(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[TimeWalker]

yeah, I did change 07 00 01 00 34 00 98 04 to 08 00 00 00 02 00 82 05.

[kasar]

ah, ok

thanks for the aclaration.

what other changes you made to the ME appart from changing the version number and the clock source?

but the main question is, how the heck I can mod your modded ME version with FICT without errors and the ME is 1376 kb instead the ones from 820 kb I get from the ones from my dumps?

it seemed you fixed it by somewhere


so in order to set the original version numbers all I have to do is hex edit

08 00 00 00 02 00 82 05 to 07 00 01 00 34 00 98 04 ?

this means if you version works to make changes, I will save all the hex headache from my previous post and chances to get it working will be higher ^^

[TimeWalker]

yeah, pretty much just changed the versioning hex string and made some changes from FITC taking the x17m (what was the name of this bloody laptop anyway?) as a base for reference, don't remember what exactly..
I'm not even sure about the sizes anymore, I recall pulling the ME header as well, so it ended up being somewhat close to 1.5Mb ROM as stated in the BIOS, has to be 1532Kbytes IRRC .. 17FFFFh-1000h = 17EFFF

[kasar]

ok, replaced 4 ocurrences of 08 00 00 00 02 00 82 05 to 07 00 01 00 34 00 98 04

now FITC seems to identify the ME version as 7.1.52.1176

I think the name you have in mind is alienware ^^


mmm I wonder with it failed after flashing with fptw64

it was fptw64 fault? (you said it flashed )

this quote is from the fail flash last year, the one from page 94

C:\BIOS MOD\A12 PROJECT\modded menus\ME test\Tools\System Tools\Flash Programmin
g Tool\Windows64>fptw64.exe -ME -F modded_l502x_me_image_OC.bin

Intel ® Flash Programming Tool. Version: 8.1.10.1286
Copyright © 2007 - 2012, Intel Corporation. All rights reserved.

Platform: Intel® HM67 Express Chipset
Reading HSFSTS register... Flash Descriptor: Valid

--- Flash Devices Found ---
W25Q32BV ID:0xEF4016 Size: 4096KB (32768Kb)


Warning: The file does not contain enough data to completely fill
the target write area! Continuing will truncate the Write
Length to the File Length!
File: "modded_l502x_me_image_OC.bin"
File Length: 1441792
Write Length: 1568768

Do you want to continue? Y/<N> or q to quit : y

PDR Region does not exist.
GBE Region does not exist.

- Reading Flash [0x161000] 1408KB of 1408KB - 100% complete.
- Erasing Flash Block [0x002000] - 100% complete.
- Programming Flash [0x002000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x005000] - 100% complete.
- Programming Flash [0x005000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x00D000] - 100% complete.
- Programming Flash [0x00D000] 20KB of 20KB - 100% complete.
- Erasing Flash Block [0x011000] - 100% complete.
- Programming Flash [0x011000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x015000] - 100% complete.
- Programming Flash [0x015000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x01D000] - 100% complete.
- Programming Flash [0x01D000] 20KB of 20KB - 100% complete.
- Erasing Flash Block [0x021000] - 100% complete.
- Programming Flash [0x021000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x025000] - 100% complete.
- Programming Flash [0x025000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x02D000] - 100% complete.
- Programming Flash [0x02D000] 20KB of 20KB - 100% complete.
- Erasing Flash Block [0x033000] - 100% complete.
- Programming Flash [0x033000] 12KB of 12KB - 100% complete.
- Erasing Flash Block [0x035000] - 100% complete.
- Programming Flash [0x035000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x092000] - 100% complete.
- Programming Flash [0x092000] 360KB of 360KB - 100% complete.
- Erasing Flash Block [0x106000] - 100% complete.
- Programming Flash [0x106000] 456KB of 456KB - 100% complete.
- Erasing Flash Block [0x159000] - 100% complete.
- Programming Flash [0x159000] 320KB of 320KB - 100% complete.
- Verifying Flash [0x161000] 1408KB of 1408KB - 100% complete.
RESULT: The data is identical.

FPT Operation Passed

C:\BIOS MOD\A12 PROJECT\modded menus\ME test\Tools\System Tools\Flash Programmin
g Tool\Windows64>

well, it also could be related with incompatible values changed on FITC, so the machine were unable to boot.

what do you think?

[TimeWalker]

Continuing will truncate the Write Length to the File Length!

