[UEFI] SecureCore Tiano crisis recovery - WIP

Discussion in 'BIOS Mods' started by TimeWalker75a, Oct 13, 2012.

  1. TimeWalker75a

    TimeWalker75a MDL Novice

    Oct 13, 2012
    10
    1
    0
    #1 TimeWalker75a, Oct 13, 2012
    Last edited: Oct 13, 2012
    First of all hello,
    This is my first post on the forums .. I have never been into bios modding before, but since I got my new Vostro 3450 recently things got me going .. I may be posting in a wrong section, but this technically is related to bios mods, so might as well post it here.

    Basically this thread is created to find a person, with a bricked Dell laptop preferably .. an XPS L502x/L702x .. a Vostro 3450 or similar which uses SecureCore Tiano 2.0 (Acer or Packard Bells would also suffice as a test machine) to verify if the crisis recovery method of making the recovery capsule would actually work and a person would be able to re-flash the on-chip bios with a proper image. I believe I have figured the procedure because I'm able to side-load a bios from a USB drive and boot with overridden bios which is loaded in memory, those one could boot the OS (or use PFlash.efi from shell) and reflash the chip.

    So is there someone with a bricked Phoenix SecureCore Tiano laptop out there who is willing to do some tests (unless your boot block is completely butchered :nono2:)?
    I have been looking for someone to confirm this as working for a real deal - the actual bios recovery, not just loading it of off the usb drive and seeing a completely different version of BIOS being loaded.

    Cheers!
     
  2. TimeWalker75a

    TimeWalker75a MDL Novice

    Oct 13, 2012
    10
    1
    0
    #2 TimeWalker75a, Oct 13, 2012
    Last edited: Oct 13, 2012
    (OP)
    Since nobody shows up I will quote myself here, hope someone with a bricked machine can figure the steps out. If not - feel free to PM or ask here.
    I've been active on another forum, but since I can't post links - there goes the quote:



    I've looked at an Acer 4750G with a JE40 motherboard and the stock rom JE40XXX.ROM has the same structure as .WPH for my Dell Vostro, so the procedure should apply. Since Packard Bell is a division of Acer it should apply to those machines as well.
    The step 3. will be different for these machines though, you should probably be pressing Fn+Esc and press Power button after inserting the AC plug into the laptop.

    Below is the comparison of the on-chip bios and the side-loaded bios which is loaded as a capsule into memory of off a usb flashdrive.
    1.jpg 2.jpg

    A huge thank you goes to jkbuha (for a hint to unlocking advanced menus) and kasar (for testing everything we throw at him) over at bios-mods.
     
  3. TimeWalker75a

    TimeWalker75a MDL Novice

    Oct 13, 2012
    10
    1
    0
    And another quote regarding previously documented method from the Packard Bell's service manual:


    Actually quid provided the link to us to some sort of a store-terminal service support web page which has bios tools for download. There's the PFlash.efi application people been searching for ages now, but it appears that it can only be run when a recovery/update capsule is loaded in memory. Since my laptop has UEFI Boot mode disabled from the factory and so is shell, I'm unable to verify if the Shell flasher actually works. This is because when recovery capsule is loaded into memory the CMOS is being reset on the machine (so the UEFI boot gets disabled and I can't run shell from the USB) .. I guess this is done in order to solve possible problems that the machine may experience without the need of disassembling the unit to reset from coin-cell battery (even though most Acer laptops have pads that you short together in the battery compartment, my Emerald Lake FAB1- based laptop doesn't have these).

    So there's that .. hope the info is useful to someone.
     
  4. kvankam

    kvankam MDL Novice

    Oct 14, 2012
    3
    0
    0
    Thanks for the info!
    I've got a bricked Lenovo S-205 for a while (actually I'm not sure why it has died, it won't boot after a mess with NVRAM variables while installing linux distro), it has the same SecureCore Tiano EFI and I wonder if it is possible to use similar recovery method. Knowing the keystroke for recovery mode (Fn+R), I've tried before to feed some capsule (BIOS.cap), which I have found in OEM flasher package, it seems to be executed (causes continuous beeps for a few minutes and restarts, I would suppose it is even flashing something), but with no visible effect afterwards. I wish I could boot up normally with help of a capsule built with your method, I've been experimenting with the instructions you have provided (although everything is different, there is no part with such GUID in the first place, other parts do not have padding) - no luck though.
    Do you think it may be a way to go for the Lenovo laptop, maybe you could give some suggestions, please?

    Thanks.
     
  5. TimeWalker75a

    TimeWalker75a MDL Novice

    Oct 13, 2012
    10
    1
    0
    #5 TimeWalker75a, Oct 14, 2012
    Last edited: Oct 14, 2012
    (OP)
    Your bios has a padding layer 2 which starts at 2002Ch and is 2FFD4h bytes in size (which is 192Kb) so the file you are looking for is PADDING-0002002C_x_x.ROM. So presumably first 50000h bytes should be truncated - this is the part where the start of fw volume is found.

    lenovo.jpg

    I'm not sure what is this PEI module responsible for (has something to do with S3 sleep state though) .. leave it there first, if the capsule is not picked up then remove D52h bytes starting from offset 48h so that the firmware volume would be the first.
    I've used LENOVO-4BCN24WW.rom (S205 E-450 APU BIOS )as a base .. here are the two capsules.. try them and report. Don't forget to change the name to just BIOS.cap

    mediafire . com/?a6s8p5nht61t7xo
     
  6. kvankam

    kvankam MDL Novice

    Oct 14, 2012
    3
    0
    0
    Thanks for your help, I've tried both capsules, unfortunately they did made no difference to the boot process (the same black screen). Later I have tried again to experiment with the boot capsule from lenovo flasher (which causes beeps), and I believe I have managed to brick the laptop completely - now there is no USB activity at all :) It seems hard reflashing is the only possible way now. So, sorry for the noise :)
     
