(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[follow_me]

I found a lot of SATA and USB related stuff in the BBL region of the firmware

Thats intersting - can you share the results of your investigations ?
Is there a way to turn on RAID mode for SATA controller ?

[kasar]

someone still alive here?



@timewalker

do you still interested on keep investigating/unlocking overclocking?

maybe if we combine our intel ME firmware and bios hacking knowledge we can get the overclocking menus from the advanced bios setup unlocked

I think you mentionated they were related with ME variables

[jkbuha]

Hey kasar

Apologies for delayed replies as am still travelling lots these days. Even for Easter!

Just to summarize where things are at the moment, I think we all need to focus on the following points:

1) ME firmware hacking - can this be done without any extra hardware?
2) Overclocking / undervolting - is there a way to do this without ME; eg: SSDT patching etc
3) Additional hardware modding; eg SATA, Display EDID etc - any chances for updates?

Hopefully we can get cracking with the same momentum on these

[HairyCube]

I'm still lurking around. Glad to see you guys are still here too.

2) As far as overclocking/undervolting goes, I'm pretty sure it cannot be done with just SSDT modding. Sandy Bridge processors have their own independent voltage control which is embedded into the CPU itself. It makes any software mods impossible (and it's also the reason why programs like RMClock no longer work on newer CPUs).

3) So far I haven't been able to modify SATA behavior yet, though I have replaced a lot of modules in my Vostro BIOS with the ones from L702X BIOS. It seems that a lot of modules are compatible and very often exactly the same (I'm starting to think SATA 2 port reset is by hardware design). Also, no sight of RAID mode, though I never looked for it specifically.
A lot of interesting SATA and USB-related stuff resides in the BBL region of the firmware, which is very dangerous to modify. If something goes wrong with the BBL region (like a broken or an incompatible module), you won't be able to start the PC in recovery mode even if you have a working USB stick with a firmware capsule. I learned it the hard way. Therefore, I can't touch the BBL modules at the moment. If anyone has hardware means of BIOS recovery, you're welcome to experiment though :p

[follow_me]

@HairyCube

I have a hw recovery for L702X ... so, can you share what you have found ? I volunteer to test it
As far as I know @kasar has hw recovery, he can join testing , if he wants

Does anyone know how to replace built in module with a custom one, to have it loaded at start up (oryginal module does start)

Here is idea - firmware contains couple of drivers for different flash chips , most of which are physically absent, but modules for those chips are loaded. if it possible to replace this module with a custom one - we can load a modified ffs driver with a custom modules loader directly from firmware

ADDED: recent news - JetWay has leaked bios sources for thier bioses, may be interesting from porting features point, and low level init code
There is tons of reference info from intel - ACPI tables / config registers for Sandy | Ivy bridge - found out RAID mode switching ... must see !
here is link magnet:?xt=urn:btih:bd8b50ebfc73b4f0ea53bda4f7f6a1861b1eb19c&dn=leaked%5Fbios

[HairyCube]

@follow_me

I don't think I have anything exciting apart from what you probably know already.
Like, in my Vostro BIOS, the RAID module is ED2DE537-7823-4CB1-B687-85BA9BBEF0B4_1_587.ROM. You can try replacing it with a similar module from a RAID-enabled laptop, but I think you also need RAID to be supported in DSDT and maybe on hardware level. I never looked for RAID support particularly, so I can't say for sure.

My current objective is to modify SATA and USB port behavior on my Vostro 3450 so that it wouldn't cut power to SATA ODD port and USB 3.0 ports when the system is restarting.
I've been comparing V3450 and L720X BIOS modules, and most stuff in the BIOS region is compatible (meaning the system will boot with it). However, the behavior doesn't change. I'm starting to think that SATA/USB port configuration data is stored somewhere else (like NVRAM, maybe?) and doesn't depend on the modules themselves.
If you open the F33.... image in PhoenixTool 2.01 (you have to use this old version to see the difference between regions), and click Structure, it will show two "File Volumes" with identical filenames. The first "File Volume" is the BIOS region, where it is relatively safe to replace stuff. I tried replacing most of SATA-related modules (like SystemAhciBusDxe.efi), but it didn't do anything.

The second one is BBL region, which includes low-level stuff loaded during initialization, like EFI drivers for filesystems and the "Security Core" itself. There are interesting files in this region, like SataPeim.efi, PchConfig.efi, PchUsb.efi, SystemEhciComboPei.efi and many others. The filenames speak for themselves, and it would be really interesting to see how the behavior changes if you modify or replace them.
You can try replacing some of these modules using the latest version of PhoenixTool and the instruction I posted at the bottom of the first post in the Vostro thread ("To flash modified DSDT", just skip steps 5-7).

