Samstag, 20. August 2016

Dell Vostro 3350 - A10 - Bios Mod v0.1

Hey,
i edited an AMI Aptio 4 IV Bios.

First of all - Features:
  • CPU Microcode Update
  • LAN Rom Module Update
  • PowerManagement | Sandy Bridge with ME 8.xx, Ivy Bridge
  • Engineering Menu
  • UEFI Boot Options
  • UEFI Shell

Start


Download the BIOS from the following Website:
Dell Homepage
Direct Link

execute the following command to extract the BIOS rom file:
3350A10.exe /writeromfile


CPU Microcode Update

LAN Rom Module Update


Download UBU Tools from here.

Copy the BIOS Binary into the UBU Folder and execute UBU.bat file.

The Tool will disassemble/analyze the BIOS and shows you what modules can be updated.
In my case i updated the Microcode of the CPU and the LAN Rom Module.

To update the LAN Rom Module press 3 and then 1.

* Update OROM Realtek LAN PXE Device ID 8168 ...Ok!

OROM Realtek Boot Agent GE - 2.64
Press any key to continue . . .

To update the CPU Microcode press 7 and then 1.

Select Microcode for CPU IvyBridge (LGA1155)

Select the newest Microcode

Select Microcode for CPU SandyBridge (LGA1155)

Select the newest Microcode again

Generate FFS files Microcode
Found 1 module(s).
Update Microcode Patch...Ok!
+-----------------------------------------------------------+
|No| CPUID | Platform | Version | Date | Size Hex |
+--+----------+----------+----------+------------+----------+
|01| 000306A9 | 12 | 0000001C | 26-02-2015 | 00003000 |
|02| 000206A7 | 12 | 00000029 | 12-06-2013 | 00002800 |
+-----------------------------------------------------------+
MPDT None

Attention!!!
Check the address in the _FIT_
Address mCode + Size mCode = Address next mCode

Press any key to continue . . .

PowerManagement | Sandy Bridge with ME 8.xx, Ivy Bridge


Next, we will enable the Powermanagement on this Notebook.

Download UEFIPatch.

Execute the following command:

UEFIPatch.exe bios.bin
patch: replaced 10 bytes at offset 273Ah 75080FBAE80F89442430 -> EB080FBAE80F89442430
Image patched

UEFI Boot Options

UEFI Shell


Download another BIOS rom file from the Dell Inspirion N5110 Mod on Insanelymac:
Thread
Direct Link

Start MMTool from the UBU Directory.
You will find here a guide howto work with MMTool (insert, extract, delete modules...).
Extract the following modules from the Dell Inspirion N5110 BIOS Mod file:
  • EnhancedFat
  • ExtFs
  • HfsPlus
  • NTFS
  • PartionDXE
  • HermitShellX64
Open the Dell Vostro 3350 A10 rom file to insert this modules:
  • EnhancedFat
  • ExtFs
  • HfsPlus
  • NTFS
  • PartionDXE
  • HermitShellX64

ePSA (Dell Enhanced Pre-boot System Diagnostics)

Extract the following module from the Dell Inspirion N5110 BIOS Mod file:
  • 0A602C5B-05A0-40C4-9181-EDCD891D0011
Delete the existing module with MMTool on the Vostro 3350 Bios and insert the ePSA module.
This will update 4210.3 to 4213.5.
Do you know a newer version? Share it with me :).

Engineering Menu


Extract the setup module !uncompressed! from the Dell Vostro 3350.
Open the setup module with a hex editor.

Search for the following hex code:
010100010101000000000000
Replace it with that hex code:
010101010101010101010101

CRC Fix - Workaround

Problem: I don't know how the crc checksum inside the module will be calculated.
There will be following error messages will be shown:

However, i found a workaround.
First delete the original setup module with MMTool inside the original 3350a10.rom file,
after that insert the edited uncompressed setup module. (there is enough space in section 01).
Extract the edited uncompressed setup module again.
This will fix the crc checksum at the beginning of the file.
You can compare the file with a hex editor.
before: D7079489FE99D8439A2179EC328CAC214E9A
after : D7079489FE99D8439A2179EC328CAC214E93
Open the rom file which u are modding.
Press the Insert Button on MMTool,
choose the uncompressed edited crc-fixed setup module and insert it in compressed form.

Flash It!

