(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[jkbuha]

@TimeWalker - check lenovo's module: 17772369-D262-4B90-9F31-BDC41F2663A5_1_759.ROM
It's an ME update, but an old one (7.0.0.x) - looks like it's an executable though?

[TimeWalker]

Downloaded an Intel® Server Board S1200KP BIOS KPC2060H and there's indeed
ME 7.1.52.1176 - C43791FC-E05B-4AA0-84B1-F14547885C70_0_21.ROM 1.27 Mb
ME 8.0.13.1502 - 098D0689-4245-4F65-80C9-7F3202C5F44E_0_28.ROM 1.48 Mb
inside the bios capsule ...

---

@jkbuha, yeah it appears to be ME 7.0.0.0054 .. which explains why the size is so tiny. But this one is actually referenced as MEBx .. which my explain why it starts with an executable header (MZ)

[nebster]

@TimeWalker
You said earlier on that you have Clover working. Does that mean you've got your touchpad working in Clover too?

btw, I've uplaoded the new version of my tool. It should extract/inject everything correctly. Make sure though since I compiled it as 32bit this time as it's more stable.

[TimeWalker]

@nebster
Clover does not support PS/2 input in GUI, so no.

Cool, thanks! Will give it a go tomorros ..

[nebster]

Do you have a list of all the patches we've done so far and what they are actually for?

So far I know about:

Code:

{
Name = "OS X Power Management"
File = "PowerManagement2.efi"
Search = [0x75, 0x08, 0x0F, 0xBA, 0xE8, 0x0F, 0x89, 0x44, 0x24, 0x30]
Replace = [0xEB, 0x08, 0x0F, 0xBA, 0xE8, 0xF, 0x89, 0x44, 0x24, 0x30]
}

What does this actually fix with OS X power management?

Code:

{
Name = "Unlock Advanced Tiano Setup"
File = "PlatformSetupAdvancedDxe.efi"
Search = [0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x45,0x0A]
Replace = [0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x45,0x0A]
}

I'm assuming this is what unlocks all the options in Tiano BIOSes

Code:

{
Name = "Remove Tiano 'Reserved' String"
File = "PlatformSetupAdvancedDxe.efi"
Search = [0x00,0x14,0x42,0x00,0x65,0x00,0x6C,0x00,0x6F,0x00,0x77,0x00,0x20,0x00,0x69,0x00,​
0x73,0x00,0x20,0x00,0x72,0x00,0x65,0x00,0x73,0x00,0x65,0x00,0x72,0x00,0x76,0x00,​
0x65,0x00,0x64,0x00,0x20,0x00,0x66,0x00,0x6F,0x00,0x72,0x00,0x20,0x00,0x52,0x00,​
0x44,0x00,0x2C,0x00,0x20,0x00,0x6E,0x00,0x6F,0x00,0x74,0x00,0x20,0x00,0x44,0x00,​
0x45,0x00,0x4C,0x00,0x4C,0x00,0x4F,0x00,0x49,0x00,0x4C,0x00,0x20,0x00,0x72,0x00,​
0x65,0x00,0x71,0x00,0x75,0x00,0x65,0x00,0x73,0x00,0x74,0x00,0x2E,0x00,0x00,0x00]
Replace = [0x00,0x14,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,​
0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,​
0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,​
0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,​
0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,​
0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x20,0x00,0x00,0x00]
}

Now this I have no idea, was it just a test?

Was there also a new VBIOS? What needs to be modified for this to work?

[kasar]

nebster , those are the ones I modified on my xps 15 with good results

jkbuha & timewalker, let me know if I missed something important.