Not sure what it did in the end .. flashed it as is and left the absent parts untouched, or indeed somehow truncated it and slingshotted the bottom part of the firmware up ? But then again it may have been related to changing stuff looking at this alienware (aha, thats the name!) laptop's ME.

[kasar]

ok, since I can see more flashings, I decided to setup a dedicated computer for flashing.

used a old desktop machine with usb boot and parallel port, it doenst need hdds, optical drives or even mouse just a keyboard and screen.

I picked a old screen I modded with LEDS (it had backlit and power suply broken, so it works now by leds and with 12v, consume very little power and now it can be powered by batteries, I like this old mod ^^ )

this is how my current desktop looks, just wondering how yours looks



and the led modded screen ^^



relating with your last post, well, at the other forum with the FITC tuturial I think someone found similar message and it was OK for him.

however, I remember you said something about the app writting on weird zones. (where it was suposed to not write)

mmm, I think I am going to make backups at the other chips with my latest backup and will do some tests like:

flash via fptw64 a unmodded version of the ME firmware, or very little modded, to see if it works ^^

also will try to reintegrate the modded ME manually into the whole chip rom file with the programer, so a lot of work is pending at least for me, hehe ^^

also, did any of u guys sucesfully unlocked the descriptor settings or bypassed the settings with the pin override mod? (kinda feel alone with testing hardware )

[kasar]

you guys have to give a a look to FITC and the descriptor too

I can see many interesting features there

all of them editable ^^





it talk also of intel thief feature, I was after that option since you can once enable or disable intel thief tecnology in bios, once you change them it will be locked forever, thats why it would be nice to locate the part of the firmware wich store the configuration value.

I supose it will be something like

00 = default value (let the user to enable or disable the feature)
01 = enabled (cant be disabled)
02 = disabled (cant be enabled)

so if we locate the byte at the firmware and we find the values, that probably will be a nice way of unlocking it by manually tweaking the byte to the default value ^^

[kasar]

while reading the FITC pdf I found some usefull stuff

SMLink1 Thermal
Reporting Select

Desktop
false
Mobile
true

false = Intel ME FW will collect temperature from the processor, PCH and DIMMs. It will be available for polling on SMLink1.

Note: ME Thermal Reporting:
Advantage = Does not require PECI capability in EC.
Disadvantage = no real time temperature alert level control, and no dynamic Sandy Bridge CPU Turbo controls.

— SMLink Thermal Reporting Select = false (default)

— PECI from Sandy Bridge processor is connected to PCH

— BIOS sets Thermal Reporting Control (TRC) MMIO register at TBARB+1Ah to enable ME reporting of processor, PCH, and DIMM temperatures (as appropriate)

— ME thermal reporting PCI device should be enabled for proper interaction with EC, SIO, BMC, or equivalent fan control logic




true = PCH temperature ONLY(1 byte of data) will be available for polling out on SMLink1. Processor and DIMMs temperature monitoring will require an external device.

Note: Platform based Thermal Reporting:

Advantage = allows full dynamic Sandy Bridge Turbo control.

Disadvantage = Requires EC/BMC with PECI capability.

— SMLink Thermal Reporting Select = true

— PECI from Sandy Bridge processor is connected direct to EC, SIO, BMC, or equivalent fan control logic

— BIOS sets Thermal Reporting Control (TRC) MMIO register at TBARB+1Ah = 0x0, disabling ME reporting of processor,PCH, and DIMM temperatures

— ME thermal reporting

that option can be found on descriptor/PCH straps/PCH 15

the PDF specify it usually should be enabled for notebooks and that it allows turbo control, but seems disabled on mine, since that seems a descriptor setting I think I can try flashing a custom descriptor now ^^

edit: I saw stuff to enable the ME emergency mode at the descriptor :o

[kasar]

ok, flashed modded descriptor, aparently no noticiable differences.

now flashed an ME fw using fpt64w
the one tw sent to me, fixed the version numbers and restored all settings to original one

flashed it

output, going to reboot, will let you know if the machine got bricked and I had to swap chips or if it worked without issues.

brb rebooting ^^

C:\BIOS MOD\A12 PROJECT\ME WORK\Flash Programming Tool\Windows64>fptw64.exe -ME
-F ME_Region_base_testttt.bin

Intel ® Flash Programming Tool. Version: 8.1.10.1286
Copyright © 2007 - 2012, Intel Corporation. All rights reserved.

