(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[kasar]

ok, I belive you, but ...more than 10 results?

here is the list of changes I made to my bios

PlatformSetupAdvancedDxe.efi
CFEF94C4-4167-466A-8893-8779459DFA86_1_1073.ROM

00 29 02 29 02 0A 82 45 8A 00 to 00 29 02 29 02 0A 82 45 8A 01 (two ocurrences) (first one unlock language, second one menus)

00 20 00 29 02 0A 82 45 8A 00 to 00 20 00 29 02 0A 82 45 8A 01 (one ocurrence) (thermal menus)

00 00 00 00 00 00 00 00 45 0A to 01 00 00 00 00 00 00 00 45 0A (four ocurrences) (smbios log, intel ME submenu and INTELME ability to disable it?)



SystemSetupSecurityDxe.efi
166CD554-8AAE-4617-8FDD-A2E3A5AFD89E_1_1081.ROM

0A 82 45 8A (00) 00 00 00 00 00 00 00 45 0A to 0A 82 45 8A (01) 00 00 00 00 00 00 00 45 0A (two ocurrences) (min and max password lenght options unlock)


powermanagement2.efi
F7731B4C-58A2-4DF4-8980-5645D39ECE58_1_632.ROM

(75) 08 0F BA E8 0F to (EB) 08 0F BA E8 0F (to enable native speed steep)

with the ocurrences, you were talking about the 00 00 00 00 00 00 00 00 45 0A hex values?

[jkbuha]

check the original post I put in page 30... how many occurrences were there?

to be clear - I'm not sure right now on what the matches were - they could just be the suppress instruction (not the opcode)

will check tomorrow once i'm back at my laptop...

[kasar]

on the original post, you said you found 15 ocurrences.

however, I made a total of 10 hex changes

7 at PlatformSetupAdvancedDxe.efi
2 at SystemSetupSecurityDxe.efi
1 at powermanagement2.efi

and there were many different hex edits.

so even having all those 10 changes as a group, there are 5 remaining changes, right?

edit: I think you should edit the first post, it still asking for money for a motherboard

[jkbuha]

I'll check my original file & let you know

Oh and first post amended - thank you for the reminder!

[jkbuha]

Update: here is the hex string search...

Searching for: 29020A82458A

C:\PhoenixTool\DellA12\DUMP\DUMP\166CD554-8AAE-4617-8FDD-A2E3A5AFD89E_1_1056.ROM: 2
C:\PhoenixTool\DellA12\DUMP\DUMP\4A538818-5AE0-4EB2-B2EB-488B23657022_0_4.ROM: 14
C:\PhoenixTool\DellA12\DUMP\DUMP\CFEF94C4-4167-466A-8893-8779459DFA86_1_1048.ROM: 12

[kasar]

oh, relating that hex search, I found 14 at my

4A538818-5AE0-4EB2-B2EB-488B23657022_0_4.rom module

however, all of them are 01 (already enabled I guess)
well, we can try also set some of them 00, maybe some of the menus need to make the condition false to be showed, idk.

there must be something else we are missing, those interesting OC and advanced boot mode strings arent there by mistake, also if we are able to boot the built in EFI shell it would be nice

[jkbuha]

My understanding is that these menus are only enabled via ME registers, unless CodeRush and TW have some other ideas?

[TimeWalker]

Probably just ME, or in other words - platform features. These are advanced features that appear in the bios when some conditions are met. So these entries are enabled, but are not visible due to lack of support from the hardware part.. like @jkbuha said originally while we were still hunting for advanced menus and @HairyCube was lurking around inside the AdvancedSetup module.

I for example don't get any battery information in bios, while you @jkbuha seem to have some sort of string related to battery status I believe.. and also the RST, which appears only in crisis boot mode .. ?

[jkbuha]

Yes that's correct @TimeWalker. I'm still stumped why the 15z gets RST only in crisis boot mode. But to your point this is another example of condition-based triggers. Only in Crisis mode does the RST menu enable itself, which clearly shows that we've unlocked all the available menus, and there just need to be an additional set of conditions from hardware (registers) to enable them in the BIOS.

So it looks like we're going to have to dig deeper into the ME region if we are to unlock any overclocking/undervolting...

[kasar]

then it looks we are moving again to ME firmware tweaking

even we were unable to move to the ME8 firmware, there are some tweaks we can do at the ME7 firmware, like enable OC

http://forum.techinferno.com/general-not...ptops.html

I think I am going to continue with the suggestions from that topic since I already have the descriptor unlocked and fptw64

I think dumping and editing the current ME image from the laptop should be a good choice

jkbuha, did you also updated the me firmware? I think I dont have the original firmware wich came with the xps 15, however I feel lucky the update package I made didnt screwed the me. so I will work with the updated image.

I attached the fptw64.exe (untouched) of my l502x at this post

(parameters to make the dump are fptw64.exe -ME -d dumpfilename.bin)

did you guys had luck unlocking your descriptor by tweaking the byts or doing the bypass hack on the chip mentionated before by TW and CR?

edit, it looks like I am able to dump or flash the whole chip image from windows with fptw64 if I dont specify a region, that will save me some time taking appart the machine to use the hardware programmer if the machine is not in a bricked status ^^

fptw64 is also really fast to make the dump, like 1 second compared with the 3 mins from the hardware programmer, lol

---

oh, it seems both dumps are different, not sure if ftpw64 skiped something :o

here are both dumps if you want to compare them.

HW programer dump and fptw64 dump to compare.