Again, I have to remind you that breaking stuff in the BBL region will likely make the laptop unable to boot in recovery mode, so be careful.

[follow_me]

@HairyCube

Like, in my Vostro BIOS, the RAID module is ED2DE537-7823-4CB1-B687-85BA9BBEF0B4_1_587.ROM. You can try replacing it with a similar module from a RAID-enabled laptop, but I think you also need RAID to be supported in DSDT and maybe on hardware level. I never looked for RAID support particularly, so I can't say for sure.

Already did this way with no luck. Btw - data stored in setup data, not in ACPI table and used by Platform init code directly from setup data

My current objective is to modify SATA and USB port behavior on my Vostro 3450 so that it wouldn't cut power to SATA ODD port and USB 3.0 ports when the system is restarting.

You think it is possible to modify this behaviour by just replacing modules ?
I doubt that it is possible in this way. It would be great luck to boot system with initial modules from another fw.
In my opinion the best way is to inject custom loader, that will load custom /unload system modules or modify boot configurations at startup
Take a look at sources from link I have posted before - there is init code for platform hardware such as SATA/USB controllers. For example I have found code that responsible for RAID mode switching , and now the only problem is how to modify existing code with custom SATA mode switch

Again, I have to remind you that breaking stuff in the BBL region will likely make the laptop unable to boot in recovery mode, so be careful.

I have a flash dump and hw programmer , so this is not a problem for me

[kasar]

@HairyCube

yeah, I have a hw recovery for the L502X ^_^

(well, I found there are two flash chips at the L502X, the one I modified to be extracted/dumped/flashed is the bigger one 4mbit, there are a smaller size one 512 mbit, I didnt installed anything on that one yet, however I am pretty satisfected with the modifications I made thanks to the HW programer )

oh, and as for the link you posted
magnet:?xt=urn:btih:bd8b50ebfc73b4f0ea53bda4f7f6a1861b1eb19c&dn=leaked%5Fbios
I cant open it with my browser, does it need to be opened with some kind of app?

edit: do you have pics of your recovery method from your L702X? , I'm allways curius in HW modifications

[Sebashi]

someone still alive here?



@timewalker

do you still interested on keep investigating/unlocking overclocking?

maybe if we combine our intel ME firmware and bios hacking knowledge we can get the overclocking menus from the advanced bios setup unlocked

I think you mentionated they were related with ME variables

Hello Kasar
First thank to you, Timewalker and jkbuha for this really deep investigation in that thread
I'm interrested as I've got an unlocked advanced menu that show up "Extented ICC" but even with a tweaked ME firmware, option are still greyed out and don't reflect what I set in FITC....
I get two brick with some wrong settings, but know I think there is someting that interfere and it seems that the ICC profile is not loaded ?
http://www.bios-mods.com/forum/Thread-UN...VE1712-C5E

Maybe we could compare our ME FW as on my notebook, the bios show icc menu without ME mod.

So one question for you kasar, did you have to change other setting than the FCIM-BTM 11A33 to 11A34 ?
To get it working, I have been forced as it assign SSC3

I have also changed of course the range of the DIV-2S ... bios still show up the exact greyed out menu filled with original values.

The modded ME Firmware I've seen, your's HM67 , a Clevo Z77 and another unidentified one, show similarities that I have copied ... but no success for me.

[kasar]

@Sebashi

hey

oh, I see you managed to unlock your descriptor by doing the pinmod

as for BCLK overclocking, I was able to do only with XTU software after my ME firmware sucesfully mod.
and yes, I changed some others adjustments

give a read to this pdf

http://driveragent.com/c/archive/aa650e5...7.0.0.1144

your should find there what values need to be changed for FCIM overclocking

values needed to be changed usually are on green colour


I also modified some clock ranges

if you want to see my changes here is my modded me patch

http://www.mediafire.com/?tgv2qpll3patc2j

since you dont have my laptop, ignore all the other files and load the l502x_me_overclock_by_capitankasar.bin file on FITC to compare it with yours

---

oh, and as for the descriptor override by doing pinmod, I am interested.

I already modded it via a external programmer, but I am looking for easier ways for people trying to enable OC without desoldering the whole bios chip like I did.

here is a pic of my l502x motherboard, I can see 3 suspicius chips at this one.

do some of these is the one to be pinmodded?

http://img823.imageshack.us/img823/1949/dsc0080fi.jpg