Hacking Nvidia's Drivers!

[ProngsOldGuy]

On 2/4/2019 at 2:59 AM, GabenJr said:

We didn’t recommend using the Chinese driver in our mining GPU video, but now, we’ll show you how to make Nvidia’s drivers work for yourself – And how to go deeper.

Buy a P106 (mining "GTX 1060") on Taobao: https://lmg.gg/8KV9W

 

Buy a real GTX 1060:
On Amazon: http://geni.us/rveAUH
On Newegg: https://lmg.gg/8KV6B

 

Download link for GeForce driver 416.34: https://lmg.gg/8KV93

Download link for HxD: https://lmg.gg/8KV9m

Download link for DifferentSLIAuto: https://lmg.gg/8KV9P

Download link for 7-Zip: https://lmg.gg/8KV9p

TechPowerUp Forum Thread: https://lmg.gg/8KV91

 

How to mod the P106 driver

• Make sure Secure Boot is disabled and Windows is in testsigning mode
  • Check your motherboard manual for information on how to disable Secure Boot
  • Testsigning can be enabled by opening up a Command Prompt or PowerShell as administrator, then typing:
  • bcdedit /set {current} testsigning on
  • bcdedit /set {current} nointegritychecks on
  • This can be done for a single boot by going to Start -> Power -> Restart and holding shift while clicking Restart, then choosing Troubleshoot, then Advanced Options, then Startup Settings - Once you get to the menu, choose to disable driver signature enforcement.
  • After restarting, you’ll know it worked if some text is displayed in the lower right corner of your desktop
• Download and extract the GeForce driver using 7-Zip
• In the extracted folder, go to the Display.Driver folder and open nv_dispi.infusing Notepad++
• Search for lines containing 1B87 (P104-100), 1BC7, (P104-101) 1C07(P106-100), and 1C09 (P106-090)
  • Change each line's Section number to match the 1C06 (GTX 1060) line - On 416.34, that means from Section110 to Section108
  • On the third set of lines, the Section numbers will be different; Again change it to match the 1C06 (GTX 1060) line - On 416.34, that's Section109 to Section107
• Save the file
• Install the driver as normal – Windows will complain that it’s unsigned; Click allow.
• Right-click the desktop, go to Display Settings, then Graphics Settings
  • From here, you can force any game to use the P106 to render while your integrated GPU is used for display output.

How to perform the SLI mod

• Make sure Secure Boot is disabled and Windows is in testsigning mode
  • Check your motherboard manual for information on how to disable Secure Boot
  • Testsigning can be enabled by opening up a Command Prompt or PowerShell as administrator, then typing:
  • bcdedit /set {current} testsigning on
  • bcdedit /set {current} nointegritychecks on
  • This can be done for a single boot by going to Start -> Power -> Restart and holding shift while clicking Restart
  • After restarting, you’ll know it worked if some text is displayed in the lower right corner of your desktop
• Install both graphics cards you wish to attempt SLI with
  • The first three characters of the PCI device ID MUST match to enable SLI
  • To find out what the device ID is, right-click the start button and click Device Manager
  • In the Display adaptors list double-click the card you want to check.
  • Under the Details tab, click the drop-down and then click Hardware IDs.
  • It will look like this: PCI\VEN_10DE&DEV_1F07&SUBSYS_86701043&REV_A1
  • VEN_10DE means Nvidia, while DEV_1F07 is the device ID – In this example, an RTX 2070. So in order to run SLI, the other card’s device ID will have to also start with DEV_1F0
• Download and install the GeForce driver as usual
• Download and extract the DifferentSLIAuto package
• Go to C:\Windows\System32\DriverStore\FileRepository and sort by date
• Go into the newest folder beginning with nv_dispi.inf
• Copy the nvlddmkm.sys file to the DifferentSLIAuto folder
• Open the install.cmd file in the DifferentSLIAuto folder in Notepad++
• Replace the three mentions of nv_dispi.inf in install.cmd with the folder name we got the nvlddmkm.sys file
• Open the nvlddmkm.sys we copied in a hex editor (HxD)
• In HxD, go to Search, then Find, then click the Hex Values tab
  • Search for 79050fba6b240e
  • Position the cursor at the start of these values
  • Replace with C7432400000000 (no need to delete first, just type over it)
  • Save the file
• Reboot into Safe Mode with Networking
  • Click Start, then Power, then hold shift while clicking Reboot
  • In the menu that comes up, click Troubleshoot, then Advanced Options, then Startup Settings (on some PCs, this may be behind a “show more options” arrow) - Once the PC reboots, press 5 on the screen that appears.
• Run install.cmd in the DifferentSLIAuto folder as administrator
• Reboot into normal mode
• Enable SLI (hopefully)

Hi thank you for sharing the guide. I'm testing this method on p104-100 now. And it's works. Thank you very much

[TheGiolly]

8 hours ago, X_X said:

 

 

 

People want to experiment Thought you had done a lot of VBIOS flashing and might want to share your experience. If I have misunderstood then apologies.

