Tenoroon's Guide to Fully Unlocking Haswell's Turbo bins

[Tenoroon]

Good Evening everyone,

After hours of following old guides, and installing odd software, I believe I have found the easiest and most universal way to fully unlock Haswell-M class CPUs that utilize turbo bins.

I will do my best to explain everything, but I must warn you all that everything listed below is what I have figured out, and I am still learning. This means that this process might not work for some people. (Step 10 of the Insyde portion goes into more depth.) I am hoping I can get some input and have some people test out my method on different computers. I really want to test and ensure this method works for all Haswell mobile BIOSes, but I don't have all of the resources and knowledge to do that. I would really appreciate any help/assistance that I can get on this journey 😉

Let me know if my way of explaining this is too confusing/convoluted. I struggle a bit with putting my mind into words, so I might not go fully in depth into some things that don't seem complicated to me. This post will probably be edited multiple times to make things more clear and to fix spelling errors as this is quite a lengthy post 🙂

Anyways, let's get started!

What is the Haswell Microcode "Bug"?
The Haswell Microcode "Bug" as it is called isn't really a bug at all, but more so an oversight that managed to slip through the cracks and end up available for us, the general consumer. 

Haswell CPUs, like all other CPUs, have a few different Microcode versions as seen in the list below. Think of the Microcode as a set of very basic, but important instructions that are implemented on a higher level than other instructions that a CPU utilizes. One of the Microcode versions (306C2, better known as C20603) has a very special attribute. It allows for certain Haswell based CPUs to have a fully unlocked multiplier up to x80. I personally don't know why it is this way. It is either because this microcode was used for pre-production testing and somehow made its way to the public, or because it was a simple bug that went unnoticed until it was too late. Either way, Intel quickly realized the problem, and pushed out a newer microcode version that patched this "bug".



A few years later, people realized that this old microcode version would allow them to further push their MQ CPUs. A guide was posted over various websites, but it seems that the guide is only really intended for AMI/Phoenix BIOSes, and some of the tools listed in the original guide have been lost to time. 

Despite these roadblocks, I have found a way to implement the older "bugged" microcode into both AMI/Phoenix BIOSes and Insyde BIOSes (the latter being a bit more difficult, but still possible.)

I am not entirely sure if this works for desktop CPUs (If someone could test this, I would be glad to credit you!), but I can attest that this does work for all Haswell CPUs with the MQ moniker. I plan on testing a 4210M that I have, and will update this post once I get results from using that.

 

Edit as of 12/28/22:
This method will only work for Haswell CPU's that have turbo bins. I tested my 4210M and it was not able to be overclocked.

This guide will be using the unlocked A14+ BIOS for the Alienware 17 R1 by @Ashtrix and Striker1234 as a reference for the Insyde portion, and the stock E1763IMS.11D BIOS from the MSI GT70 will be used as a reference for the AMI/Phoenix portion. While you can use the guide from the Insyde portion on AMI/Phoenix BIOSes, I heavily recommend not doing this as the Insyde method has potential problems (See Step 10 of the Insyde method.)

The Guide:
Implementing the old Microcode into a BIOS

There are some programs that you will need in order to perform this mod, below is a a list of the programs needed:
UEFI BIOS Updater (UBU) https://winraid.level1techs.com/t/tool-guide-news-uefi-bios-updater-ubu/30357 This will be used for obtaining the "bugged" microcode version. It can also be used to obtain any other microcode versions you may want.
HxD - Freeware Hex Editor: https://mh-nexus.de/en/hxd/ This will be used for viewing and editing the BIOS and microcode files if you are modifying an Insyde BIOS.
Throttlestop version 8.70: https://www.filehorse.com/download-throttlestop/41599/download/ This older version of TS is necessary for changing the speed of the CPU as the multiplier behaves in a very odd way. Any TS version 8.x should work, but 8.7 was the newest version I could find that worked.
AMI MMTool v5.0.0.7 This tool is only needed if you are modifying an AMI/Phoenix BIOS. I cannot provide a download link here for various reasons, but just look up "MMTool Aptio 5.00.0007" and download that.
 

