Insyde hacking - New Vaio Z - Advanced menu in BIOS

@edit - Sony BIOS for new Z (VPC-Z) is now 0WNED!

@edit 2 - For even more advanced options (Overclocking, undervolting!!!) it is needed to disassemble setup executable to figure out where are those items stored. They are definitely inside the setup, but are not accessible even with this unlock.

VSS register which controls advanced menu is now: 0x258 (for old Z, it was 0x25A) - in advanced menu, you can configure SATA controller to IDE/AHCI/RAID, change lots of advanced features etc...

Now, I cannot share my bios dump as the serial number is inside. But I can give you info how to do it.

DISCLAIMER AND WARNING: This is HIGHLY EXPERIMENTAL and for EXPERIENCED PEOPLE ONLY - IF YOU ARE NOOB, PLEASE DO NOT TRY THIS! - YOU MIGHT BRICK YOUR (EXPENSIVE) DEVICE!!! It goes without saying that fiddling with advanced options CAN (AND MOST LIKELY WILL!) VOID YOUR WARRANTY! I AM NOT RESPONSIBLE FOR ANY PROBLEMS THAT MIGHT BE CAUSED BY THIS - USE IT ON YOUR OWN RISK! THIS IS FOR NEW Z (VPC-Z) ONLY!! IF you decide to enable Advanced menu, PLEASE DO NOT TOUCH FEATURES YOU DO NOT UNDERSTAND! YOU MIGHT MAKE YOUR NOTEBOOK UNBOOTABLE AND CONVERT IT INSTANTLY INTO A VERY EXPENSIVE BRICK!!!!

Also, VSS offset is for European Z11 and for the original BIOS version R1180C3 - this offset might be different for your new Z - if you are getting VSS errors with advanced_menu.py you will have to find your VSS offset. I suggest using d6z tools from here: http://thechaw.com/insydecodr (check main.py - but this requires python knowledge)

@edit - Treofred posted an easier way to do it, without Linux - so here are two guides:

######## WINDOWS WAY ######## (by Treofred)

Prep work (not as bad as it looks):

- make a bootable USB key with FreeDos. Go to http://unetbootin.sourceforge.net/ and download the latest version. It will allow you to make a bootable USB with FreeDos straight out of the box.
- Download Flash-it (disregard/remove the dash in each step) with the link in this thread and copy it to the key
- Download Portable Python from http://www.portablepython.com/wiki/Download (you want version 2.6.1 and not 3.0.1 since you need Unicode per your python script.)
- Install Portable Python to the USB Key
- Download your advanced_menu.py script from your first post and copy it to to the App directory in Python installation directory on the USB key

Do the patching:

- Reboot the Z to the USB key.
- Choose default boot options
- Switch to drive C: (cd C - this is not your hard drive but FreeDOS ramdisk
- perform "Flash-it dump.rom /g" process to extract the rom
- copy the dump.rom file to the App directory in the Python folder
- Reboot to Windows
- Switch to command prompt on the USB key, in the python directory and do the "python advanced_menu.py dump.rom new.rom" command
- Reboot to USB key
- perform "Flash-it new.rom /f" process to write back the patched rom


######## LINUX WAY ########

YOU WILL NEED:

1. Linux with Python (I used Ubuntu)
2. Insyde Flash-it utility (remove the dash in each step)
3. USB drive which is bootable (DOS)
4. Python files from: http://marcansoft.com/uploads/insydehacks/
5. Python file from this post (advanced_menu.py which is attached in advanced_menu.zip, just unzip it)

HOW TO DO IT:

1. Copy Flash-it on your USB stick, and boot from it
2. Backup your ROM with flash-it by: flash-it dump.rom /g (also, remove the dash in the command name)
3. Reboot into Linux
4. Copy dump.rom into directory where all python files are
5. Execute: python advanced_menu.py dump.rom new.rom -> IT SHOULD REPORT NO ERRORS!!! IF YOU GOT ERRORS PLEASE DO NOT FLASH!!!
6. Copy new.rom to your USB stick
7. Boot from USB stick again, and flash your new BIOS: flash-it new.rom /f (remove the dash in the command name)
8. You're all set - go to BIOS setup with F2, and you will see nice advanced menu

IT DOES NOT WORK?

If you are getting VSS errors trying to run advanced_menu.py, you need to find your VSS offset because it might be different in your BIOS. You can use d6z's main.py - but you will probably have to edit it a bit (dumpsetyp.py is missing operand 0x27)

If that is too hard for you, you can also try to locate VSS offset with hex. editor - search for this hex sequence: 24 56 53 53

Also, I added complete dump of setup options - they are in vpc_z.txt, attached with this post.