I don't have done a lot of VBIOS flashing, I'm just a passionate electronic engineering student that likes to play around with electronics and IT stuff 

 

Today I experimented with changing values of resistors in a "suspicious" array on my Palit P106-100.
Out of 7 of them, 6 of which didn't do nothing, 1 changed the PCI ID from 1C07 (P106-100) to 1C47 (nothing) with no possibilities of chosing intermediate values.
I'll play around more with the PCB in the next days and post updates here.

[psyolent]

Nice work @TheGiolly would be good to have a GTX1060 to work from to see exactly what the differences are. Of course we'll see a slight difference between vendors but essentially the schematic /layout should be pretty similar. There may also be SM diodes which set the values as well i've seen this done before. You'd think though that the firmware of the card would set this though out of cost to create the card.

[RazorCard]

16 hours ago, ProngsOldGuy said:

Hi thank you for sharing the guide. I'm testing this method on p104-100 now. And it's works. Thank you very much

 

That's amazing. I was just going to ask if someone had tried this on a p104-100 or a p102-100.

 

Does it work with any regular P104-100 or did you have to get a specific one off taobao with modifications for this to work?

 

EDIT:

 

Secondary question: I have a pc with Intel onboard graphics.

 

I have another PC with a ryzen 1600, an Asus B450i and an RX 570. Is it possible to install the modified drivers on the ryzen pc and swap out the RX570 for the P106 and use the hdmi output from the B450i? 

[ProngsOldGuy]

20 hours ago, RazorCard said:

 

That's amazing. I was just going to ask if someone had tried this on a p104-100 or a p102-100.

 

Does it work with any regular P104-100 or did you have to get a specific one off taobao with modifications for this to work?

 

EDIT:

 

Secondary question: I have a pc with Intel onboard graphics.

 

I have another PC with a ryzen 1600, an Asus B450i and an RX 570. Is it possible to install the modified drivers on the ryzen pc and swap out the RX570 for the P106 and use the hdmi output from the B450i? 

yes its works for any regular p104-100 and or p104-101

[TheGiolly]

I spent quite a bit of time today probing around the PCB, desoldering, modding and trying.
But sadly I couldn't get the hardware id of the card to change.
Just for fun, I also tried the card with the flash chip that contains the BIOS desoldered and Windows still detected it as a 1C07 but with the SUBSYS part blank.

That's a real shame because yesterday I wanted to try out Apex Legends and it didn't work because of the modded nv_dispi.ini file (even if the driver is self signed and Windows is not in test mode).

[RobbinM]

On 2/6/2019 at 10:21 AM, TheGiolly said:

I followed this tutorial and it woked perfectly.

Games like Rainow Six Siege doesn't allow you to play in test mode because of the anticheat system. 

Today I'll try to (hardware) dump the flash of my Palit P106-100 and then try to (hardware) flash the rom of a Palit GTX 1060 6GB Dual.
I'll report here how it goes 

UPDATE: flashed the 1060 rom, the card still works but still gets recognized with ID 1C07

So we need to find out what reports this 1C07. If it's not the BIOS chip, what is it?

 

Also, we can see if these cards support "virtual GPU" mode like the grid card...

https://docs.nvidia.com/grid/latest/grid-management-sdk-user-guide/index.html

 

I have a GTX 1060 3GB (MSI Gaming OC) if you want to compare any outputs of any commands.

If needed, I also have a CH341A flash tool.

[TheGiolly]

14 minutes ago, RobbinM said:

So we need to find out what reports this 1C07. If it's not the BIOS chip, what is it?

Usually some resistors on the pcb that sets the ID.
I think I found them on my PCB (they are quite obvious, if they actually are the ones that I'm looking for) but are all 100KΩ and even if I change them from pullup to pulldown (and vice versa) nothing happes except for one resistor that changes the ID from 1C07 to 1C47.

