Monday, August 21st 2023

NVIDIA BIOS Signature Lock Broken, vBIOS Modding and Crossflash Enabled by Groundbreaking New Tools

You can now play with NVIDIA GeForce graphics card BIOS like it's 2013! Over the last decade, NVIDIA had effectively killed video BIOS modding by introducing BIOS signature checks. With GeForce 900-series "Maxwell," the company added an on-die security processor on all its GPUs, codenamed "Falcon," which among other things, prevents the GPU from booting with unauthorized firmware. OMGVflash by Veii; and NVflashk by Kefinator (forum names), are two independently developed new tools that let you flash almost any video BIOS onto almost any NVIDIA GeForce graphics card, bypassing "unbreakable" barriers NVIDIA put in place, such as BIOS signature checks; and vendor/device checks (cross-flashing). vBIOS signature check bypass works up to RTX 20-series "Turing" based GPUs, letting you modify the BIOS the way you want, while cross-flashing (sub-vendor ID check bypass) works even on the latest RTX 4090 "Ada."

The tools bring back the glory days of video BIOS modding using utilities the likes of NiBiTor (now discontinued). The possibilities of such utilities are endless. You can, for example, flash the BIOS of a premium factory-overclocked graphics card onto your close-to-MSRP graphics card. For cards up to RTX 20-series "Turing," in addition to clock speeds, BIOS modding lets you raise power limits, which have a more profound impact on performance, as they increase boost frequency residency. BIOS modding also gives you control over the graphics card's voltages, cooling performance, and fan-curve, so you can make your card quieter, as long as your cooler can keep the GPU away from thermal limits (which you can adjust, too). With cross-flashing (without modifying the BIOS or disturbing its signature), you are now able to restore a voltage of 1.1 V on your RTX 4090 GPU, if you've got one of the newer models, which ticks at 1.07 V only. You could also flash your FE with a custom-design vBIOS with high power limit, to go beyond NVIDIA's power limits.
OMGVflash author Veii posted a comprehensive thread on the TechPowerUp Forums, which announces the first public beta of the tool, its development history, usage instructions, and some troubleshooting support. Find the thread here. The author has expressed interest in working with TechPowerUp on publishing future versions.

NVflashk author Kefi posted a similar comprehensive thread on TechPowerUp Forums, which can be accessed here.

OMGVflash and NVflashk are independently developed of each other. We've hand-inspected the binary code of both tools and they are free of any viruses or trojans. There's only few code modifications to the original NVFlash tool, to activate the bypass. There's no additional malware payload or anything similar. The file sizes are identical to the unmodified files. VirusTotal also confirms that these patches are legit.

Tampering with the vBIOS will void your graphics card's warranty. As with all modding, graphics card BIOS modding is not without risk, and meant for power users. It is fairly easy to recover from a broken flash, as all current desktop processors come with iGPUs that you can boot from, so you could flash a working BIOS onto the bricked graphics card. Just do remember to back-up your BIOS. You can use either of these tools to extract your current BIOS, or better yet, use GPU-Z for the task.

TechPowerUp editor and author of GPU-Z, W1zzard, will be answering all your questions in the comments section of this post. He has extensive experience with vBIOS internals from his worth with GPU-Z and he has also developed a parser that decodes, processes and organizes the ROM files in our TechPowerUp GPU BIOS Database.

Update 16:44 UTC: Kefi is currently working on a GUI version that makes it easy to backup and flash the BIOS. You can also search our BIOS Collection from within the app and filter on various properties.
Sources: OMGVflash by Veii, NVflashk by Kefi
Add your own comment

209 Comments on NVIDIA BIOS Signature Lock Broken, vBIOS Modding and Crossflash Enabled by Groundbreaking New Tools

#26
W1zzard
KARMAAADoes this mean I could flash a 3090 BIOS onto a 3080 Ti and unlock the extra CUDA Cores that were disabled?
No, core counts are not configured within the BIOS, but through a separate system called "fuses"
Posted on Reply
#27
Prima.Vera
Thsts good news, however you need liquid cooling to really take advantage of those tools. Already my card goes into lower power due to high temps, so not going to help users with default cooling much.
Also, is it possible to modify the card description, ID, serial, etc, în order to fake it look like another card?
Posted on Reply
#28
Karti
ZoneDymoman...I honestly did not know Nvidia even (tried to) locked this out....what a crappy move.
has AMD locked this out as well?
Not only that

they also locked (still since i don't know if that will be supported now) CUSTOM vbioses

Maxwell 2.0 was the last gen - that i know - which allowed end user / customer to literary make their own vbios and flash it onto the card without any issue.

