VBIOS and firmware

The 170HX VBIOS is signed, and the memory/compute unlock does not come from flashing a modified VBIOS; it comes from the driver patch (cmpunlocker). Most VBIOS work on these cards is either identification, power-limit editing, or dead ends. Treat anything that writes the flash chip as high-risk.

Background: why driver-loaded overrides work (Petri Krohn)

Petri Krohn's explanation of the firmware model, as background, not a measured result: the GA100 does not load firmware blobs directly from the SPI ROM chip; the driver loads them into the Falcon cores. The IMEM sections are encrypted and signed, but the DMEM data (power tables, fan curves) is cleartext and unsigned apart from the whole-image signature, so the driver can hand the Falcon a modified DMEM. The bootrom only checks the ROM copy at power-up, so in a Linux VM you can present the driver a modified shadow VBIOS. Source: @petrikrohn_26497, 2026-10-20 Separately, he says the unlocker does not use or need the debug version of booter_load (that was only needed while developing the ROP chain, because the debug AES key let the booter be disassembled), so NVIDIA cannot disable the unlocker except perhaps by forcing a firmware upgrade. Source: @petrikrohn_26497, 2026-10-27

Stock VBIOS inventory

Version	Card	Notes
92.00.67.00.01	8 GB	stock production (2021-05-14, 250 W)
92.00.6D.00.0A	8 GB	300 W OC image, memory OC allowed
92.00.6D.00.09	8 GB	300 W, no memory OC
92.00.66.00.02	10 GB	the only 10 GB image
92.00.6D.00.01	8 GB (ES)	PG199 engineering-sample 170HX, unlocks to 32 GB only

The VBIOS version does not decide whether the unlock works. Source: @rrickk420, 2026-08-22 92.00.6D.00.0A is an 8 GB image. Source: @ghostinthedatacenter_87281, 2026-10-17 Board part numbers: 900-11001-0108-000 (8 GB), 900-11001-0105-000 (10 GB); an ES/32 GB card uses a 699-xxxxx-xxxx-RCx number. See Which card do I have.

The vix no-flash loaders (Panchovix)

nvidia-linux-vbios-vix-loader (Linux) and nvidia-windows-vbios-vix-loader load a modified VBIOS at boot in memory by patching the 615.x open modules so GSP starts with the override image; the flash chip is never written, and the companion nvidia-vbios-vix-editor edits power limits, voltages and fan curves. Warning These do not support the CMP 170HX today: the device table has no 0x20C2/0x2082 entry and GA100 GSP firmware is explicitly unaudited.

lxwx tested the Linux loader on a 170HX 10 GB and reports it works and let him tweak TDP to 300 W on 610/615 drivers, together with the gen3 unlock. Source: @lxtend, 2026-10-20 But the override is applied in GSP, which is too late in boot to touch anything still locked on the 8 GB card, so for the unlock it adds nothing new; clocks and similar settings should be reachable through it, little else. Source: @scallion_9883, 2026-10-17
Source: @scallion_9883, 2026-10-19
Source: @scallion_9883, 2026-10-19
Source: @scallion_9883, 2026-10-19 The 300 W power-limit bytes sit outside the VBIOS signature section, implying the power limit is editable without the signing key. Source: @xanthefin, 2026-10-18

An older method: before the vix loader, the 10 GB card's VF offset and 300 W limit were reached by giving the driver the 8 GB unlocked VBIOS, truncated, instead of normal operation; Mr Pec got 300 W max on a 10 GB card this way. Source: @bigptoughneigh, 2026-10-04

The "64 GB unlocked VBIOS" repos (bogus)

Warning The repos 344303947/CMP-170HX-64GB-Unlocked-VBIOS and its mirror justin-kk-coder/CMP-170HX-64GB-Unlocked-VBIOS (git author "Thaurock") present a 1 MB ROM (sha256 2e8961ac518924cebd52363555c875071e6a58ece1ef494e192e42d5c1dcd5a2) as a "64 GB unlocked" VBIOS with nvflash -6 instructions. By version, date and IDs it is the stock 8 GB production VBIOS (92.00.67.00.01); the 64 GB readout in its screenshot is what the driver-side unlock produces, not the ROM. The unlock involves no VBIOS change. When members compared the file to the original in August there was no difference. Do not flash it. Source: @c133, 2026-10-18 Source: @xanthefin, 2026-10-18
Source: @globalapathy, 2026-10-18
Source: @c133, 2026-10-18

Contested An "unlocked VBIOS" for the 10 GB card is also said to exist, "a harder find it seems due to legal concerns"; this was hearsay, with no file or result shown. Source: @supasnipa360, 2026-10-18 The answer in the same thread applies to both variants: the unlock makes no VBIOS change, and someone able to write a VBIOS would not have stopped at 64 GB. Source: @xanthefin, 2026-10-18
Source: @globalapathy, 2026-10-18

SPI flashing (if you must)

Flashing a different VBIOS (e.g. A100) means opening the card and programming the flash IC. Warning Be careful which programmer you buy: flash ICs are 1.8 V or 3 V and a 3 V programmer fries a 1.8 V flash; some "3.3 V" CH341a units are really 5 V. Prefer a CH347-based flasher (its software selects the voltage). Source: @wakeupmbrc1, 2026-10-13 The 170HX VBIOS is signed, so flashing a modified image is a separate (unsolved) problem; and Warning a VBIOS TOCTOU test was reported to brick a card permanently, unrecoverable even after restoring the original image. Source: @youngju10000, 2026-10-08

A dead-on-arrival 10 GB card whose VBIOS ROM reads 0xFFFF and fails GSP init is likely a bad SPI flash; see Troubleshooting.

GSP-off and vGPU

GSP disabled: applying the unlock, building a dual-stack driver that persists the unlock kernels, then loading

 the proprietary driver with NVreg_EnableGpuFirmware=0 let certain register changes survive the reload
 with no GSP panics. GreenDam replied that it works well on the 90HX. matstatman doubts it helps, since everything
 software can unlock has been found and the fuses cut off the rest. Source: @zarknoth, 2026-10-27

 Source: @matstatman, 2026-10-27

 Source: @green_dam, 2026-10-28

vGPU: close to working in cmpunlocker on the vGPU-and-others branch (three patches:

 vgpu-kvm-build, vgpu-ga100-host, vgpu-umd-version). Source: @_j3ns, 2026-10-26
 arabus's build note: clone with git clone --branch vGPU-and-others --single-branch https://github.com/amoghmunikote/cmpunlocker.git;
 the patches live in driver/patches/vgpu-*.patch, must be in PATCH_ORDER in
 driver/build.sh, and each must be declared under unlocks: in common/constants.yaml
 (three entries before the ecc: block, each with registers: {}) or
 tools/read-constants.py rejects the build; then sudo ./install.sh --profile=10gb. Whether
 vGPU then worked is not stated. Source: @arabus_74064, 2026-10-27

Fuse RE references

The GA100 fuse / RIR architecture is reverse-engineered read-only in ahnguyen17/ga100-fuse-re (FF instruction layout, RIR macro, the corrected Gen3 burn list, the 80 GiB fold). Use it as a cross-check before trusting any burn list; the repo's own verdict on burning a working card is NO-GO. Source: @exile_1ck, 2026-10-07

Status

VBIOS editing can change power/clocks (reported); it cannot do the memory/compute/PCIe unlock (that is driver-side). Flashing modified or third-party ROMs is a warning, not a recommendation.