[RobbinM]

Shall we compare pictures of these resistors then? If you can upload a picture of where these resistors are globally located and a close-up of the resistors, I will do the same.

I have also bought a 1060 6GB (MSI Gaming Z) so we can compare apples to apples. Have to still pick up the card though.

[TheGiolly]

1 minute ago, RobbinM said:

Shall we compare pictures of these resistors then? If you can upload a picture of where these resistors are globally located and a close-up of the resistors, I will do the same.

I have also bought a 1060 6GB (MSI Gaming Z) so we can compare apples to apples. Have to still pick up the card though.

Yeah, I could upload a pic of my card but it's a Palit P106-100 so, to compare, I would need a Palit GTX1060 6GB Dual

[RobbinM]

It could be that the PCB's don't differ that much if they use the reference design so we should definately try...

[Apolonia]

2 hours ago, TheGiolly said:

I spent quite a bit of time today probing around the PCB, desoldering, modding and trying.
But sadly I couldn't get the hardware id of the card to change.
Just for fun, I also tried the card with the flash chip that contains the BIOS desoldered and Windows still detected it as a 1C07 but with the SUBSYS part blank.

That's a real shame because yesterday I wanted to try out Apex Legends and it didn't work because of the modded nv_dispi.ini file (even if the driver is self signed and Windows is not in test mode).

 @TheGiolly 

So playing Apex Legends using P104-100 would not work in anyway?

Are other games that uses Batteye would not work too? (eg. PUBG, R6 siege, etc.)

Thanks in advance!

[RobbinM]

It might have to do with the anti-cheat engine?

[TheGiolly]

12 minutes ago, Apolonia said:

 @TheGiolly 

So playing Apex Legends using P104-100 would not work in anyway?

Are other games that uses Batteye would not work too? (eg. PUBG, R6 siege, etc.)

Thanks in advance!

Tested PUBG and R6 Siege and they work but you need first to self sign the modded driver

[RobbinM]

GeForce GTX 1060 3GB	1C02	H
GeForce GTX 1060 6GB	1C03	H
P106-100	1C07	H
GeForce GTX 1060	1C20	H
GeForce GTX 1060 with Max-Q Design	1C20 17AA 39B9	H

 

The only usable reference for 1c47 I could find was for a "Palit 1070 Ti JetStream"

Can you try to flash a 1070 Ti Jetstream BIOS with this configuration?

[RobbinM]

From another post on this forum:

 

 

[TheGiolly]

3 hours ago, RobbinM said:

From another post on this forum:

 

 

Yup, I saw this too but my card is different. I'll post some photos of the PCB tomorrow 

[TheGiolly]

3 hours ago, RobbinM said:

The only usable reference for 1c47 I could find was for a "Palit 1070 Ti JetStream"

I don't think this is right. And the 1070ti is a 8GB card

[RobbinM]

It shouldn't be right. I figured if you are able to start flashing this BIOS from windows, it is a small step. I agree with you it is unlikely the card will work with the 1070 Ti BIOS.

If so, we have to figure out what the resistor layout should be for the 1060.

 

Quote

When pulling high:

5K   = 8
10K = 9
15K = A
20K = B
25K = C
30K = D
35K = E
40K = F

Source: http://www.eevblog.com/forum/chat/hacking-nvidia-cards-into-their-professional-counterparts/

 

I wonder if these resistors work in the same way. If so, we have to translate the HEX value to the resistor value.

You said you were able to change the ID value from 1C07 to 1C47

If the resistor values correspond to the table above, we can already check some of the work this guy did and verify it.

1= unknown

C= 25k pulled high

0= unknown

7= unknown

 

So if you can find one resistor of 25k pulled high, then we can work from here.

The resistor values for 0-7 should be in the same range, but pulled low.

If 0 starts at 5k and 7 ends at 40k we don't know, it might also be reversed, 0=40k and 7=5k

 

--edit--

I am so bad at reading. You already posted the value for the resistor you changed: 100k

So at least we know 2 values now:

100k pull up? = 0

100k pull down? = 4

 

I'll be looking on my card if I can find this array of resistors. My Device ID (pulled from nVidia control panel) would be 10DE 1C02.

 

[poorboy]

On 2/6/2019 at 2:19 PM, zikkz said:

@GabenJr Do you think this method would also work with an eGPU dock?