 

I see stuff for GPU overclocking and VID override... we have to have access to this

 

Unfortunately, tools to disassemble Insyde setup data from

http://marcansoft.com/blog/2009/06/enabling-intel-vt-on-the-aspire-8930g/

Will not work on this one, many new opcodes seem to be added.

And, 'advanced' menu is now called 'debug menu'.

There is also TDP configuration for Turbo Boost inside..

 

What about IDE and AHCI mode? That would ease up things with SSD's.

 

That's in, too - controller can be set up in AHCI, RAID and IDE as it seems.

Check the setup binary - all is in in unicode text format.

There is also an internal EFI shell... This must be cracked

Bad news: looks like VSS register 0x25a is not responsible for Advanced Menu anymore - we have to parse the setup string table...

 

interesting stuff! do you think in there somewhere lies the answer to the question of life, the universe, and battery drain?

 

Latest EzH2O is seeing all options!

Unfortunately it crashes every time I try to patch it..

@I am installing XP in the virtual machine... maybe it will work there

 

Sure --> 42

 

Of course, it's 42

Check the attached picture... this is just a preview of things to come

 

who knew Doug Adams would foresee battery drain !!!! What a genius

 

Btw,

There is an option called "DebugReclaim"

I think I know what is it for

 

I like the size of that scrollbar

 

Yep

This time, it is >HUGE< - old "Advanced" menu from old Z is nothing compared to this. Looks like Calpella platform has much more nice things to play with

 

This is the first time I feel jealous about the new Z

 

InsydeH20 crashes in XP, too

Oh well.. back to the drawing board.

 

psyq, is InsydeH20 a BIOS/EFI emulator? I read this but I'm not sure I could get through all the marketing speak...

 

InsydeH20 is a full-blown EFI, but it also has legacy (BIOS) emulation

 

Can i disable Hyperthread feature ?

 

Yes, you can:

443 - Enable/Disable Hyper-Threading

That is, you will be able to as soon as we manage to unlock these options

 

OK, I can edit VSS now, tried to disable VT - and it worked

So, the only thing left is to figure out which value should be used for enabling this menu...

 

More interesting stuff:

- Memory frequency goes up to 1333 MHz
- QPI speed is set to "Auto" but it can go to 6400 GT
- There is VT-D support available
- There is also complete fan control
* Low speed fan temperature (55C)
* High fan speed temperature (70C)
* Throttle On temperature (93 C)

IDE controller (option 0x39) can be configured as "RAID" or "AHCI" or "IDE"

I can "poke" these options with modified vtenable.py from the link provided before already

 

Wow memory frequency is very interesting but why intel states in website that arrandale only support 800/1066
http://ark.intel.com/Product.aspx?id=43560

Fan control also is very very interesting too.

 

It's great that they didn't stuck a read-only bit like they did for the VT originally in the previous iteration Z BIOS.... and you could only peek, no poke

 

Ah no,

VT setting was fully read/write in the VSS - you could enable it by poking to the VSS register. If it is disabled in VSS, BIOS (EFI) will "lock it off" during boot and resume. You are confusing VSS (EFI setup) register with the CPU VT flag, which is controlled by BIOS/EFI

Looks like setting "DebugReclaim" to 1 will not enable advanced menus to be visible.... must be something else as well... Now if I could only make this EzH2O thing to patch the BIOS...

I just increased FanON temperature from 55 to 65C and FanHigh from 70 to 75C... let's see if this will shut this thing up...

 

Unfortunately, no... the fan does not stop even if the FanON temperature is raised to 65C

On the other hand, I still don't know what is the sensor which is being used for this check... maybe temperature is higher than 65 C (CPU is 48)

 

Setup options disassembled:

http://pastebin.com/bg3At2rt

 

Hi, Psyq321!

I'm sorry that I'm unable to assist, but seeing your cool work is very impressive! Well done!

Cheers!
Mark

 

Sony BIOS is now 0wned.

I cannot post my bios dump, as it contains serial numbers... who knows, maybe Sony would try some DMCA tricks or whatever.

But I posted instructions how to do it. It requires bit more knowledge than for old Z, because EFI boot is disabled by default.

 

I don't think messing with all these options will make the Vaio Z any better. Maybe changing to IDE or AHCI will give you more options but I think leaving the rest is best.

 

Yep - I second that.

