How do I flash bios to an Alienware M16 R1 AMD edition?

[Arc717]

Another issue I came across. I am assuming that the BIOS chip is 32MB in size. The .bin file for the bios is ~35MB in size. It may have a head and tail (junk data at beginning and end) that needs to be cut off. Saw that on the LTT forum here: https://linustechtips.com/topic/1314...arger-than-ic/

The bios file for 1.2.2 is here: https://www.dell.com/support/home/en...-r1-amd-laptop

extracting the .exe with 7zip gives a isflash.bin file which is the exact same size as the bios recovery image file BIOS_RCV.img. I am assuming isflash.bin is the actual bios itself since it matches the bare recovery file. They are both of a size 35,601,656 bytes. Not sure how to flash this onto the bios chip since I think it would be bigger than the 32MB chip, unless the chip is 64MB? Does some part of the .bin file have to be clipped off with a hex editor?

[piernov]

The UDC1 IC is indeed a 256 Mb (32 MB) 25-series SPI ROM so that matches.
The UEFI image from the recovery file can be extracted with Insyde iFlash/iFdPacker Extractor (see https://www.badcaps.net/forum/troubl...=8#post1622426 ).
The EC is a microcontroller that may have its firmware stored inside either an internal Flash, an external SPI ROM or the main SPI ROM alongside UEFI. Dell often uses SMSC MEC5xxx with internal Flash but I don't know if that's the case here.

If the UEFI got corrupted after a downgrade, try to use the recovery mechanism using the recovery file from the version that was installed before the downgrade. If that doesn't work you should check with Dell if they may fix it under warranty.

But as I said already, I don't think it's wise to mess with that stuff, even more so when you do not know how to fix it yourself if something goes wrong, because if you mess with BIOS/UEFI beyond what the manufacturer intended, something will go wrong. And messing with voltage/clock/power limit of the CPU could just kill the CPU which is basically not repairable (they already die on their own way too often in gaming laptops).

[Keith1341]

I haven't had the chance yet to take the machine apart. However, I did find a picture online of the back side of the mobo that is pretty decent. Is it possible that this is the bios chip? I put a blue arrow pointing at it on the picture.

[Arc717]

I dug through the 1.2.2 BIOS_IMG.rcv file for dell. I could not extract the image using the link piernov gave, but I was able to get it through a hex editor, HxD. The start and end offsets of the bios image are: "1E54B0" and "21E54AF" respectively. I put a few screenshots of the process here. Copied over the block into a new file and saved it as BIOS_IMG_EXTRACTED. I cannot upload the bios image here for some reason it will not let me. When you are ready to flash it Keith1341 I will find some other way to send it, or you may want to make one yourself just to be sure the file does not get corrupted while downloading it. The process is not too bad. I've never used a hex editor and was able to figure it out pretty quickly.

I used this tutorial on YouTube to get the bios image: https://www.youtube.com/watch?v=LMHTi23VxO0

I have the exact size for the bios image so I know I did it right. Its 2^10 * 2^15 or 1024 * 32,768 = 33,554,432 bytes = 32 MB exactly.

Unfortunately I could not find the EC file using that tutorial. I could not find an "IFLASH_EC_IMG", I did find "IFLASH_BIOSCER" and "IFLASH_BIOSCR2", not sure what those are though. They are basically at the bottom of the binary file though, so they can't be the EC image. There's an "IFLASH_DRV_IMG" near the top but I dont think an EC file would be referred to as "DRV_IMG". There's also "IFLASH_INI_IMG" but that just marks the end of the bios image.

Searching for "EC" (case sensitive) at the bottom of the file leads me to believe that the EC file is in the isflash.bin binary file with the bios, since there are mentions of it updating or not and checking for updating it. I just don't where in the bios it is, or what its size is. There is a string "$WISEC$" that may denote the EC file, but I don't know how big the EC file should be so I cannot grab it. I also don't know if that would mark the end or the beginning of the EC file. The reason I suspect that is the marker of the EC file is because there are a lot of those weird "ÿÿÿÿÿÿÿÿÿ" characters like for the bios image around.

[Keith1341]

I was finally able to disassemble the laptop this weekend. From what I can tell, there are at least 5 "winbond" chips on the motherboard. I connected a CH431 to each of the chips, and did a dump of the data to see what was what. I only ended up getting a .bin file that was 2048kb, 1024kb, or 128kb. None of them seemed to have the amount of data stored in them that would correspond to a full blown bios. So I'm at a stand still because I don't know which chip is the bios chip.

[rogfanther]

pics please, of the board and the possible chips

[Keith1341]

Hopefully these help. One of the pictures contains a chip that is not shown in the motherboard photos because it was hiding underneath a silver protective sheet.

[Arc717]

I was finally able to disassemble the laptop this weekend. From what I can tell, there are at least 5 "winbond" chips on the motherboard. I connected a CH431 to each of the chips, and did a dump of the data to see what was what. I only ended up getting a .bin file that was 2048kb, 1024kb, or 128kb. None of them seemed to have the amount of data stored in them that would correspond to a full blown bios. So I'm at a stand still because I don't know which chip is the bios chip.

