(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[Brabbelbla]

@follow_me
From here I added a _EFI_IFR_REF3 entry in the IFR structure. In binary form, you have to insert somewhere on some form:

For the main form, form ID 1, using the RAID0 unicode string:

Code:

0x32C2F Ref: RAID0, Variable: 0xFFFF {0F 21 C9 01 CA 01 A2 01 00 00 FF FF 00 01 00 00 00 57 CD 7B D3 A1 AB E6 44 A9 2C 89 8B 15 8F 2F 59}

And for the create volume form, form ID 2, using the RAID1 unicode string:

Code:

0x32C50 Ref: RAID1, Variable: 0xFFFF {0F 21 CB 01 CC 01 A2 01 00 00 FF FF 00 02 00 00 00 57 CD 7B D3 A1 AB E6 44 A9 2C 89 8B 15 8F 2F 59}

Insert them somewhere in the IFR structue and either update the PE section and common headers with the new file size and checksums or remove other operators to create space. Or just use my attached file (your's is an L702X, right?). Still a WIP. Replace CFEF94... with it. The references show up on the HDD configuration page, after enabling RAID. Then reset the system, if the RST driver is not loaded, the links do not work.

I believe the way it should be is the RST driver publishing the formset, and somehow the form browser should pick it up as a tab. I tried adding the GUID's that all stock tabs have to the IFR structure in that driver, but it still didn't show.

EDIT, WARNING: Having flashed this version, and also with one before this, containing pretty much the same as this one, I have been unable to boot using the sideloaded BIOS in crisis recovery mode. It just resets when the blue bar on the splash screen reaches 60% or so. Not sure if defaults are loaded, that is basically the only thing I have ever really needed. Luckily I don't need it now, but it feels tricky. Years ago, I had this problem as well, I don't know what caused it now and what caused it then. Somehow it got solved then, but I don't have a clue how.

[follow_me]

@kasar

take a look at this post
it's about platform , key hardware is the same
http://forum.techinferno.com/alienware-m...ounge.html

and here , post about tool which allows to "circumvent write protection", and it is possible ( I guess ) to bypass the read protection
http://forum.techinferno.com/alienware-m...sions.html

And we can find a user (here or at NR) with AW 17x R3 to ask him to make a dump

[jkbuha]

So it turns out that the ME descriptor region in the L502x and L511z is not functionally equal. How do I know - because when I applied all of kasar's ME settings, the 15z bricked. Yup - recovery CD not working, fan on and nada else.

So, thankfully (and thanks to kasar's advice) I *did* make a backup of the 4MB Winbond chip. Problem is, I cannot seem to flash it whilst it's still directly on the motherboard (I know, most posts say that you can't due to the other components connected to each pin) so it looks like I'm going to have to desolder.

@kasar - what soldering iron did you use to desolder? Would a 30W do the trick or would it be too high & lift the tracks as well? Also, did you use a needle to pull up each leg during desoldering, or did you use a copper 2.5mm wire around the chip?

[kasar]

@follow_me

yeah, it is quite similar system

anyway on the R4 topic I see people using 3xxx mobile CPUs, wich mean ivy bridge support.

I think I should try on this one instead
http://forum.techinferno.com/alienware-m...tweak.html

wich is for r3 ^^
just posted there ^^


the L502X does not have ivy bridge support, and relating the HM67 chipset, I read on many places there are no support for ivy proccesors, just sandy bridge, that confuses me a little.

so there are probably some differences on the r3 and r4 model from that topic, from what I read, r3 is like the L502X supporting only sandy bridge, while R4 offer support to ivy bridge, but yeah, getting one of those ME dumps would be awesome, also porting some bios stuff from alienware m17x r3 to our dell's would be super

@jkbuha

well, in my case, after descriptor unlock, I susucesfully dumped and flashed not only specific parts thanks to FPTW64, also the whole backup, those backups are the same and compatible with the programmer method.

