(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[kasar]

welcome Paralel


well, there are a backing up method wich at least partially work

download "Universal BIOS Backup Toolkit 2.0" (you can download it from this post as attachment.)

it backup the bios , it cant be used to be flashed, however we can see the modules and everything inside.

also it can be used to be booted from a USB stick as a backup bios to recover main bios from a bad flash.

[TimeWalker]

Hey, welcome aboard. You can read a few pages back about the recovery method. I had initially mentioned a utility which allows you to dump the on-chip BIOS. Assuming you will end up with an F33-like capsule at your hands a padding layer can be added and the F33 capsule should theoretically be posible to upconcert to a wph. Just need to compare the structure of V3450,V3750,15z, L502x,L702x and your 17R to make sure they're identical structure wise. If they indeed are, there's a good chance the above can be done. Also its a wise move to ask dell support (or ppl over at their discussion boards) to provide a BIOS download link for you. DellCares on twitter may be of a help as well.

[Paralel]

I just noticed that the WinFlash64 for Dell 0.5.4 has an option to update microcode built into it. Now I just need a valid microcode file to give it.

The switch in WinFlash64 is -vcpu. It says this about it in the command list:

vcpu [filename] Update variable size CPU microcode.

[Paralel]

I found a BIOS similar to the one in my 17R, it's the BIOS for the 17R-SE, essentially the same system, the only major difference is that it has the Ivy Bridge i7-3630, rather than the i7-3612, but it should be structured the exact same way. That should hopefully tell us what we need to know. Here's the link to it:

ftp://ftp.dell.com/FOLDER00818022M/1/7720A08.exe

The BIOSes for the 17R and 17R-SE seem to be a bit different than the ones for previous Dells (such as the L502X). They use a new set of flash utilities, SCTWinFlash32 and it's associated files (appraently customized for Dell, according to the info when you run WinFlash64), rather than the standard UEFI WinFlash32. The BIOSes for the 17R and 17R-SE are also contained in .CAP files, rather than .WPH.

Here is the link to that screwy BIOS listed for the 17R that doesn't work corrently:

ftp://ftp.dell.com/FOLDER00545802M/1/5720A04.exe

The SCTWinFlash32 utilities in this file are 0.5.4, compared to the ones in the first link which are 0.7.5. The WinFlash 0.5.4 file doesn't seem to be as restricted as the 0.7.5 version. In the 0.5.4 version you can see the hidden commands by using the -helpall switch, which doesn't seem to work on the 0.7.5 version.

Some of the hidden commands are:

dmpgr Dump gated regions
dmppr Dump protected regions

When I tried those I BSOD'd with a SYSTEM_SERVICE_EXCEPTION, figure these might have to be run using the DosFlash utility that's included rather than through Windows.

[TimeWalker]

To run it under DOS you'd need to have FreeDOS installed/loaded up from ext media otherwise no chance it will run on a UEFI BIOS. But nevertheless it's an interesting find, I will take a look when I'm near a computer. Uhm, you can rely on the SE fw to generate an update capsule for your machine based on the structure of the capsule on your hands.

Sent from my LG-P500 using Tapatalk 2

[Brabbelbla]

Hello everyone,

Great work going on so far.

A modded L702X (which I own) A18 BIOS with unlocked menus was mentioned by krzysio30, which I'd like to try to change the boot mode to UEFI. So, I got the WPH file, got WinFlash and know what command to run but am reluctant to flash. So, I wanted to give the recovery sideload a try to see if everything was fine.

I extracted the F33E367F-41D2-4201-9CB7-AFA63DCCEEC9_0_4.ROM from the stock A18 BIOS, removed the first 180000(h) bytes, verified having 16 0x00 bytes before the first character and saved it to BIOS.cap in the root of a FAT32 USB flash drive. Then shut down, disconnected the power cord, pressed and held the End key, reinserted the power cord, released the End key. The thing started, with the power LED blinking, it read the USB drive (LED was blinking for some time) and then the Dell splash screen showed up. I tried both ramming the F2 and the F12 key, but after filling the blue progress bar the system just restarts and then loads the on-chip BIOS again.

Am I doing something wrong or could it just be that the F2/F12 key is not pressed fast enough?

ZIP file containing used .WPH, .ROM and .cap: https://dl.dropbox.com/s/wivfew5fkmx6h9l/Files.zip

EDIT: Even when pressing the F2 or the F12 button in time, and with the text at the right bottom lighting up, the system still resets. Also tried using the on-chip BIOS, extracted with the Universal BIOS Backup tool. Same result.

