Sony Vaio Z2 (2011) Advanced Menu BIOS Hack

Sony VAIO VPC-Z2 (2011) BIOS hack available


Update (03-27): New pre-hacked BIOS version available as regular BIOS update (serial numbers etc. will be retained with this patched BIOS update)

____________________________________________________


After all the hacking I did to my Z1, I finally looked for a new challenge. I decided to have a deeper look at the Z2's BIOS. I disassembled the BIOS ROM with the help of the TianoCore UEFI devkit and I thought, why not unlock the advanced options we already have on our Z1's?

Well you can imagine what happened. Now it looks like this:




Some very interesting options are available to you now. I hope you'll like it. I am also open to any new hack of other BIOSes or platforms. Just drop me a line.

Before I forget it: The disclaimer
This project is 100% spare time driven. There is no warranty or support at all. Don't use this if you are unexperienced with computers. All you do with this BIOS is on your own risk! Flashing is a dangerous process. Make backups of your data. Your warranty may void with flashing this hack. Don't fiddle around with settings you don't understand - you may brick your laptop. All settings in BIOS get stored in the flash rom. Disconnecting the RTC battery will NOT reset the BIOS settings since they are non-volatile. If you fail, there is no return since BIOS recovery is unavailable to the Z2.

You have been warned, now let's have some fun!

Some brief background info for the tech people:
The BIOS is a InsydeH2O BIOS with tianocore module compression. There is a big setup utility (multiple languages) stored at 0x111068 in the BIOS file (length) 0x9705C. If you disassemble it you will notice that BIOS does not check a VSS variable in the advanced options suppress-if condition (like on the VPC-Z1, variable 0x258), it refers to opcode 0x27 instead. This opcode returns true so the advanced options get suppressed completely. I changed this instruction to the opcode 0x28 that returns false so the full options get revealed. In the BIOS ROM, nothing more than one byte was changed (0x27->0x28 in the suppress instruction). 25% of the BIOS ROM appears to be changed, this is a result of the tianocore compression of the 600kib setup module.
Not ALL options are unlocked, some still depend on VSS variables but did not seem important to me. Have a look in the detailed Z2 BIOS options table here.

__________________________________

Prerequisites:

Create a backup of your stock BIOS - you might need it later for warranty reasons etc.:

- Download this BIOS Backup tool
- Extract it and run the contained file dump_BIOS.bat. Read the note and confirm. Then you will find the Backup Image as DUMP.ROM in the same directory.





____________________________

Flashing process:


Close all running applications. Charge your battery and leave your AC adaptor plugged in until you are finished.
Download the attached file and extract it to your local disk drive. Navigate to the directory with the unpacked BIOS package and run WBFLASH.exe as Administrator.

Press Start and follow the screen instructions. After the flash completed, reboot your laptop, enter BIOS setup and load defaults. Chose your individual settings and have fun!

____________________________________

Acknowledgements:

cherrybombaz - volunteer tester - thanks mate!
psyq321 - Z1 BIOS hacker
northox - provided me with his Z2 BIOS dump that led me to the breakthrough
lovelaptops - kept me motivated to do the hack and to search for new adventures - thanks buddy!
TTAV134@mydigitallife - author of background info that helped me hacking the Z2 BIOS
davidxxw@mydigitallife - author of universal bios backup tool
Sony - thanks for the BIOS maze, that was really fun!
NBR - thanks for hosting this community!

 

Thank you for the info detail! I've been digging around the Vaio SA UEFI with some heavily inadequate tools (my google/bing-fu is really bad, now ).

 

This smells like we may have freed another nice laptop from its bad driver support!

 

Nice work. The question is, do you have the guts to start messing around with those graphics settings?

 

Great work - all working perfectly here...

 

" lovelaptops - kept me motivated to do the hack and to search for new adventures - thanks buddy!"

You are way too kind, my friend, but I can only say this:

Those who can do, do. Those who can't - and can't teach - are left to inspire the greatness that surrounds. Anonymous

Nice work - and without even having your own Z2 to test it on! Thou rock!

 

will this allow you to always have the backlit keys on?

 

That is really cool.

Thank you very much.

 

I can't test, but there ARE options to control the EC (Embedded Controller) and the LEDs - Polling interval, LED switches etc. As there is NO software way to keep keyboard backlight on (hardcoded timeouts in the EC), perhaps these options bring the solution to this.

@ZoinksS2K, try that if you like, perhaps finally you get your request resolved.

 

Here's a video: Vaio Z2 Bios Hack Advanced Menu - YouTube

 

Worked like a charm. Did not have to browse for the BIOS image. It was present in the textbox automatically.

First tweak: Changed panel depth from 18 to 24 bits. Probably just my imagination, but the screen does look a little brighter.

 

Im with beaups.

Would like to see how this open door effects the ability in pushing the PMD.

 

Hey everybody,

This guy >>> pyr0/100% laptop dynamite

He deserves to have his Rep bumped way high.

'nuff said.

 

Hmm?
Malware found in "Universal Bios Backup Toolkit 2.0.exe"
Virus or malware "TR/Agent.ukb" found.

anyone else got this warning?

 

Can you change the PowerXpress Settings? On my notebook there is only one option: "Muxless Fixed Scheme Only".

How can I disable the internal intel card?

 

The picture shows the PCI Express card only (the PMD) the internal card has an own menu. Handle with care!