Platform: Intel® HM67 Express Chipset
Reading HSFSTS register... Flash Descriptor: Valid

--- Flash Devices Found ---
W25Q32BV ID:0xEF4016 Size: 4096KB (32768Kb)


Warning: The file does not contain enough data to completely fill
the target write area! Continuing will truncate the Write
Length to the File Length!
File: "ME_Region_base_testttt.bin"
File Length: 1409024
Write Length: 1568768

Do you want to continue? Y/<N> or q to quit : y

PDR Region does not exist.
GBE Region does not exist.

- Reading Flash [0x159000] 1376KB of 1376KB - 100% complete.
- Erasing Flash Block [0x002000] - 100% complete.
- Programming Flash [0x002000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x005000] - 100% complete.
- Programming Flash [0x005000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x00E000] - 100% complete.
- Programming Flash [0x00E000] 24KB of 24KB - 100% complete.
- Erasing Flash Block [0x012000] - 100% complete.
- Programming Flash [0x012000] 8KB of 8KB - 100% complete.
- Erasing Flash Block [0x015000] - 100% complete.
- Programming Flash [0x015000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x019000] - 100% complete.
- Programming Flash [0x019000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x021000] - 100% complete.
- Programming Flash [0x021000] 20KB of 20KB - 100% complete.
- Erasing Flash Block [0x025000] - 100% complete.
- Programming Flash [0x025000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x02D000] - 100% complete.
- Programming Flash [0x02D000] 20KB of 20KB - 100% complete.
- Erasing Flash Block [0x031000] - 100% complete.
- Programming Flash [0x031000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x035000] - 100% complete.
- Programming Flash [0x035000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x092000] - 100% complete.
- Programming Flash [0x092000] 360KB of 360KB - 100% complete.
- Erasing Flash Block [0x106000] - 100% complete.
- Programming Flash [0x106000] 456KB of 456KB - 100% complete.
- Erasing Flash Block [0x159000] - 100% complete.
- Programming Flash [0x159000] 320KB of 320KB - 100% complete.
- Verifying Flash [0x159000] 1376KB of 1376KB - 100% complete.
RESULT: The data is identical.

FPT Operation Passed

C:\BIOS MOD\A12 PROJECT\ME WORK\Flash Programming Tool\Windows64>

edit: laptop still alive , bios chip swap/reprogram wasnt needed.

however, while turning it on, it took 2 seconds more, fan spin a lot, and bios report ME version as 0.0.0.0

wich make me think I screwed the ME by flashing this.

will restore my latest ME backup (lazy to reprogram the entire chip now) and if the backup fix the me region will try another test.

backup restore

Microsoft Windows [Versión 6.1.7601]
Copyright © 2009 Microsoft Corporation. Reservados todos los derechos.

C:\Users\kasar>cd "C:\BIOS MOD\A12 PROJECT\ME WORK\Flash Programming Tool\Window
s64"

C:\BIOS MOD\A12 PROJECT\ME WORK\Flash Programming Tool\Windows64>fptw64.exe -ME
-F ME_BACKUP.rom

Intel ® Flash Programming Tool. Version: 8.1.10.1286
Copyright © 2007 - 2012, Intel Corporation. All rights reserved.

Platform: Intel® HM67 Express Chipset
Reading HSFSTS register... Flash Descriptor: Valid

--- Flash Devices Found ---
W25Q32BV ID:0xEF4016 Size: 4096KB (32768Kb)

PDR Region does not exist.
GBE Region does not exist.

- Reading Flash [0x180000] 1532KB of 1532KB - 100% complete.
- Erasing Flash Block [0x002000] - 100% complete.
- Programming Flash [0x002000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x005000] - 100% complete.
- Programming Flash [0x005000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x00E000] - 100% complete.
- Programming Flash [0x00E000] 24KB of 24KB - 100% complete.
- Erasing Flash Block [0x012000] - 100% complete.
- Programming Flash [0x012000] 8KB of 8KB - 100% complete.
- Erasing Flash Block [0x015000] - 100% complete.
- Programming Flash [0x015000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x019000] - 100% complete.
- Programming Flash [0x019000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x021000] - 100% complete.
- Programming Flash [0x021000] 20KB of 20KB - 100% complete.
- Erasing Flash Block [0x025000] - 100% complete.
- Programming Flash [0x025000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x02D000] - 100% complete.
- Programming Flash [0x02D000] 20KB of 20KB - 100% complete.
- Erasing Flash Block [0x031000] - 100% complete.
- Programming Flash [0x031000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x035000] - 100% complete.
- Programming Flash [0x035000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x092000] - 100% complete.
- Programming Flash [0x092000] 360KB of 360KB - 100% complete.
- Erasing Flash Block [0x106000] - 100% complete.
- Programming Flash [0x106000] 456KB of 456KB - 100% complete.
- Erasing Flash Block [0x159000] - 100% complete.
- Programming Flash [0x159000] 320KB of 320KB - 100% complete.
- Verifying Flash [0x180000] 1532KB of 1532KB - 100% complete.
RESULT: The data is identical.