That's it, you can flash the BIOS now.
You will find here a guide to flash it.

I personally prefer to flash it over DOS.
The Tool RUFUS can help you to create a bootable usb stick.
I create a Bootstick with FreeDOS and put the following files on it: afudos.exe , 3350a10mod.bin

afudos 3350a10mod.bin /P /B /K

Optional:

Install Windows 10 in UEFI Mode on a empty HDD/SDD

Make a USB Stick to boot Windows 10 -> Download it from here.
Use the windows 7 usb dvd download tool for that.
Press F12 to show the UEFI Boot Options and select the UEFI Entry for the USB Stick.
Follow the install wizard.

To control if the Windows 10 Installation on UEFI Boot Mode was successful you can start a command line as administrator (right click).
Type following commands:
  • diskpart
  • list disk
This will show you all disks and the partition table that was selected.
If a star appears in the GPT row, everything is fine.

Intel Management Engine Firmware

You can additionaly update the Intel Management Engine Firmware.
as far as I know you can't integrate it inside the BIOS.

Todo:

  • VBIOS Update
  • AMIBCP compatibility
  • Enable additional menu points in the BIOS.
  • - e.g. Fast Boot
  • Update Dell Enhanced Pre-boot System Diagnostics (ePSA)
  • ACPI Fix/Clover|Powermanagement Fix

Progress: Enable additional menu points in the BIOS

First of all, download the Tool IFR Extractor:
https://www.bios-mods.com/software-releases-and-updates/2014/01/universal-ifr-extractor/

Choose the Setup Module from the BIOS.
Save the Text-File for analyze.

I switched the following bits in Hexeditor:
0A 82 46 02 <- true to 0A 82 47 02 <- false 1E 82 46 02 <- true to 0A 82 47 02 <- false However, only checkboxes for disable/enable stuff will be shown in the UEFI if i flash it again. Looks like the labels are missing? I don't know. Need some tipps :).






Progress: AMIBCP compatibility


Florin9doi also edited some other modules:
  • CORE_DXE
  • ReFlash
  • AMITSE
  • CSMCORE
  • SETUP
But i don't believe that all this modules are neccessary for the AMIBCP Tool compatibility.
I wrote with him a PM and he means, that i must cut some too long strings.

Progress: VBIOS

Had some problems with a script.
Can anybody tell me something about this error?

Progess: Clover / ACPI|DSDT Fix / Powermanagement Issues


Clover

My goal was to start Clover on this Notebook to override the ACPI on boot process.
I would like to use Clover for ACPI debugging purposes -> replace everytime the ACPI table of my UEFI binary and flash it again could be really annoying.

For that, i created a USB Stick with BootDiskUltility.
However, it was not possible to add any boot options | boot files from the Boot Maintanance Manager.
This happend, because following modules were missing:
  • EnhancedFat
  • ExtFs
  • HfsPlus
  • NTFS
  • PartionDXE
  • HermitShellX64
I followed this guide to boot the bootx64.efi file from my usb stick after i inserted the modules.
However, no success - the Boot Maintanance Manager is booting, but i still can't load boot files from the EFI partition from the USB stick.
But wait, it shows me the UEFI partition from my Windows installation.
I booted Windows, started the commandline as administrator (right click) and mounted the partition with the following command:
volmount z: /s
After that i copied the efi/boot/bootx64.efi file from usb stick to the HDD/SDD:
xcopy d:/efi/boot/bootx64.efi z:/bootx64.efi
Start the Boot Maintanance Manager from USB stick and select the bootx64.efi file from HDD/SDD.
Works for me.

ACPI|DSDT Fix / Powermanagement Issues


I requested a fixed ACPI from arthur-pt on olarila.com.
Compiled it inside my Linux Kernel for testing purposes, but it will freeze my notebook :/.
https://wiki.archlinux.org/index.php/DSDT

Other research results
http://www.tonymacx86.com/threads/vostro-3350-lion-ok-geting-tuning.50221/
http://www.osx86.net/files/file/2154-dsdtaml-for-dell-vostro-3350/
http://www.osx86.net/files/file/2130-extra-for-dell-vostro-3350/

UEFI Revovery

Manual UEFI Recovery

I inserted in the Boot Block Section (Section 02) a module.
However, i think there is a checksum or something for the hole section that was invalid now.
I flashed the UEFI and the device didn't start anymore.
Got only a black screen and a repeating beep code (1-1-1-1-1-1-1...).
In the boot block section is the emergency recovery module.
so this is the point, where you can only flash the sop-8 chip manually.
First of all, you must remove the mainboard from your notebook.
Take a look at this guide for this procedure.
Remove the CMOS battery for safety purposes.