[TimeWalker]

@Paralel
The utility is definitely newer then what we've seen previously. The functionality however is not that different. The utility is still the same - WinFlash SCT stands for SecureCore Tiano.. the default.rsp is a derived version of old pflash.ini which acts as a startup script to dictate how the rom should be flashed. We do it by hand, just specifying the arguments in series. The BIOS capsule however is HUGE in size.. 13Mb compared to 5Mb on previous generation Dells. Passing it through andy's Phoenix Tool unveils the following:
- Structure wise it's almost the same... just more stuff has been put inside, so .cap is the same as .wph
- The module C8AB0F4E-26FE-40F1-9579-EA8D30D503A4_0_6.ROM is less in size then for previous gen machines.
- The main fw module 6C60EE00-C316-4C95-A684-CDC7E7033311_0_5 is 6.5Mb in size, whereas for previous gen it is 4.12 (my Vostro)
- The initial padding layer is 280000h (2.5Mb -> PADDING-00000000_0_2.ROM) in size opposed to 180000h for previous gen bioses.
- Recovery capsule results as 4Mb file .. mind trying this one to see if the recovery methods still apply to new gen of SCT Dell Phoenix machines? Just to see if the SE version would be compatible with your 17R ... http://www.mediafire.com/?0yyzzjujpfjh0vk
- Strangely enough no hex string for known IFR_SUPPRESS have been found in the Advanced Setup module .. I hadn't looked for ascii strings though, but there may be a fat chance of having no advanced options in this bios at all.

@Brabbelbla
You start to hit either F12 or F2 as soon as the fan stops spinning in the process of loading the bios of off the external media. Not sooner nor later. The capsule appears to be fine. The other person with L702x was trying to follow the steps as well with no apparent success.. see if you get lucky

[Brabbelbla]

@TimeWalker
Which guy do you mean? I could only find krzysio30, and he appeared to be able to at least enter setup, and then presumably boot a usb drive, for instance.
It was you who actually uploaded the modded L702X A18 BIOS, so do you perhaps have any information on its safety or functionality?

[TimeWalker]

@TimeWalker
Which guy do you mean? I could only find krzysio30, and he appeared to be able to at least enter setup, and then presumably boot a usb drive, for instance.
It was you who actually uploaded the modded L702X A18 BIOS, so do you perhaps have any information on its safety or functionality?

I was talking about krzysio30, yes. AFAIK he wasn't able to boot an operating system properly so I consider it a partial success.

It was indeed me (or someone else at the same time) who uploaded the A18 for L702x. As always - no one can guarantee you anything when it comes to BIOS modding. Even if you update from the official updater there is always a chance of bricking.. not to mention you are dealing with a customized bios over here. Something goes off and the machine is screwed. I however did the same modification to the BIOS as I did for my Vostro: PWM, Advanced Setup, Security password lengths (except I didn't fill the 'Below is reserved for RD, not DELLOIL request' string with spaces to eliminate this ridiculous and pointless string of text which goes across your screen) so it should be pretty safe to use.

[Paralel]

@Paralel
The utility is definitely newer then what we've seen previously. The functionality however is not that different. The utility is still the same - WinFlash SCT stands for SecureCore Tiano.. the default.rsp is a derived version of old pflash.ini which acts as a startup script to dictate how the rom should be flashed. We do it by hand, just specifying the arguments in series. The BIOS capsule however is HUGE in size.. 13Mb compared to 5Mb on previous generation Dells. Passing it through andy's Phoenix Tool unveils the following:
- Structure wise it's almost the same... just more stuff has been put inside, so .cap is the same as .wph
- The module C8AB0F4E-26FE-40F1-9579-EA8D30D503A4_0_6.ROM is less in size then for previous gen machines.
- The main fw module 6C60EE00-C316-4C95-A684-CDC7E7033311_0_5 is 6.5Mb in size, whereas for previous gen it is 4.12 (my Vostro)
- The initial padding layer is 280000h (2.5Mb -> PADDING-00000000_0_2.ROM) in size opposed to 180000h for previous gen bioses.
- Recovery capsule results as 4Mb file .. mind trying this one to see if the recovery methods still apply to new gen of SCT Dell Phoenix machines? Just to see if the SE version would be compatible with your 17R ... http://www.mediafire.com/?0yyzzjujpfjh0vk
- Strangely enough no hex string for known IFR_SUPPRESS have been found in the Advanced Setup module .. I hadn't looked for ascii strings though, but there may be a fat chance of having no advanced options in this bios at all.

@Brabbelbla
You start to hit either F12 or F2 as soon as the fan stops spinning in the process of loading the bios of off the external media. Not sooner nor later. The capsule appears to be fine. The other person with L702x was trying to follow the steps as well with no apparent success.. see if you get lucky

Sounds good. I'll give it a shot sometime between tonight and the next few days. Life, always gets in the way of useful hacking.

The 17R & L502X are both under warranty, so, worst comes to worst, Dell will have to fix it. I don't really have anything to lose.