L702x Modded GPU BIOS

you mean these ?



these seriously dont work it still activate at 55c

 

Hi,

I have tried both bioses on my L702X (3GB GT555M, optimus, no 3D) but can't get the UEFI option to work. Once enabled, I just get the legacy boot menu which doesn't present an EFI option - nor can I find a way into the UEFI shell? If I turn off legacy boot, I still get the boot menu (no efi option) expect I cannot boot anything selected.

The modded GPU version does not appear to change the stock voltage at all I'm afraid to report.

 

hey guys, anyone is having trouble with usb 3.0 on dell xps l702x ? ,mines keep disconnecting when i attach an hdd and start read/write

 

it might be a driver related issue, try different drivers and disable power saving feature on your usb 3.0. I had the issue, and with a different driver it stopped. Also dell sent a tech who changed the daughterboard and the issue persisted, and he said most of the time the problem with 3.0 is drivers

 

2 capitankasar
Is it possible to integrate RAID BIOS module (raid is suppported by chipsed according to intel's site)
Here is the link where I have found some of RAID roms
AHCI/RAID ROM modules for BIOS modding - already extracted - BIOS/BIOS-Modding - Win-Lite Forum

Are they suitable to use with this bios ? any chances to integrate ?

 

@followme

dont know, never tried before.

also that site ask that is for AMI/Phoenix/Award BIOSES

our bioses are Insyde

it also doenst talk about the HM67 chipset the one on L502X and probably also at L702X

 

There is mentioned that roms are suitable for 6-Series or 7-Series SATA Controller , as far as I understand we have 6-Series
RAID ROM is a generic PCI ROM and it is not deppends on BIOS manufacturer, it is hardware specific code
Do you have ability to insert ROM in your firmware ? Can you build a test one ? Or just point in direction where to dig next

 

2 capitankasar

Do you use "MMTool aptio" to edit bios ?

sorry for bothering you, any links that might point me will be appreciated
Great thanks !

 

@followme


nope, I allways use phoenix slic tool to mod those bioses.

well, I made some research at the L702X BIOS

the SATA module name is the

ED2DE537-7823-4CB1-B687-85BA9BBEF0B4_1_587.ROM (85kb)

and the version is v10.0.0.1046

I never modded the Intel RAID for SATA module, but I will consult the already modded ones in order to see if I can replicate the mod.

 

Mega thanks !!!

 

Some lspci output (may be useful perhaps)

AHCI MODE
00:1f.2 SATA controller [0106]: Intel Corporation 6 Series/C200 Series Chipset Family 6 port SATA AHCI Controller [8086:1c03] (rev 05)

IDE MODE

00:1f.2 IDE interface [0101]: Intel Corporation 6 Series/C200 Series Chipset Family 4 port SATA IDE Controller [8086:1c01] (rev 05)
00:1f.5 IDE interface [0101]: Intel Corporation 6 Series/C200 Series Chipset Family 2 port SATA IDE Controller [8086:1c09] (rev 05)

 

@followme

ok tried something


updated the sata to the v11.6.0.1702 version they have there and patched the table

6E 00 05 1C 4B 1C (01) 05 1C 4F 1C (01) 07 1C 00 00 (01) 06 1C 00 00 (01) 05 1E 00 00 (06) 04 1E 00 00 (07)

to

6E 00 05 1C 4B 1C (07) 05 1C 4F 1C (07) 07 1C 00 00 (07) 06 1C 00 00 (07) 05 1E 00 00 (07) 04 1E 00 00 (07)

the updated module is bigger than the previous one, so I cant guarantee this to work

then reintegrated the file at the non gpu modded version but it have the unlocked menus and other enchancemets.

however I didnt tested this mod never even with my L502X, so I DONT GUARANTEE THIS TO WORK

flash this file under your own risk

 

I know you dont have a L702x, and I realy greatfull for all your help

One little favoir - can You share the link with recovery method using usb stick ?

THANK YOU very much !!!

