[Detailed + Need Help] Interesting Undervolting Lock(?) Situation on HP Victus 16 r1xxx

[Fadel_Hel]

The interesting and weird thing is that Throttlestop undervolting is completely locked as shown in the screenshot, BUT there is an HP Omen Gaming Hub Utility that has an undervolt feature which allows me to undervolt the CPU Core only.

Although Throttlestop shows voltage controls as locked, it shows that the undervolt which is applied through the HP Omen Utility is real and functional in the FIVR page.

.

I have had experiences with locked undervolting before, so far I was able to unlock it in every case, except my current HP Victus 16-r1057nt Laptop with an i7-14700HX on the latest BIOS version from HP (version f.12).

Simple fixes:

• Disabling Core Isolation
• Disabling VBS (Virtualization-Based Security)
• Disabling Virtualization from BIOS

Advanced fixes:

Modding BIOS using setup_var or RU.efi, to change both CFG Lock and Overclocking Lock variables, done it successfully 5 times so far on different machines from different manufacturers. (Lenovo, Dell, and Asus)
But when it comes to this HP BIOS (Insyde f.12), I am unable to.

I was not able to backup my current BIOS using the Universal BIOS Backup Toolkit, I get the error "Driver install failed!" which as far as I understand means that there is some kind of protection on the BIOS.
I was able to bypass the backup issue by using the UEFITool on the official BIOS from HP's website (since it is the BIOS that I currently have installed) then using IFRExtractor to turn it into a readable text file, it is attached.
From the text file I was able to learn the Offset Values of CFG Lock (0x43) and Overclocking Lock (0x10E), but I couldn't make sure in which EFI variable they are stored, usually it is CpuSetup or Setup
Nevertheless, I still booted into RU.efi and tried changing the Offset Value 0x43 inside CpuSetup from 1 to 0. When I try to save the new value (ctrl+w) I get WRITE ERROR 0x00000008 EFI_WRITE_PROTECTED.

As far as I understood from other guides and threads, if there is EFI write protection then the only thing which only has a low chance of working is flashing an already modded BIOS with an external programmer.

If anyone reading this with some experience or knowledge could answer some of my questions I would appreciate it a lot.
Questions:

• In which EFI Variable are the CFG Lock and Overclocking Lock actually located? If you know how to read BIOS dumps please check the attached text file.
• Do you think that both of these Lock variables are currently set to 1, if not, which variable is responsible for what? The fact that the Omen Utility is able to undervolt CPU Core makes me think that only one of the variables is actually locked not both.
• Why can't Throttlestop change voltages but the Omen Utility can? What special permissions or drivers does the Omen Utility have that makes it able to somehow bypass the undervolting lock that Throttlestop is experiencing?

Possible Solutions?

• Do you think it is possible to locally modify the HP Omen Gaming Hub Utility to add "sliders" just like the CPU Core one but for CPU Cache as well? This solution might be very difficult since the utility is not open-source
• What about modifying Throttlestop in such a way to make it "pipeline through" the HP Omen Utility? Maybe if we somehow connect it to one of the HP drivers we could at least obtain control over CPU Core (which is definitely adjustable) from Throttlestop as well rather than only from the utility.

Anyways, I love this forum, and I love Throttlestop and the freedom it gives you to control everything. Thank you for spending the time and reading. Any help is appreciated

 

[unclewebb]

When you make a voltage change using the HP OMEN software, is this change reported immediately in the ThrottleStop FIVR monitoring table or do you have to reboot first before the offset voltage change takes effect?

I am guessing that the HP OMEN software interacts with the BIOS. It can only apply a voltage change when the CPU is unlocked while in the BIOS. As the BIOS initializes the CPU, the undervolt is applied and then the lock bit is set so no further voltage changes can be made after you boot up into Windows. The BIOS setting this lock is what prevents ThrottleStop from being able to change the CPU voltage.

As far as I know, HP does a good job locking down the BIOS of their laptops. If you can find a way to remove the lock bit, ThrottleStop should work.

Do you think it is possible to locally modify the HP Omen Gaming Hub Utility to add "sliders"

How can you modify the HP OMEN Gaming Hub source code if you do not have access to this source code?

What about modifying ThrottleStop in such a way to make it "pipeline through" the HP Omen Utility?

That is never going to happen.