The flash chip is in the near of the wifi card port.



google for the chip designation and search for a specifcation sheet.

I can't describe the flash procedure for your notebook, because i don't know what flash device you are using.
however, you will need the following pins for the flash procedure: VCC, CS#, SO/SPO7, GND, SI, SCK

map it to the ports of your flash device and use the original bios binary for reflash process.

Boots again. :)

Software UEFI Recovery

Didn't work for me. :(

you can extract the recovery module in the boot block partition (02) of the UEFI module.
open it up with your hex editor, you will find the names for the rom or hdr file there.

first of all, disconnect the cd-rom and harddrive phsyically from your notebook.
warning: the connector for the harddrive is a little bit fragile ->
pull on the right and left foots to open it up.
now pull the ribbon cable out.
if you are unsure, you can use this owner guide from the dell website.

format a usb stick with RUFUS:



Select first the USB stick you want to format.
Warning: All data on this USB stick will be lost.
Use MBR partition scheme for BIOS or UEFI, FAT32 (Default), Cluster Size 8192 bytes (Default).
The volume label doesn't matter.
Set a tick at quick format.
Untick "Create a bootable disk using..."
Untick "Create a extended label and icon files"

Download the UEFI version that was at last on your notebook.
if it was version A07, then download A07.
if it was version A10, then download A10.

Extract from 3350A10.exe / 3350A07.exe the UEFI file.
Open up a cmd and enter the following command: 3350A10.exe /writehdrfile
Rename the rom file to 3350.hdr and move it on the usb stick.

Disconnect the battery from your notebook.
Plug In the pendrive.
Press the end key and hold it down.
Connect the charger (still hold END).
The notebook starts automatically and shows the recovery screen.
Press enter and wait until finish the flashing.
Press any key to restart.
The first restart attempt wouldn't be successful.
The second one would work.
Give it a little bit time between the start attempts.

Credits

Thanks is going to Florin9doi and all other BIOS Modders who modded the Dell Inspirion N5110 Bios. :)

Freitag, 2. Oktober 2015

OS X 10.11 El Capitan - Hashes

find Install\ OS\ X\ El\ Capitan.app/ -type f -print0 | sort -z | xargs -0 shasum | shasum
bf84d7eb8e42f144c66b4ca4e9b72a1a5563b29c

find Install\ OS\ X\ El\ Capitan.app/ -type f -print0 | sort -z | xargs -0 md5 | md5
58a7c34eb5d52b9ba459982587fa46cc

Montag, 20. Juli 2015

Kindle Paperwhite 2 teardown

Kindle Paperwhite 2 – 4 GB – WLAN Edition – Teardown
Damaged my Paperwhite 2 several times while opening.
So I decided to write up a tutorial.
needed tools:
hair drier with essay
comodon squeezer (very good for leverage + cheap)
Credit card



1. TAKE YOUR TIME ON EVERY STEP.
Please read the complete tutorial before beginning teardown your device.

2. This is the right place, to leverage (there is a recess area on this place)
The gap dimension between the frame and housing is 0,15 - 0,2 mm (measured with a feeler gauge).
So if you get a piece of stable metal (like a comodon squeezer) with this width you can open up without damage.
Doesn’t push the lever too deep in y direction – height. You are risking to damage the display.

3. Heat up the area with your air dryer (till the glue begins to melt).
(There was no damage on the plastic after I heat it up between 60-70 C°.

4. Push your credit card between the frame and housing. Remove the lever and doesn’t use it anymore.
(This step will safe against damages).
Ride over the upper area (heat it up again if it’s not hot enough).



Be also careful not to damage the frame overhang.
If this happen, you can’t close the kindle anymore.



Heat up this area (till the glue begins to melt).
I used the upper framepart as pull of help.
Optional: push up your credit card under this area. (Not to deep – you are risking to damage the display).

Be careful in the lower left area (there is a ribbon cable (heat this area also up!!))



