Research Bryan Catanzaro

"The OFA has existed in GPUs since Turing. However, it is significantly faster and higher quality in Ada, and we rely on it for DLSS3. [RTX 2000 and 3000] customers would feel that DLSS 3 is laggy, has bad image quality, and doesn’t boost FPS."
Posted on Reply
#77
Tomorrow
kefiDesign preview of the nvflashk UI I'm working on.. feel free to make suggestions - release later this week!
Well you have dark mode straigh off the bat. It's surprising how many bigger developers who have more resources still manage to burn people's eyes.
Looks pretty good an clean.
Posted on Reply
#78
kefi
TomorrowWell you have dark mode straigh off the bat. It's surprising how many bigger developers who have more resources still manage to burn people's eyes.
Looks pretty good an clean.
Light mode, too, for those who love burning eyeballs!
Posted on Reply
#79
R-T-B
P4-630Great, so we can see many more "Fake" Gpu's in the near future....
I see that as totally worth it to open up the bios scene again. Just quit ordering cheap obvious garbage cards off places like aliexpress.
Posted on Reply
#80
mbze430
The last time I was able to mod my vBIOS was on my 980TI. Can't wait to see what this unlocks
Posted on Reply
#81
MarsM4N
Ferrum Master@eidairaman1 Get ready :D
My first thought. The forums will be flooded with cry babies who bricked their cards. :laugh: Nvidia's warranty center will also have to ramp up staff.



[ICODE]Conspiracy theory: the mod tools where "leaked" by Nvidia on purpose to increase (replacement) sales for broken cards.[/ICODE] :cool:
Posted on Reply
#82
rio
Finally, I can up the power limit on this titan v without having to shunt mod it lmao
Posted on Reply
#83
Dr. Dro
TomorrowGreat news for flashing but what i really want is a GUI tool, to modify any 20/30/40 series BIOS file (v/f curve, voltage, limits etc) and then flash it to the card.

If i understand thing correctly then no such GUI tool currently exists but it is possible to flash different manufacturer made BIOS'es to cards they were not meant for?

I already have 380W KFA2 BIOS on my Gainward GS 2080Ti ~300W card. I could try 450W bioses and there's even crazier Galaxy HOF OC LAB WC Edition with effectively unlimited 2000W and higher v/f curve but im not brave enough to try that even tho my card is cooled by Morpheus II and two high static pressure 120mm fans. Essentially 4,5 slot air cooling.

Im more interested in somehow unlocking ReBAR on 20 series. Nvidia never bothered making new BIOS'es to unlock this so i wonder if it requires unlocking or does it require new code in BIOS? Im asking because ReBAR has been PCIe feature for a long time and so it's possible that it has been included in some very old cards but never enabled?

AMD enabled it for 5000 series Navi 1 and if i remember correctly people have enabled it on older GCN cards too.

EDIT: Thanks kefi. Looking forward to it.
I wouldn't play with >500W BIOSes on anything short of a full cover waterblock. Killed my original GTX Titan that way, flashed the unlimited ES BIOS that leaked many years ago and used it with an Accelero Xtreme IV.

It's not the core you'll end up damaging, it's the VRM.
Posted on Reply
#84
pexxie
Just tested both briefly, simply saving my GPU BIOS file (--save). This card: www.techpowerup.com/gpu-specs/palit-rtx-4060-ti-jetstream-oc-16-gb.b11330

Veii's one gives trouble:
Adapter not accessible or supported EEPROM not found, skipping
Nvflash CPU side error Code:2Error Message: Falcon In HALT or STOP state, abort uCode command issuing process.

Kefi's one works:
Reading EEPROM (this operation may take up to 30 seconds)

Build GUID : E7C321C21D454934BD3410C4E56D5202
Build Number : 32849521
IFR Subsystem ID : 1569-F314
Subsystem Vendor ID : 0x1569
Subsystem ID : 0xF314
Version : 95.06.25.00.A8
Image Hash : N/A
Hierarchy ID : Normal Board
Build Date : 05/14/23
Modification Date : 06/27/23
UEFI Version : 0x7000F ( x64 )
UEFI Variant ID : 0x000000000000000B ( Unknown )
UEFI Signer(s) : Microsoft Corporation UEFI CA 2011
: Microsoft Time-Stamp PCA 2010
XUSB-FW Version ID : N/A
XUSB-FW Build Time : N/A
InfoROM Version : G002.0000.00.03
InfoROM Backup : Present
License Placeholder : Present
GPU Mode : N/A
CEC OTA-signed Blob : Not Present
Posted on Reply
#85
kefi
pexxieJust tested both briefly, simply saving my GPU BIOS file (--save). This card: www.techpowerup.com/gpu-specs/palit-rtx-4060-ti-jetstream-oc-16-gb.b11330

Veii's one gives trouble:
Adapter not accessible or supported EEPROM not found, skipping
Nvflash CPU side error Code:2Error Message: Falcon In HALT or STOP state, abort uCode command issuing process.

Kefi's one works:
Reading EEPROM (this operation may take up to 30 seconds)

Build GUID : E7C321C21D454934BD3410C4E56D5202
Build Number : 32849521
IFR Subsystem ID : 1569-F314
Subsystem Vendor ID : 0x1569
Subsystem ID : 0xF314
Version : 95.06.25.00.A8
Image Hash : N/A
Hierarchy ID : Normal Board
Build Date : 05/14/23
Modification Date : 06/27/23
UEFI Version : 0x7000F ( x64 )
UEFI Variant ID : 0x000000000000000B ( Unknown )
UEFI Signer(s) : Microsoft Corporation UEFI CA 2011
: Microsoft Time-Stamp PCA 2010
XUSB-FW Version ID : N/A
XUSB-FW Build Time : N/A
InfoROM Version : G002.0000.00.03
InfoROM Backup : Present
License Placeholder : Present
GPU Mode : N/A
CEC OTA-signed Blob : Not Present
Well that's interesting. What about normal nvflash? I didn't think any bypass was necessary to *save* a BIOS.
Posted on Reply
#86
mb194dc
Probably little benefit anyway from this for all but a few use cases. Nvidia never locked clocks as AMD did on the 5600xt to my knowledge and chips are laser cut so you can't enable extra hardware like on the old 6800 vanilla.