I used it a lot to restore previous images with all settings and me configurations.

this method is also way faster than the external programer, flashing the whole chip from FPTW can take few seconds while the external programmer take minutes and require remove phisically the chip and attach it to the programmer (more time.)

however, this requires obviouly the laptop on a at least partially working status wich allow to boot the OS and run FPTW

if the system is bricked, your only change is to program it externally by removing the chip (yep, remove it is required since there are still many parts connected to the chip, I was unable to program it with my first try, the external programmer port, thats why I only had success after removing the chip and attaching it directly to the programmer without other components.)

relating soldering, I used also a 30w soldering iron.

a cheap one, just filed the head to make it thiner so I were able to do more precise stuff.


and yeah, true, I used a needle yo lift on per one the chip legs while applying heat.

patience is the key, specially the first time

you need to do this VERY carefully, excesive heat will fry the chip, like it happened to me the first time after several solderings and desolderings.

and excesive force will break chip legs, (hapened to me after with the external programmer)

that is why I ordered more winbond chips (you can get many of them for very very little money, just ensure they are exactly the same model as yours and it will be fine,I got a pack of 5 of them for just 3 eur from ebay) and also ordered the sockets for both motherboard and programmer side.

sockets make life way easier if you need to program the chips externally more than once , and also have extra chips helps in case some of them got damaged.

also the extra chips can be used to store different configurations or just working backups in case you get the laptop with you and the firmware get corrupted and you dont have your programmer or another PC with LPT port to use the programmer, swaping the chips would need the sockets, else you would need soldering and desoldering everytime.

It saved me some times

[follow_me]

yeah, it is quite similar system
anyway on the R4 topic I see people using 3xxx mobile CPUs, wich mean ivy bridge support.

@kasar
The post with the R4 was there only for the tool to unlock descriptor , as I understand it will be needed to make a dump

But , I think we will need more than just full flash dump - because raw bios dump is ~4,5M size , which means the ME FW is most likely 3,5M size one
Did you thought about "bigger size flash" mod (e.g. w25q64bv) ?

[kasar]

oh, the PRR2.exe tool, is really interesting

this may allow to bypass the need of hardware mods to get access to some regions.

I think I will ask the forum users to test it (as I have already unlocked descriptor ^^)

they all may be able to finally flash the BCLK patch I made some time ago. (instead just the people who hardware modded the machine)

I will ask them now if they can test it (will upload a test/scripted package with my tested ME oc patch)

are you talking about the R3 firmware size?

well, in that case it may not be compatible at all.

well, in the case of the L502X, we use the 1.5 mb ME firmware updates

bigger ones does not install at all

as for the moment I know two types of ME firmware versions, the 1,5 mb package versions, and the 5 mb package versions.

[kasar]

added a small guide to test the soft unlocking (to test the security bypass)

http://forum.notebookreview.com/dell-xps...ost9657720

[follow_me]

well, in the case of the L502X, we use the 1.5 mb ME firmware updates

bigger ones does not install at all

as for the moment I know two types of ME firmware versions, the 1,5 mb package versions, and the 5 mb package versions.

the small ones are usually focused to laptops, meanwhile the bigger ones are usually for desktop machines wich offer hybrid functions between for example ME 7.x and 8.x versions (sandy + bridge support)

I can't test either, because I've unlocked descriptor too
my bad, I thought that there is 1,5 mb and 3,5 mb versions
We will newer find out unless we try , and in case of 5Mb ME firmware we always can upgrade bios flash chip to a bigger one

[kasar]

haha, its funy before no one had it unlocked, and when we need people to test finally some software methods everyone have it patched already

well, I know there are at least 1,5mb and 5 mb firmwares, not sure about 3 mB firmwares.

I saw them at many ME updates, the update files are exactly that size usually ^^

about the chip upgrade , it can be a interesting idea, it reminds me like the router mods to upgreade the flash memory or ram, making the posibilities higher and make them faster.

however, not sure if it will work that easy without several softmods.

I remember timewalker said there were several mentions to the phisical chip models at the firmware, so if we replace the bios chips with bigger ones, I supose we will need heavy modding.

and also we would need to change the regions sizes, start and the end of each one.

I dont know how to make all of that , maybe just buy a bigger size chip and install it on my already soldered socket, but appart from that , I follow you

[follow_me]

I dont know how to make all of that , maybe just buy a bigger size chip and install it on my already soldered socket, but appart from that , I follow you

As I understand - we need to buy a bigger chip ( I already did )
Update "Bios Region length" using fitc to a bigger size(or ME region to fit 5M firmware) , rebuild image and flash it