PlatformSetupAdvancedDxe.efi
CFEF94C4-4167-466A-8893-8779459DFA86_1_1073.ROM

00 29 02 29 02 0A 82 45 8A 00 to 00 29 02 29 02 0A 82 45 8A 01 (two ocurrences)
00 20 00 29 02 0A 82 45 8A 00 to 00 20 00 29 02 0A 82 45 8A 01 (one ocurrence)
00 00 00 00 00 00 00 00 45 0A to 01 00 00 00 00 00 00 00 45 0A (four ocurrences)

(to enable all the sub menus)



SystemSetupSecurityDxe.efi
166CD554-8AAE-4617-8FDD-A2E3A5AFD89E_1_1081.ROM

0A 82 45 8A (00) 00 00 00 00 00 00 00 45 0A to 0A 82 45 8A (01) 00 00 00 00 00 00 00 45 0A (two ocurrences)
(to enable password lenght options)



powermanagement2.efi
F7731B4C-58A2-4DF4-8980-5645D39ECE58_1_632.ROM

(75) 08 0F BA E8 0F to (EB) 08 0F BA E8 0F

(to enable native speed steep)

[TimeWalker]

hmmm... will try doing something else tomorrow. Thanks to @dmazar's tricks I was able to mount the firmware's file system!
And there are certainly more modules loaded up then I see being unpacked from the capsule.. also there are two file system which I'm not sure what the fsnt0 is ..

a simple ls in the filesystem's root reveals the following: 243 modules (i'm thinking of passing all of the *.efi modules to an external drive to see if ME fw is there .. and some other stuff possibly?)

and I tried running the Internal Shell from the firmware ..


As you can see from the image below- we are still stuck with UEFI version 2.0 (whilst most modern boards are running 2.31 already)


A quick dh shows that shell now has a handle of 1AE ..

If the filesystem was always mounted like that we would be able to do:
bcfg boot addh 1 1AE "Shell 2.0" -opt 0x40000000 0x0015
This would make a new Boot menu entry called "Shell 2.0" and would call for the respective handle's GUID from the fw when key 0x0015 (F11) is pressed. But since I can only mount the fs from a third-party driver .. we have no internal shell ... for now.

Also I quickly checked if the ME from X1 can be run as an application.. nah-uh, it can't.

[kasar]

@nebster

I noticed something on your quote


{
Name = "OS X Power Management"
File = "PowerManagement2.efi"
Search = [0x75, 0x08, 0x0F, 0xBA, 0xE8, 0x0F, 0x89, 0x44, 0x24, 0x30]
Replace = [0xEB, 0x08, 0x0F, 0xBA, 0xE8, 0xF, 0x89, 0x44, 0x24, 0x30]
}

missing 0 at

Replace = [0xEB, 0x08, 0x0F, 0xBA, 0xE8, 0x0F, 0x89, 0x44, 0x24, 0x30]


@timewalker

woah, nice work! o.O

[TimeWalker]

0xF and 0x0F is the same thing you can't split a byte in hex

here's the module after applying the patchset.

and these were probably my edits ... lemme see ..

yeah they were lol.

---

The power management patch unlocks write access to MSR Register 0xE2

I'm assuming this is what unlocks all the options in Tiano BIOSes

Correct.

Now this I have no idea, was it just a test?

This fills the manufacturing unicode string with spaces. The string reads as follows: "Below is reserved for RD, not DELLOIL request."
You can actually see what it says by decoding HEX-> ASCII

For new VBIOS an entire module has to be reintegrated.
There was also a CPU microcode update but it's to big to patch it like that... besides it sometimes differs in size and you have to know what was the binary data for the previous version, so automating this is pretty pointless if you ask me.

---

I have just one suggestion @nebster ...
don't call the modified file .WPH.mod .. it's annoying to having to go to Folder Options ans removing 'hide extensions for known file types' because VLC threats .mod as a media container ... and I hate Midnight Commander (or TC) -like apps.

[nebster]

@TimeWalker
As per your request, I've modified it so that it now asks for a filename as well.
Also, I have implemented patch versioning, compression, checksums, comments and lots of checks just in case the patches become corrupt.

I'll upload a patch in a bit as an example. At some point, I'll add embedding binary files into the patches so we can replace whole files if we want. Maybe I'll even implement a way of copying data from the old file into the new one if it is useful for anything.

------------------
Ooops, forgot to hit "Post Reply"


EDIT: Patch now attached