Bios:Dell XPS 15 9560
Stock bios exe file: https://dl.dell.com/FOLDER06283343M/1/xps_15_9560_1.19.2.exe
I used pfs extractor to extract bios bin files from official stock bios exe file( as -whitehrdfile switch never works). These are the file extracted
Than I successfully moded that 1 – 1 System BIOS with BIOS Guard v1.19.2.data.bin bin file, now the question is how do I make it payload file WHERE THAT MODED BIN FILE CAN BE FLASHED WITH dell official flash tool?
when I trying to flash with moded bin bios file directly by using dell official flash tool, it asking for payload file. How do I make that extracted bin file in to payload file? is there any guide available for this?
This not possible. Dump current BIOS with FPT or programmer, modify that, flash it back. The files above are mainly used, in part, often not as-is, when making out a recovery BIOS.
@Lost_N_BIOS
Than Bad luck for me
any bios related things are not easy
First it is intel bios and defiantly I tried to dump bios region only with FPT and success but never success Flash with it!
As attachment there is the dump file dumped via FPT(name bios.rar)
Then I tried to extract the bios section using official STOCK Bios file by PSF extractor,
PSF extracted bios file from official stock bios uploaded as attachment(name pfsbios.rar)
I wanted to activate Autoon power to everyday and Autoon power time to 00:40( midnight) but there is no way to flash it using fpt. interesting thing is, when I just trying to DUMP nvram region( yes JUST DUMP the NVRAM) using that command (FPTw.exe -a 0x784000 -l 0x80000 -d NV1m.bin) , it giving me
Error 318: The host CPU does not have read access to the target flash area. To enable read access for this operation you must modify the descriptor settings to give host access to this region.
FPT Operation Failed.
by the way, this bios has BOOT guard enabled.
I don’t know if there is any other way to bypass that error, its looks like they blocked to read(yes just read, not write!) anything using fpt( rather than -bios section only) and I don’t know what to do with PSF extracted bios file, can I put it back to stock bios’s exe file( after modified it) and flash there using that exe? maybe thats not possible too!!
bios.rar (4.87 MB)
The PhoenixTool, it extracting from that exe soomany files, one file call “XPS_15_9560_1.19.2” directly extracted to desktop, I don’t know what type’s of bios file it extracted, is it HDR bios file extracted from exe? another bios file call “BIOS0.BIOS” extracted to “BIOS” folder, what is it? is it same HDR bios file renamed by PhoenixTool in to .BIOS? is there any proper guide available about PhoenixTool extraction things?
What to do with modified HDR file(extracted from dell’s exe file)? can I flash it? which tools can flash the bios from HDR file? I heard cctk can do that, but don’t know how
@superb123 - Yes, BIOS mod is not always easy, especially with OEM BIOS like Dell.
What do you need to do here, I can help? You just need to change those settings? If yes, that is easy, and does not involve use of stock BIOS exe or anything from it. For this, you only need to edit NVRAM
First try this, put system to sleep (S3, not hibernate) for one minute, then wake it up and try to dump BIOS region then flash back BIOS region (ONLY), do you still get error 318 or 167/280/368?
The command you gave above to dump NVRAM is not correct, not sure where you got those values (?) that would be dumping part of the ME region thus the error you ran into 
Here is correct NVRAM dump command for this 32MB BIOS, and you should not need to S3 sleep around, or have issues with dumping/flashing back (I assume) >>
FPTw.exe -a 0x1700000 -l 0x60000 -d NV1m.bin
You need to change all of the following, and time is in hex counting zero as first value (ie 0-17 = 0-23 hours) - I guess since Midnight is goal, you can leave Hour at default and only set minute to 40 = 28h
Wake system from S5, VarStoreInfo (VarOffset/VarName): 0xD, VarStore: 0x1, QuestionId: 0x193, Size: 1, Min: 0x0, Max 0x1, Step: 0x0 {05 91 DB 00 DC 00 93 01 01 00 0D 00 10 10 00 01 00}
One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 04 00 30 00 00}
One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
Numeric: Wake up hour, VarStoreInfo (VarOffset/VarName): 0xF, VarStore: 0x1, QuestionId: 0x194, Size: 1, Min: 0x0, Max 0x17, Step: 0x1 {07 91 DD 00 DE 00 94 01 01 00 0F 00 10 10 00 17 01}
Default: DefaultId: 0x0, Value (8 bit): 0x0 {5B 06 00 00 00 00}
Numeric: Wake up minute, VarStoreInfo (VarOffset/VarName): 0x10, VarStore: 0x1, QuestionId: 0x195, Size: 1, Min: 0x0, Max 0x3B, Step: 0x1 {07 91 DF 00 E1 00 95 01 01 00 10 00 10 10 00 3B 01}
Default: DefaultId: 0x0, Value (8 bit): 0x0 {5B 06 00 00 00 00}
In NVRAM, search this string, and edit the bytes in bold for wake enable (0xD) and minute (0x10) >> 01 00 01 01 00 02 01 00 00 00 00 00 00 00 00 00 00
There will be x64 instances to replace with 01 00 01 01 00 02 01 00 00 00 00 00 00 01 00 00 28
If you need me to do, send me the dumped NVRAM.
@Lost_N_BIOS
Maybe my head was in the sky, I still don’t know how I got those values
Anyway how did you get those value 0x1700000 and 60000 ? is there anyother tool available which can detect those value correctly? for me I use UEFITool Alpha to detect those value, but UEFITool Alpha showing those values are 0x700000 and 0x60000
nvram dumped file attached as NV1m.zip
No no this time I need to change "Auto on VarStore 0x110A to everyday 01" "Auto On HOUR VarStore 0x110C to midnight 12 thats mean 00 hex" "Auto On MINUTE VarStore 0x110D to 40 thats mean 28 hex"
I think need to search this string from nvram 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 01 05 04 00 32 5A and change those values to 00 00 00 00 00 00 01 00 00 01 00 00 28 00 01 01 05 04 00 32 5A I don’t know if those are correct values or not
I already used cctk to change those values but cctk changes are not affecting, thats why I going to nvram edits and flash.
NV1m.zip (25 KB)