I don't think it would be recommended. As @GabenJr mentioned, it would only be 4x link:

 

On 2/6/2019 at 3:37 PM, GabenJr said:

I mentioned it in briefly in the video, but there is a way to sign the driver yourself so you can disable testsigning - Try this: http://woshub.com/how-to-sign-an-unsigned-driver-for-windows-7-x64/

 

It should. SLI in particular though might not be ideal over the 4x link...

 

and the P106 only has PCIE 1.1. Putting PCIE 1.1 16x through a 4x link may bottleneck it down to 1/4th of its power! I wouldn't suggest it. (I wanted to use it as an eGPU for my laptop, and decided against it in the end.)

[poorboy]

15 hours ago, TheGiolly said:

I spent quite a bit of time today probing around the PCB, desoldering, modding and trying.
But sadly I couldn't get the hardware id of the card to change.
Just for fun, I also tried the card with the flash chip that contains the BIOS desoldered and Windows still detected it as a 1C07 but with the SUBSYS part blank.

That's a real shame because yesterday I wanted to try out Apex Legends and it didn't work because of the modded nv_dispi.ini file (even if the driver is self signed and Windows is not in test mode).

Wait, that's interesting. I played Apex Legends last night using my P106-100 with the modded driver. I'm going to try to run Rainbow 6 Siege today to see if it blocks me, I'll report back after.

[poorboy]

So I completed my dedicated P106 build a couple days ago! It was actually my first personal desktop.

 

My build:

CPU: Ryzen 3 2200G

APU: Vega 8

GPU: Gigabyte P106-100

Mobo: Asus PRIME B450M-K

Storage: Seagate Barracuda 250GB SSD

Storage: WD 1TB HDD

RAM: 2x8GB TeamGroup 2666 Mhz

PSU: Cooler Master MWE 500

 

All in all cost me about 515 USD!

 

I got all the drivers installed and things are going smoothly. The P106 is properly being utilized and I was able to hop onto games like World of Warships, The Division and Apex Legends just fine. Performance was as expected, and I got a 1527 score on the Unigine Heaven benchmark. I even got FreeSync to work, so that was a nice bonus!

 

One thing I had meant to ask @GabenJr was that the modifications you guys made to your driver were actually different from the modifications that the Chinese team made to theirs, and I was wondering why. The changes that the Chinese team made were clearly outlined here:

 

https://github.com/gerdesi/NVIDIA_P106

 

Which modifies both the nv_dispi.inf and nvaci.inf files. The team that did it also insists that these modifications can be applied to later driver updates as well. While I understand that the changes outlined in Linus' video were to trick the driver into treating the P106 like a 1060, the changes that the Chinese team made deleted certain entries and added entries as well, rather than making changes. I was wondering how significant the differences in approach were to each other, or if they worked the same way.

[TheGiolly]

8 hours ago, RobbinM said:

I am so bad at reading. You already posted the value for the resistor you changed: 100k

So at least we know 2 values now:

100k pull up? = 0

100k pull down? = 4

I tried various values using a 100K potentiometer and it didn't matter what value I chose. If I was pulling up it was 1C47 and I was pulling low it was 1C04.

1 hour ago, poorboy said:

Wait, that's interesting. I played Apex Legends last night using my P106-100 with the modded driver. I'm going to try to run Rainbow 6 Siege today to see if it blocks me, I'll report back after.

That's interesting. Which driver are you using? Modded as the Chinese git or modded as LTT video?
This is what I get with self signed driver modded as LTT video.

[poorboy]

32 minutes ago, TheGiolly said:

That's interesting. Which driver are you using? Modded as the Chinese git or modded as LTT video?
This is what I get with self signed driver modded as LTT video.

 

We are using the same driver, but I admit I applied the Chinese modifications rather than the one outlined in the LTT video.

 

As for Rainbow Six Siege, I successfully logged into the game. The game also successfully detected my P106 as the GPU, as you can see in the bottom right.

 

I ran the benchmark and the results were what they should have been, I think.

 

Since the modifications that the Chinese team made to their .inf files are not dangerous (this topic has been bouncing around a few Chinese forums for a while), I didn't have any problems with using their modifications instead. I also did it with my own official copy of the Nvidia drivers, so I know that the .exe wasn't modified at all.

[TheGiolly]

3 minutes ago, poorboy said:

Are you using unsigned driver? So are you using Windows in test mode?
If so, how where you able to even launch R6 Siege?