(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[kasar]

mmm tried to open my ME backup with fitc version 8.xxxx , it doesnt even open

tried to open it with version 7.xxxx, it opens fine and it shows "clock source select" as 0x00011A33

so theorically it is posible to hack it acording with this topic

http://forum.techinferno.com/general-not...ptops.html

however I keep getting the following error while trying to build the image (compacted image option already selected)



I remember Tw managed somewhere to skip that error when building the image (I wish I know how )

then he sent me the image, I flashed with fptw64, and it caused a big brick.

I thing it is related fptw64 doesnt integrate it at all correctly.

so, it would be posible reintegrate manually like tw tried with the ME8 firmware.

here is it.

http://www.mediafire.com/?byesk5xfqmsbyo4
I am going to get the ME region directly from my bios backup without using fptw64.

acording with what TW said those are the regions

— Flash Devices —

W25Q32BV ID:0xEF4016

Size: 4096KB (32768Kb)

00000000h – 00000FFFh: Flash Descriptor Region

00001000h – 00037FFFh: Common ME Header

00038000h – 0017FFFFh: ME Region

00180000h – 003FFFFFh: BIOS Region

so, if I am right, it would be as easy as selecting
00038000h – 0017FFFFh: from my whole bios backup and saving it as new file, right?

reintegrate the modded ME image would be similar, probably.

let me know what do you guys think

edit: tried opening 00038000h – 0017FFFFh hex part with fitc and it does not work, it seems I did something wrong?

maybe I should include the header too??

00001000h – 00037FFFh: Common ME Header

00038000h – 0017FFFFh: ME Region


so from 00001000h to 0017FFFFh?

[TimeWalker]

IIRC I took your dump and cut the ME part out, it allowed me to change stuff on it through FITC.

[kasar]

yeah, I managed to get it working now too

the magic thing was so from 1000 to 17FFFF

however I compared the hex obtained dump from the whole backup from the programer, and it is different than the me region dumped from fptw64

what is going on with fptw64? :o

I think I am going to work now only with my programer dumps instead fptw64, I simply dont trusth that,I think caused the brick some time ago by writting on other sections like you said

the fact is that my programmer unbrick my laptop and fptw64 bricks it


in the other hand, yeah, the total backup 1000 to 17FFFF is editable with fitc.

but sill getting that annoying error while building it.

can you tell me how do you managed to build it?

any chance you can upload your fitc folder?

maybe my version isnt working properly :/

[TimeWalker]

ugh I'm not sure what was my FITC version back then, I believe I just googled and got the first thing I had found.
I'm kind of far from a windows machine right now and I don't recall from the top of my head how I managed to build it in the end ... sorry.

[kasar]

well, I will google FITC and will check if I can get something easy from the first pages, that will be probably your version.

well, I will try with my own, anyway, cant you tell me if you remember doing something complex or hard? or just modfy that option with default settings?

I remember you got it so easly while my version keep asking for that stupid missmatch error

[jkbuha]

Hey guys - what happened to this mod?
@kasar - did you manage to mod the ME dump - let us know if you need any help!

IIRC, I had similar problems using different versions of the windows-based fitc program - it sometimes had problems processing the files. Not sure if it's been corrected in a later build.

[kasar]

nope, I still getting that error.
currently waiting input from timewalker, I remember he managed to mod it some time ago.

however I am pretty sure that modding the ME firmware with FITC and manually reintegrating it into BIOS rom file later is the correct way.

just need a little help with this step.

[jkbuha]

@kasar - did you try my mod suggestion from page 59:

1) Dump your Desc table via fptw.exe -DESC -D DESC.BIN
2) Open FITC and load up DESC.BIN
3) Go to Master Access Section, and select Manageability Engine.
4) Change Read/Write Access...

And then - because you have the HW programming tool:

5) Flash DESC.BIN via programmer

or

5) Integrate DESC.BIN back into firmware
6) Flash firmware via programmer

What do you think?

[kasar]

but, that is for unlocking descriptor settings, right?

I already unlocked the descriptor by doing thos

looked at the whole chip dump

00 00 0B 0A 00 00 0D 0C 18 01 08

to

00 00 FF FF 00 00 FF FF 18 01 08

then I flashed it and my descriptor settings was unlocked, I am currently running a unlocked descriptor backup with my laptop.

however what I am trying now is to mod the ME region

[jkbuha]

No it also allows you to modify ME region by selecting read/write in step 4. In theory you should then be able to flash ME via fptw command line.