(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[Brabbelbla]

@follow_me
Sounds cool, and pretty difficult.

Actually maybe... it may not be the way you intend, but at least it's something. bcfg can configure driver loading, too. If you can load an FFS driver you can create a driver entry for an FV file (even assign a keycode to force loading?), like Setup and Diagnostics are boot options for FV files. There already is some DellFfs driver (GUID 12345...) present in the firmware. When I loaded it nothing happened but maybe you can get it to work.

Sorry for bringing this up, but you are probably the only one ever to test the RAID OROM with a dual SSD setup. Any progress on RAID/TRIM?

EDIT: It seems that pretty much every if not every FV file is attached to a driver handle, so I guess DellFfs does do something and is loaded by default. You can then use bcfg driver addh. Not ideal, but necessary only once. You could even create a .nsh file to automate it.

[follow_me]

@Brabbelblaneed couple more days to test, for now rolled back to non-raid firmware

I have a ffs driver which makes rom image mountable and addressable from shell and I wonder is it possible to implant it

All my experimets are ended with no luck for now

[forsaken123]

thanks for all the help, i managed somewhat to make it work with this bios i have so ill just leave as it is for now, to much hassle trying to revert back, as it seems its not even possible.

@forsaken123

so, they switched from wph to cap after some updates, not sure if rename the file will work, so its better keep with its original software and method per each version for now.

well, relating the parameters, I wasnt just talking about the ones inside the rsp files.

I was more talking about this

http://forum.notebookreview.com/dell-xps...oject.html

that post describes the very first step for bios the L502X, first steps were obiusly extract the flasher and bios out from the exe package, and also get the flashing parameters, I acomplished this by tweak the taskmgr settings and watching the paths and folders.

its posible that it start the app with hidden or custom parameters. keep an eye on task manager after doing stuff.


@Brabbelbla

this is how mine looks

Code:

Intel (R) Flash Programming Tool. Version: 8.1.10.1286 Copyright (c) 2007 - 2012, Intel Corporation. All rights reserved. Platform: Intel(R) HM67 Express Chipset Reading HSFSTS register... Flash Descriptor: Valid --- Flash Devices Found --- W25Q32BV ID:0xEF4016 Size: 4096KB (32768Kb) --- Flash Image Information -- Signature: VALID Number of Flash Components: 1 Component 1 - 4096KB (32768Kb) Regions: Descriptor - Base: 0x000000, Limit: 0x000FFF BIOS - Base: 0x180000, Limit: 0x3FFFFF ME - Base: 0x001000, Limit: 0x17FFFF GbE - Not present PDR - Not present Master Region Access: CPU/BIOS - ID: 0x0000, Read: 0xFF, Write: 0xFF ME - ID: 0x0000, Read: 0xFF, Write: 0xFF GbE - ID: 0x0118, Read: 0x08, Write: 0x08 Total Accessable SPI Memory: 4096KB, Total Installed SPI Memory : 4096KB FPT Operation Passed

take a look specially to this part

Code:

CPU/BIOS - ID: 0x0000, Read: 0xFF, Write: 0xFF ME - ID: 0x0000, Read: 0xFF, Write: 0xFF

they became 0xFF when I did the descriptor mod when desoldering the chip, changing those bytes, and soldering back, that allowed software read and write.

I was expecting that option you unlocked would also unlock those settings.

sadly it didnt worked as expected >.<

well, I dont know how those values should look after just bypass the descriptor, maybe bypassing the descriptor just bypass those settings, and even they still the same, you are able to dump or flash stuff. idk

in my case I didnt bypassed the descritor, I just altered the settings to let me do stuff.

what is also this command output for you?

Code:

fptw64.exe -D total_backup.rom

the -D parameter specify to create a dump, since no -ME or other flash part specified, it will backup the whole chip into the total_backup.rom file.

try also dump the ME region to a file

Code:

fptw64.exe -ME -D ME_backup.rom

and the descriptor

Code:

fptw64.exe -DESC -D descriptor.rom

if you are able to get a descriptor dump, then just get a hex editor, and look for this HEX string

00 00 0B 0A 00 00 0D 0C 18 01 08

then change it to

00 00 FF FF 00 00 FF FF 18 01 08

that should unlock your settings.

now the tricky part would be flash your modded descriptor.

Code:

fptw64.exe -DESC -F modded_descriptor.rom

with a normal locked descriptor this command would get some kind of access denied reply.

however, there would be a chance it would work with that bios option enabled. who knows if maybe that works .. ^^


@all

I has been away for some time on other projects, but I plan to relase a newer bios mod for the L502X wich all the new researchs that has been made here.

did you guys hex modded more the bios after this?


that is the last I did relating raid options, not sure if those options work anyway.

