r/LenovoThinkBook

I have been reverse-engineering the InsydeH2O firmware used by the Lenovo IdeaPad Gaming 3 15ARH05 (82EY / IP3GAMING-15ARH).

The project started because this model exposes only a very limited BIOS interface, while common unlock sequences such as Fn+R+N do not appear to work reliably on this generation.

So far, I have:

• extracted Lenovo’s official FCCN21WW Windows update package;
• recovered the complete 16 MiB update ROM;
• parsed its AMD PSP directory;
• decompressed and executed the x86 reset-stage image;
• traced its reset loop under QEMU;
• extracted the Setup Utility and reconstructed its IFR;
• confirmed the existence of a separate hidden Advanced form set;
• recovered its GUID, variable stores, offsets and option inventory;
• tested an experimental SREP runtime patch without permanently modifying the firmware.

The hidden menu contains controls for:

• PCIe GPP and power policies;
• SATA/AHCI and RAID configuration;
• TPM and fTPM;
• USB controllers and individual ports;
• ACPI features;
• SVM, SVM Lock and SMM Code Lock;
• DASH and AMD remote KVM;
• Above 4 GB MMIO.

One particularly interesting result is that the Advanced form set is not surrounded by a top-level IFR SuppressIf condition. My current hypothesis is that Lenovo/Insyde hides it through a visibility table or registration logic inside H2OFormBrowserDxe, rather than through a simple “unlock” setup variable.

I also recovered this form-set GUID:

C6D4769E-7F48-4D2A-98E9-87ADCCF35CCC

However, the runtime SREP patch has not exposed the menu yet. The laptop currently runs FCCN19WW, while the analyzed update is FCCN21WW, so differences in modules, patterns or variable semantics may explain the failure.

The repository documents the full process, hashes, extraction commands, QEMU findings, IFR inventory, experimental SREP configuration and suggested next steps:

https://github.com/root-hunter/lenovo_bios

Update: the hidden Advanced BIOS menu has now been successfully unlocked on the test machine using SREP. This is a runtime unlock and does not require flashing a modified BIOS image.

The method remains experimental and model/firmware-specific. Hidden settings can still cause a brick, boot failure or no-display condition, so do not change unfamiliar options without a verified SPI backup and recovery plan.

I would especially appreciate help from anyone who:

• owns the same 15ARH05 / 82EY model and can reproduce the unlock;
• can test it on other FCCN firmware versions;
• has experience with InsydeH2O, SREP or H2OFormBrowserDxe;
• can help validate and document the exposed settings safely.

Issues, corrections and reproducible test results are welcome.