The only useful option is the SATA controller mode - by configuring it to IDE, we can use HDDErase to perform secure erase of the SSD.

 

Waiting for your instruction

I want to turn off hyperthread feature very much ^^

 

Instructions are posted in the first post.

However, they are very advanced. Unfortnately I cannot distribute my ROM dump as it contains user-identifiable information (serial number, etc...) - maybe someone has info what info to remove from it to be anonymous.

You will have to do it by yourself (you will need: Linux, Python and Insyde flash1t tool)... Or wait that someone does this and posts a BIOS without serial number info inside...

If you do it - disable hyperthreading option is in Power -> Advanced CPU Control

 

Oh it seems the harddest part for me is to get Linux.

So I can install in VMware or use liveCD right?

 

I am always using VMWare Player... so yeah it works. But please be careful and do not flash under any circumstance if you get any errors!

 

I'm run the python code on mac osx vmware in vaio z and get this result


So it look fine to flash it ?

 

Yep, this looks like it worked - it shows that it modified the VSS register 0x258 successfully.

--

Also, it looks like features like UEFI boot are still locked out - if you look at the setup dump, form processor is using Opcode 0x27 which is called "EFI_IFR_VARSTORE_DEVICE" - it points to some other configuration store...

 

WoW, Finally i got it

Thx u very much psyq321 for the best guide ^^

Here is some screenshot after enable advanced option

 

You are welcome!

Also, there seem to be even more hidden menus - like Overclocking!

Looking into the setup binary there are options for manual voltage override and overclocking... Jesus, this is like, what, ASUS "Rampage" kind of motherboard... who would think of a laptop with such powerful configuration options inside

But those menus are not accessible even with the advanced unlock - and dumping the setup string table does not show them. There is this thing, called "DebugReclaim" but it still does not show them.

I suspect the Opcode 0x27 is here at play, too... thing is we cannot even dump these yet... gotta hack more

@edit - bloody hell, I am just reading the "VID Override" description, this thing can be used for automatic undervolting straight from the BIOS...

 

Now that the new Z's EFI has been cracked open, was this enthusiasm speaking, or has InsydeH2O been changed to becoming fully EFI for the new Z?
For the old Z, it can't boot GPT partitioned drives like EFI is supposed to, only MSDOS MBR partitions. (Of course, this may be Yet Another Sony Crippling)

 

No, not yet.

UEFI boot is controlled by something outside of VSS

Even if I enable it by setting the VSS flag, it still does not work.

It is related to the infamous "Opcode 0x27" - which is used to check whether to enable this one or not. I suspect the same thing is used to enable/disable overclocking, VID override and Extreme Edition CPU support. All those things are in the setup executable, but not really accessible yet.

Note that next version of IDA Pro disassembler will support EFI bytecode - so I guess then we will have more tools to play with

 

Just wondering what will happen if i changed memory speed to 1333 ?

Will someone dare to try?

 

Please don't do it - it will most likely not work, and it could permanently render your notebook unbootable.

 

Thanks psyq321 for your excellent work. BTW, can I flash the mod and reflash the original BIOS afterwards?

 

following every post here with lot of interest. awesome work After you guys r done, can someone post the simplest way of doing this (ie enabling other modes) with the steps to a novice like me. Thanks mucho

 

OMG!!! I can now see the advanced options. Thanks psyq321!!

FYI mine is an Aussie model VPCZ117GG.

 

I wonder if this is possible for the CW27FX? !?

 

Does the bios have SLIC 2.1 ?

 

Yes, of course - just keep the original backup dump. You can simply flash it with Insyde tool again.

As for SLIC - all VPC-Z notebooks come with Windows 7 licensed.

@ozbimmer, it is simple to check, afer you dump the bios and try the advanced_menu.py - if it does not complain, it means the BIOS is the same. If it does complain - you will have to find VSS offset.

 

Thanks, psyq321.

I have a problem thou - In IDE mode Windows only recognises two out of the 4 ssd available. Also, I was unable to get HDDerase to detect the ssd. I also notice for each drive the security mode is at "No Accessed" state. Are you able to tell me what it is about?

Thanks.

 

I have to investigate about 2 visible discs... maybe Sony has even more "custom jobs" there with the quad ssd

As for the HDDErase... this might be a bad sign. If I remember correctly, even in old Z it was not possible to run it. Maybe the IDE emulation Insyde is doing is not complete, or it just does not play well with HDDErase.

PS - looks like USA Z has the same BIOS. Finally, Sony has started shipping identical systems worldwide