FPT Operation Passed

ok, ME backup seemed to fix it.

going to try now to flash the untouched 820 kb firmware I got from my chip dump, will use FPT64 to flash it again.

if this still not working I will go bed now after restore my last backup again

C:\BIOS MOD\A12 PROJECT\ME WORK\Flash Programming Tool\Windows64>fptw64.exe -ME
-F completedump_FITC_PROGRAMER.bin

Intel ® Flash Programming Tool. Version: 8.1.10.1286
Copyright © 2007 - 2012, Intel Corporation. All rights reserved.

Platform: Intel® HM67 Express Chipset
Reading HSFSTS register... Flash Descriptor: Valid

--- Flash Devices Found ---
W25Q32BV ID:0xEF4016 Size: 4096KB (32768Kb)


Warning: The file does not contain enough data to completely fill
the target write area! Continuing will truncate the Write
Length to the File Length!
File: "completedump_FITC_PROGRAMER.bin"
File Length: 839680
Write Length: 1568768

Do you want to continue? Y/<N> or q to quit : Y

PDR Region does not exist.
GBE Region does not exist.

- Reading Flash [0x0CE000] 820KB of 820KB - 100% complete.
- Erasing Flash Block [0x011000] - 100% complete.
- Programming Flash [0x011000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x021000] - 100% complete.
- Programming Flash [0x021000] 4KB of 4KB - 100% complete.
- Verifying Flash [0x0CE000] 820KB of 820KB - 100% complete.
RESULT: The data is identical.

FPT Operation Passed

edit:

ok, it worked! , aparently the version numbers and everything stayed fine, will try to flash a modded 820 kb image, I almost got it

C:\BIOS MOD\A12 PROJECT\ME WORK\Flash Programming Tool\Windows64>fptw64.exe -ME
-F modded_me.bin

Intel ® Flash Programming Tool. Version: 8.1.10.1286
Copyright © 2007 - 2012, Intel Corporation. All rights reserved.

Platform: Intel® HM67 Express Chipset
Reading HSFSTS register... Flash Descriptor: Valid

--- Flash Devices Found ---
W25Q32BV ID:0xEF4016 Size: 4096KB (32768Kb)


Warning: The file does not contain enough data to completely fill
the target write area! Continuing will truncate the Write
Length to the File Length!
File: "modded_me.bin"
File Length: 839680
Write Length: 1568768

Do you want to continue? Y/<N> or q to quit : Y

PDR Region does not exist.
GBE Region does not exist.

- Reading Flash [0x0CE000] 820KB of 820KB - 100% complete.
- Erasing Flash Block [0x002000] - 100% complete.
- Programming Flash [0x002000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x009000] - 100% complete.
- Programming Flash [0x009000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x013000] - 100% complete.
- Programming Flash [0x013000] 12KB of 12KB - 100% complete.
- Erasing Flash Block [0x015000] - 100% complete.
- Programming Flash [0x015000] 4KB of 4KB - 100% complete.
- Erasing Flash Block [0x021000] - 100% complete.
- Programming Flash [0x021000] 4KB of 4KB - 100% complete.
- Verifying Flash [0x0CE000] 820KB of 820KB - 100% complete.
RESULT: The data is identical.