I also made some more unlocks at the advanced security menus, unlocking asset tag edit and the ability to disable or enable computrace after the initial settings.


however didnt touched any raid stuff, what would be the list of changes needed in order to get raid working?

I noticed lot of people interested in raid option at the NBR forums, so it would be another nice addon to the modded bios

[kasar]

I think inserting another option goes beyond our knowledge at the moment. Probably this is what jkbuha once meant, but I haven't seen it being done anywhere. So I don't know. I guess there will be many places where the size of some part of the module is stated. The PE header, maaany other different places.

What you could do relatively easily is sacrifice some other useless option (to me ATA mode is, but maybe people want to use some really old OS). For instance... adapter warnings. Then you can't disable those anymore, cry cry. Or maybe even more useless... express charge. Hidden by default and why the heck would anyone want to disable it? Anyway, as long it is on the same form, this is easy. I don't believe there are any size checks to bother you within the same form or even within the formset, only for individual statements and the formset a whole. So you just move the option to SATA Operation, give it the correct value and change the text string belonging to the original option.

Btw, the IFR extractor doesn't like zeroes being inserted in the IFR part. Haven't tested such a module but guess it doesn't work. So you have to make sure the IFR structure has the same size while not containing zeroes.

EDIT: Alright, that works. I moved RPB Baudrate option 9600 (pretty useless) to SATA Operation and edited the text string accordingly. So, as long as you are on the same formset, you are free to move anything.

oh, awesome, you got it working

can you give me more details about how to do the trick?

I really want to replicate that on mine too

[Brabbelbla]

@kasar
Yes. That works. I am now slowly working through the entire module, there are many useless expressions present. For instance, now every entry under Boot Configuration is suppressed if ever 0 equals 1 and is grayed out if you are not a supervisor. One single grayout statement for the entire form does the same. That creates quite some space to fill without removing things. However, as I don't know how to resize the entire IFR block all reclaimed space that I can't fill with useful things has to be filled with useless operators. But at least it will look pretty, I can move stuff around and I can try out some weird settings that are connected to others. There is one setting that controls the Intel AMT menu showing up and maybe more but it has no options now, no defaults and no text. But now I can go try. It really is a shame the IFR Extractor doesn't work for you.

On your question now, just take

09 0E 95 00 00 00 00 00 00 00 00 00 00 00

from where it is to the position after

09 0E 11 00 00 00 01 00 00 00 00 00 00 00

Then modify

09 0E 95 00 00 00 00 00 00 00 00 00 00 00

to

09 0E 95 00 00 00 02 00 00 00 00 00 00 00

Then look for the unicode string 9600 and change it to RAID.

[kasar]

thank you a lot +1 rep

I will follow your steps and flash the modified module.

let us to know if you unlock or find anything else

---

mmm, there is something I didnt understand at all

On your question now, just take

Code:

09 0E 95 00 00 00 00 00 00 00 00 00 00 00

from where it is to the position after

Code:

09 0E 11 00 00 00 01 00 00 00 00 00 00 00

not sure if you mean:

* cut that part out of the code, and insert it after 09 0E 11 00 00 00 01 00 00 00 00 00 00 00

or

* replace the part after 09 0E 11 00 00 00 01 00 00 00 00 00 00 00 wich is 29 02 05 A6 14 00 15 00 06 00 05 00 06 00, with the 09 0E 95 00 00 00 00 00 00 00 00 00 00 00 part

I supose it is the first option, but just wanted to be sure ^^


about the 9600 unicode string , there are several finds, should I replace all of them? or just a particular one?

[kasar]

ok, managed to get it working.



just replaced all the strings and did the first guess

* cut that part out of the code, and insert it after 09 0E 11 00 00 00 01 00 00 00 00 00 00 00

however I noticed something weird at this HDD configuration sub menu



this is what appear with ahci config



and this with raid config




mmm, if raid option is suposed to do raid configurations, why the raid options got dissapear while I selected Raid?

shouldnt it be the oposite? while ata or ahci options selected they are invisible and while raid is selected they appear?

maybe we altered something wrong in previous unlocks?

do you get the same result guys? ¿

[Brabbelbla]

@kasar
Yes, you were right. Cut and insert. You appear to still have the suppress statement for the RAID entries edited, when they shouldn't be anymore. The suppress condition originally was the SATA Operation variable not having value 0x2, then edited to suppress if the value is 0x2, being as we know now, the RAID option. So you should revert that change, the original condition was correct.

[kasar]

@brabbelbla

you mean this one?

http://www.bios-mods.com/forum/Thread-UE...7#pid66587

so basically if I return that to its original value, should it make the trick?

I will try, thanks ^^

[Brabbelbla]

Hmm, someone is really busy And yes, that one.