(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[Brabbelbla]

I noticed that with the TRIM modification (if it works) my UEFI Clover boot entry doesn't work, while with the same version, umodified, it does work. Adding the entire drive as a boot option works, though.

Furthermore, against better judgement, I tried to get some TPM functionality. "Current TPM state" remains "Unknown", so it really isn't there. I did notice another option on the Security tab, "Flash Controller Lock", which is enabled by default. Sounds fancy, but I don't know what it does and don't think I will need it, could it have to do something with the descriptor locks that were so nasty with ME modding? And I once said something about Intel AMT and hardware, I read now that actually ME has its own processor, so maybe AMT is reachable. On that menu there is a setting called "Unconfigure ME", interesting maybe?

@kasar
You once said something about integrating the XTU modules. Have you tried that? There is mention of a variable store XtuNv7 on in advanced setup module.

[kasar]

well, I just replaced existing modules, but never integrated newer modules wich wasnt there before (allways needed existing or older modules), I dont know how to integrate new modules, I also asume you will have to "link" them to somewhere in order to load them at system start, I basically have no idea.

however I had sucess while flashing a modded ME region, wich enabled BCLK overclocking at intel XTU software.

well, I has been away for a few weeks, so I didnt noticed about most changes.

anyway , I see you unlocked an option wich says "Flash Controller Lock" and you can disable it.

this can be really interesting if that option unlock the descriptor without the need of mess with the hardware like I did.

I attached fptw64 to this post.

can you post the result of the "fptw64.exe -i" command output with both "Flash Controller Lock" settings enabled and disabled?
you can just run the show info.bat script

[forsaken123]

Im trying to revert back to an older bios, i have a lenovo u310. however winflash says "can not open firmware device file" i removed the dellbios file and put my own lenovo bios file and renamed it BIOS1.wph, its a .wph originally. is it something more i have to do to make it work? change the bios.cap perhaps?

Awesome recovery iso btw, a real fine job.

I just tested the whole procedure and it worked like a charm

procedure.

1- bricked laptop, my recovery cdrom inside the cdrom.
2- power cord unplugged, you press end button.
3- you plug the power cable, and then you relase the end button.
4- the bios start reading the cdrom, it load BIOS.cap file from the cdrom.
5- you have to hit f12 fast when the dell screen is at the screen, it will bring the device boot menu, then select cdrom.
6- windows xp is loading.
7-when you are at the main screen, click no on the network message box. then click the go button and click "Command Prompt(CMD)" open a cmd prompt. and type "repair" without the quotes, that will launch my main script (Dont close the CMD window, it still needed to reboot the system.)
8- follow the script instructions, it is a little modified script from my main custom bioses.
9-since the automatic reboot didnt worked for the winflash in that boot cd, my script will do it, just wait after the winflash window is closed and the system will autorestart.
10-black screen for some seconds and the flashing screen will appear , woot

I noticed I was unable to get this working by conecting the cdrom via the esata port, so I had to remove the second hdd caddy I installed and plugged the dvd-rom drive in its original location, then it worked like a charm





















and here is the download link of the image

warning: this recovery package is only for the l502x system, it you have another system ISO modifications will be needed!

recovery cd image: L502X BIOS Recovery package 1.0

here is the app I used to edit the iso file ^^

http://www.mediafire.com/file/gjomz3fenz...6.2750.zip

[kasar]

@forsaken123

bios.cap file is only required for the recovery mode, allowing the machine to boot up loading a temporal bios from the bios.cap file instead from the motherboard flash.

I would try the flasher from your laptop official drivers/bios updates page.

however if the older update is already a wph file, it should work fine with winflash.

if you are trying to flash a older version, try the /v and /svs parameters

Phoenix WinFlash for UEFI Command Options

This section lists WinFlash command options and parameters.

Syntax

WINFLASH [options] [romfile] [@rspfile]


romfile The new BIOS image name, eg: BIOS.FD
@rspfile The response file (PFLASH.RSP by default) contains all command parameters in text format.