 

here are the usefull posts


(unlocked A18 + flashing instructions + BIOS recovery cd )
http://forum.notebookreview.com/dell-xps-studio-xps/641688-l702x-modded-gpu-bios-15.html

(pictures of unlocked bios + unlocked A19)
http://forum.notebookreview.com/dell-xps-studio-xps/641688-l702x-modded-gpu-bios-18.html



however, unlike on the XPS 15, even the procedure to build the recovery CD been the same (except for minor changes), no one confirmed yet the recovery cdrom working for the XPS 17, I know i didnt had so many testers, however facts are facts ^^


also the recovery cdrom fixed bios zone for xps 15, other region issues like descriptor, EC, or me firmware arent covered by this recovery method , only BIOS flashing (well, it should work for a bad BIOS flash, but first we would need to know the recovery works itself )

the only method worked 100% for me after hard descriptor/me and other firmware bricks was phisically remove the chip and reflash it externally on my xps 15, however that needs hardware mods and a previous working laptop.

well, in your case I think you dont have to worry since you are going to flash stuff at the BIOS region.

anyway if you can confirm the recovery cdrom works for the xps 17 first, it would be nice.

else even if it is a simple BIOS brick, we cant recover anything if no single recovery method is avalible ^^

thanks for understand

 

I've decided try to boot recovery CD before any actual flshing of any riski firmware - and CD method didn't worked for me ! (the bad news) Blank screen and Insane system fan noise.

But, (the good news ) it worked only when I have placed capsule to my flashdrive - loaded bios version A13
Now i will try to flash new firmware

 

oh, thanks for the info

then it isnt the recovery capsule I made fault, it seems the XPS 17 doesnt like to read if from the cdrom

I have an idea

since you have the recovery cdrom and bios capsule on a usb stick you will need to use both

* put the cdrom in
* put also the usb stick in

when you boot the capsule from usb in the recovery mode. hit F12 and select the cdrom from the list, if you load the OS from the CDrom it will work ^^



it will be like

1 - boot capsule from usb (cdom doenst seems to work for capsule on xps 17)
2 - boot cdrom OS via the capsule
3 - flash the bios repair via the cdrom method

if that works this means you have recovery working for xps 17 ^^

it will be more annoying than xps 15 since you need both usb and cdrom, but well, it still functional ^^
I remember when I was building the recovery method on my xps 15 I used also both usb and cdrom while made my first sucesfull complete recovery boot + reflash
then I packed all in the cdrom included the recovery capsule, too bad the xps 17 doesnt like just the cd for some reason :/

well, if the suggested recovery method let me to know it worked and I will update the guide

just tell me wich usb you used, (usb/esata combo port?)

oh, and huge thanks for your feedback and testing

+1 rep!

 

I've used esata combo port (the most right side one)

Well nothing has changed in this new firmware
There is no new items in the menu, no new modes for SATA operation

Is there any way to find out does this mode hidden or it just unsupported ?
May be symmetrical disks configuration is required to unlock this mode ?
I will receive couple of OCZ vertex 3 this monday and I hope it will make any difference

Thank you for your help!
If you have any ideas - I will be very appreciated. If you need any testing on L702x - you can count on me.

 

well, I know there are no new menus,

however, there must be something wich changed.

if you go to the topic you linked me, people made tests them with some software.

if you can let me to know if something changed by using the patched BIOS, it would be nice to know ^^

anyway if you are already using the machine and hdd functions without issue this means at least the module update to the latest version was a success

 

I recomend you to lock at MMTool (I suppose you have already) - there is a way to see names of included efi modules
there is module called SatController.efi (GUID starts on BB65942B) - this is a Serial ATA controller initialization driver

I will make some testing this weekend and report you results about difference if any

 

oh, thanks

yeah, I used that tool before, now I am using other tool nebster developed.

good thing is taht it output results to a file if correct commands are set ^^

example of my l502x bios output ^^

he was developing it during our bios hacking progress

here is the link for more info about the tool ^^

(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO - Page 69

oh thanks for the info about that module, let me know how your testing goes

 

It's me again
Take a look to
6-and-c200-chipset-specification-update.pdf
pages 13-15 , especially notes at the end of page 15

Is it possible to extract modules responsible for raid from enother insyde bios (from notebook based on hm67 with raid0 e.g. Sony Vaio Z2) ?

And, take a look to this post on a msi forum about upgrade to RAID0 firmware for gt680
It is also poossible to upgrade to RAID0 version for gt683 based on HM67 chipset

 

I was blind and stupid
there is dell Alienware m17xr3 based on HM67 with Insyde bios and RAID functionality from the box - perfect candidate for modules transplantation !
here is the link to latest m17xr3 bios file
RAID BIOS has GUID 501737AB-9D1A-4856-86D3-7F1287FA5A55

 

nice find, that alienware module is exactly the same size of the one inside the L702X BIOS

chances to get it working are higher, I will give it a look

 

ok made a second test,

replaced the entire module with the one from alienware BIOS (no other changes than rename the module for implementation)

here it is, like I said I dont guarantee it works

the BIOS I took as base to mod is the A19 modded/unlocked bios with no GPU mods

L702X_A19_generic_Unlocked_Menus_&_updated_cpu_microcode_RAID0_test2.rar

 

Still no luck
suppose there is more than just a PCI rom to change, it should be configured to work in RAID mode
Wiil try to find SATA driver in Alienware firmware and replace original driver by it

 

I have found it
it has the same GUID BB65942B-521F-4EC3-BAF9 as l702x, but a bigger size

Can you build image with the AW sata module ? Please ....

if take a closer look to CFEF94C4-4167-466A-8893-8779459DFA86 - which is a advanced tab representation - there is mentioned RAID many times , sooo I hope it is possible to unlock this options

 

@followme

done, I reintegrated that module plus the other one you requested before at this file

hehe, at this way we will replace half of the BIOS with the alienware stuff

edit by capitanksar: link removed since this mod have a corrupt/non valid modules and the machine is unable to boot

 

"Bad news everyone"
froze on boot with test 3
And this is not the worst news, the worst one - We don't have a working recovery
recovery capsule can start only from usb drive - you know why ? Because all sata devices are disabled ! including CD Drive
even after bios boot and bootloader start? enabled only first hdd , built in CD drive is disabled thats why windows falls to BSOD

fighting to boot recovery from usb drive , with no luck yet

Writing this post from linux

 

srry to hear that, told ya I was unsure from this last mod.

I will remove the previous link. to keep people away from brick/freeze the laptop too.


well, on my L502X it booted from Sata drives and usb on recovery.

try putting the recovery CDrom inside, then put the usb with recovery capsule too.

then do the END key trick + plug power cord to make the recovery boot trick and after that keep hitting fast the F12 key

when the dell splash logo appears you should be hitting f12, so you get the boot menu, then select cdrom.

if everything is fine, it will boot the cdrom with winxp.

then open the cmd and type repair to fix your BIOS.

let me know if you can restore it like that way

 

Don't worry , it's not a big problem
CD boot won't work, I can't see CD Drive under linux - this means it is completely disabled

if I can boot - I can restore, not a big deal

and I don't afraid of soldering and programming spi flash manualy , so

There is one interesting thing - END trick works only if there is no any files on a flash drive except the capsule
it starts, and hung at the end of post , right before boot

UPDATE: recovery image is not usable - caught a BSOD on boot

 

yeah, if you boot the capsule and dont touch anything by default it doesnt work.

but since the machine is booting the capsule instead the damaged BIOS, it may get the cdrom working by the F12 key and selecting it.

else you may need to boot some kind of OS by LAN or something and flash from that, because with the recovery capsule at the xps 15 I was unable to boot anything from usb, just cdrom.

anyway I am confused about how you loaded linux on your half/bricked laptop

oh, you are the only guy who is not afraid about programing the chip by hardware

I desoldered my bios chip at the l502x, installed a socket for the chip and also made a simple lpt programer with a socket too, so I can program and switch chips easly from programer to motherboard.

however, I made a backup before I started bricking the laptop while testing stuff.

so in your case it may be harder.

take in mind the chip store more stuff than just bios, like descriptor and me firmware plus the specific hardware settings like aset tag and other stuff.

I have a dump of my whole laptop.

well, as for if the recovery image gives BSOD,

thats weird, in my case it gave BSOD on normal mode, but worked on recovery mode ^^

well , in your case it isnt a total brick, so must be software alternatives to desolder the chip.

like boot from lan or something.

but well, I can provide info about how I managed to program my laptop externally , and since both have almost the same hardware, it will probably work too, just let me know if you need info for it

 

I finaly managed to restore my bios

and here is what I found out:

