Forum RSS Feed Follow @ Twitter Follow On Facebook

Thread Rating:
  • 11 Vote(s) - 4.64 Average
  • 1
  • 2
  • 3
  • 4
  • 5
[-]
Welcome
You have to register before you can post on our site.

Username:


Password:





[-]
Latest Threads
[REQUEST] Bios Unlock Asus ROG GL552VW
Last Post: retryer
Today 01:31 AM
» Replies: 123
» Views: 72226
Bricked Ms-16j9
Last Post: Venor
Yesterday 07:49 PM
» Replies: 0
» Views: 60
[REQUEST] Lenovo Thinkpad X1 Carbon Gen3...
Last Post: Dudu2002
Yesterday 03:12 PM
» Replies: 36
» Views: 14827
Sony Vaio AW11Z - Support for Quad CPU -...
Last Post: BootlegScarce
Yesterday 01:16 PM
» Replies: 9
» Views: 3508
Dell XPS 8900 bios mod - Requesting Kaby...
Last Post: Dragzilla66
Yesterday 04:15 AM
» Replies: 2
» Views: 247
MBX-160 , Rev: v1.1 , Chipset: Intel 945...
Last Post: dma
10-29-2024 10:10 PM
» Replies: 16
» Views: 13874
HOW TO FLASH MODIFIED OR ORIGINAL BIOS
Last Post: dma
10-29-2024 10:01 PM
» Replies: 19
» Views: 67713
[REQUEST] Lenovo IdeaPad Z510 (8DCNxxWW)...
Last Post: autism86
10-29-2024 03:56 PM
» Replies: 18
» Views: 8192
Optiplex 7060 SFF 9th Generation Intel C...
Last Post: peter123
10-29-2024 03:54 PM
» Replies: 61
» Views: 16227
[Request] eMachines EL1200-05w Bios Unlo...
Last Post: LePhoenixReborn
10-29-2024 03:12 PM
» Replies: 0
» Views: 99
[REQUEST] Lenovo G40-70 (9ACNxxWW) White...
Last Post: Dudu2002
10-29-2024 09:15 AM
» Replies: 37
» Views: 11591
[REQUEST] Lenovo B490 (H9ETxxWW) Whiteli...
Last Post: staroface
10-29-2024 03:08 AM
» Replies: 4
» Views: 1294
Acer Veriton M480 (G43T-AM4) and Core 2 ...
Last Post: DeathBringer
10-29-2024 01:09 AM
» Replies: 3
» Views: 164
Asus M5A99FX EVO R2.0 Bios
Last Post: ChenZhen
10-28-2024 09:44 PM
» Replies: 0
» Views: 155
[REQUEST] Lenovo G50-70 (9ACNxxWW) White...
Last Post: Dudu2002
10-28-2024 04:42 PM
» Replies: 235
» Views: 87096
Asrock ALiveNF6G-DVI AM3 support mod
Last Post: vorobaz
10-28-2024 02:12 PM
» Replies: 29
» Views: 18187
[REQUEST] Asus ROG Strix G15 G513QM Lapt...
Last Post: elfametesar
10-28-2024 06:12 AM
» Replies: 2
» Views: 729
[REQUEST] Asus ROG Strix G512LW BIOS Unl...
Last Post: Melzas
10-28-2024 02:48 AM
» Replies: 14
» Views: 3659
[REQUEST] Can I enable my integrated GPU...
Last Post: SplatPie
10-27-2024 01:20 PM
» Replies: 0
» Views: 131
[REQUEST] ECS G41T-TM Bios Mod ~ unique ...
Last Post: Akash453
10-27-2024 12:10 PM
» Replies: 20
» Views: 7958

(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO
Hey Ahmed

Hope you're well. Have you had time to peek at the ROM?
I've spent some time this afternoon, and I think we're getting closer, but I need your help with something:

off_41504:
lea r9, off_310c0 <- possible index table?
lea r8, off_3e0 <- string index to all "Advanced" settings
lea rdx, qword_2f0 <- another possible table?
lea ecx, [rbx+2] <- rbx is set to arg_0 at the beginning of the subroutine

From your experience, how are the index tables usually set up, and how long would they be as a sequence in the file? Would it make sense to modify off_310c0 or qword_2f0 (or the locations they point to respectively), and if so, to what?

Cheers
jkbuha
find
quote
i`m busy these days as i have started the 2nd term in my college , but i will have some time to look into this today and tomorrow Smile
i can answer some questions before i look into this .......... the index table is working like a pointer to a string ( in c++ ) like this :-

15 07 00 00 19 07 00 00 05 06 00 00 ....... etc . 15 07 is 0715 ( endian format ) and this is the string offset in the file ....... if you got to offset 0715 , you will find a string in the BIOS like ADVANCED or any other word .
the 00 00 seperates between the offsets in this index ......... 15 07 ( 0715 ) is a word and 1907 ( 07 19 ) is another word and so on ........... sothat strings table is like this .

the strings table can`t hide any options or menus , its just pointing to it no more .......... the menu structure itself may have specials bytes working as flags telling that this menu is hidden or not and as a result determine if the BIOS will show it or not ( and this is what we are looking for now ) so , we should knew where is the strings table and where are the pointers inside the index is called ( sure its only called from menu ) if we found this , then we begin to play with the bytes there to find out the one reponsible for hiding the menu .