5. Heat up this area. (till the glue begins to melt).
I used the upper framepart as pull of help.
Optional: push up your credit card under this area. (Not to deep – you are risking to damage the display).

Be careful in the lower right area (there is a ribbon cable (heat this area also up!!))



6. Most critical part:
Heat up this area WELL. (till the glue begins to melt).
There is many many glue in this area.
I doesn’t recome to use any additional tool (credit card or lever).
You are risking to damage Chips or LED’s.
I used the left and right framepart as pull of help.
Heat up again if it’s not hot enough.



7. Screws

The rest is easy peasy.
Congratulations!! :)

Original Post: http://www.mobileread.com/forums/showthread.php?t=258624

Sonntag, 7. Juni 2015

Mac OS X 10.10 (Yosemite) - Mac Pro 1.1 - Repair recovery partition automatized

Heyyo Dudes,
i automized a script to repair the recovery partition
- done it several times on a mac pro 1,1
- so i had no lust to do it over and over again after every update per hand.
can someone try the script out to confirm that it works well?
the only thing what made me concerns are the permissions.
maybe somone can proof them before and after execution.

Warning:
Please proof with 'diskutil list' if the script is executed on the right partition.

#!/bin/bash
sudo su
diskutil mount /dev/disk0s3
cd /Volumes/Recovery\ HD/com.apple.recovery.boot/
/usr/libexec/PlistBuddy -c "Add :SupportedBoardIds: string 'Mac-F4208DC8'" PlatformSupport.plist
/usr/libexec/PlistBuddy -c "Add :SupportedBoardIds: string 'Mac-F4208DA9'" PlatformSupport.plist
/usr/libexec/PlistBuddy -c "Add :SupportedModelProperties: string 'MacPro1,1'" PlatformSupport.plist
/usr/libexec/PlistBuddy -c "Add :SupportedModelProperties: string 'MacPro2,1'" PlatformSupport.plist
hdiutil convert BaseSystem.dmg -format UDRW -o ~/Downloads/BaseSystemUDRW.dmg
cd ~/Downloads
chmod 777 BaseSystemUDRW.dmg
hdiutil attach -readwrite BaseSystemUDRW.dmg
# Piker-Alpha_bootloader_-_black_-_build_3b402a9
curl -o piker.zip 'http://forums.macrumors.com/attachments/boot-black-zip.511172/'
unzip piker.zip
chmod 644 boot.efi
cd /Volumes/OS\ X\ Base\ System/
rm -rf /System/Library/CoreServices/boot.efi
rm -rf /usr/standalone/i386/boot.efi
cp ~/Downloads/boot.efi /System/Library/CoreServices/
cp ~/Downloads/boot.efi /usr/standalone/i386/
cd /Volumes/OS\ X\ Base\ System/System/Library/CoreServices/
/usr/libexec/PlistBuddy -c "Add :SupportedBoardIds: string 'Mac-F4208DC8'" PlatformSupport.plist
/usr/libexec/PlistBuddy -c "Add :SupportedBoardIds: string 'Mac-F4208DA9'" PlatformSupport.plist
/usr/libexec/PlistBuddy -c "Add :SupportedModelProperties: string 'MacPro1,1'" PlatformSupport.plist
/usr/libexec/PlistBuddy -c "Add :SupportedModelProperties: string 'MacPro2,1'" PlatformSupport.plist
cd /Volumes/OS\ X\ Base\ System/System/Library/CoreServices/com.apple.recovery.boot/
/usr/libexec/PlistBuddy -c "Add :SupportedBoardIds: string 'Mac-F4208DC8'" PlatformSupport.plist
/usr/libexec/PlistBuddy -c "Add :SupportedBoardIds: string 'Mac-F4208DA9'" PlatformSupport.plist
/usr/libexec/PlistBuddy -c "Add :SupportedModelProperties: string 'MacPro1,1'" PlatformSupport.plist
/usr/libexec/PlistBuddy -c "Add :SupportedModelProperties: string 'MacPro2,1'" PlatformSupport.plist
hdiutil convert ~/Downloads/BaseSystemUDZW.dmg -format UDZO -imagekey zlib-level=9 -o BaseSystem.dmg
cd /Volumes/Recovery\ HD/com.apple.recovery.boot/
rm -rf boot.efi
rm -rf BaseSystem.dmg
cp ~/Downloads/boot.efi /
cp ~/Downloads/BaseSystem.dmg /
chflags uchg boot.efi

add execution permission in terminal to the script:
chmod +x repairrecovery.command
Execute it with doubleclick.

macrumors.com

Mac OS X 10.6 (Snow Leopard) - Teamviewer - Wartungsskript

Hey Leute,
supporte zur Zeit öfters Mac OS X Maschinen over Teamviewer -
leider war die support experience für den Arsch...