 

do you know, where to get information about the menu?
f.e. what is PEG, ASPM, etc?

thanks
gyhor

 

Every item has a help text on the right. If this does not explain the option enough, you have to look in the internets.

 

^Do you think it's possible to make two external monitors work with Intel graphics only by messing with the graphic settings?

 

Great job @pyr0!

Interesting, it is possible to enable VT-d, same as in old Z notebooks... I wonder why they keep it disabled.

It is also possible to change the DDR3 speed (1066 MHz - 2133 MHz). I am not going to try any of that as I already bricked the Z once in the past. I suppose this will not work anyway with the stock RAM, and since RAM is proprietary anyway this option is probably useless right now.

If Sony starts shipping faster DDR3 (e.g. with Ivy Bridge refresh for Z) then maybe it will make sense for people that want just to upgrade to faster DDR3 by buying newer Sony DDR3 modules.

Also, overclocking lib is there - but tweaking of the turbo options is going to require poking VSS registers directly.

 

No big deal at all since we got full control over the entire BIOS including VSS registers.

 

JFYI - do not attempt to increase the aperture size of the internal GPU to 512 MB - it will result in an unbootable system (at least with my Z).

 

^Were you able to recover or reset CMOS or?

 

Fortunately, it allows you to enter the EFI after ~30 seconds of pooling something - which was a big relief, as I was already seeing my Z2 on its way to the repair center.

eGPU works all the time - you can even see 'Operating system not found' message if you connect the PMD, so I suppose it is just one of the unused and untested EFI options that breaks something else, and nobody @Sony bothered to check that.

My bet is on some memory mapping that is fixed, and gets trashed by the enlarged eGPU memory window.

 

Dose This Work On Vaio, Bios R019020 ?

 

Hi! I've seen this video:

So, this means Vt-d is not enabled by default and the only way to get it enabled is to hack the BIOS?

If you think that Sony released an old laptop (SZ330P) without the possibility to enable even the Vt-x, even if it was supported by the CPU, we can consider ourselves very lucky that at least such possibility is given!

 

No, you can also hack only this single setting.

 

Thanks for the information. I bet that this is explained somewhere, but I've missed it. A procedure similar to the one described in the first post would be necessary?

 

Yes! me too!

 

There is no malware inside. Nevermind, I dropped the Backup tool in my manual and created a batchfile that uses the original Insydeflasher tool. This is 100% safe. See the instructions.

 

Many thanks pyr0. Just a question to be sure it is OK. My notebook is of course a Z2 laptop but it's VPC-Z21X9E the exact model name. Is it safe to hack the BIOS with your method?

Furthermore, I would like to do steps 1,2 and 4 but I don't understand what you mean with: Service Tag Number.
Model number, ok, it should be VPCZ21X9E (I guess without the "-"). Serial number, I know what it is ... but I have a doubt on service tag.

Here's a screenshot of my system info (it's in Italian )


I guess service tag number would be Service Number (Numero di servizio). Of course I don't see any alternative, but just to be sure.

Thank you.

 

^
Model Number : "Modello"
Service-Tag Nr. : "Numero di Servizio"
Serial Number: "N. di Serie"

If you have a look on the number structure in the hex editor picture in post 1, you will see from the format of the numbers that there is no other combination.

 

Thanks, it's clear now!

 

OK, BIOS successfully hacked. Thank you.

Anyway, I had a heart attack, because when the process has finished, the InsydeFlash.exe automatically closed and I've manually rebooted. Then the fan went to the maximum speed and the screen was totally blank.
I pressed the power button to power down the notebook and switched on again.
Fortunately nothing bad happened and the BIOS is OK.

Very scared.

EDIT: by the way: what about the old BIOS restore, just in case of warranty purpose?

 

Just download the latest BIOS 'update' from the Sony driver site. Do the 'update' and you'll be back to a factory fresh BIOS Couldn't be easier!

 

Thank you very much Ambroos.
I guess it is also possible to use InsydeFlash.exe with the DUMP.ROM file once it has been ranamed. Isn't it?

Sent from my HTC Desire S using Tapatalk

 

I don't believe there are any BIOS updates for the Z2 series yet.

 

Yes, you are right actually! I didn't find one so far, but since Ambroos said that it was possible to restore using such practice, I couldn't say nothing about that.
In any case I think you can rename the DUMP.ROM to R0170H5.FD, replace the old R0170H5.FD after making a backup copy, and launch InsydeFlash.exe then reboot and load default values in the BIOS setup.

 

This is 100% correct.

 

Hi Pyro,

great work for this bios hack!!!

Tomorrow I'll try it.. but one question: in original bios is not possible to switch off completely raid controller.. is it possible with this hack?

 

Yes it is. I've done it.

 

^perfect!

Since I wanted to do some hot stuff with various OS

 

I perfectly understand!
I use VT-d with XEN and I had to install the hacked BIOS on the purpose.
Now I have 3 OSs (1 on external USB drive)

 

Guys, I was trying to install WIN8 (or WIN7 +UPGRADE) on one ssd in GPT. But it doesn't work.. is there some hack options to be activated to do it?

UPDATE: avoided the problem using a VHD volume file into the GPT partition..

 

Hi Pyr0.
Are you going to hack R0172H5 as well?
Keep up the good work!

 

Thanks for the info, I will upload the modified BIOS upgrade and update the first post later.

 

Many Thanks!

 

So this means that there is a BIOS upgrade for ours Z2. Isn't it?

 

Yes there is!

 

Good. Waiting for the hacked version of the new BIOS then!