Using an external programmer to flash a modified BIOS is beyond my skill level. Post in the ThrottleStop thread if you ever come up with a solution. Anyone that figures this out will have a lot of new HP friends.

 

[Fadel_Hel]

When you make a voltage change using the HP OMEN software, is this change reported immediately in the ThrottleStop FIVR monitoring table or do you have to reboot first before the offset voltage change takes effect?

I am guessing that the HP OMEN software interacts with the BIOS. It can only apply a voltage change when the CPU is unlocked while in the BIOS. As the BIOS initializes the CPU, the undervolt is applied and then the lock bit is set so no further voltage changes can be made after you boot up into Windows. The BIOS setting this lock is what prevents ThrottleStop from being able to change the CPU voltage.

Dear unclewebb, yes your guess seems to be right. To apply an undervolt from the HP Gaming Hub a restart is required.

As far as I know, HP does a good job locking down the BIOS of their laptops. If you can find a way to remove the lock bit, ThrottleStop should work.


How can you modify the HP OMEN Gaming Hub source code if you do not have access to this source code?

Honestly no idea, I was thinking of something like when people crack executables. Maybe the .msixbundle contains the source code since the .exe is not compiled yet. This is probably completely off topic, but a possible solution down the line

Using an external programmer to flash a modified BIOS is beyond my skill level. Post in the ThrottleStop thread if you ever come up with a solution. Anyone that figures this out will have a lot of new HP friends.

Same here, and will do.

On a side note, I have been reading your replies to threads on here for at least 2 years now unclewebb, and I just want to say thank you for your efforts in developing Throttlestop and the time you put into helping people.

 

[Fadel_Hel]

Dear unclewebb, I seem to have unlocked my CFG Lock and Overclocking Lock bits, but throttlestop still shows Locked. Is it possible that it is due to the fact that throttlestop 9.6 does not have support for 14700HX cpus yet? I have an i7 14700HX

 

[unclewebb]

Throttlestop 9.6 supports the 14700HX. Post a screenshot of the FIVR window. Does the top middle of the FIVR window show that Undervolt Protection is enabled?

Try uninstaling HP Gaming Hub.

 

[Fadel_Hel]

Throttlestop 9.6 supports the 14700HX. Post a screenshot of the FIVR window. Does the top middle of the FIVR window show that Undervolt Protection is enabled?

Try uninstaling HP Gaming Hub.

Dear unclewebb, apparently I was mistaken the CFG Lock and Overclocking Lock bits are still set to 1, whatever method we used to edit the BIOS envirnoment variables showed that it succeeded but in reality it didnt change the bits. Before I figured out my mistake though, I had the same idea that the Gaming Hub was blocking throttlestop somehow. I uninstalled the HP Gaming Hub app but its undervolt stayed, then I deleted its drivers and disabled its services, but the undervolt also stayed. Even reinstalling it and setting the offset to 0 did not disable its undervolt although you can change the undervolt value. So in the app if you ever used it's undervolting feature, you can only bring it down to -0.005 mv, then if you bring the slider one step further to 0, it still stays on -0.005mv. The bug in the Omen Gaming Hub is that when you set the offset to 0, it doesn't set it to 0 it just turns off the feature without updating the offset to 0 in the BIOS. I just thought it is interesting.

The only way to remove the effect of the HP Omen Gaming Hub undervolt is to do a CMOS reset which resets the BIOS. (in my case it was holding the power button for around 30 sec)
This confirms your suspicion that it is somehow interacting with the BIOS and making permanent changes to it.

Regardless the HP BIOS are well protected. I hit a dead end with modding my BIOS because my Intel ME is too new (version 16.1.30.2418) and the FPTW16.1.30.2418 has not been leaked yet. This is the tool which occasionally leaks from Intel that allows flashing of modded BIOSes. Latest leak was for version 16.1.25.something , maybe it's near.

For anyone reading this who has a modern HP Laptop and is trying to unlock its BIOS, check your ME version, and search for the FTW tools with your exact version, if it exists you have a good chance of being able to unlock your BIOS. If not then you are like me, I will sit tight and wait for the tool to leak, and then I will post a step by step guide on how to do it if I am succesful.

The only remaining potential solution which I havent tried yet, is shorting specific pins on the motherboard to enable "service mode" which disables BIOS protection temporarily. If anyone tries this please do let me know. When the time comes for me to open my laptop to clean it, I will briefly explore this approach.

Cheers.