Das Dock (vergrößern, verschwinden...)
sowie der Finder (Minimiereffekte...)
sind ja mit zahlreichen Effekten versehen -

das führte bei mir immer wieder zu Missclicks
- ein flüssiges Arbeiten war kaum möglich.

Deshalb dachte ich mir - bastel dir ein Script:

#!/bin/bash
#User Script
defaults -currentHost write com.apple.screensaver idleTime 480
defaults write com.apple.Dock mineffect suck
defaults write com.apple.dock autohide -bool true
defaults write com.apple.Dock orientation -string right
defaults write com.apple.dock magnification -bool true
killall Dock
defaults write com.apple.finder AppleShowAllFiles FALSE
killall Finder
killall Terminal
killall TextEdit
apply "; exit"

#!/bin/bash
#Maintenance Script
defaults -currentHost write com.apple.screensaver idleTime 0
defaults write com.apple.Dock mineffect scale
defaults write com.apple.Dock orientation -string bottom
defaults write com.apple.dock magnification -bool false
defaults write com.apple.dock autohide -bool false
killall Dock
defaults write com.apple.finder AppleShowAllFiles TRUE
killall Finder
open -a TextEdit

Das User Script müsst ihr natürlich entsprechend anpassen.

Donnerstag, 4. Dezember 2014

Samsung ML-2955DW - Debug Port

Hey Leute ;),
nun blog ich doch mal wieder etwas.
Habe heute ein wenig gelötet - und zwar an meinem Drucker.

Wollte eine serielle Konsole dort haben.

8N1
Baudrate: 115200


Konsolenoutput:
http://pastebin.com/KkU8bF3i

Mittwoch, 20. November 2013

Siemens Gigaset A265 - Nummer des letzten Anrufers


Liebe Freunde des Siemens Gigaset A265 ,
habt ihr auch das Problem, das ihr die Telefonnummer des letzten Anrufers nicht mehr herausfinden könnt?
( angenommene Anrufe )
Diese Funktion ist beim Siemens Gigaset A265 deaktiviert um scheinbar Speicherplatz zu sparen.

Folgende Tastenkombinationen müssen angewendet werden, um dieses Problem zu beseitigen.


Drücke die folgenden Tasten hintereinander (2-3 Sekunden pro Eingabe Zeit lassen):

Menu Taste - Wecker wird angezeigt
3 - Datum/Uhrzeit wird angezeigt
3 - Audio wird angezeigt
9 - Die Rufnummerneingabe mit der Ziffer 9 wird angezeigt

Hinter der Ziffer 9 den folgenden Code eintippen:
4762005

Nun steht folgendes im Display:
94762005SET[1]

Hier setzt ihr eine "0" und bestätigt das ganze mit "OK" (Menü-Taste).

Es passiert gar nichts - ihr kommt wieder auf den Startbildschirm.

Folgende Schritte wiederholen:

Menu Taste - Wecker wird angezeigt
3 - Datum/Uhrzeit wird angezeigt
3 - Audio wird angezeigt
9 - Die Rufnummerneingabe mit der Ziffer 9 wird angezeigt

Hinter der Ziffer 9 den folgenden Code eintippen:
10

Nun steht folgendes im Display:
910 SET    [0]

Hier setzt ihr eine "1" und bestätigt das ganze mit "OK" (Menü-Taste).

Es passiert gar nichts - ihr kommt wieder auf den Startbildschirm.

Die Funktion ist jetzt erfolgreich aktiviert.

Das nächste mal wenn jemand anruft,
das Gespräch geführt wurde und auflegt ist,
wird die Nummer im folgenden Menü hinterlegt:

Mailbox Taste - Anrufb.: 00+00
Pfeil nach unten - Anrufe: 00+18
Menu Taste - Mit OK bestätigen

Quelle der Information:
http://forum.siemens-club.ru/attachs.php?action=getfile&attachID=13226