[Success] [Bios Mod] Dell XPS L321X EFI boot enabled + Advanced menu

[SlayerProof32]

Hello guys,

I recently picked up a Dell L321x from a e-waste recycler and powered it on. Immediately seeing that the firmware was the Phoenix Tiano securecore bios, I was pretty sure this device was EFI boot compatible. As it turns out, it is and Dell for some inexplicable reason disabled the EFi boot functionality entirely. I successfully brought this back!

Quick unmodded bios details:

Version: Phoenix Securecore Tiano (UEFI disabled) A08


Initial issues:

1: Uefitool ReconstructRegion size error

Code:

reconstructRegion: reconstructed region size 390448h (3736648) is smaller then original 421000h (4329472)

Solution: Use PhoenixTool instead


Issue #2: Phoenix Winflash will not flash bios image

Code:

Sha1 Value in capsule in incorrect. Please get correct capsule.

Solution: Use Phoenix SCT flash or Winflash provided by manufacturer

Quick How to:

1. Download Update EXE

2. Run the updater but disconnect the AC adapter so it doesn't flash. DO NOT CLOSE THE APPLICATION ON ERROR

3. Go to your temp folder (Run (Win+R) --> %temp%)

4. Find your bios file (either BIOS1.WPH or Spyder.cap)

5. Rename your modded bios to the name of the BIOS in the folder and REPLACE the file

6. Run the EXE from the temp folder and flash away with no SHA1 error


----------------------------------------------------------------------------------------------------------------------------------------------------------------

!!Disclaimer!! This bios and guide is provided for experimenters only. Flashing modded Bioses can brick your perfectly working computer.
You have been warned.

And now to the good stuff.

-------------------Setup---------------------

0. Required tools:
-  Your system manufacturer's bios executable
- UEFItool (for Exploring Uefi files)
- HXD (For modding your bios) (or any other good hex editor)
- PhoenixTool (for rebuilding your modded bios)
- Universal IFR extractor
- RWeverything


1. Launch your bios executable. Don't flash the bios or close the program. Doing so will delete the extracted bios from the EXE.

2. Navigate to your temp folder and find the BIOS.wph or SPYDER.cap bios module

3. Open your bios image with UEFItool and get modding!


-------------------------The Modding begins-----------------------------

This section will briefly explain how to mod a BIOS and bring back the hidden menus. I have no experience with other types of mods.

1. Search for the options you want in UEFItool. In my case I wanted UEFI boot so I searched for "UEFIboot and found the such an option existed in
"SystemSetupMainDxe."

2. Extract the IFR of the BIOS dxe that contains the desired options.


3. Take a look at the IFR. If it looks like what is displayed in your firmware settings and is full of suppress statements, you likely need to modify that part of your bios. If it does not, your computer is likely using a custom form set like the L321x and so you will have to change what options are read by your bios at boot using the GUID patch method (Global Unique Identifier). This is what we will explore today.


4. If your device is using custom form sets, you will have to replace those form sets with the unlocked ones. These unlocked bios form sets exist in our firmware but our bios has been programmed to load custom ones instead. For example, Dell loads DellSetupDXE (locked down) instead of SystemSetupMainDXE (unlocked) so we need to patch the EFI module responsible for loading these forms. To find this, we will have to get the GUID of the forms that are loading right now at boot. Start by searching UEFITool for "setup." This should reveal the custom form sets being used. For example, dell uses "DellSetup," and "DellAdvanced" 

5. Now we need to get the GUIDs of these OEM formsets. To do so, open HXD and search for the 16-byte GUID header

Code:

A1 31 1B 5B 62 95 D2 11 8E 3F 00 A0 C9 69 72 3B

Underneath that header should be your GUID. For the DellSetupAdvanced formset, it is

Code:

9D BA 58 21 4F C1 78 40 96 48 FA EC A0 34 CA 67

Now verify that you have a valid form GUID by searching UEFItool for the GUID. Use the "hex values" search tool for this. If you were successful, your hex search should return two matches

Code:

Hex pattern "9DBA58214FC178409648FAECA034CA67" found as "9DBA58214FC178409648FAECA034CA67" in EfiCrc32GuidedSectionExtractionGuid/PE32 image section at header-offset 2A4h ---> DellSetupAdvancedDxe

Hex pattern "9DBA58214FC178409648FAECA034CA67" found as "9DBA58214FC178409648FAECA034CA67" in EfiCrc32GuidedSectionExtractionGuid/PE32 image section at header-offset 2A4h ---> SystemFormBrowserCoreDxe

The second should be the BIOS module responsible for loading system forms. For example in the L321's case, this is SystemFormBrowserCoreDXE Tip if you return only 1 result, try taking 4 bytes off each side of your search just to verify your GUID is correct. If that still doesn't work, you may not have the correct form.

