(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[TimeWalker]

You can't use it from shell, it requires the machine to be in crisis recovery or firmware update boot modes. And we don't have access to shell.. even the external one in either of these states.

Sent from my LG-P500 using Tapatalk 2

---

362A30h - General DMI data
363C17h - Service Tag
363CA0h - NVRAM data

The easiest way for @kasar to provide readable data for BIOS analysis is to do a couple of dumps from shell and share them with @CodeRush privately.
dmpstore would be your NVRAM dump
smbiosview -a would be your SMBIOS (DMI data essentially) dump

[kasar]

allright, I think I already had those dumps on one of my usb drives while we were testing the shell

I attached the files at this post, I will send the password to CR by PM, if anyone else need the PW, just let me to know

[TimeWalker]

It looks like the offsets inside OEM updater BIOSes are not fixed unfortunately.. for me A04 and A13 BIOSes have different offsets for unique data..it's inconsistent. It may very well have fixed position when it's written onto the chip. From @kasar's chip dump I lured out the following:

System Product Name: 3D03E2h
A04: 3D068Ah and A13: 3D076Ah

System Service Tag: 363C17h
Blank in OEM RAWs, don't have a full chip dump yet.

BIOS Build Date: 362A50h
A04: 362C96h and A13: 362CB6h <- so this is obviously an nvram variable that gets merged.

BIOS Build Time: 362A80h
A04: 362CABh and A13: 362CCBh <- again, obviously merged with nvram on the chip.

BIOS Version: 3D03FAh
A04: 3D06A4h and A13: 3D0784h

ME Version: 38024h
normally blank FF FFed in F33 RAW, Dell never updated their machines

EC Version: 401010h inside the RAW F33

NVRAM Contents: 363000h
The part shortly after "TBD by ODM" unicode string, lengths depends on NVRAM contents.. I believe it's reserved up until 3FF30Fh

[jkbuha]

Hey y'all... just logging in quickly before we kick off NYE...

And well, [censored] that ... SCT 2.0 UEFI Booting any OS = utter crap!

2. Need special tweaked .efi driver to emulate variables in RAM ... The driver occasionally fails to shut down the machine properly.
4. Brightness controls get lost for no reason occasionally, no known way of restoring the functionality other than using a completely stock rom.
5. In Windows installing QuickSet or ST Micro accelerometer driver locks up the machine.
7. Dell uses outdated version of Phoenix UEFI SHELL Flasher .. like real outdated 1.5.2 while the latest is 1.5.66, no comment here. No way of starting a newer version because it requires Firmware update or crisis recovery boot mode to be initialized and we don't have access to UEFI booting in either of these modes.
8. Dell's outdated Intel VBIOS doesn't support resolutions higher than 1024x768, third party boot loaders look squashed. Implementing newer version results in weird system failures as proven by some 15z users attempting it.
9. If not using a custom VBIOS artefact appear all over the place in OSX, no proven way of getting rid from them...

So here are my two cents...

2. Happens on the 15z as well. My theory is that this is could be due to Clover as well though. 'Native' UEFI booting w/o Clover seems to throw up some interesting differences...
4&5. I have an interesting difference in this on the 15z. The brightness on OSX (BIOS and UEFI) starts up in faintly, and I have to sleep or switch off the display to bring it to proper brightness. Win & Linux seem to start up fine though, so I'm not sure where this comes from.
7. I'll refer to your subsequent posts to get this working properly - but I do think this is a key issue in us also being able to unlock the ME region possibly without any hardware modifications.
8. This is a weird one and which is troubling me the most at the moment. Importantly - is it possible to recover a laptop from the '6-beeps' issue, ie: video failure? Has anyone successfully managed to recover their 15/15z from the 6-beeps state?
9. I have posted one method on how to do this with standard vbios, via EDID override (google me on tonymac).

Happy NYE everyone and see y'all in 2013!

[twntysvns]

Hello!

My name is Matt, and I am curious if you guys here have found a way to unhard-brick the L502x? I was researching this at work, and was going to make my XPS into a Mountain Lion dual boot machine. My co-worker got on it while I was on the floor helping a customer, tried to take over, and flashed the 15z BIOS file. I am assuming that it is hard bricked, as it took me a while to find the response from kasar in February that was made to ScruffyITA, to even figure out why recovery methods were not working. I am hoping that there is some hope as my laptop is 1.5mts out of warranty, and Dell is really giving me a hard time.

Thank you!
Matt

[TimeWalker]

Hello!

My name is Matt, and I am curious if you guys here have found a way to unhard-brick the L502x? I was researching this at work, and was going to make my XPS into a Mountain Lion dual boot machine. My co-worker got on it while I was on the floor helping a customer, tried to take over, and flashed the 15z BIOS file. I am assuming that it is hard bricked, as it took me a while to find the response from kasar in February that was made to ScruffyITA, to even figure out why recovery methods were not working. I am hoping that there is some hope as my laptop is 1.5mts out of warranty, and Dell is really giving me a hard time.

Thank you!
Matt

Sorry to hear that. Read first post in this thread and get the crisis cd from the article on the homepage.

Отправлено с моего PMP5770D через Tapatalk

[kasar]

happy NY to all guys.

srry I couldnt connect before but it was a long night ^^

@tw

what do you mean with my chip dump is incomplete?

are you talking about the 4mb dump?

I 'm almost sure it is fine since I was able to write it on a totally emty chip and then the machine worked perfectly with the chip programed by me using the dump ^^




@twntysvns

you can find a guide of how to recover l502x bios here and DL links

http://forum.notebookreview.com/dell-xps...-more.html

just go to the recovery chapter and follow instructions, there are also pics of the entire process

[TimeWalker]

happy NY to all guys.

srry I couldnt connect before but it was a long night ^^

@tw

what do you mean with my chip dump is incomplete?

are you talking about the 4mb dump

I 'm almost sure it is fine since I was able to write it on a totally emty chip and then the machine worked perfectly with the chip programed by me using the dump ^^

Thanks, pal!
I've said that data location is not consistent, nothing about the dump being incomplete.

Отправлено с моего PMP5770D через Tapatalk

[kasar]

ah, ok ^_^
well I just said it because I read this before

System Service Tag: 363C17h
Blank in OEM RAWs, don't have a full chip dump yet.

[TimeWalker]

I was referring to an offset from your dump and saying that service tag is empty in raws and I dont have a dump myself to check if the offset from my chip matches. I will do a full dump from FPT when I will be installing an ssd, so that I will be able to bridge HDA chip.