AMI/Phoenix Method:

Spoiler

Step 1: Download or dump the BIOS you plan on modifying. For this portion, it is the E1763IMS.11D BIOS that can be found on MSI's website.
Step 2: With UBU open, put your BIOS file and AMI MMTool v5.0.0.7 into the folder with all of the other files. (Your folder may look a bit different then mine)

Step 3: Rename mmtool_v5 to "mmtool_a4" and make sure that it's a .exe file.
Step 4: Run the UBU .bat file, and go through until you get to the "Main Menu" 
Step 5: Choose the number that says CPU MicroCode next to it. (For me it's usually 5)
Step 6: You should be on a prompt below. (Yours may look different then mine depending on what BIOS you are modifying, this is okay) Press V to open the list of microcode's supported through the program.

Step 7: Scroll down in the text file until you find #LGA1150 like in the picture below. Delete all of the strings besides the 306C2 string as that's the "bugged" microcode we want to keep. Save the text file when you are done.
From this:

To this:

Step 8: Go back to the UBU tab, and press F to replace the microcode in the BIOS with the the "bugged" C20603 microcode. You should be on a prompt that only has the CPUID of 306C2:

Step 9: Press R to start the replacement. Wait for it to finish, press any key to exit and then you can close out of UBU.
Step 10: To double check that the "bugged" microcode was implemented, rename the bios.bin to bios.rom and open the mmtool_a4 file we added earlier.
Step 11: Click "Load Image" and select the bios.rom that is in the UBU folder. Now go to the "CPU Patch" tab and make sure the only CPU ID is 06C2. If it is the only one, then you are good to go.

Step 12: Flash the newly modified BIOS onto the desired computer.

What we just did was replacing the newer microcode with the older "bugged" microcode in the BIOS file by using the UBU tool. This means that once you flash the BIOS, it should utilize the old "bugged" microcode.

Insyde Method:

Spoiler

Step 1: Download or dump the BIOS you plan on modifying. For me, it is the A14+ BIOS that can be found here.
Step 2: With UBU open, put your BIOS file into the folder with all of the other files. (Your folder may look a bit different from mine)

Step 3: Run the UBU .bat file, and go through until you get to the "Main Menu" 
Step 4: Choose the number that says CPU MicroCode next to it (For me it's usually 5)
Step 5: You should be on the prompt below, press X to extract all of the CPU microcode's from the BIOS file. 

Step 6: Close out of the prompt, and go back to the UBU folder. Go to Extracted -> Intel. Locate the file that says cpu306C2... and open it in HxD. I will be referring to the information in this file as C20603, as that is the microcode version that it contains.
Step 7: Now, open the BIOS file that you intend to modify in HxD. Ignore the other tab with the cpu306C2... file 
Step 8: Press Ctrl+F, select Hex-values, and type in C3 06 03 and click Forward. (Include the spaces) You should be in an area that looks like this:

Step 9: There are some important things you need to know. First off, the 01 12 hex bytes before the C3 06 03 is where the microcode portion of the BIOS starts. Second, to tell how large the portion of microcode is in the BIOS, look 19 hex bytes after the C3 06 03. The 58 for me means that the block size of the microcode portion is 5800. (I am not using rows or columns to describe the location of the specific bytes as different BIOSes may have said bytes in slightly different locations, but the bytes will always be the same distance apart from the first C3 06 03.
Step 10: Go into the cpu306C2 tab of HxD, and make sure the block size is the exact same as the block size in the BIOS tab (for me it is 58).

Step 10 is the iffy part. For me, the block size for the original microcode and the "bugged" microcode is the same, so it works, but this may be different for some other BIOSes. If the BIOS C30603 portion is bigger than the C20603 portion. Than I would assume that if you added blank data to the end of the BIOS portion after pasting in the C20603 microcode, that everything SHOULD be fine. If you are in the scenario where the C20603 portion is bigger than the original BIOS portion, I don't really know what to do as it may increase the size of the BIOS file. I hope I can get some help on this as there are probably certain BIOSes that fall into this category. Any technical help on this would be appreciated. (This post will be edited if a solution is found).


