[GUIDE] Unlocking CFG with OpenCore and CFGLock.efi

[miliuco]

@trs96
Here is the beginning of the CrScreenshotDxe project. It is from the year 2016. According to the instructions, LCtrl + LAlt + F12 is the keyboard shortcut handler although I already told you that my Apple Keyboard works with F10.

As you can read, the project was looking for a way to take screenshots of the UEFI BIOS screens using the feature of adding DXE drivers into BIOS images with UEFITool.

But, as you surely know, many modern BIOSes have this feature built in. We must boot the PC with a USB flash drive (formatted as FAT or FAT32) previously connected and press F12 or Print Screen when we are in the chosen BIOS screen. If the screenshot is captured successfully, a confirmation message should appear immediately. The image is saved to the USB stick in BMP format.

 

[konsti]

Hi @miliuco and everyone, hope you are well and safe. For those people needing to further explore unlocking MSR E0x02 register (which I successfully did on my NUC10 with the tool by user "Brumbaer") here are a couple of interesting URLs!

opencore-debug = https://github.com/utopia-team/opencore-debug
They have a compiled a new version of ControlMsrE2.efi, the next generation of CFGLock.efi...

OpenCorePkg = https://github.com/acidanthera/OpenCorePkg/pull/167
This is indication that the tool makes its way to OpenCore as the original developer seems to have provided to the team the code; tool is seemingly still being finalised...

Hope this helps!

P.S. There has been no versioning of some kind, whatsoever, so we can only rely one dates for now. Hope the OpenCore team streamlines this tool soon!

 

[miliuco]

Hi @miliuco and everyone, hope you are well and safe. For those people needing to further explore unlocking MSR E0x02 register (which I successfully did on my NUC10 with the tool by user "Brumbaer") here are a couple of interesting URLs!

opencore-debug = https://github.com/utopia-team/opencore-debug
They have a compiled a new version of ControlMsrE2.efi, the next generation of CFGLock.efi...

OpenCorePkg = https://github.com/acidanthera/OpenCorePkg/pull/167
This is indication that the tool makes its way to OpenCore as the original developer seems to have provided to the team the code; tool is seemingly still being finalised...

Hope this helps!

P.S. There has been no versioning of some kind, whatsoever, so we can only rely one dates for now. Hope the OpenCore team streamlines this tool soon!

Thanks for the info. I had lost track of brumbaer but I find him in this project with his tool ControlMsrE2.efi, an improved version of CFGLock.efi which was very useful until Gigabyte included the CFGLock enable / disable option in my motherboard configuration.

Warning for those trying this EFI folder: it has Vault enabled (Misc -> Security -> Vault as Secure and 2 files vault.plist and vault.sig).
If you have Vault as Optional like me, before using it you have to set Misc -> Security -> Vault as Optional and remove vault.plist and vault.sig.

 

[miliuco]

@konsti I'v tried ControlMsrE2.efi and got an error about OCB StartImage. Back in OpenCore menú, macOS has booted fine. I don't know if Vault secure boot is required, I've tried with Vault=Optional.
CFGLock.efi works well.

 

[konsti]

( hi @miliuco what EFI folder are you referring to, mate? )

Just a word of caution; using ControlMsrE2.efi in "interactive" mode freezes my NUC10 computer

I added ControlMsrE2.efi in v0.6.5 OpenCore's list of Auxiliary tools in config; it runs fine without any Arguments (read-only) but if adding "interactive", it freezes on mine:

            <dict>
                <key>Arguments</key>
                <string>interactive</string>
                <key>Auxiliary</key>
                <true/>
                <key>Comment</key>
                <string>Control MSR Lock</string>
                <key>Enabled</key>
                <true/>
                <key>Name</key>
                <string>Control MSR Lock</string>
                <key>Path</key>
                <string>ControlMsrE2.efi</string>
                <key>RealPath</key>
                <false/>
                <key>TextMode</key>
                <false/>
            </dict>

UPDATE: Yes, the original CFGLock.efi works well, my version dates 1 June 2020 with size 13952 bytes that is seemingly the latest by user "Brumbaer". MD5 checksum is ec4db1ba1e282f00e29f3ce11f2f734f

 

[miliuco]

@konsti

... what EFI folder are you referring to, mate?...

I mean the EFI you download from utopia-team > Releases, it's just a file called EFI.zip.
As they say "it would be useful to have a generic EFI with just the minumum requirements needed to obtain the most debugging logs from most motherboards as possible".

... Just a word of caution; using ControlMsrE2.efi in "interactive" mode freezes my NUC10 computer...

Thanks for the info. I've tried without arguments and got that error bit it wasn't last version of ControlMsrE2, the zhen-zen version from 8 days ago. I'll try this and I'll comment.

 

[miliuco]

@konsti

Without arguments I get the "Unable to find arguments" error. In fact there is an issue titled "Made changes because GetArguments returns Error when no argument" but it seems unresolved yet.
I can see 4 possible arguments: check, lock, unlock, interactive. Code tries to go to check if there is not any argument. I'll try with check.

With check it says not valid. It seems that interactive, lock and unlock are the only valid arguments.

 

[miliuco]

(OpenCore 0.6.7 and 0.6.8)

CFGLock.efi has been included in OpenCore tools under the name ControlMsrE2.efi.
It can be executed in 2 ways:

• From UEFI Shell: looking for the macOS EFI partition and, within it, the EFI/OC/Tools folder, writing in the prompt ControlMsrE2.efi followed by the argument that can be lock, unlock or interactive; if it is executed without arguments it uses verify mode that only reads the current state of CFGLock.
• From the ControlMsrE2.efi icon in the OpenCore menu: in this case the way to pass it an argument is to write it previously in config.plist so that the chosen argument (lock, unlock or interactive) remains fixed for each time the tool is used.

 

[Kinsfire]

I have been trying to get this worked out for about two weeks, and this FINALLY answers my questions, I think. I'll let you know later.

 

[Sebseb82]

Someone disable CFG lock on new version(056) bios on intel nuc 10 fnk? all the time i get error 0x8…