Still interesting to have a play around I guess.
Posted on Reply
#87
pexxie
kefiWell that's interesting. What about normal nvflash? I didn't think any bypass was necessary to *save* a BIOS.
Yes, normal nvflash v5.814 reads and saves fine. I think Veii's one is struggling because it's a bit older; v5.780. Just guessing.

EDIT: Yep, normal/original v5.780 fails as well. Something different about this newer card.
Posted on Reply
#88
Canned Noodles
I see people saying that 3000/4000 cards aren‘t picky about how many power connectors or display outputs the VBIOS has. Does the number of fans matter?
Posted on Reply
#89
AusWolf
This is not gonna ruin the used GPU market at all! :fear:
Posted on Reply
#90
Macro Device
kefiLight mode, too, for those who love burning eyeballs!
Thank you very much, kind sir. Bright modes look dope if you got a proper display and forget to shut your curtains.
Posted on Reply
#91
TheDeeGee
W1zzardYou could use the nvidia-smi command line utility, set a batch to run on startup, done
I currently run Afterburner with the "-profile1 -q" command line via task scheduler, that starts Afterburner (silent), applies profile 1 and instantly quits the app.
leezhiranThe fans are DC regulated?
They're all PWM.
Posted on Reply
#92
80251
FrozenlordIs there some tool for modding voltages on Paacal? My 1080 could use a bit of help and I have not thought it possible that we might finally be able to mod a Pascal vBios.
After flashing the Asus XOC VBIOS I could pump up to 1.2V on my 1080ti using afterburner. It took that, liquid metal TIM and 127mm fans to get my 1080ti to 2164Mhz. core clocks
Posted on Reply
#93
Hifihedgehog
Putting aside for a moment that GPU mining is not so profitable anymore, would vBIOS modding make it possible to circumvent hardware-based measures that as of now reduce mining performance?
Posted on Reply
#94
80251
mbze430The last time I was able to mod my vBIOS was on my 980TI. Can't wait to see what this unlocks
I never got much out of modding the vBIOS on my Zotac GeForce 980Ti AMP Extreme, but at least I didn't need afterburner anymore, the vBIOS did all the overclocking for me (after I tested the overclocks).

I remember on the 980ti there seemed to be three or four time/frequency domains, core, memory, cache, and something else (system clock?).
Posted on Reply
#95
R-T-B
AusWolfThis is not gonna ruin the used GPU market at all! :fear:
Not any more than it already was with shunt modding, no.
HifihedgehogPutting aside for a moment that GPU mining is not so profitable anymore, would vBIOS modding make it possible to circumvent hardware-based measures that as of now reduce mining performance?
Probably. But thats been possible for awhile now anyways.
Posted on Reply
#96
d0x360
N3utroDLSS3 uses hardware fourth generation tensor cores and Optical Flow Accelerator that do not exist on 3xxx series, it's not just software

Cool news! I'm wondering if removing TDP limit on my 4070 could change anything performance wise.

Is there a tool which allows to modify the existing bios of our own cards? I had 2 cards dying on me quickly after I used an xoc bios on another model in the past while they were properly cooled so now i wont flash anything that has been specifically designed for a specific model.
One problem... you can technically use reshade to get the same data without much performance difference since most of the optical flow! It's already being output by the engine so you just need to translate the engines data into the data from the DLSS sdk.

PureDark made a mod that replaces FSR2 with DLSS 2 on cards but on the 4000 series it does frame gen. I played Jedi survivor at 4k120 maxed out and it ran like a dream. He has a few mods and I offered to help and didn't want credit but he doesn't want help which sadly means it's limited to games he likes which is like 6.

I did fork a repo so I'm gonna try to figure it out but there are people more qualified than I who should take a look because it's the real deal.
Posted on Reply
#97
AnonymousGuy767
Canned NoodlesI see people saying that 3000/4000 cards aren‘t picky about how many power connectors or display outputs the VBIOS has. Does the number of fans matter?
Yes and yes. I've personally experienced fan misbehavior or display outputs stop working if a bios from a different card is flashed. Strix bios on MSI? You're losing a displayport output.
Posted on Reply
#98
squee666
Curious will this work on 4xxx mobile.
Saw a guy shunt mod his 4090 mobile lul for a decent uplift.
Posted on Reply
#99
Fluffmeister
Talk is cheap, get flashing. I want to see results.

I for one don't give a shit about your bricked cards.

Go!
Posted on Reply
#100
Kaotik
N3utroDLSS3 uses hardware fourth generation tensor cores and Optical Flow Accelerator that do not exist on 3xxx series, it's not just software
You shouldn't read manufacturer PR like gospel or whatever.
Optical Flow Accelerator has been present since Turing (even if the latest in Ada is more powerful and/or advanced).
Only thing 4th gen Tensors add is support for even lower FP precision which definitely isn't required for any version of DLSS.
There should be nothing preventing DLSS3 from running on Turing & Ampere other than NVIDIA deciding they shouldn't, it would just be slower.
Posted on Reply
Add your own comment
Nov 21st, 2024 10:15 EST change timezone

New Forum Posts

Popular Reviews

Controversial News Posts