/? or /help or /h Displays help screen
/all Flash the entire image including the descriptor region
/bak:filename Backup ROM to a file.
/bbl Program the boot block. By default, bootblock is not updated.
/bios Flash the BIOS region
/cs Verify BIOS.FD image checksum
/cvar Clear variables
/console Console mode (only progress bar)
/desc Flash the descriptor the region
/dmctring Specify chassis manufacturer DMI string
/dmmtring Specify motherboard manufacturer DMI string
/dmstring Specify system manufacturer DMI string
/dpctring Specify chassis asset tag number
/dpmtring Specify motherboard product ID DMI string
/dpstring Specify system product ID DMI string
/dsctring Specify chassis serial number DMI string
/dsmtring Specify motherboard serial number DMI string
/dsstring Specify system serial number DMI string
/dustring Specify UUID DMI string
/dvctring Specify chassis version DMI string
/dvmtring Specify motherboard version DMI string
/dvstring Specify system version DMI string
/ec Flash the EC region
/exit Exit without rebooting
/gbe Flash the GbE region
/hash ??
/ls Reserve logos in BIOS ROM
/logo:imagefile Replace the BIOS logo with an imagefile in jpeg or bmp format.
/me Flash the ME region
/mfg Manufacturing mode. Automatically reboots without the need for pressing a key.
/mod:filename Updates the module in the BIOS with the module contained in the file (such as /MOD:vga.ffs); the rest of the BIOS image remains unchanged.
/mode=n Specify dmi mode n = {0, 1, 2, 3}
0: Just update BIOS with new file, don’t update DMI variables.
1: Just update DMI variables, keep ROM BIOS as before.
2: Update BIOS, merge ROM DMI variables with command line(default).
3: Update BIOS, merge image variables with command line.
/noflash Perform all steps that do not update the flash part
/p Production mode (minimize messages and delays)
/pfaefv:filename Loads and runs PFAE modules in specified volume file
/raw:uuid:filename Replace the RAW module content.
/remote2 Execute WinFlash without GUI, allowing other applications or other computers to call WinFlash.
/ro[=name] Read contents of flash part and save to a file.
/v Verify each block after programming it.
/vcpu:filename Update variable size CPU micocode
/vbl Show warning for Microsoft Bitlocker
/sm Skip all WinFlash messages
/swm Skip all WinFlash warning messages
/sd Skip BIOS date check.
/sn Skip BIOS part number check.
/sp Skip BIOS product code check.
/sv Skip BIOS version check.
/svs Skip BIOS same version check.
/sa Skip all BIOS checks.

/slp:filename Replace SLP marker (bin size=182 octets)
/spu:filename Replace SLP pubkey (bin size=156 octets)
/ss Use current SLP

[forsaken123]

So i got this far:

anyways, failed at last stage

but how is it possible it says invalid bios image when its the original stock from the lenovo support page? unbelivable..

This is the bios file im trying to flash: 65cn21ww.wph U310 BIOS

@forsaken123

bios.cap file is only required for the recovery mode, allowing the machine to boot up loading a temporal bios from the bios.cap file instead from the motherboard flash.

I would try the flasher from your laptop official drivers/bios updates page.

however if the older update is already a wph file, it should work fine with winflash.

if you are trying to flash a older version, try the /v and /svs parameters

Phoenix WinFlash for UEFI Command Options

This section lists WinFlash command options and parameters.

Syntax

WINFLASH [options] [romfile] [@rspfile]


romfile The new BIOS image name, eg: BIOS.FD
@rspfile The response file (PFLASH.RSP by default) contains all command parameters in text format.

/? or /help or /h Displays help screen
/all Flash the entire image including the descriptor region
/bak:filename Backup ROM to a file.
/bbl Program the boot block. By default, bootblock is not updated.
/bios Flash the BIOS region
/cs Verify BIOS.FD image checksum
/cvar Clear variables
/console Console mode (only progress bar)
/desc Flash the descriptor the region
/dmctring Specify chassis manufacturer DMI string
/dmmtring Specify motherboard manufacturer DMI string
/dmstring Specify system manufacturer DMI string
/dpctring Specify chassis asset tag number
/dpmtring Specify motherboard product ID DMI string
/dpstring Specify system product ID DMI string
/dsctring Specify chassis serial number DMI string
/dsmtring Specify motherboard serial number DMI string
/dsstring Specify system serial number DMI string
/dustring Specify UUID DMI string
/dvctring Specify chassis version DMI string
/dvmtring Specify motherboard version DMI string
/dvstring Specify system version DMI string
/ec Flash the EC region
/exit Exit without rebooting
/gbe Flash the GbE region
/hash ??
/ls Reserve logos in BIOS ROM
/logo:imagefile Replace the BIOS logo with an imagefile in jpeg or bmp format.
* forsaken123 Flash the ME region
/mfg Manufacturing mode. Automatically reboots without the need for pressing a key.
/mod:filename Updates the module in the BIOS with the module contained in the file (such as /MOD:vga.ffs); the rest of the BIOS image remains unchanged.
/mode=n Specify dmi mode n = {0, 1, 2, 3}
0: Just update BIOS with new file, don’t update DMI variables.
1: Just update DMI variables, keep ROM BIOS as before.
2: Update BIOS, merge ROM DMI variables with command line(default).
3: Update BIOS, merge image variables with command line.
/noflash Perform all steps that do not update the flash part
/p Production mode (minimize messages and delays)
/pfaefv:filename Loads and runs PFAE modules in specified volume file
/raw:uuid:filename Replace the RAW module content.
/remote2 Execute WinFlash without GUI, allowing other applications or other computers to call WinFlash.
/ro[=name] Read contents of flash part and save to a file.
/v Verify each block after programming it.
/vcpu:filename Update variable size CPU micocode
/vbl Show warning for Microsoft Bitlocker
/sm Skip all WinFlash messages
/swm Skip all WinFlash warning messages
/sd Skip BIOS date check.
/sn Skip BIOS part number check.
/sp Skip BIOS product code check.
/sv Skip BIOS version check.
/svs Skip BIOS same version check.
/sa Skip all BIOS checks.

/slp:filename Replace SLP marker (bin size=182 octets)
/spu:filename Replace SLP pubkey (bin size=156 octets)
/ss Use current SLP

[kasar]

what was exactly the update procedure for your system?

I mean, when updating to a newer bios, did winflash appear in the proccess?

well, you can add some other parameters, that may skip some bios checks, but its better to ensure you are doing it exactly like the normal update proccess, try flash the current or latest bios for your system, and while updating, check the command line/parameters and apps wich use it by checking the taskmanager, thats how I found my bios parameters and flasher.

I got the flasher from windows temporal files when I was doing a official update

[forsaken123]

the orginial bios is a installer, it extract itself to c:\bios then runs a file called swbios.exe which creates a temp folder in windows with winflash and the bios.wph, the default.rsp contains this parameters: /sd /force /silent /ipf bios ec /bkfp /file 65CN21WW.WPH adn the winflasher that is used is


This is the files to my Current bios:
Command line for current Bios in default.rsp: /sd /sn /force bkfp bkoa3 /ipf bios ec /file 65CN99WW.cap


pretty much exact same thing i did but automaticly, there is no cmdprmpt showing only the winflash window in the post above, however if im right its gives me the same error as when using dosflash.exe in dos, "ERROR 233 - Only secured capsule is allowed on a SecureFlash system! Status = 1"

I see now also that the files differ from eachother, however the 65cn99ww did just fine when it flashed for the first time, could it be if the 65cn21ww.wph was converted into .cap or .bin it could work?

this is how the original installer looks like: http://download.lenovo.com/consumer/mobi...cn21ww.exe


did a cmdprmpt with the winflash32.exe and found this with the cmd -help:



Currentbios winflash64.exe -help parameters

what was exactly the update procedure for your system?