- there is no any other boot device except first hard drive and network. I've tried CD/USB/ESATA/USB CD/2nd hard drive
- boot menu is useless, when you are inside capsule, even if you chose to boot from first HDD it will tell you that "operating system is not found"
- windows (any thing I say about windows means Win 7 x64) won't boot because of controller mode
- I've tried to run 8 types of WinPE images (images were loaded to memory) 50% hung / 50% BSOD (versions are XP/7/8 x86/x64 )
- You have only 2,9 GB of ram available , no matter how many you have
- I'm not sure that if you boot from lan you will be able to load OS , because you need to copy it entirely to RAM
- it's easy to boot in dos environment - but there is no tool to flash the chip from dos
- Linux and Grub are your's best friends

BTW - I didn't installed linux while was in capsule - it's my primary OS , and because it not deppends much of installed hardware , like windows, it was able to boot any time I needed

I saw a thread at bios-mods couple month ago where you built your's HW mod , and it's awesome !
From that thread a know about capsule boot

Unfortunately capsule can't be used to test SATA changes - the only way is to flash actual chip


OFFTOP: What tools do you use to disassemble and edit firmware ?

 

thanks ^^

mmmm, I just modified some bytes manually from the chip image by using hex editor about descriptor unlock.


and if you are talking how I modded the bios, I used phoenix slic tool, allways use it, it is really nice tool.

about ME firmware hacking, I used FITC and FPTW64

for manual chip programing used SPIPGM and FLASHROM

so you finally got it?




how?

 

Minimal xp image from first hd loaded by grub

 

Good news

I found many interesting thing and possible - the new and easy bios restore method !

comming sooon

 

oh

keep us updated ^^

 

Lets start from theory
We have a UEFI bios - it is an open standard which was developed by intel
UEFI consists of virtual file systems
this filesystems are contain UEFI portable binary modules, option and pci ROMs , like RAID or GPU bios

this image is packed in so called Capsule

We have bios packed in WPH format - which consists of three parts:
1 - capsule
2 - padding filled with ff's
3 - --> flasher <--

flasher is packed in some format, but it's easy to extract clean UEFI module

Next problem is to find a way to run this module - and I have found a solution
Tianocore UEFI shell !!!

I've managed to run it and even loaded flasher module
It starts but refuses to flash system because there in no capsule to flash
(and I think I know how to load it !)

this shell allows you to:
- load/unload modules
- list all modules deppendencies !!! (possible, the solution for the 'RAID problem')
- list all the loaded modules
- dump options storrage
- run module diagnostics
- write logs to disk
- run commands and custom EFI software
- it is supports batch files ( useful for automation of recovery )
- and many many other usefull features


I may wonder - 'how to load this shell ?'

here is the recipe
unpack this file to a device, start it - thats all, no need to install bootloader, etc...
(partition should be formated as FAT with GPT partition table )

About recovery

I see it as :
- booting capsule ( because we have uefi boot enabled by default since A19, capsule should be >= A19)
- loading shell
- starting custom loader that copies capsule in memory, loads flasher and then starts it (not a problem to write such loader)

UPD: forgot to mention - by default capsule loads with SATA disabled - but ! using the shell it's possible to load required modules and boot from devices unavailable for boot before , in case if we want to load real OS

thats all for now

 

nice info, yeah, it should be posible

the bad point is that in order to do uefi boot, you need the modded bios in a working status.

it probably will not work with unmodded bioses or modded bioses with the uefi boot disabled.


however,acording to this

it should be posible then

I never tried the uefi boot from the recovery capsule since it allways came disabled by default at the L502X bioses, and you cant change default options at the capsule boot, because after save options it will start with the normal bios/not capsule.

so let me know if this works for you.


arrgg, cant give u rep points twice D:

 

Here it is !!! The working UEFI PFlash.efi app

I've managed to start it, backup my current rom and update it to stock A19

And now we possibly have unbrick method
in case of a disaster we can flash recovery dump directly to chip (FvRecovery.fv - as I belive it is a flash recovery dump)
- start bios capsule
- run shell
- flash bios (it possible to flash serial number and asset tags, but before you should save this numbers using smbiosview.efi utility from shell )

more over - there is a build in shell in the firmware, but it is disabled (GUID C57AD6B7-0515-40A8-9D21-551652854E37 ), and I wonder, is it possible to replace, for instance, diagnostics app to shell ?
If it's possible - we will be able to start the shell from boot menu even from recovery capsule !!!

there is more space to think about ...

offtop:
@capitankasar
Did you managed to upgrade your system with 3rd gen core processor ?

 

nice job!