Were you able to put a CH341a and do a dump on the chip in the red here? (It's on the side of the motherboard with the ram, so just need to take the back panel off.) I went on win-raid (bios modding forum) to ask where the bios chip was, someone suggested that is the bios chip. I don't have my ch341a programmer yet so I cannot check, but piernov thinks that was the chip as well. The chip has "256" written on it, that may be its storage size, 256MBit = 32MByte. Test that one if you can manage to get the ch341a clip on somehow since it is kind of wide and flat.

[Keith1341]

Were you able to put a CH341a and do a dump on the chip in the red here? (It's on the side of the motherboard with the ram, so just need to take the back panel off.) I went on win-raid (bios modding forum) to ask where the bios chip was, someone suggested that is the bios chip. I don't have my ch341a programmer yet so I cannot check, but piernov thinks that was the chip as well. The chip has "256" written on it, that may be its storage size, 256MBit = 32MByte. Test that one if you can manage to get the ch341a clip on somehow since it is kind of wide and flat.

Thanks! I will try that when I get home in a few hours.

[Keith1341]

The height of the chip is so low that I was not able to get the clip to attach to the solder points, no matter what I tried.

[Arc717]

The height of the chip is so low that I was not able to get the clip to attach to the solder points, no matter what I tried.

I will get my CH341a programmer in a few days and will see if I can come up with some creative way to connect to that chip that does not require temporary soldering of a wire to each of the pins. I'm fairly certain that's the bios now, seems like something Dell would do to make flashing it tedious.

[Keith1341]

I just ordered an adapter that from the looks of it I am hoping I can use to attach to the chip:

https://www.amazon.com/gp/product/B0...?ie=UTF8&psc=1

[Arc717]

I just ordered an adapter that from the looks of it I am hoping I can use to attach to the chip:

https://www.amazon.com/gp/product/B0...?ie=UTF8&psc=1

That link you posted has one review with a photo in it. The chip is inside of the socket at the top of the adapter. I don't think this thing is for soldered chips, but free ones.

[piernov]

MX25U25673GZ4I40 is in a WSON8 8×6mm package. Also, it works at 1.8V.

[Arc717]

MX25U25673GZ4I40 is in a WSON8 8×6mm package. Also, it works at 1.8V.

Would a WSON8 Chip probe like this work for flashing the bios? Here is the link: https://www.amazon.com/WSON8-Probe-W...ustrial&sr=1-5

[piernov]

This should be the correct probe for this IC. But it doesn't mean it will work. In-circuit programming often goes wrong.

[Arc717]

Alright, picked it up. Will take a week to get here, and I'll try to read that bios chip when I get the probe.

[Keith1341]

Hopefully, you can read it. Unsurprisingly, the item that I posted the link for did not work.

[Arc717]

Some good news and some bad news.

First of all good news: I can confirm that is in fact the bios chip! I was able to read it using the adapter I bought. >98.8% match of all bytes.

Downloaded AsProgrammer from GitHub and installed the driver that was included before starting the .exe (don't forget that). Took off back panel, unplugged battery, selected the matching chip in AsProgrammer (MX25U25673G) and used the probe to read it. I used ImHex to see any differences in the bios files that I read vs the bios image from HxD I pulled. I also used a Python script to find how many bytes differed from the two bios images: 386,332 bytes. I am assuming some of those are the motherboard UUID and things of that nature. Only 1.15% of the bytes differed from each file, so I am basically 100% certain that is the bios chip.

Now for the bad news: It takes just over 5 minutes each time to read it with the probe, and you have to hold it perfectly still and press it down enough to make contact with the tiny solder points or else the read will mess up. You have no way of knowing if it did other than to compare with a bios image and make sure the bytes don't differ by more than 1.5%.

I also did not yet try to write to the bios chip. I know some bios chips have write protection, so I'm not sure if that is in place here or not. Also not sure where the EC chip is if this motherboard even has one. (I talked to some Chinese vendor on eBay that sells preprogrammed bios chips for Alienwares and he said the M16 R1 AMD does not have an EC, though take that w/ a grain of salt).


Here is the link to read/write the bios chip:
AsProgrammer: https://github.com/therealdreg/aspro...egmod/releases
Here is the link to compare .bin files:
ImHex: https://github.com/WerWolv/ImHex/blob/master/INSTALL.md

Did this using the CH341a mini programmer (Black). Also recommend getting a probe with a baffle plate from aliexpress, it may make holding the probe easier when writing. You basically have to put the probe in place perfectly with one hand, hit write (or read) with the other and not move for 5 minutes exactly. Even the slightest movement throws off the read/write, that's why I recommend the probe with the baffle.

Aliexpress link for 6x8 probe with baffle: https://www.aliexpress.us/item/32568...yAdapt=glo2usa

I'll throw in a photo of my setup (1.8v adapter is needed) so you can see how it goes and make sure its hooked up correctly. Put in another photo of the chip and one of the adapter I ordered. I can't upload the Python file to compare differing number of bytes, but I got that from chatgpt so it should be easy to make yourself if you want to see.

[Arc717]

This should be the correct probe for this IC. But it doesn't mean it will work. In-circuit programming often goes wrong.

piernov Is there anything I need to know for flashing the bios? I've made 4 backups of the bios file. A few bytes (108,847) changed from the 1st backup vs the last 3 which are all the same.