I mean, when updating to a newer bios, did winflash appear in the proccess?

well, you can add some other parameters, that may skip some bios checks, but its better to ensure you are doing it exactly like the normal update proccess, try flash the current or latest bios for your system, and while updating, check the command line/parameters and apps wich use it by checking the taskmanager, thats how I found my bios parameters and flasher.

I got the flasher from windows temporal files when I was doing a official update

[Brabbelbla]

I don't know what it all means, but is seems FPT output is the same...

With Flash Controller Lock enabled:

Intel ® Flash Programming Tool. Version: 8.1.10.1286
Copyright © 2007 - 2012, Intel Corporation. All rights reserved.

Platform: Intel® HM67 Express Chipset
Reading HSFSTS register... Flash Descriptor: Valid

--- Flash Devices Found ---
W25Q32BV ID:0xEF4016 Size: 4096KB (32768Kb)

--- Flash Image Information --
Signature: VALID
Number of Flash Components: 1
Component 1 - 4096KB (32768Kb)
Regions:
Descriptor - Base: 0x000000, Limit: 0x000FFF
BIOS - Base: 0x180000, Limit: 0x3FFFFF
ME - Base: 0x001000, Limit: 0x17FFFF
GbE - Not present
PDR - Not present
Master Region Access:
CPU/BIOS - ID: 0x0000, Read: 0x0B, Write: 0x0A
ME - ID: 0x0000, Read: 0x0D, Write: 0x0C
GbE - ID: 0x0118, Read: 0x08, Write: 0x08

Total Accessable SPI Memory: 4096KB, Total Installed SPI Memory : 4096KB

FPT Operation Passed

And disabled:

Intel ® Flash Programming Tool. Version: 8.1.10.1286
Copyright © 2007 - 2012, Intel Corporation. All rights reserved.

Platform: Intel® HM67 Express Chipset
Reading HSFSTS register... Flash Descriptor: Valid

--- Flash Devices Found ---
W25Q32BV ID:0xEF4016 Size: 4096KB (32768Kb)

--- Flash Image Information --
Signature: VALID
Number of Flash Components: 1
Component 1 - 4096KB (32768Kb)
Regions:
Descriptor - Base: 0x000000, Limit: 0x000FFF
BIOS - Base: 0x180000, Limit: 0x3FFFFF
ME - Base: 0x001000, Limit: 0x17FFFF
GbE - Not present
PDR - Not present
Master Region Access:
CPU/BIOS - ID: 0x0000, Read: 0x0B, Write: 0x0A
ME - ID: 0x0000, Read: 0x0D, Write: 0x0C
GbE - ID: 0x0118, Read: 0x08, Write: 0x08

Total Accessable SPI Memory: 4096KB, Total Installed SPI Memory : 4096KB

FPT Operation Passed

[kasar]

@forsaken123

so, they switched from wph to cap after some updates, not sure if rename the file will work, so its better keep with its original software and method per each version for now.

well, relating the parameters, I wasnt just talking about the ones inside the rsp files.

I was more talking about this

http://forum.notebookreview.com/dell-xps...oject.html

that post describes the very first step for bios the L502X, first steps were obiusly extract the flasher and bios out from the exe package, and also get the flashing parameters, I acomplished this by tweak the taskmgr settings and watching the paths and folders.

its posible that it start the app with hidden or custom parameters. keep an eye on task manager after doing stuff.


@Brabbelbla

this is how mine looks

Code:

Intel (R) Flash Programming Tool. Version:  8.1.10.1286
Copyright (c) 2007 - 2012, Intel Corporation. All rights reserved.

