(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[TimeWalker]

http://downloadcenter.intel.com/Detail_D...ldId=20592
here are the contents:

See the readme .. which is an interesting read.

FVMAIN.FV is the main file that needs to be present in order to start the system to the recovery image.
If this file is missing, there will be NO DISPLAY, the system will be ON, the POST LED will light up but nothing will happen.

So once the system finds the file FVMAIN.FV onto the EFI bootable media (usb fat formatted or El Torito CD Image), it will then boot the system automatically into the EFI Shell which will look for the Startup.nsh script file.

The bios is updated through the usual method which will need the iFlash32.efi file and the .CAP file which is the BIOS package.

Why do I mention this?
Because there's this subversion changelog ...

1.5.61.0
Bug fix:
Bugzilla 16420 - Shell Flash
BIOS cannot keep the 2 passwords after the USB Key Crisis Flash (Fvmain.fv).

I'm still not at home, so I'm unable to see which is the version of the EFI used on Intel Desktop boards, but it must have it's origins from Tianocore EDKII whihc SecureCore Tiano is based of off.. So the contents of the .fv file are interesting for us.

[kasar]

got it

thanks!

[TimeWalker]

We have to first invoke something basic before trying the pflash.efi .. like a startup.nsh with just a ver > ver.txt command (or similar basic stuff that is knows to the embedded shell) in order to make sure it can run the startup script. Because otherwise there is no point in even having the Pflash.efi on the stick .. we will be running it from the script with some args to it, so basically the system won't complain if it's absent. According to the stuff found in the readme for the Intel boards it won't do anything until you place a FVMAIN.FV into the root of the flashrive. I have found that it will be platform specific ..

[components]
$(PLATFORM_PATH)\...\OptionRom\OemOpRom.inf FV=FvMain

#define PEI_FAT_RECOVERY_CAPSULE_WITH_NT_EMULATOR L"fv0001.fv"
#define PEI_FAT_RECOVERY_CAPSULE_WITHOUT_NT_EMULATOR L"fvmain.fv"
found in http://feishare.com/edk2doxygen/df/d26/_...ource.html

Will compare wether the Intel one uses this name in FatLitePei .. whereas our Tiano uses BIOS.cap as we've seen previously..

[TimeWalker]

Meh, basically we can't even run PFlash.efi /? or PFlash.efi /back:backup.fd if the proper BIOS.cap (or some other name) .. is not on the USB media. In order to even call the help function we will have to figure a proper file. That's why Packard Bell's document was referring to it.

EFI_NOT_FOUND, If: boot mode could not be determined, or the boot mode is not flash-update, or the capsule descriptors were not found.

Also the underlined part can be the reason .. but I don't quite feel like flashing anything I'm not even sure is flashable.

[jwhirl06]

Flashed the bios, errored out at the end had to disconnect and reconnect the battery, upon rebooting I went into the bios and lo and behold it took. One thing I do notice is that some of the settings do not stick. Is there an overclock option anywhere in there? And thanks for all the effort I appreciate it.

[TimeWalker]

WEll, basically these are possible...
The Minimal Configuration = Quick Boot ..
Recovery is triggered by the End key, the Flash Update on the other case is triggered by loading the capsule into memory and entering S3 state (sleep) and waking up the machine those resulting in flash update procedure start (notice how power button LED blinks firmly when you flash the bios and the machine reboots into Shell Flasher) - which is what me and DoiX experienced previously by putting the machine to sleep and somehow triggering the flash update ..

[TimeWalker]

you guys, I think I finally have something ...
I think the theory about the "temporary BIOS from external media" is correct, unless it's some kind of a crash that it experiences along the way.

1. I got hold of utility called "Universal BIOS Backup Toolkit 2.0" and dumped my actual on-chip (SPI) BIOS, which is exactly 2.50 Mb in size as the chip can hold only this much (not like on desktop boards when they are 64Mb). The program warns you that the actual dump can be incorrect, so I would assume a dump from WinFlash (BIOS.bak) would be definitely more prone to errors... because for me this program assumes I have an Award BIOS, even though the rest of the info is correct.

I renamed the file that it has created from DellInc.-A04.rom to BIOS.cap and placed it in the root of my USB flasdrive formated as FAT32.

2. I had created a set of folders EFI/BOOT of the USB drive. Created a startup.nsh script and placed it in the root and in the BOOT folder as well.
The contents of it are simple, just:
fs0:
ver > ver.txt
.. in order to test if it will execute. (turns out it doesn't or the fs0: mount point is incorrect). I should point out that I also had shell.efi (Interactive Phoenix 2.0) named as bootx64.efi in the /BOOT folder.

3. I cut the power to the laptop, unplugged the power lead and plugged it back in with the usual technique - holding the End key and letting it of as soon as the plug was inserted. The machine powered on with fans at full speed and blinked the USB drive LED for longer that I expected. Suddenly the fans stopped and I felt butterflies in my stomach lol .. but then it just blinked the 3 QuickSet buttons at me powered on the screen, showed up the Dell splash and proceeded to boot windows like nothing happened.