I still have files for my custom undervolted Titan X bios, which also gave me 0rpm fan mode etc
Posted on Reply
#29
JakoDel
do they work on pascal cards? I'm broke af
Posted on Reply
#30
InVasMani
I can't believe it took this long honestly. It'll be interesting to see where it leads with bios modders for certain.
Posted on Reply
#31
Unregistered
Thinking of flashing a 400w vbios to my 350w 3080ti. Maybe this weekend I'll try.
#32
HDBitdata
Can you cross flash a Quadro Bios into a 3090 or 4090 card?
Posted on Reply
#33
Unregistered
KARMAAADoes this mean I could flash a 3090 BIOS onto a 3080 Ti and unlock the extra CUDA Cores that were disabled?
You can try :)
If NVIDIA's Bird falcon allows you with my Version - then that's a success.
But mind you the following:

You need to match the display-out most of the time.
I/O (Display) Matrix & Powerplugs , do adapt ~ usually also memory IC detection does adapt.
Yet you can easily find yourself in a situation of other Parts of the GPU not working.

If Falcon allows, then that's a yes.
It's not on nvflash to allow or prohibit that

Pascal (and pretty much Turing) will allow a "flash to whatever you want" mode.
Including everything under it will flash, as long as the Biosmod was correctly made and no checksums are broken (see Maxwell tweaker for example)
Good luck :)
#34
Nanochip
Cease and desist coming soon? But the rabbit is out of the hat. This is excellent.
Posted on Reply
#35
Unregistered
HDBitdataCan you cross flash a Quadro Bios into a 3090 or 4090 card?
A little group tried to play with Volta and Engineering Cards.
Falcon itself refuses. Mostly due to a new vbios version.

If you can get the foundation on the ROM , lets say your Target Vendor Bios
And then utilize my tool to update - it will update the remain sections too and count as a full rebrand.
As for times at & before Pascal - yes, full access
Turing Half access,
Ampere and Ada - only signed bioses have full access ~ but pretty much every Boardpartners Bios is signed :)

ChipID rebrands, are difficult
It's not really nvflash's work to excecute such. It does forward to Flacon and from there the Topic is open ended.
Falcon's access, is Nvidia's proprietary and confidential information/tools/access.
Due to friendly reasons, i refuse to help on this part.
But nvflash won't be the reason why it fails. It will start executing and either finish or Falcon will say no.

Try and have fun.
Just if you have two NVIDIA cards ~ remember to start from Index 1,
If you recover with an AMD GPU, Index0 or no index at all ~ will be your target flash (recovery procedure).
#36
Jism
ZoneDymoman...I honestly did not know Nvidia even (tried to) locked this out....what a crappy move.
has AMD locked this out as well?
The only thing that was left was Morepowertool for the 6x00 series. Now the 7x00 series are completely locked out.

This is fantastic news. Many boards of Nvidia had hard caps of 200W or even lower. With this you can unlock it. New OC's incoming!
Posted on Reply
#37
asdkj1740
any new bios tweaker for ampere and ada lovelace?
Posted on Reply
#39
Daven
W1zzardWhich you still cannot, because the cores are disabled through on-die fuses. Unlocking through BIOS modding was possible on older ATI cards until they figured that using the BIOS to lock shaders is too easy to circumvent. It's how I got interested in the hardware scene over 20 years ago (ATI Radeon 9500 to 9700 mod, web.archive.org/web/20030118032341/http://www.maxdownloads.com/~ian/wizzard/)
Ahhh, those were the days. I once modded a 9800pro into a 9800xt back in 2003. I bought individual little copper heatsinks for each memory chip and a new cooler for the GPU. Tinkering like that is so much fun!

Edit: The copper heatsinks look very much like this..
Posted on Reply
#40
Jism
@W1zzard What actually happened with Atitool and why is it even discontinued? I mean a "Atitool" as of today would be excellent. A build-in OC'ing tool to either find max mem or core - it was so simple and easy to use lol. Rebrand it, breath new life into it, it might be a big phat techpowerup Hit here.
Posted on Reply
#41
katzi
Oh... That's got to be upsetting for Jensen. Oh well /s
Posted on Reply
#42
neatfeatguy
Only flashing I ever did was on a bad GTX 285. BFG closed doors and this replacement they had just sent me crashed with everything I tried. It was either trash the card or do something extreme - I pulled the BIOS off my GTX 280, dropped it on the 285 and it worked. No more crashes, even ran the flashed 285 and the 280 in SLI for about two years. I haven't thought about flashing the BIOS on a GPU for years, never had another reason to do so. If the card works, no since in mucking around with it.

It's always interesting to read up on this stuff and it's good to see these locks can be bypassed now should folks feel the need to tinker. I do wonder, though, how many people are going to start coming around asking for help to fix bad BIOS changes/flashes....you know, more than they already for the fake cards they by off bad sites.
Posted on Reply
#43
dyonoctis
Vya DomusConsidering that their implementations are closed source we have no idea whatsoever if this really is true or not. My guess is that it more than likely isn't, there is nothing about frame interpolation that requires any kind of special hardware, computing motion vectors is something people have done for at least a decade on normal shaders and it's plenty fast.

