(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[follow_me]

so another posibility is that if we find another laptop very similar or if posible almost identical in hardware , but with cool firmware stuff, and we try to cross flash or at least "port" some of the stuff, it would be interesting to be tested.

@kasar
We have one - Alienware M14x r1 (but it is insyde bios) it is identical to Xps l702x, and as we know it close enough to l502x
UPD
and we have Alienware M17X R3, with different gpu (insyde bios )

[kasar]

oh, thats interesting.

a posible test then, would be if someone here have a L702X (and a recovery feature in case of bad flash) to flash the m14x r1 into the l702x.

however, the flasher method may differ since the different coding.

so, a interesting test, would be "just swap the bios chips" or with a unlocked descriptor, backup the whole chip from the m14x r1, and write it into the l702x.

that may work.

anyway, I heard some brick caused to a l502x user by flashing the 15z bios jkbuha did.

so, a posible test would be to flash a l702x bios on my l502x modded bios, if that works, then I would flash the m14x r1 bios (would need also to edit the gpu bioses)

anyway, the best way to do it would be flashing the total dump from the chip with fptw instead the flashing app.

that could work, anyway I dont have any of those L702X or m14x r1 total chip dumps arround.

I would test it if needed.

[follow_me]

a posible test then, would be if someone here have a L702X (and a recovery feature in case of bad flash) to flash the m14x r1 into the l702x.

@kasar
Thats me , the guy with a L702X , with unlocked descriptor and full flash image dump

[kasar]

oh, then we can proceed

you can send me a full flash image and I can test it

you could test also directly one of those alienware flash, but we dont have yet a full alienware flash or a fast recovery method for you :o

so yeah, I can procceed to flash the full image

anyway, I cant restore the EC region wich is on another chip, I hope that doesnt cause issues.

[kasar]

ok, follow_me sent me his dump, I am waiting the system ends its current tasks and meanwhile I am preparing the stuff, external computer, programmers etc.

I also prepared a bootable usb stick with a DOS version of FPT, really usefull.

this is really usefull if the machine meet two requirements:

* descriptor unlocked
* current firmware in at least partially working status

this will allow to flash or backup the whole chip fast without the need of remove the chip, and will also do it in seconds.

I allways try to avoid the external LPT programmer since it involves handle very delicated chips, it takes several minutes, and it also takes longer to prepare the machine and connect all the pins, also the sockets will get more damaged on every ussage.

for that reason, I only use the LPT programmer in case the machine is dead and it is the only way to revive it.

I was also looking for alternatives for the LPT programmer.

I remember we managed to get a working recovery method using a cdrom or a usb drive with a file named BIOS.cap

that worked fine, but only for bios region bricks, all other firmware bricks were imposible to be recovered with this trick

I was wondering if it is posible to the the same stuff but with all the firmware (descriptor, bios, ME...)

for example, using a total dump file as BIOS.cap, maybe it need a different name like FLASH.cap or FIRMWARE.cap, idk.

that would allow recover from all kind of bad flashes without the need of handle chips.

also may work to unlock descriptor for all computers by just modding the backup to have the descriptor unlocked.

anyone tested?

[follow_me]

for example, using a total dump file as BIOS.cap, maybe it need a different name like FLASH.cap or FIRMWARE.cap, idk.

that would allow recover from all kind of bad flashes without the need of handle chips.

also may work to unlock descriptor for all computers by just modding the backup to have the descriptor unlocked.

anyone tested?

AFAIK this is not possible , because recovery is defined as a special boot mode alongside with wake boot, capsule update, normal boot etc
to trigger this spacial boot mode you have to be able to run at least SEC and some PEI boot code , which will not run in case if you have broken ME for example. This means that if you flashing full flash dump any recovery will work only if ME stage is finished and control is passed to bios block
I've took a look to Intels code and there is couple interesting methods of direct reading|writing bios chips , and MAY BE it is possible to bypass the descriptor lock using this direct fash r/w routines ... But this is requires some time to investigate

[kasar]

oh, I see, well, then the external programmer still being a must have in case of bad flashes that BIOS.cap cant fix ....^^

well, have some updates:

you guys are not going to belive it but ....

the L702X dump follow_me sent me ..... WORKED on my L502X, lol crossflash definitly works in some cases




as you can see, I can even see what version of the bios is, it works fine, I can also see it is one from the modded bioses I did for the L702X replicating the changes we did for the L502X.

anyway, I noticed the 3.0 ports wasnt working.

only the 2.0 one did for me, so I was unable to use my external keyboard.

since booting windows would probably bring issues, specially since the L702X dont use the same GPU the L502X I decided to plug in the bootable usb stick into the working port, and using FPTW again, flash the last working L502X backup.

yeah, during the whole proccess I didnt removed the chip from the socket, I flashed all the stuff using the DOS version of FPT.


about the external programmer, I flashed one more pending test I have for the 16mb chip

it is the untouched l502x BIOS with just padding added until it fits the 16mbit size of the bigger chip, I will try to swap chips


anyway, I also have some issues.

other chip started to give issues.

it is one of the 4mbit one



doesnt matter how many times I disconnect and reconnect it, it allways gives the same error, probably toasted or damaged.
so I connected another one and it flashed fine


well, after all the tests, this leaves just three chips usable.


2 x 4mbit chips (one in the laptop now being used, and other as backup)

1 x 16mbit chip

this means I cant lose more chips unless I want to have a brick for some time.

for that reason I think I will order aditional 16mb and 4 mbit chip to have as spare ones.

if everything goes fine, I think I will also test the 16 mb chip again and report results.


let me know what you have in mind about those tests guys

oh, and if someone can get a total flash dump of those alienware laptops with the same hardware of the L502X, that would be awesome, since the L702X already worked on my machine

edit: tested the 16 mb chip with the untouched formware + padding= didnt work (lights started blinking as normal, but fan went full speed and black screen :/ )

[follow_me]

@kasar
Awesome results !
So , I suppose we need to find AW 14 r1 flash dump - any suggestions ?

[kasar]

I wish I knew where I find one.

I am googling for M14 R1 unlocked descriptor or M14 R1 chip dump, and I cant find nothing D:

I think I even posted once in some modding forum related modded the laptop itself modded bioses and I asked there for a dump, obviusly it got ignored ...

[follow_me]

Does anyone know is it possible to upgrade from 3rd gen CPU to 4th gen , and what are requirements for such upgrade ?
Or is it possible to run 4th gen cpu on HM77 chipset ? I know that it is possible for U series , but what about QM ?