4. Just to make sure it wasn't tripping on bootx64.efi in EFI/BOOT and going to 5sec countdown and then blindly rebooting I have deleted the shell from the drive, leaving the BIOS.cap and startup.nsh (2x in different folders) in place. And it did the same thing - started booting Windows after ~ 10 seconds of LED light blinking and a couple of seconds Idleing ..

Could someone try repeating my actions?

Anyways .. it's 1AM and I have a test tomorrow

[kasar]

woot, I can confirm this worked for me

my setup:

l502x with modded a11 bios installed

FAT formated usb drive with BIOS.cap at the root (I used a old unmodded A07 backup I obtained some time ago using the universal tool you said)

1 - laptop turned off
2 - disconnected all perihpericals including battery and charger.
3 - plugged the usb drive on the laptop.
4 - hold END key
5 - pluged the powercord and relase the END key 1 second after the power cord is in.
6 - Fans started to spin fast, power led blinked fast, and the usb too.
7 - bios showed up ^^

to ensure it worked, I repeated the whole process by hitting F2 key to enter at the setup while the bios was booting from the usb drive,then it entered at the setup menu, and it definitly was the unmodded A07 version!!!

rebooted the machine, entered in bios setup and the a11 modded version was there ^^
all settings was cleared to default for some reason.

I supose this is the solution because this seems to load temporally a bios from the usb, letting you to boot windows and run the flasher in order to repair the real bios

very nice find man!

we have finally recovery!

the next steep is find someone with a bricked computer and tell him to test this

well, another option is flash one of jkbuha xps15z bios on my xps15 laptop to brick it like other users actidentally did and test it then, but well, I preffer the first option I think ^^

but Im almost sure it will work, once we get this confirmed we can start with more agresive mods to the bioses

[TimeWalker]

woot, I can confirm this worked for me

my setup:

l502x with modded a11 bios installed

FAT formated usb drive with BIOS.cap at the root (I used a old unmodded A07 backup I obtained some time ago using the universal tool you said)

1 - laptop turned off
2 - disconnected all perihpericals including battery and charger.
3 - plugged the usb drive on the laptop.
4 - hold END key
5 - pluged the powercord and relase the END key 1 second after the power cord is in.
6 - Fans started to spin fast, power led blinked fast, and the usb too.
7 - bios showed up ^^

to ensure it worked, I repeated the whole process by hitting F2 key to enter at the setup while the bios was booting from the usb drive,then it entered at the setup menu, and it definitly was the unmodded A07 version!!!

rebooted the machine, entered in bios setup and the a11 modded version was there ^^
all settings was cleared to default for some reason.

I supose this is the solution because this seems to load temporally a bios from the usb, letting you to boot windows and run the flasher in order to repair the real bios

very nice find man!

we have finally recovery!

So it's official. Thanks for testing, kasar! That's what I was going to do - test with different versions in order to see if it actually side-loaded the version from the usb drive as a temporary - turns out it does... but I didn't feel like flashing a different version at 1AM just to verify this.

Also I've noticed it resets CMOS those reverting everything to default on the actual on-chip BIOS in case something weird was going on with your machine.

We need some more input from the thread guys and we could propose the method over at MDL forums to andyp, so he could potentially make the Phoenix tool assemble the BIOS.cap for a particular laptop providing just the BIOS1.WPH from the OEM installer. That'd be cool to have .. because most people brick by accident and wouldn't have a backup at their hands ..

After almost 10 month we have a somewhat settled way of unlocking custom stuff along with a recovery method if case things go totally wrong.

Cheers!

[TimeWalker]

Ok, I've figured how the capsule is made.. we don't need the original on-chip bios.

1. Extract the BIOS1.WPH from the OEM updater
2. Take the F33E367F-41D2-4201-9CB7-AFA63DCCEEC9_x_x.ROM
a) Use any HEX editor of your choice and remove the first 180000h bytes of the file, it's the initial padding layer. There should be 16 zero (0x00) bytes left before the first symbol.
b) Extract the F33E367F-41D2-4201-9CB7-AFA63DCCEEC9_x_x.ROM using Phoenix Tool again, set the Manufacturer as Dell, press Advanced button, confirm with Yes .. enable the option to be able to alter the contents of the rom. Press Go, wait for the prompt .. Go to the DUMP folder and remove PADDING-00000000_x_x.ROM which is usually ~1.536 Mb in size. Press OK and wait until Phoenix tool finishes. You will end up with a F33E367F-41D2-4201-9CB7-AFA63DCCEEC9_x_x_SLIC.ROM in the same directory which will be by 0.1 Mb bigger than your on-chip bios image. Rename it to BIOS.cap and place in the root of FAT32 formatted flashdrive
3. Cut the power to the laptop, unplug the AC and leave the battery in place. Press and hold the End key, insert the AC plug back in and let go of the End key. In ~ 20 seconds you will be booting into your favorite operating system.

The 2a. option is far easier .. at least for me, so this is the one I've used. Someone try the second one and confirm if it's plausible.

On-chip BIOS v.s. USB-based BIOS: