HP DM1Z Advanced Bios

I was able to access advanced menu HP Dm1. No bios mod needed (at least for some screens)

Here is how you get in to advanced bios

1. Shutdown your computer completely
2. Power on and hit 'esc' to enter the boot menu.
3. Now press F10 immediately followed by the key "A". you have to press "A" after you press F10 and before you are in bios setup screen.
4. You are now in advanced bios setup. You should see additional tabs and new options.

If you see normal bios screen start from step1 and try again.

I am bios version F.03

Youtube video
http://www.youtube.com/watch?v=8-9XFejk0_w

 

Excellent! Going to try it now.

 

some interesting options. Dont know what they mean yet.

1. PowerXpress in video configuration - seems useless since we only have a single graphics card.
2. Individual ACPI Feature control
3. Fusion utility support - http://sites.amd.com/us/vision/tips-tools/cool-apps/Pages/fusion-utility-mobility.aspx
4. Light sensor
5. Hardware thermal control
6. Thermal Fan Control (Disabled by default)
7. HP Quickweb enable/disable

 

I think PowerXpress allows the switching between integrated and discreet graphics. If so, not applicable for us.

 

well, i created a modded bios removing the whitelist. But have not been able to find a way to flash it.

Even tried to use recovery mode flashing (Win +B trick) but it did not work. I guess it will try to recover unless the bios is corrupt.

In any case here is an untested bios mod file.

Do not flash unless you are willing to take a risk of bricking your laptop. I have not tested this myself.

I will be flashing mine once i find a way. It was created with EzH20 so it should work without any issues.

If you do brick your machine there is a standard recovery process that should work. Again, this recovery is also not tested by me yet.

http://www.sendspace.com/file/1sxumb

 

I've read elsewhere you just replace the bin with the hack one and use InsydeFlash.exe

 

tried that. It says the file is not signed. I think since i started with the unsigned version that you provided me. I cannot use that utility.

Which folder in the recovery drive did you get it from?

 

Hewlett-Packard\BIOS\Current

 

Let me ask you a dumb question. How are you navigating the recovery drive.
I am using the command prompt since explorer blocks access.
I do not see a Hewlett-Packard in root of D.

 

Well, afaik D: is originally the recovery partition. The HP_TOOLS partition is hidden. I think you can use Windows Volume/Drive manager to fix that.

 

success. was able to flash it and laptop booted back up. Now i have to check if it really disabled the whitelist.

1.Go into the HP_TOOLS, then Hewlett-Packard\BIOS\Current (on the hard drive). There are three folders: Previous, Current, New. HP puts a dumped bios in these folders.
2. Backup the bios folders to a USB drive in case you run into problems later.
3. Put the modified bios (renamed to 01611.bin) in each of these folders (replacing what is there).
4. Shutdown and remove the battery
5. Reboot holding down WINDOWS+B
The BIOS Recovery tool will load the modified (dumped) bios and install it.

Edit:nevermind. My update did not work. It seems like the behavior is different when i put a modded bios up there. Will have to try tomorrow. But the recovery process works well with the above approach if your ever corrupt your bios. There is also a usb based recovery approach.

 

ravic, have you tried removing the Driver I was offering to remove?
it's GUID is cd28daca-bdbe-481a-ac90-625c79cf234c

Sorry, I didn't have time this night, so no progress since. But I've started a full reverse engineering of that Driver.

Btw, thanks for the Tool, it's very helpful compared to a number of tools provided in python.

 

Kemkin, I have not tried that let me give it a shot.

I have tried removing 5CD10F33-B73B-465F-A89B-7A881137D416 but it does seem to have worked. But at the same time, i am not sure if my bios flash worked (did not see progress bar when i was flashing the modded bios)

 

ravic, I will explore the executable of the 5CD10F33-..., it's called H19DxeServiceBody, and I am really not sure that is about the locking.

Still disassembling the exe. The problem is that actually it has a number of defined strings with the hardware ids/vendor ids in the memory, but the problem is that it actually does not access them at all, so I am pretty much doing the decoding.

 

ok, my main issue right now seems to be about flashing the bios.

Every method is expecting a signature file. Seems like some kind of hash based on the original bios and i dont have one for the modified bios.

So insydeflash throws the message below
---------------------------
Error
---------------------------
Error : Can not found sign file. The system BIOS will not be updated.
---------------------------
OK
---------------------------

 

Need to research the sign verification procedure and try to disable it. If it is really the sign we need - then we're pretty helpless here, cause we do not have the right certificate for signing the file.

Are there any info on the forums about that?

 

yeah, seems like some guy on mydigitallife is patching the iscflash.dll to override the signature check
But i have not dug deeper into that.

 

you are right about the cd28daca-bdbe-481a-ac90-625c79cf234c that might be the potential candidate based on the name.

If we could only find a way to flash it.

Here is the modded bin file
Download dm1new.bin from Sendspace.com - send big files the easy way

 

It's not the potential candidate - I have all the code disassembled currently. It is the Driver we were looking for. So we're either removing it completely and check if the BIOS works without it, or we're modifying it's code for it to skip the check (not so tricky, actually, I did a pretty long research today, and taking into account that the code itself is quite short, I'll need a couple of hours to do the needed mods, actually.)

I am either receiving my dm1z tomorrow and trying to do the flushing, or I will be back on Monday, and I hope I'll have it then.

Waiting to hear from you on your progress with flushing

BTW: as I get, you've firstly got to the strings defining hardware names in that module by the Vendor and the Hardware ID's. But it actually does not access that part of the code at all.
This is the real list of the hardware it should accept:
- /Name/ /Vendor ID/ /Hardware ID/ /Subsystem L/H/
- J9CGobi2000-H 03F0 241D 03F0 251D
- J9CUNDP-1H 03F0 1F1D 03F0 3B1D
- QDS-BRCM1043 03F0 231D 03F0 171D
- VQF-RT3090BC4 0A12 0001 1000 148F
- QDS-BRCM1051 0A5C 21B4 03F0 331D
- VQF-RT5390BC8 148F 2000 ?(0000 0000) <- that one does not have any subsys defined

 

Kemkin,

Great work.
The biggest issue right now is the utility to use to flash a modded bios. All the ones i tried seem to look for a signature file to flash the bios.
Do you have any experience with that? Is there something in the bios that is making the flash utility prompt for a signature?
I can definitely try it on my dm1 if u want me to.
I do have good recovery approach so i should be able to get back up even if it corrupts the bios.
I am unable to spend much time for the next couple of days.

Thanks
ravic

 

I tried a HP version of the J9CUNDP-1H card

It threw the same unsuported card message.

I need to check the subsystem id on that card to make sure it matches.

 

Sorry, ravic, I did not actually have any of the experience in bios flashing, though I've had a lot of experience in software reverse engineering.

Hum. It might be different for the decrypted bios? It might have some other flags in the detection code that affect the check (the problem is that it does have the check, but it has a rather tricky approach, so it has a lot of conditions that have to be met before it accepts hardware, for example)

I will not have time for doing the research till Monday, too. So I'll proceed with the research further then.

 

everything we want to know about those signature files.
http://search.hp.com/redirect.html?...727/c01564727.pdf?jumpid=reg_R1002_USEN&pos=1

 

i guess the un2400 card i have has a device id of 03F0 201d instead of 03F0 1F1D

 

ravic - thanks again for posting this. after jumping into the advanced bios (i wish it was the default bios) i was able to goto the advanced options tab and enable SVM to turn on the virtualization extensions within the CPU.

 

awesome, at least some good came out of it.

 

SVM was there without enabling the advanced menus

 

hi, i'm following this thread since i'm hoping for some improvement over the crippled bios hp always provides with his laptops... if i could find you the hardware id of a minipcie ssd could you add it to the whitelist?

 

good luck... hope to be able to remove the blacklist so i can put in an Intel Centrino Advanced-N 6200 card for 5ghz N.

places selling that card say "For half size mini pci-e slot, Not for IBM Lenovo and HP machines."

i assume that's because of bios restrictions only, though.

 

Hi everyone,

I'm an 'almost" happy owner of a HP DM1..
model DM1-3100 (bought in BELGIUM).
I've read the service manual before buying this model, because I wanted to be sure I could install a 3G Mini pci-e card.
To my joy the manual had all the options already in it BUT to my surprise when I opened the DM1 : no sim card reader, no m-pcie slot and no atennas.
Has I already added these things to my old Aspire One (had same 'surprise') and ordered the missing pieces and soldered them yesterday onto the DM1.
BUT the only thing now : the Gobi m-pcie card is not found in OS.
I suspect that we (as for the Aspire One) need to shortcircuit 2 pins on the motherboard to activate wwlan slot.
SO, my question to you all : can someone put or send me some highdef pictures of the motherboard with m-pcie & sim card reader, so I can check with this motherboard and see where the difference lies in terms of pins.

I'm certain we can find a way to activate this slot, so all the 'unhappy' owners of a crippled DM1 can maybe add this on their own.

Thanks to you all.

Cheers,
Davy

 

sorry guys, dont have a Dm1Z anymore.

But in any case, i see that couple of requests have been posted at mydigitallife to mod the bios
Insyde bios mod requests.

Hopefully the experts will get it modded.

 

Yeah, its been weeks since I posted mine.
I wonder when HP started encrypting their BIOS files anyway.

 

They have been encrypting them for a while.

Hoever, they also signed the encrypted file with a signature file. What I dont know is how to create the signature file and sign it?.

Even the recovery process is looking for a signature file.

 

Would another option be to get InsydeBIOS.exe to not care if it is signed or not?

 

Yes, i think so.
The bios image file says that a sinature check has to be done and the insydeflash.exe does the check.

 

Probably quite dumb but if HP is the only manufacturer thats doing this could one use the exe from ASUS, etc?

 

Hi everyone,

Still looking for someone who can make some pictures of the mainboard with 3G or 2nd mini-pcie slot active on DM1Z.

I've attatched some pictures of my mainboard (no 2nd m-pcie slot and sim card holder - soldered myself the sim card reader and 2nd slot).

So, now I need you all to find a way to activate power to both (I found WWAN 1.5 text on the back of the mainboard - see picture).

If someone can help...electronic person or just a few ideas will be more than welcome to complete this hack!!

Thanks,
Davy

 

Wow, where did you buy this DM1z?

HP almost always uses a motherboard with the WWAN slots installed even when you dont order with one.

For starters, Here is a pinout for a mini PCI-E slot.
Mini PCI Express Bus Description; MiniCard Interface for the Laptop PC

The pins that are important for WWAN are 3.3v, GND, USB D+, USB D- and the SIM pins.
Typically SIM pins are already wired. Power is not wired. So you will have to bring power in from somwhere. Try to trace the line for the power pins and see if there is a capacitor or a resistor missing.

Sorry, i do not have a DM1Z, otherwise i would have take some pictures.

 

Hi Ravic,

I bought it in Belgium.. I think we all got the missing slot due to the fact that we have a very tight mobile network here..

SO, probably to let you buy a very expensive contract and stick at the mobile providers...

I knew we have to connect the power to the slot, and if you look at the picture you can see a WWlan 1.5v labelling, can you make anything out of it.
Because I'm not an electronic person (how can I trace it?)?


Thanks,
Davy

 

So let me get this straight, the purpose in modding the BIOS is to remove the blacklist/expand the whitelist of Wireless cards so we can get some 'N', right?

Are there more purposes? (SSD in the WWAN slot perhaps?)

 

Yes, the main purpose is to get some real N
And also being able to use any WWAN card.

mini PCI-E SSD depends on whether HP implemented the pci-e lines on the slot. they do on the WLAN slot. But not sure on the WWAN slot. We can only test after that mod.

 

Correct.

If the hardware allows it.

 

Great, ok, that makes more sense. Pretty exciting that there's an advance BIOS. Shame there wasn't a way to overclock (even by slightly).

 

Hi everyone,

Is there really nobody who wants to take a few pictures of the motherboard (with mini-pcie slot)?

Cheers,
Davy

 

Just too lazy to do it.

 

So I assume this BIOS is still unable to be whitelisted? I haven't been able to find an update anywhere on forums

 

You would be correct

 

I've taken some pics. Please move all of the discussions to the dm1z thread.
If this is getting somewhere I might take mine apart.

 

Davy28,

I'm a Swedish DM1 owner that suffer from exactly the same problem as you, namely the lack of WWAN connectivity on the European models. How far are you in your progress of getting the secondary mini-PCIe connector to work?

Regards

Zeke

 

Has anyone been able to get the HP Restore utility to even come up with Win + B? I do it with the USB and without just straight black screen blinking caps lock. My 3105m works fine just want to restore from current F13 which disables? advanced menus. So I wanna go back to F05 is whats on the website.

I can't get it to work I named it 01611.bin and 1611.bin but haven't tried bios.bin...

Placed in the the hewlett-packard\bios\current\ and all that jazz... am i doing something wrong?