Step 11: Copy ALL of the C20603 microcode. Go into the BIOS tab and click the 01 I explained about in Step 9. Right click it, and click select block. Enter whatever your block size is into the length portion (for me that would be 5800,) and click OK.
Step 12: Now paste the code you had copied from Step 12 into the highlighted portion of the BIOS tab, it should now look something like this: (The red area indicates where the copied code now occupies.)

Step 13: Save the BIOS file with the new code, and get ready to flash it.

What we just did was replacing the newer microcode with the older "bugged" microcode in the BIOS file using the hex editor. This means that once you flash the BIOS, it should utilize the old "bugged" microcode.

Utilizing the newly unlocked multiplier
Because of the weird nature of this microcode version, you cannot adjust the multiplier in the BIOS. You may also have incorrect voltage readings. These aspects can be annoying, but it is worth it if you want your CPU to run faster than normal. Using this microcode also means you DON'T have the Spectre/Meltdown mitigations, so if you are worried about that, don't use this microcode. 

Also, you will probably realize that you can't overclock your CPU too much without feeding it a LOT of voltage. This is because these CPUs are worse bins than the MX class CPUs, meaning they will require more voltage to hit the same clocks as a higher SKU CPU. I can only really get my 4710mq to 4.3ghz all core before it starts needing 1.38-1.4 volts to run, which at that point it will either throttle because it generates so much heat or I will get a BSOD.

Setting up Throttlestop:

Spoiler

Step 1: DON'T change any of the OC settings in the BIOS. Make sure you have overclocking/extreme edition enabled in the BIOS and that's it. I know this is odd, but it will not work if you OC from the BIOS. (Also make sure XTU isn't installed.)
Step 2: Go into AIDA64 and check what IA Brand ID says. If it says 00h, it means that you have the "bugged" microcode. If it says anything else, you might want to disable Windows microcode updates and re-flash the BIOS. Look up how to prevent Windows microcode update if you don't already know how to do this.

Step 3: Open Throttlestop version 8.7 (Any variant of 8 will work, but I use 8.7 as its the newest 8.x version I could find).

This is where the process gets a bit weird, so stick with me!

Step 4: On the bottom, click "Turn On" and then click "Save." Now open FIVR and make sure "Overclock" is selected and that "Ok - Save voltages immediately" is selected, click apply.

Step 5: Crank up the Turbo Ratio Limits to the max and hit apply.
Step 6: Now, here's where it gets weird. Close out of the FIVR tab by pressing the X. Now open it again and your Turbo Ratio Limit (TRL) max should be upped by 2 (For me it went to 42 -> 44) Every time you open and close out of the FIVR after maxing out the Active TRL, it should up the TRL max by 2.

Step 7: Now to get your actual CPU to run faster, go into the main TS menu and click "Set Multiplier". Now increase the number so that it corresponds with the Active TRL you set. (for me that is 43) Now click "Save" and your CPU should be running faster!

 

Conclusion

I've already said everything I've wanted to, so I'll keep this short, but I hope this guide is useful for those that need it. If anyone has any questions, feel free to ask me. 

Thank you!
-Tenoroon
 

 

Edited December 29, 2022 by Tenoroon

[jaybee83]

kool i was juuust about to ask about the deetz on this over in the benchmark thread when i saw this thread pop up in my feed. nice write up! 

u maybe wanna post a link to this thread over there 🙂 

[Tenoroon]

I'll be honest, I forgot I made this post lol. I updated it with information that only Haswell CPU's with turbo bins support this bug.

Back in October I was messing around in a standalone version of MC Extractor and learned that you may be able inject supported microcodes really easily regardless of what BIOS vendor your device had. I don't remember too much about it as it was a while ago during a slow day at school, but I'll look into it again when I have the chance. If MCE does what I think it can, then my guide will basically be outdated as the process will be much easier and faster, but again, I still need to look into it. I will edit the original post whenever I learn more about it.

Also, just as a bit of reference for what this microcode bug allows you to do, here's a CPU-Z validation of my 4710mq running a tad over 5ghz on a single core...

[Reciever]

I was wondering for months if you got around to making this