(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[kasar]

thx ^^

I am now dumping, aparently ok, lets compare the 3 different dumps now

---

woot, the dumps are identical!

I think I finally got it

---

ok, here is the complete backup, disolder the chip seemed the only way to get the backup ^^

http://www.mediafire.com/?p5bncm59yf5rez8


now I need to patch the file

I think it was mod this

00 00 0B 0A 00 00 0D 0C 18 01 08

to

00 00 FF FF 00 00 FF FF 18 01 08


right?
and then flash the file back

if this work and I sucesfully can attach back the chip to the motherboard I will have the first unlocked l502x I think ^^

else I will have a beautifull brick

[TimeWalker]

Nice! Yes, that's correct!
No, else you have a backup at hand but you would have to desolder and solder everything again which would be a bummer.
Like I said .. coin cell 3.3 and lifted up VCC leg and short wires should do the trick. And they did .. even without the capacitor.

Don't rush on flashing yet, I will compare your BIOS, ME and FD regions side by side to verify they are indeed properly dumped.
I will be doing this in like 10-15 minutes, please stay put.

Also, like I said there's no warranty it will allow you to use the intel's tool to flash both ME sectors of the firmware.. it may then say that there's not enough space. So it might e required to flash both of ME sectors with v8 ME firmware to fit it properly .. and I'm not sure if it will boot after that :|

[kasar]

ok, I was using sipigm under ms2 from a bootable usb stick in a old desktop.

for some reason spipgm was unable to write even a single bit.

but I managed to write the whole modified rom by using flashrom app


flashrom -p rayer_spi -w moddedfirmware.rom

ok, flashed, and then made another dump

everything succeded

now the hard part, pick the modded chip, and put it back to the motherboard

note: unlocking this has been a pain in the [censored], so I guess this is not a suitable method for all users.

too bad we cant relase some kind of patch or modded bios with this D:


edit:

oops, late , I already flashed >.<, didnt saw ur post


well, lets supose things went fine, I will put everything back at the laptop when you confirm.

let me know what you see from those dumps

[TimeWalker]

-FD identical
-ME (v7 part) identical
-BIOS is not identical.. there are changes in regards to EVSA. I've seem this name mentioned in WinFlash changelog.
But on a positive note the file you took with universal bios backup tool has zeros on these places while the actual dumped bios has NVRAM runtime variables (like service tag, express service code, boot order, boot entries, hdd passwords etc.) in this place... so you are all good!

[kasar]

great!

green light then ^^

time to pick the soldering tool again, if the laptop boots again and it have the stuff unlocked this will be a real acomplishment

thanks for your support man!

[TimeWalker]

Go on then.
Hope it actually lets you flash entire v8 ME thereafter.. otherwise there's no really a point to unlocking this thing :S

Will assemble a dump from the one you have provided to integrate ME v8 into both ME sectors... but I don't feel like you will be attempting any more magic on this chip in case software method of flashing v8 fails .. otherwise traces on the mobo may get lifted and that won't do you any good.

Edit:
There you have it: http://www.mediafire.com/?ahgv0vanv7zh177
1000h - 17FFFFh replaced with v8 firmware.

[kasar]

yeah, that was enough for me using this method

to much headache just to change 4 bytes


well, soldering went fine, aparently I didnt broke any leg or damaged nearby eletronic components, also tested with multimeter and it seems properly conected.

now the final step, asembly the laptop and report results ^^

thanks for the firmware

but well, not sure how I will flash it without doing all the suicidal thing again

time to pick screwdrivers and reasembly stuff!! ^^

[kasar]

posting from the l502x




success!

now your turn to unlock your descriptor settings

[TimeWalker]

Uhm .. actually use MEInfoWin to check whether it is now unlocked. This proves nothing, just reads the values from 0x60h

FW Capabilities: 16784480

Intel® Anti-Theft Technology - PRESENT/ENABLED
Intel® Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED

Level III Manageability Upgrade State: Not Upgradable
CPU Upgrade State: Upgrade Capable
Cryptography Support: Disabled
Last ME reset reason: Power up
Local FWUpdate: Enabled
BIOS and GbE Config Lock: Unknown

Host Read Access to ME: Disabled
Host Write Access to ME: Disabled

[kasar]