If you return many results with a GUID search, try moving 16 bytes ahead in the DXE file in HXD and copy that GUID instead.

7. Once you get a GUID that only includes the formset you are trying to replace and the form parser, extract the form parser in HXD and search for your GUID again. This is what you will be replacing.

8. Extract the replacement formset, find the GUID header and overwite the old (locked down) formset's GUID in the formset parsing UEFI module.

9. Save the modded parser, then open PhoenixTool. Tell it to extract the bios you got from your System Manufacturer's website

10. Provide the Manufacturer of your bios, then select the appropriate SLIC and SLP files (I used Dell.rom and Dell.txt for the L321x)

11. Click the "structure" button then browse your efi volume for the formset parser you replaced the GUIDs in. For the L321x, this would be SystemFormBrowserCoreDXE. Click on PE32+ image section, then replace. Add the modified parser efi file you edited in HXD. Click ok to save the BIOS.

12. Last step: Create a RWeverything report/dump, add it the phoenixtool then hit GO to regenerate your bios image. This new (modded) bios is now flashable! Cross your fingers, flash, and enjoy the mod!


---------But what if I don't want to do the mods myself? Can you provide images for me?----------

Yes. The modified SystemFormBrowserCORE.efi and L321xModded.cap are provided! Have fun!

Spyder.cap is the original BIOS.



  Dell XPS L321X Bios Mod EfiBoot+ Advanced bios settings.zip (Size: 1.6 MB / Downloads: 36)



Credits for this mod go to @Maxinator500 for his advice and @CodeRush for his awesome insights

[Maxinator500]

reconstructRegion: reconstructed region size 390448h (3736648) is smaller then original 421000h (4329472)

Hello.
Try using the PhoenixTool for BIOS file rebuilding. It just won't let you do some things wrong.

[SlayerProof32]

reconstructRegion: reconstructed region size 390448h (3736648) is smaller then original 421000h (4329472)

Hello.
Try using the PhoenixTool for BIOS file rebuilding. It just won't let you do some things wrong.


Thanks for the tip! The bios did rebuild, however I was wondering how I'm supposed to flash it. Winflash is giving me a "Sha-1 check failed. Please load a correct capsule file." If I try to write the bios as an image by extracting it from the capsule, that fails as well citing "Invalid bios image." Is there another tool that will write Phoenix uefi bios images?

[Maxinator500]

Winflash is giving me a "Sha-1 check failed. Please load a correct capsule file." If I try to write the bios as an image by extracting it from the capsule, that fails as well citing "Invalid bios image."

Although I think the installation of modified BIOS can be done using Winflash, it's a tedious process of debugging software limitations to get this work I don't want to be involved into without having a SCT Phoenix BIOS device in my hands.
I had a little success in it while patching BIOS rollback lock and it did work for IdeaPad 110, but that was the chosen final of my progress.

The other way is to use PFLash shell program. You need to learn how to execute EFI files, and you're good to go.
I don't have any experience with it, but according to community experience it works for IdeaPad U310 mod. BIOS, that also updates through capsule method.

PFlash - UEFI Shell method:
Only use this method if you have EFI-capable BIOS, all BIOS settings will be retained, and your custom boot entries will be saved too...

- put the correspondent files to a USB drive formatted as FAT32;
- reboot the laptop, go to BIOS setup, navigate to Boot Configuration and make sure UEFI Boot is enabled;
- reboot the laptop and go to Boot Manager, select your USB drive with EFI folder and boot from it (make sure this is the only USB connected);
- as soon as it's booted, EFI SHELL will appear counting down 5 seconds to start startup.nsh you might pre-configured in advance
- if your flash drive was assigned fs0: identifier you will see Phoenix UEFI SHELL Flasher.
- if your flash drive is some other file system number an error will appear, so type the following:

map fs*
- see the number of your USB drive, let's say it's fs2:, then type:
fs2:
cd <working dir>
PFlash.efi /sa /bios <capsule>

[SlayerProof32]

Winflash is giving me a "Sha-1 check failed. Please load a correct capsule file." If I try to write the bios as an image by extracting it from the capsule, that fails as well citing "Invalid bios image."