I have been skeptical about Nvidia's claims ever since Remedy spiled the beans that the version of DLSS they used didn't even use the RT cores in Control. Intel's XeSS doesn't need ML accelerators either.
From what I've understood the benefits of AI hardware on consumer device is not about "computing stuff that cannot be done with regular hardware" but being more efficient at doing it, and not using compute ressources that could be used for something else.
While XeSS doesn't need the XMX units, even Wizzard found that the "non- native" XeSS wasn't equal when it comes to performance gain and visuals.
Remedy also eventually stopped using the "2.0 prototype" in favor of the Tensor core accelerated one.

For DLSS3 an Nvidia engineer came out and said that DLSS 3.0 can work on ampere...But the end result will not be as good, and seeing how people like to trash talk the current "ideal" implementation, they might have avoided a bullet. :D If it was even more glitchy and had a higher latency impact, forums dwellers would have never shut up about how laughable the tech is

Posted on Reply
#44
W1zzard
Jism@W1zzard What actually happened with Atitool and why is it even discontinued? I mean a "Atitool" as of today would be excellent. A build-in OC'ing tool to either find max mem or core - it was so simple and easy to use lol. Rebrand it, breath new life into it, it might be a big phat techpowerup Hit here.
I have something similar for internal use in my reviews, not enough time to polish, release and maintain
Posted on Reply
#45
Jism
AMD version's is buggy. What might be stable in a compute based way of testing, can completely be unstable in games.

We had such good tools to our benefit in the past compared to now.
Posted on Reply
#46
xrli
Will this work on Tesla and Quadro cards? If so this is going to be great!
Posted on Reply
#47
kefi
Oh, cool! Thanks for the shoutout.

What I released is only the bypass itself - I'm working on a graphical user-friendly version of nvflash to release later this week.
Posted on Reply
#48
Tomorrow
Great news for flashing but what i really want is a GUI tool, to modify any 20/30/40 series BIOS file (v/f curve, voltage, limits etc) and then flash it to the card.

If i understand thing correctly then no such GUI tool currently exists but it is possible to flash different manufacturer made BIOS'es to cards they were not meant for?

I already have 380W KFA2 BIOS on my Gainward GS 2080Ti ~300W card. I could try 450W bioses and there's even crazier Galaxy HOF OC LAB WC Edition with effectively unlimited 2000W and higher v/f curve but im not brave enough to try that even tho my card is cooled by Morpheus II and two high static pressure 120mm fans. Essentially 4,5 slot air cooling.

Im more interested in somehow unlocking ReBAR on 20 series. Nvidia never bothered making new BIOS'es to unlock this so i wonder if it requires unlocking or does it require new code in BIOS? Im asking because ReBAR has been PCIe feature for a long time and so it's possible that it has been included in some very old cards but never enabled?

AMD enabled it for 5000 series Navi 1 and if i remember correctly people have enabled it on older GCN cards too.

EDIT: Thanks kefi. Looking forward to it.
Posted on Reply
#49
kefi
TomorrowGreat news for flashing but what i really want is a GUI tool, to modify any 20/30/40 series BIOS file and then flash it to the card.

If i understand thing correctly then no such GUI tool currently exists but it is possible to flash different manufacturer made BIOS'es to cards they were not meant for?

I already have 380W KFA2 BIOS on my Gainward GS 2080Ti ~300W card. I could try 450W bioses and there's even crazier Galaxy HOF OC LAB WC Edition with effectively unlimited 2000W and higher v/f curve but im not brave enough to try that even tho my card is cooled by Morpheus II and two high static pressure 120mm fans. Essentially 4,5 slot air cooling.

Im more interested in somehow unlocking ReBAR on 20 series. Nvidia never bothered making new BIOS'es to unlock this so i wonder if it requires unlocking or does it require new code in BIOS? Im asking because ReBAR has been PCIe feature for a long time and so it's possible that it has been included in some very old cards but never enabled?

AMD enabled it for 5000 series Navi 1 and if i remember correctly people have enabled it on older GCN cards too.
That’s what nvflashk is going to be, a GUI flasher, I just released the bypass the very day I made it work. GUI release should be ready later this week
Posted on Reply
#50
Jism
Even Polaris works with Rebar if i'm correct. Just never bothered to actually implement it. Users had to hack around it. It's nothing special - it's a PCI-E sig and it's bin there for many years.

2000W bios is'nt going to harm your card - only when you raise crazy amount of power through the chip and not having sufficient cooling.
Posted on Reply
Add your own comment
May 12th, 2024 07:55 EDT change timezone

New Forum Posts

Popular Reviews

Controversial News Posts