(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[kasar]

ok, tested your new shell enabler

if I press the F10 hotkey while booting, it brings up the shell ( success )

however I must report some small issues.

the text relating hotkeys from the diagnosis splash screen (the one I most use) just disapeared.

I was about to ask if there is a chance to add the new hotkey as text info like the existing ones, but well, first it would be nice to keep older ones keep showing





on the splash startup screen (default option) it keeps working as normally



but not at the diagnosis screen :o

I personally like more the diagnosis screen because it feels like a small desktop machine, showing info of the detected CPU, hard disks, ram, and other devices.

[follow_me]

@kasar

Did you tried to use Alienware m17 r3 ME firmware ?
we should look at modules there , because it is 90% same hardware we have and it has overclocking features right from the box

[kasar]

the alienware's ME from previous topic didnt worked for me (didnt tested flashing directly, but since I was unable to open it with FITC, I didnt tried)

not sure if it was a m17 r3, if you saw a ME firmware dump from a M18 R3 please let me know, because is not easy to find those kind of dumps ^^ (they usually require unlocked descriptor or hardware mod to be able to create those dumps.)

[Brabbelbla]

@follow_me
From here I added a _EFI_IFR_REF3 entry in the IFR structure. In binary form, you have to insert somewhere on some form:

For the main form, form ID 1, using the RAID0 unicode string:

Code:

0x32C2F Ref: RAID0, Variable: 0xFFFF {0F 21 C9 01 CA 01 A2 01 00 00 FF FF 00 01 00 00 00 57 CD 7B D3 A1 AB E6 44 A9 2C 89 8B 15 8F 2F 59}

And for the create volume form, form ID 2, using the RAID1 unicode string:

Code:

0x32C50 Ref: RAID1, Variable: 0xFFFF {0F 21 CB 01 CC 01 A2 01 00 00 FF FF 00 02 00 00 00 57 CD 7B D3 A1 AB E6 44 A9 2C 89 8B 15 8F 2F 59}

Insert them somewhere in the IFR structue and either update the PE section and common headers with the new file size and checksums or remove other operators to create space. Or just use my attached file (your's is an L702X, right?). Still a WIP. Replace CFEF94... with it. The references show up on the HDD configuration page, after enabling RAID. Then reset the system, if the RST driver is not loaded, the links do not work.

I believe the way it should be is the RST driver publishing the formset, and somehow the form browser should pick it up as a tab. I tried adding the GUID's that all stock tabs have to the IFR structure in that driver, but it still didn't show.

EDIT, WARNING: Having flashed this version, and also with one before this, containing pretty much the same as this one, I have been unable to boot using the sideloaded BIOS in crisis recovery mode. It just resets when the blue bar on the splash screen reaches 60% or so. Not sure if defaults are loaded, that is basically the only thing I have ever really needed. Luckily I don't need it now, but it feels tricky. Years ago, I had this problem as well, I don't know what caused it now and what caused it then. Somehow it got solved then, but I don't have a clue how.

[follow_me]

@kasar

take a look at this post
it's about platform , key hardware is the same
http://forum.techinferno.com/alienware-m...ounge.html

and here , post about tool which allows to "circumvent write protection", and it is possible ( I guess ) to bypass the read protection
http://forum.techinferno.com/alienware-m...sions.html

And we can find a user (here or at NR) with AW 17x R3 to ask him to make a dump

[jkbuha]

So it turns out that the ME descriptor region in the L502x and L511z is not functionally equal. How do I know - because when I applied all of kasar's ME settings, the 15z bricked. Yup - recovery CD not working, fan on and nada else.

So, thankfully (and thanks to kasar's advice) I *did* make a backup of the 4MB Winbond chip. Problem is, I cannot seem to flash it whilst it's still directly on the motherboard (I know, most posts say that you can't due to the other components connected to each pin) so it looks like I'm going to have to desolder.

