(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[jkbuha]

Tried it kasar a couple of weeks ago - flash descriptor is read only.
We need another way in, most likely through (i) flashing the BIOS+ME regions together in winflash (ii) unlocking the ME at boot-up through a key combo.

[TimeWalker]

I've mentioned the idftool a couple of pages back, but now I read this:

ifdtool will now dump access permissions of system components to
certain IFD sections:

Found Master Section
FLMSTR1: 0xffff0000 (Host CPU/BIOS)
Platform Data Region Write Access: enabled
GbE Region Write Access: enabled
Intel ME Region Write Access: enabled
Host CPU/BIOS Region Write Access: enabled
Flash Descriptor Write Access: enabled
Platform Data Region Read Access: enabled
GbE Region Read Access: enabled
Intel ME Region Read Access: enabled
Host CPU/BIOS Region Read Access: enabled
Flash Descriptor Read Access: enabled
Requester ID: 0x0000

FLMSTR2: 0x0c0d0000 (Intel ME)
Platform Data Region Write Access: disabled
GbE Region Write Access: enabled
Intel ME Region Write Access: enabled
Host CPU/BIOS Region Write Access: disabled
Flash Descriptor Write Access: disabled
Platform Data Region Read Access: disabled
GbE Region Read Access: enabled
Intel ME Region Read Access: enabled
Host CPU/BIOS Region Read Access: disabled
Flash Descriptor Read Access: enabled
Requester ID: 0x0000

FLMSTR3: 0x08080118 (GbE)
Platform Data Region Write Access: disabled
GbE Region Write Access: enabled
Intel ME Region Write Access: disabled
Host CPU/BIOS Region Write Access: disabled
Flash Descriptor Write Access: disabled
Platform Data Region Read Access: disabled
GbE Region Read Access: enabled
Intel ME Region Read Access: disabled
Host CPU/BIOS Region Read Access: disabled
Flash Descriptor Read Access: disabled
Requester ID: 0x0118

Also, ifdtool -u /path/to/image will unlock the host's
access to the firmware descriptor and ME region.
ifdtool -l /path/to/image will lock down the host's
access to the firmware descriptor and ME region.

fancy, right? now ... either find a compiled version or compile it ourselves
https://github.com/XVilka/coreboot/tree/...il/ifdtool

actually no, they seem to have changed the repo:
http://review.coreboot.org/gitweb?p=core...5d42bfb947
Change listed above is dated: Fri, 9 Nov 2012 19:59:42 +0200 (18:59 +0100)
Fairly recent, really!

Code:

static void print_usage(const char *name)
{
    printf("usage: %s [-vhdix?] <filename>\n", name);
    printf("\n"
           "   -d | --dump:                      dump intel firmware descriptor\n"
           "   -x | --extract:                   extract intel fd modules\n"
           "   -i | --inject <region>:<module>   inject file <module> into region <region>\n"
           "   -s | --spifreq <20|33|50>         set the SPI frequency\n"
           "   -e | --em100                      set SPI frequency to 20MHz and disable\n"
           "                                     Dual Output Fast Read Support\n"
           "   -l | --lock                       Lock firmware descriptor and ME region\n"
           "   -u | --unlock                     Unlock firmware descriptor and ME region\n"
           "   -v | --version:                   print the version\n"
           "   -h | --help:                      print this help\n\n"
           "<region> is one of Descriptor, BIOS, ME, GbE, Platform\n"
           "\n");
}

[kasar]

awesome find timewalker!

rep added!
I must get a compiled version of that awesome software o.O

[TimeWalker]

I can only compile for GNU :|
Maybe @nebster can assists us with this, since he compiles his EFI-Modifier the same way I would guess (gcc -O2 -g -Wall -W)

[TimeWalker]

I've compiled it but it acts weird .. won't let me save anything to anywhere:

Code:

usage: C:\ifdtool\ifdtool.exe [-vhdix?] <filename>

   -d | --dump:                      dump intel firmware descriptor
   -x | --extract:                   extract intel fd modules
   -i | --inject <region>:<module>   inject file <module> into region <region>
   -s | --spifreq <20|33|50>         set the SPI frequency
   -e | --em100                      set SPI frequency to 20MHz and disable
                                     Dual Output Fast Read Support
   -l | --lock                       Lock firmware descriptor and ME region
   -u | --unlock                     Unlock firmware descriptor and ME region
   -v | --version:                   print the version
   -h | --help:                      print this help

<region> is one of Descriptor, BIOS, ME, GbE, Platform


C:\ifdtool>ifdtool.exe -x bu.bin
Could not open file: No such file or directory

Maybe someone can get it to work ..
https://dl.dropbox.com/u/2573233/ifdtool.rar

[nebster]

Here you go.

Haven't tested it though! Required a slight patch to make it compile on windows.

EDIT: Oops, didn't see you compiled it @TimeWalker

---

@TimeWalker Aren't you using the ifdtool wrong? It is trying to access bu.bin to extract it. Does bu.bin exist?

[kasar]

thanks for the compilation guys

added rep to both of you ^^

I noticed timewakers file is 56 kb
and nebster's one is 171kb

also since timewalker reported issues with his version I will try nebster's first


edit: oh, im curius, did you compiled for win32 or win64?

[TimeWalker]

Yeah, I've figured:
#define S_IRGRP (S_IRUSR >> 3) /* Read by group. */
#define S_IROTH (S_IRGRP >> 3) /* Read by others. */
are missing.

But the tool doesn't actually do anything properly. It needs a fine to save the dump, but won't save the dump and reads the size of the specified file instead.. can't wrap my head around it. Besides I'm bloody tired today..

Also apparently this tool is used by Google to deploy ChromeOS onto Chrome Books ...

Code:

Copyright (C) 2011 The ChromiumOS Authors.  All rights reserved.
Copyright (C) 2011 Google Inc

86/64 .. what the heck is different .. you can run both arch natively.

Code:

>ifdtool -d backup.bin
Could not open file: No such file or directory

>ifdtool -d 7.1.52.1176.bin
File 7.1.52.1176.bin is 1335296 bytes
Could not read file: No error

>ifdtool -x v3450.rom
File v3450.rom is 4096 bytes
Found Flash Descriptor signature at 0x00000010
  Flash Region 0 (Flash Descriptor): 00000000 - 00000fff
  Flash Region 1 (BIOS): 00180000 - 003ffff
   -------------- Crash -----------------

Hopes were waaay up high for this ...

Code:

>ifdtool.exe -u v3450.rom
File v3450.rom is 4096 bytes
Found Flash Descriptor signature at 0x00000010
Writing new image to v3450.rom.new

It just patches the dumped flash descriptor to "unlock" it and reflash (same as Intel's utility I guess), which can't be done since it's locked.

[nebster]

I think mine is 64bit and is most likely the debug version.
If I strip out the extra information, it is 32KB but then if it crashes we can't trace it to the line!

---

I've attached both 32bit and 64bit versions of it.

[TimeWalker]

Can't debug it either way:
Unhandled exception at 0x7510c035 in ifdtool.exe: 0xC0000005: Access violation reading location 0x005131e0.