"Many of life's failures are people who did not realize how close they were to success when they gave up." Smile
find
quote
(02-24-2012, 01:45 PM)AHMED HOSSAM Wrote: i`m busy these days as i have started the 2nd term in my college , but i will have some time to look into this today and tomorrow Smile
i can answer some questions before i look into this .......... the index table is working like a pointer to a string ( in c++ ) like this :-

15 07 00 00 19 07 00 00 05 06 00 00 ....... etc . 15 07 is 0715 ( endian format ) and this is the string offset in the file ....... if you got to offset 0715 , you will find a string in the BIOS like ADVANCED or any other word .
the 00 00 seperates between the offsets in this index ......... 15 07 ( 0715 ) is a word and 1907 ( 07 19 ) is another word and so on ........... sothat strings table is like this .

the strings table can`t hide any options or menus , its just pointing to it no more .......... the menu structure itself may have specials bytes working as flags telling that this menu is hidden or not and as a result determine if the BIOS will show it or not ( and this is what we are looking for now ) so , we should knew where is the strings table and where are the pointers inside the index is called ( sure its only called from menu ) if we found this , then we begin to play with the bytes there to find out the one reponsible for hiding the menu .

I think we have already found the index to the strings table: lea r8, off_3e0. What I'm not sure of is how big the index table should be (eg: 2/3/4/6/10 bytes per menu item?) off_310c0 and off_2f0 both have what looks like pointer tables, but in my opinion they look far to small to contain info for all the menu items.

I think 3e0 is the start pointer to the top of the strings table, and another register is responsible for advancing the pointer offset gradually down the table. If I'm correct there also should be another register pointing to another "menu" table to determine whether this menu is english/french, on/off, hardware dependent etc

It's a real shame we can't emulate the bios under some run-time environment. Unlocking all this would take sooooo much less time!

Cheers
jkbuha

find
quote
Hi Jkbuha ,

Sorry for my late response , i had started reading the UEFI spec. documentation to find out how this works .......... it will take some time to knew this .
also , this is not the strings table and its still unknown till now ............ strings table will be much longer from this and will not be in this address .
currently , no simulation tool for the UEFI BIOS is available ...... we have to do it the hard way Smile

Thank you,
Ahmed


"Many of life's failures are people who did not realize how close they were to success when they gave up." Smile
find
quote
(03-06-2012, 02:44 PM)AHMED HOSSAM Wrote: Hi Jkbuha ,

Sorry for my late response , i had started reading the UEFI spec. documentation to find out how this works .......... it will take some time to knew this .
also , this is not the strings table and its still unknown till now ............ strings table will be much longer from this and will not be in this address .
currently , no simulation tool for the UEFI BIOS is available ...... we have to do it the hard way Smile

Thank you,
Ahmed


Hey Ahmed

Thanks for this - I too downloaded & reviewed the UEFI spec too (note: on Dell UEFI Laptops its currently impossible to boot to a UEFI shell unless we manage to unlock this in some way). My concern is that finding the strings table is less of a UEFI design and more of Dell or PhoenixTiano's way of implementing specific functionality in their BIOSes. I think we need to look further at Dell/Phoenix and how they've done this elsewhere, if that makes sense?

jkbuha
find
quote
(03-11-2012, 11:05 AM)jkbuha Wrote: Hey Ahmed

Thanks for this - I too downloaded & reviewed the UEFI spec too (note: on Dell UEFI Laptops its currently impossible to boot to a UEFI shell unless we manage to unlock this in some way). My concern is that finding the strings table is less of a UEFI design and more of Dell or PhoenixTiano's way of implementing specific functionality in their BIOSes. I think we need to look further at Dell/Phoenix and how they've done this elsewhere, if that makes sense?

jkbuha

Here in my CCE 746LE+ i can boot into the UEFI shell. Bios type is SecureCore Tiano from phoenix if i can do anything for you folks just ask
find
quote
(03-11-2012, 03:54 PM)dkinsano Wrote: Here in my CCE 746LE+ i can boot into the UEFI shell. Bios type is SecureCore Tiano from phoenix if i can do anything for you folks just ask

Yes please - any extra info at this stage would definitely be useful Smile
find
quote
Hi Ahmed

Further to my post above, I've done some research - would this be of any help?
http://wiki.phoenix.com/wiki/index.php/E...TION_TABLE

jkbuha

find
quote
Sorry all for delay but have been busy on some other (non-IT related) stuff.
I've noticed that Dell have slipped an update for the 15z on their FTP site so I've modded it as well. Fan seems to work quieter - which is nice.

@Ahmed - I could really use your help on unlocking this UEFI, if you have time.

jkbuha
find
quote
I`m still up for helping you unlocking UEFI but i`m just very busy in my studies and hardly find time for researching UEFI ........... i have reached another few results about strings index but i try to find out more to make sure of it ....... i will post again in 4 or 5 days showing all new results Smile


"Many of life's failures are people who did not realize how close they were to success when they gave up." Smile
find
quote


Forum Jump:


Users browsing this thread: 11 Guest(s)