(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

[jkbuha]

Most (if not all) of the steps to enabling the advanced menu are on the first post. Should be everything you need to unpack/patch/repack the bios. The TianoCore SCT version must be 2.0, in which case you should be able to find the binary sequence outlined in the first post and patch accordingly.

Good Luck!

[gmb-gus]

Any news on L502x unlocked bios?

[kasar]

Any news on L502x unlocked bios?

@gmb-gus

this topic may interest you

http://forum.notebookreview.com/dell-xps...-more.html


@all

happy 2015 guys, do you all still alive?

I am trying more mods for the system.

now I am trying to mess with the turbo multipliers

I noticed some machines let you to handle the turbo multipliers so you can turn them higher for all cores

I'm currently looking for doing that for my i5-2430m

by default it allow

multiplier to 30 - 1 core
multiplier to 28 - 2 cores

I want to max them the highest posible.

if I cannot pass 30, then I want to at least being able to set two cores to 30.

I read that I have to mess with the MSR registers for that.

I was thinking about several options:

* mod default values in BIOS (relating overclocking menus we were unable to unlock), even we cant bring up those menus, we may be able to change the options by manually hex editing the code, or via a efi application from the shell wich does the trick.

* hardcode the changes to the bios so they are allways there.

* replace some "useless" bios options with another ones more usefull, like the overclocking ones

from what I read it have something to do with this address

MSR 0x1AD , this can be done from windows with msr tool software but,
I also read that
MSR 0xce bit 28 must be set to 1 for that
and that needs to be bios set.


with MSR tool I get following

0x00000000 0x1C1C1C1E

wich result into

1C = 28 multiplier - 4 cores active
1C = 28 multiplier - 3 cores active
1C = 28 multiplier - 2 cores active
1E = 30 multiplier - 1 cores active

and I want to set it to

0x00000000 0x1E1E1E1E

but the changes I make from the MSR tool seems to be useless

so I think that I need to unlock the 0x1AD MSR register, wich seems controlled from the 0xce bit 28

any idea about how I can acomplish this?

[jkbuha]

Happy new year kasar I'm away from the laptop until mid-Jan, hence silence from my end for a while ^^

Unlocking 0x1AD MSR should be fairly easy, I had accomplished something similar to unlock the MSR for Speedstep to work correctly in OS X. Under my existing BIOS hack I have unlocked Bit 15 of MSR Register 0xE2 so a bit of hunting around in that region should do the trick.

For 0xE2 I had to look for the opcodes

"b9 e2 00 00 00" (mov $0xe2,%ecx)
...
"75 08" (jne next)
"0f ba e8 0f" (bts $0xf,%eax)

and make sure that the CPU did not execute the last instruction through an unconditional jump. So I replaced "75 08 0F BA E8 0F" with "EB 08 0F BA E8 0F". I don't have the specific module with me right now (only so many things I can take when off skiing) but I'd assume you can search for "75 xx 0F BA E8 28" (xx could be anything depending on next jump) immediately after "B9 AD 01 00 00".

Let me know if you need any help!

[kasar]

thanks a lot for the info jkbuha

Glad to know this still active

I will give a look to the stuff at night when I arrive my grandspa home

should I look into any particular or specific modules?

Im looking for the MSR 0xCE bit 28 in particular

I will be away from my HW programmer this week, but I still have my old CD recovery, so I will still able to recover from BIOS region based bricks

[jkbuha]

You're welcome mate

Ok, now I understand, you want to set MSR_PLATFORM_INFO (0xCE) Bit 28, so this is (in theory) what needs to be done:

1) Open up the module I had modded to set MSR 0xE2. IIRC, most of the MSR read/writes are done from one module only, so this should be the correct one.

2) Find the byte sequence "B9 CE 00 00 00" which corresponds to the get MSR_PLATFORM_INFO register

3) Use a disassembler (IDA or equivalent) to dump the asm instructions around that area. We should be looking for an instruction to unset/reset Bit 28. Once found we force condition to set or else force jump away from the reset instruction.

4) Once successful, set 0x1AD to multiplier of choice from Intel XTU.

[kasar]

I am stuck on step 3

well, I never used IDA or any other disassemblers before, so I feel a little noob here

I'll try doing following

I picked of ida pro 6.1

and ran idaq64.exe

then loaded powermanagement2.efi

(the one for L502X I hex edited long time ago with your speedstep changes and also I found the "B9 CE 00 00 00" hex secuence on it)

then when I ask IDA to load the rom file, it ask to load with those settings.



then after I try to search the "B9 CE 00 00 00" part, it go to the selected zone





///////////////////////////////////

then ..... well, I feel lost after that step :'D

I attached the powermanagement2.rom module

maybe you can point me into the right direction ^^

[jkbuha]

well it looks like you *have* found something... ^^

this is the procedure to call MSR 0xCE and then immediately after call MSR 0x1AD, both of which we know are key to unlocking multipliers - nice work =D

question is; I cannot see any instructions to read/lock specific bits (btr/bts), so I'm not sure how the BIOS is locking these specific bits in this module.

unfortunately I won't be back until week after next so won't be able to help you much for the next few days. in the meantime i'l try googling around to see if anyone has had a similar method of unlocking.

[follow_me]

Happy new year everyone!

@kasar , @jkbuha

I think you are using wrong cpu for disassembly - according to your screen you've loaded image for Z80 cpu , which has "a bit different" bytecode
I may be wrong if image loader , in this case it is PE64 , forces IDA to use correct processor, but I'm not sure

[kasar]

@follow_me

yes, you are probably right, I never user IDA before or any other dissasembler app before, so I just loaded the efi module with default settings.

there are many of them, so I'm not sure wich one to pick



wich settings do you guys use to dissasembly your uefi bioses?