@kasar - what soldering iron did you use to desolder? Would a 30W do the trick or would it be too high & lift the tracks as well? Also, did you use a needle to pull up each leg during desoldering, or did you use a copper 2.5mm wire around the chip?

[kasar]

@follow_me

yeah, it is quite similar system

anyway on the R4 topic I see people using 3xxx mobile CPUs, wich mean ivy bridge support.

I think I should try on this one instead
http://forum.techinferno.com/alienware-m...tweak.html

wich is for r3 ^^
just posted there ^^


the L502X does not have ivy bridge support, and relating the HM67 chipset, I read on many places there are no support for ivy proccesors, just sandy bridge, that confuses me a little.

so there are probably some differences on the r3 and r4 model from that topic, from what I read, r3 is like the L502X supporting only sandy bridge, while R4 offer support to ivy bridge, but yeah, getting one of those ME dumps would be awesome, also porting some bios stuff from alienware m17x r3 to our dell's would be super

@jkbuha

well, in my case, after descriptor unlock, I susucesfully dumped and flashed not only specific parts thanks to FPTW64, also the whole backup, those backups are the same and compatible with the programmer method.

I used it a lot to restore previous images with all settings and me configurations.

this method is also way faster than the external programer, flashing the whole chip from FPTW can take few seconds while the external programmer take minutes and require remove phisically the chip and attach it to the programmer (more time.)

however, this requires obviouly the laptop on a at least partially working status wich allow to boot the OS and run FPTW

if the system is bricked, your only change is to program it externally by removing the chip (yep, remove it is required since there are still many parts connected to the chip, I was unable to program it with my first try, the external programmer port, thats why I only had success after removing the chip and attaching it directly to the programmer without other components.)

relating soldering, I used also a 30w soldering iron.

a cheap one, just filed the head to make it thiner so I were able to do more precise stuff.


and yeah, true, I used a needle yo lift on per one the chip legs while applying heat.

patience is the key, specially the first time

you need to do this VERY carefully, excesive heat will fry the chip, like it happened to me the first time after several solderings and desolderings.

and excesive force will break chip legs, (hapened to me after with the external programmer)

that is why I ordered more winbond chips (you can get many of them for very very little money, just ensure they are exactly the same model as yours and it will be fine,I got a pack of 5 of them for just 3 eur from ebay) and also ordered the sockets for both motherboard and programmer side.

sockets make life way easier if you need to program the chips externally more than once , and also have extra chips helps in case some of them got damaged.

also the extra chips can be used to store different configurations or just working backups in case you get the laptop with you and the firmware get corrupted and you dont have your programmer or another PC with LPT port to use the programmer, swaping the chips would need the sockets, else you would need soldering and desoldering everytime.

It saved me some times

[follow_me]

yeah, it is quite similar system
anyway on the R4 topic I see people using 3xxx mobile CPUs, wich mean ivy bridge support.

@kasar
The post with the R4 was there only for the tool to unlock descriptor , as I understand it will be needed to make a dump

But , I think we will need more than just full flash dump - because raw bios dump is ~4,5M size , which means the ME FW is most likely 3,5M size one
Did you thought about "bigger size flash" mod (e.g. w25q64bv) ?

[kasar]

oh, the PRR2.exe tool, is really interesting

this may allow to bypass the need of hardware mods to get access to some regions.

I think I will ask the forum users to test it (as I have already unlocked descriptor ^^)

they all may be able to finally flash the BCLK patch I made some time ago. (instead just the people who hardware modded the machine)

I will ask them now if they can test it (will upload a test/scripted package with my tested ME oc patch)

are you talking about the R3 firmware size?

well, in that case it may not be compatible at all.

well, in the case of the L502X, we use the 1.5 mb ME firmware updates

bigger ones does not install at all

as for the moment I know two types of ME firmware versions, the 1,5 mb package versions, and the 5 mb package versions.

[kasar]

added a small guide to test the soft unlocking (to test the security bypass)

http://forum.notebookreview.com/dell-xps...ost9657720