Platform: Intel(R) HM67 Express Chipset
Reading HSFSTS register... Flash Descriptor: Valid

    --- Flash Devices Found ---
    W25Q32BV    ID:0xEF4016    Size: 4096KB (32768Kb)

    --- Flash Image Information --
    Signature: VALID
    Number of Flash Components: 1
        Component 1 - 4096KB (32768Kb)
    Regions:
        Descriptor - Base: 0x000000, Limit: 0x000FFF
        BIOS       - Base: 0x180000, Limit: 0x3FFFFF
        ME         - Base: 0x001000, Limit: 0x17FFFF
        GbE        - Not present
        PDR        - Not present
    Master Region Access:
        CPU/BIOS - ID: 0x0000, Read: 0xFF, Write: 0xFF
        ME       - ID: 0x0000, Read: 0xFF, Write: 0xFF
        GbE      - ID: 0x0118, Read: 0x08, Write: 0x08

Total Accessable SPI Memory: 4096KB, Total Installed SPI Memory : 4096KB

FPT Operation Passed

take a look specially to this part

Code:

CPU/BIOS - ID: 0x0000, Read: 0xFF, Write: 0xFF
        ME       - ID: 0x0000, Read: 0xFF, Write: 0xFF

they became 0xFF when I did the descriptor mod when desoldering the chip, changing those bytes, and soldering back, that allowed software read and write.

I was expecting that option you unlocked would also unlock those settings.

sadly it didnt worked as expected >.<

well, I dont know how those values should look after just bypass the descriptor, maybe bypassing the descriptor just bypass those settings, and even they still the same, you are able to dump or flash stuff. idk

in my case I didnt bypassed the descritor, I just altered the settings to let me do stuff.

what is also this command output for you?

Code:

fptw64.exe -D total_backup.rom

the -D parameter specify to create a dump, since no -ME or other flash part specified, it will backup the whole chip into the total_backup.rom file.

try also dump the ME region to a file

Code:

fptw64.exe -ME -D ME_backup.rom

and the descriptor

Code:

fptw64.exe -DESC -D descriptor.rom

if you are able to get a descriptor dump, then just get a hex editor, and look for this HEX string

00 00 0B 0A 00 00 0D 0C 18 01 08

then change it to

00 00 FF FF 00 00 FF FF 18 01 08

that should unlock your settings.

now the tricky part would be flash your modded descriptor.

Code:

fptw64.exe -DESC -F modded_descriptor.rom

with a normal locked descriptor this command would get some kind of access denied reply.

however, there would be a chance it would work with that bios option enabled. who knows if maybe that works .. ^^


@all

I has been away for some time on other projects, but I plan to relase a newer bios mod for the L502X wich all the new researchs that has been made here.

did you guys hex modded more the bios after this?


that is the last I did relating raid options, not sure if those options work anyway.

I also made some more unlocks at the advanced security menus, unlocking asset tag edit and the ability to disable or enable computrace after the initial settings.


however didnt touched any raid stuff, what would be the list of changes needed in order to get raid working?

I noticed lot of people interested in raid option at the NBR forums, so it would be another nice addon to the modded bios

[Brabbelbla]

@kasar
Tried the fpt stuff, unfortunately it didn't work. Read access only to the descriptor, no write access. Enabling/disabling the Flash Controller Lock doesn't change that. Question remains: what does it do? No idea.

About the RAID, this post http://www.bios-mods.com/forum/Thread-UE...4#pid67504 did the trick. The unlocked settings only control your options once in the OROM. @follow_me offered to test, he said it works for a legacy setup and he was going to try a TRIM modified version.

Basically the tricky part is the boot entry. I have only tested with the RAID OROM enabled, but without a RAID volume created. The hard drives then report as (still separate) SCSI devices behind a RAID controller. With a modified UEFI shell with bcfg you have to add the device path of your RAID volumes as boot options. Legacy boot works, and I could get into UEFI Clover too. So as far as I can tell UEFI boot works, but @follow_me said that with an actual RAID volume it does not, so I don't know about it. You will need precautions (recovery disk, as first boot option) any way if you plan to UEFI boot Windows or Linux under RAID, both have the risk of [censored] up the boot entries and as you just created a RAID array, your drives are empty and you won't have a backup OS to boot to. Maybe I will get to test it sometime soon, until then and anyway for TRIM we have to wait for follow_me.