  7. TimeWalker75a

    TimeWalker75a MDL Novice

    Oct 13, 2012
    10
    1
    0
    Bah, that is sad. It appears your boot block has been ruined.
    That is why I was looking for a person with a bricked Dell in the first place .. because I know for a fact that the capsule is being loaded into memory.. not flashed to the chip, same thing with Acer/Packard Bell (according to their service guides). Besides your Lenovo uses AMD, so the Tiano implementation may be totally different. o_O
     
  8. kvankam

    kvankam MDL Novice

    Oct 14, 2012
    3
    0
    0
    Not a big problem, I've already lost all the hope to recover it by software :)
    Anyway, maybe a bit offtopic question, but surely you understand all that UEFI stuff more than me :) If one day I'll finally throw the chip into a SPI flasher, is it enough just to erase everything and write 2MB image from lenovo package (like BIOS1.WPH), there is no magic with, for example, predefined device-specified NVRAM variables? Quite frankly, the whole technology looks so confusing to me, even the names like SecureCore make me think like everything is signed... just do not know what to expect.
     
  9. TimeWalker75a

    TimeWalker75a MDL Novice

    Oct 13, 2012
    10
    1
    0
    I'm not a pro with UEFI in any way. Depending on the implementation, really. It may wipe just the boot-related variables and boot order.. or it could go worse .. DMI and SMBIOS information could get wiped as well.
     
  10. rassasa

    rassasa MDL Novice

    Jul 30, 2009
    10
    0
    0
    In this thread i found a file mediafire. com /?a6s8p5nht61t7xo
    I write it to my flash drive Transcend, insert to my Lenovo E425, press Fn+R buttons, plug the AC adapter, and power On it.

    And my Transcend flash begin ligth and then is shut off. I think that was unexpected error in code in those files.
    I want to say that Lenovo seek for the file BIOS.cap and try to load and apply it. I think that we are need make a right BIOS.cap.
     
  11. intense

    intense MDL Novice

    Mar 25, 2013
    5
    0
    0
    #11 intense, Mar 25, 2013
    Last edited: Mar 25, 2013
    I baught my Samsung NP530U4C 2 months ago.
    I wanted put clean Windows 8 install with DVD (no recovery partition) on SSD partition.
    Windows 8 found on SSD partition now but i have a problem with BIOS and UEFI.


    In BIOS I can't select other boot devices - only Windows Boot Manager.
    I try set Fast BIOS disabled and Secure Boot disabled ... all time is only WBM.


    Please help me. How can I fix UEFI and BIOS?
    I have newest BIOS now - A07ABH.
    Can I reflash my BIOS?


    Maybe send me please solution, how i can fix my UEFI (boot priority in BIOS and F2 key).
    Now F2, F10 etc keys not found too.
    Only system startup with SSD partition.


    I can't enter to BIOS and run my system now... I don't know fix it
    Please help me.


    F2 and other keys not found.


    How can I recovery it?
    Notebook has Phoenix Secure Core Tiano bios.

    I don't add links but my youtube video is "ArRcTnwFLGo".
    Look it please. F2 and other not found and system too... I have system on internal SSD.

    I will be thankful, help me
     
  12. intense

    intense MDL Novice

    Mar 25, 2013
    5
    0
    0
    Please help me :(
    How keys are recovery bios mode in this model?
    FN+ESC or WIN+B not found.
     
  13. volinakis

    volinakis MDL Novice

    May 17, 2010
    3
    0
    0
    I have a L702x, there are 2 eeprom chipsets, one is near HDD1 connector (32MB) and the other one (64MB) is in the middle of the motherboard, on the opposite side. For the moment it has password on power on, I was able to read both chipsets with an eeprom Programmer. If you need these infos from eeprom chipsets let me know.
     
  14. themacmeister

    themacmeister MDL Novice

    Mar 23, 2011
    1
    0
    0
    #14 themacmeister, Aug 30, 2014
    Last edited: Aug 30, 2014
    Advanced Menu?

    This is a marvellous thread. I have an Acer Aspire 4752.

    I corrupted my BIOS with steamos install (no F2 to enter BIOS, and steamos permanently in boot list). I was able to create a UEFI boot USB with RUFUS and Arch-Dual.iso

    I could get into EFI1.x shell (but not 2.x), I was able to decompile and list parts of the BIOS, so it worked to that extent.

    I fixed it with a full BIOS flash from DOS.

    All I really wanted was an unlocked advanced BIOS menu, but this BIOS looks increasingly difficult to unlock. I managed to get the whitelist removed from my old Pavilion g6, and then nearly permanently bricked it flashing a newer BIOS.

    Anyone who can point me in the right direction, I would be grateful. Cheers.
     
  15. done123

    done123 MDL Novice

    Dec 4, 2015
    2
    0
    0
    aspire 4750g bios.cap

    i have an acer aspire 4750g and it stucks on acer logo splash screen.. i tried removing the hdd and resseting the cmos but nothing happens.. can you please make a bios.cap for my unit.. i tried a lot of crisis recovery but no luck at all. its a secure core tiano.. thnx in advance..


    cheers!