FPT Operation Passed

C:\BIOS MOD\A12 PROJECT\ME WORK\Flash Programming Tool\Windows64>

modded ME flashed sucesfully ^^
(machine booted up, and the ME version appear correctly at the BIOS )

yes, I am running the modded ME

as for a quick view, no overclocking menus apeared at the bios, however tomorrow will check the me settings with cctWin

also will try intel tuning extreme overclocking utility, people who made that ME mod/patching said they used that to OC

tomorrow I will make more tests with the modded firmware

if someone want to give it a look to the aparently good modded file, here it is:

http://www.mediafire.com/?fd6dxsj23dhk3ap

if you open it with FITC you can see I made a LOT of changes ,even touched some dangerous options, kinda surprised it booted up without issues

[kasar]

woot, it seems it worked

look at this ^^

Microsoft Windows [Versión 6.1.7601]
Copyright © 2009 Microsoft Corporation. Reservados todos los derechos.

C:\Users\kasar>cd "C:\BIOS MOD\A12 PROJECT\ME WORK\CCT"

C:\BIOS MOD\A12 PROJECT\ME WORK\CCT>cctWin.exe

Intel ® Clock Commander Tool Version: 7.1.20.1119
Copyright © 2010 Intel Corporation. All rights reserved.

usage:
cctWin.exe [options] command [arguments]

Available options:
/v0 - Verbose level 0 (default mode, smallest amount of information).
/v1 - Verbose level 1 (debug). Includes raw HECI messaging.

Available commands:
gl - Get Lock
rr - Read ICC Register
wr - Write ICC Register
gr - Get ICC Record
gcc - Get ICC Clocks Capabilities
gcdr - Get Clock Range Definition Record
sl - Set Lock
sce - Set Clock Enables
gp - Get ICC Profile
sp - Set ICC Profile
rrd - Read all dynamic ICC Registers
wuob - Write UOB Record
smr - Read Single ICC Register via SMBUS
smw - Write Single ICC Register via SMBUS

To get help on specific command, use "cctWin.exe command ?"

C:\BIOS MOD\A12 PROJECT\ME WORK\CCT>cctWin.exe gcdr

Intel ® Clock Commander Tool Version: 7.1.20.1119
Copyright © 2010 Intel Corporation. All rights reserved.


clock_id = 1 [DIV1-S]

clock_usage = {Display}
frequency_min = 120.0000 MHz
frequency_max = 120.0000 MHz
ssc_change_allowed = 0
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 0
ssc_spread_mode_control_down_allowed = 1
ssc_spread_percent_max = 0.50 %

clock_id = 2 [DIV2-S]

clock_usage = {BCLK, DMI, PEG}
frequency_min = 80.0000 MHz
frequency_max = 300.0000 MHz
ssc_change_allowed = 1
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 1
ssc_spread_mode_control_down_allowed = 1
ssc_spread_percent_max = 0.50 %

clock_id = 3 [DIV3]

clock_usage = {PCIe, PCI33, SATA, USB3}
frequency_min = 99.5463 MHz
frequency_max = 100.0000 MHz
ssc_change_allowed = 1
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 0
ssc_spread_mode_control_down_allowed = 1
ssc_spread_percent_max = 0.50 %

clock_id = 4 [DIV4]

clock_usage = {Display_Bending}
frequency_min = 119.3473 MHz
frequency_max = 120.6599 MHz
ssc_change_allowed = 1
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 1
ssc_spread_mode_control_down_allowed = 1
ssc_spread_percent_max = 2.50 %

clock_id = 5 [DIV1-NS]

clock_usage = {Display}
frequency_min = 120.0000 MHz
frequency_max = 120.0000 MHz
ssc_change_allowed = 0
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 0
ssc_spread_mode_control_down_allowed = 0
ssc_spread_percent_max = 0.00 %

clock_id = 6 [DIV2-NS]

clock_usage = {BCLK, DMI, PEG}
frequency_min = 100.0000 MHz
frequency_max = 100.0000 MHz
ssc_change_allowed = 0
ssc_spread_mode_control_up_allowed = 0
ssc_spread_mode_control_center_allowed = 0
ssc_spread_mode_control_down_allowed = 0
ssc_spread_percent_max = 0.00 %


HECI CMD Status = 0x00000000 (SUCCESS)

look at the (clock_id 2 [DIV2-S])

before it was locked to 95 / 100, now it have way more range to test

check this also ^^

C:\BIOS MOD\A12 PROJECT\ME WORK\CCT>cctwin.exe rr CSS

Intel ® Clock Commander Tool Version: 7.1.20.1119
Copyright © 2010 Intel Corporation. All rights reserved.

[0x00] CSS = 0x00011a34

HECI CMD Status = 0x00000000 (SUCCESS)

it seems it worked :O