(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[ryan_975]

Yes, except that I cannot find any of the GUID files that are referenced from the push statement

for instance, push 73 B7 41 E5....8F
I can't find a 73B7....ROM, or a B773....ROM, or any combination, big or little-endian.
Do you know how variables in the stack are dimensioned (single byte, double, quad etc)?

They're not necessarily file GUIDs. They are more likely to be the GUID of the protocols published by the modules while they're executing. You'll have to search contents of the main .rom files (the ones starting with MZ).


Accoding to the PEI and DXE spec, the structure is dword-word[2]-byte[8]. So only the first part would be little endianed, while the last 8 would be big-endianed.

If so {000a010b-020c-030d-040e-101a121b131c} would be stored as

0b 01 0a 00, then 0c 02 and 0d 03, and finally 04 0e 10 1a 12 1b 13 1c

[jkbuha]

Ok let's see if I understand this properly, and please let me know if I haven't.

The setup browser utility module is CFEF94C4-4167-466A-8893-8779459DFA86(_1_xxxx.ROM). The _2_xxxx.ROM doesn't have any GUID calls (neither does the _0_). In theory then, it shouldn't have any GUID dependencies itself, but it may actually publish some itself in the main module (_1_). Seeing as the only publishing in the module appears to be the GUID of the file itself (CFEF94C4-4167-466A-8893-8779459DFA86) I then did a cross reference in all the rom dump files to find any other module that accesses this dependency (search C494EFCF dword) but the only module that comes up is the setup browser utility itself! Is this reasoning correct, that the setup browser has no dependencies, and no other modules depend on the setup browser?

[ryan_975]

How did you deduce that the only publishing done in the program was the file's GUID?

BTW, I'm learning this as I go. So don't take what I say as solid fact, only as it being the way I understand what I'm reading from the specifications and finding in the dumped files. So I may be totally off in left field on any or all of this.

[jkbuha]

Quite simple. I used this method.

1) Take a module which publishes only one dependency - eg: 0c7f41a9-0a6f-43f6-a0d9-1e2d01dbd7be_2_xxxx.ROM
2) Extract the dependency: 02 (12 4c ce 96 e4 55 1c 4a bb f3 73 a5 05 5f b3 64) 08 - corresponds to 96ce4c12-55e4-4a1c-bbf373a5055fb364
3) Search through all the roms which have a call for this dependency - there are 7 modules which reference this depex

So the above process works. You were right about depex publishing.

Now verifying for main bios module:

1) Check to see if main bios module has similar depexs (in _0_, _2_ ROMS - nothing)
2) Search through bios module to see if any depexs are referenced (using IDA) - only one: CFEF94C4-4167-466A-8893-8779459DFA86
3) Search all modules for this (dword-double-endian) GUID, only 1 module: CFEF94C4-4167-466A-8893-8779459DFA86

[ryan_975]

Ok, bear with me here. I work nights and it's now almost 12pm where I am, so I'm getting a bit slow.

What do you mean by "main bios module"?

[jkbuha]

Ok, bear with me here. I work nights and it's now almost 12pm where I am, so I'm getting a bit slow.

What do you mean by "main bios module"?

Sorry - my untechnical english.

I meant the setup browser utility (SBU) module - CFEF94C4-4167-466A-8893-8779459DFA86(_1_xxxx.ROM). So the SBU module appears to be publishing only one depex in its main code, that is only referenced by itself, unlike, say 0c7f41a9-0a6f-43f6-a0d9-1e2d01dbd7be_2_xxxx.ROM, which publishes a depex that is used by 7 other modules.

[ryan_975]

oops.. I just made a dumb move. My laptop's going to be dead for a couple days now... At least now I know ONE of those Dell DXE's are required to boot.

[jkbuha]

oh bad luck dude what did you do??
how do you intend to bring it back - replacement or do you have a bios recovery method?

[ryan_975]

I removed all the Dell named DXE modules to see if maybe there was some default drivers that were being blocked by Dell's. The laptop still boots.. to a point. but I'm guessing one of those modules contain the OS boot handoff. So it just sits there with a blank screen. (It does access my USB drive, and tests the hard drive. Plus Ctrl-Alt-Del resets the system. So it's not completely dead, just confused.

As for recovery, I'm going to take the backup battery out to see if maybe there's some residual configuration settings causing it to hang, if that doesn't work, and no other known recovery method works, I'll have Dell overnight me a new motherboard thanks to their expensive Accidental Damage program I

[jkbuha]

hmmm - sorry to hear that ryan.
I heard you can put the original BIOS.WPH file on a bootable USB and PhoenixDell will read it on bootup, but I've never managed to activate this function successfully. You might have better luck

Good luck with the replacement/recovery!