I will let to know people from BIOS-mods from your sucesfull experiments

yeah, our laptops have a integrated shell, a little limited anyway compared with other ones, and it is disabled D:

mmm, it may be posible to replace the diagnosis app with the uefi shell,
I remember the hotkeys for it was FN-B or something like that.

I like your min man , you should come over BIOS mods forums, you will be proably a big help over there

you should give a look to this topic ^^

(UEFI) Dell XPS 15z L511z modded BIOS - and HOWTO

and no, I didnt had luck with that.

I was unable to intall intel ME 8 firmware over the ME 7 firmware, however, I managed to hack the intel ME 7 firmware to allow overclocking features on my L502X

and I am quite sure the same method will work for the XPS 17

anyway, doing this involved hardware mods like access phisically to the bios chip and flash stuff externally

 

Take a look at PFlash - there is an option to flash ME section
Are you sure it's not possible without phisical access ?

 

I think that option let you to update the ME firmware, like fwupdate does (not sure anyway), but at least fwupdate.exe not let you to write the firmware parameters zone, in order to alter the parameters, I needed to unlock the descriptor, so I were able to use fptw to dump and flash firmware from windows, and FITC to edit the firmware.

 

Where is stored the region descriptor ? inside of ME formware ? is it possible to change it without phisycal access (modify ME firmware and flash modded rom) ?

 

the descriptor is stored at the header of the chip image.

theorically there is a way to pinmod a chip to bypass the region checks, also there is a tool named MESET.

however there was little people wich had luck with that, thats why I went with further mods, however you can try doing the pinmod or try MESET software

 

Successfully replaced sata initialisation drivers. System is able to boot , but there is still no RAID option in setup
Replacing DellDiag with an internal shell just by renaming the image is not an option - because DD is DXE driver which is provides EFI protocol to launch the app

Reading uefi specs, looking for a way to enumerate all registred protocols for image and make a wrapper DXE driver that can launch shell instead of DD

 

Looks like even better times are coming for our XPS's

 

There is a way of launching the internal shell, but a custom FfsDxe driver is required to access the firmware volume, then by calling for shell guid you are able to init it. There's even a way of adding it back as a otkey option to set as F11, like Phoenix originally designed. But I don't think the firmware would be totally happy to hold a custom driver or a bigger shell binary, provided the space on the chip is kind of a limited resource.

 

We alredy have a shell image built in to stock firmware !!!
We have lots of stuff in firmware - like boot manager, which can be safely dropped from image to free up some space for driver

Can you tell a little more about otkey, and how we can enable it ?
thank you !

 

The shell binary which comes bundled with the firmware can't do even the most basic thing such as copying a file from one mapped fs to another, so there's little to no point in using it. have you actually tried to use it ? I have, it's crippled to the roots of it.

If you drop boot manager you will end up loosing F12 boot menu, if it's the thing you are aiming for - go ahead and dump it.

Get this driver here: https://www.dropbox.com/s/psy8cxi67460g60/FfsDxe.zip (courtesy of dmazar over at projecosx, based on code from https://github.com/cfdrake/FileSystemPkg/)
Fire up shell (2.0 preferably, to perform dh bcfg magic) and load up the driver using the load command.
Perform a remap of all the volumes after the driver is loaded: map -r
Then map all your filesistems, including the fw volume: map fs*
At this point you probably will have fsnt0 and fsnt1 mount points
Mount the later: fsnt1:
Knowing the GUID of the shell image (C57AD6B7-...) just call flor it from the running shell and it will start the instance of shell from the firmware volume.
Then do dh command to show handles for running drivers. Make a note of the handle number assigned to original OEM shell .. it can be something like this:

To map the shell to a key do the following: bcfg boot addh 1 <handle number> "Shell 2.0" -opt 0x40000000 0x0015
0x0015 is F11, the numbers are incremented by one F1 = 0x000b through F12 = 0x0016

But please note, as soon as custom filesystem driver is unloaded you will loose access to the internal shell and boot entry will get wiped from Boot menu because boot manage will be unable to locate the executable.

credits to dmazar for this knowledge.

 

even if we don't have enough space in flash chip - we can use this method to provide easy recovery from shell using efi version of PFlaash

there is a boot manager like emulator's one - with drop shell option and other features - is it that we have on F12 ? I thought it's other one

Will this driver be loaded at startup if it included to firmware ? is it possible to build it in the firmware ?