Although I think the installation of modified BIOS can be done using Winflash, it's a tedious process of debugging software limitations to get this work I don't want to be involved into without having a SCT Phoenix BIOS device in my hands.
I had a little success in it while patching BIOS rollback lock and it did work for IdeaPad 110, but that was the chosen final of my progress.

The other way is to use PFLash shell program. You need to learn how to execute EFI files, and you're good to go.
I don't have any experience with it, but according to community experience it works for IdeaPad U310 mod. BIOS, that also updates through capsule method.

PFlash - UEFI Shell method:
Only use this method if you have EFI-capable BIOS, all BIOS settings will be retained, and your custom boot entries will be saved too...

- put the correspondent files to a USB drive formatted as FAT32;
- reboot the laptop, go to BIOS setup, navigate to Boot Configuration and make sure UEFI Boot is enabled;
- reboot the laptop and go to Boot Manager, select your USB drive with EFI folder and boot from it (make sure this is the only USB connected);
- as soon as it's booted, EFI SHELL will appear counting down 5 seconds to start startup.nsh you might pre-configured in advance
- if your flash drive was assigned fs0: identifier you will see Phoenix UEFI SHELL Flasher.
- if your flash drive is some other file system number an error will appear, so type the following:

map fs*
- see the number of your USB drive, let's say it's fs2:, then type:
fs2:
cd <working dir>
PFlash.efi /sa /bios <capsule>

Thanks for the idea! The only problem is this bios is actually UEFI (the image is comprised of EFI modules). However, Dell has disabled EFI booting at the firmware level without any method to reenable it (there is no option in the bios). This means that i cannot load a .efi file. If I could, I'd likely just use RU.efi to change bios settings.

[Maxinator500]

Check if you can boot to modded GRUB.

However, Dell has disabled EFI booting at the firmware level without any method to reenable it (there is no option in the bios). This means that i cannot load a .efi file.

No way. Perhaps the BIOS gives no option to specify a .EFI file to load? Is that what you meant?
The manuf simply could not disable loading files named bootx64 from the EFI/BOOT directory as this is where fresh OS installation starts. An .EFI file can be loaded from shell program, which is also an EFI file, but that's how it should work.

[SlayerProof32]

This problem was solved. As it turns out, using the included SCT flash tool provided with the system bios is way less picky about checksums.

How to do this:

1. Download and run the bios update exe. Unplug the AC adapter so it fails to flash.

2. Go to you temp folder (Win+R --> %temp%) and find the "Winflash" or "ExtractTemp" folder

3. Find Bios.WPH or Spyder.cap, replace it with your image (must be named the same) and relaunch the flashing tool

Note: When replacing a file, you MUST LEAVE THE PROGRAM OPEN or else it will delete the temp folder and/or replace the unmodded bios. It’s ok, you can open 2 instances of SCT flash with no problems.

[SlayerProof32]

What I've found out so far:

- Dell has replaced the standard formset with a custom (limited) one with EFI functionality removed.

- Other Laptops with this No EFI boot issue (Vostro 3450, L702x) do not use these custom forms

- All customized dell bios forms write to a UEFI variable "DellVariable"

- The original formsets that dell replaced still exist but are disabled somehow. These write to two other variables "System" and "Setup"

- GUID 76016....... contains the setup options I want enabled

If someone can help me figure out how to enable the old formsets, let me know. I theorize there is something referring to a GUID of the Dell formsets, however I have not been able to find those pointers.

I attached the image if anyone wants to take a look

[Maxinator500]

Nice news! I'm glad that you've puzzled it out.

[Maxinator500]

If someone can help me figure out how to enable the old formsets, let me know.

There are 3 possible solutions in my collection. Don't know which one matches best to be applied in your case as I did not check the BIOS file provided.
2 of them are specific to Phoenix SCT, and one is universal for all UEFI, except for AMI-based.


1. You can usually swap shown BIOS form sets to others. How to - on THIS WEB PAGE.

2. Not going too far, another method that works with true GUIDs. Instead of replacing form sets, the firmware UI is updated with additional ones. Requires code disassembly.

3. Relatively new and "easy" method of unlocking that, sadly, does not work with runtime patchers yet, but works well when BIOS flashing is allowed. You can create links to form sets.
Check out this pic. Compare the original and patched BIOS files to understand how it works. Source: https://www.bios-mods.com/forum/showthre...#pid186852