Jump to content
EwinRacing Flash Series Gaming Chairs
gerald

Y510p Ultrabay Graphics card

Recommended Posts

On 28.01.2018 at 8:28 AM, High_Voltage said:

Hi, Everyone!

 

I've just discovered this thread and the whole Y510p adapter thing and needless to say I'm quite fascinated with what you've accomplished so far.

 

While 5 years have passed since this laptop's release and it might be almost considered too old to get any useful performance from, I believe that the i7-4700MQ together with external GPU would be just enough to make this machine VR-capable, which is what I'm interested in. It is a shame, however, that NVIDIA GPUs are not supported.

 

I had some free time this weekend to disassemble and fiddle with Y510p's BIOS to make NVIDIA GPUs work and would like to ask if any of you were interested in testing some BIOS dumps on their machines, since I'm kind of too broke to afford the adapter, let alone the GPU which might not even work.

 

It looks like the BIOS code specifically checks whether a PCI Vendor ID is NVIDIA upon initialization, and if so, runs a test to check whether the Device ID is equal to that of the built-in GPU. This is a bit like whitelist, but is instead meant for people not accidentally plugging a GT755M ultrabay unit into their GT750M machines and vice versa and then complaining that SLI doesn't work, I believe. I have now removed this conditional check, which threw the "Unauthorized VGA card" exception and ran some extra code, but there are still places in the binary, which cause questions to me. If this attempt fails, there are at least two more approaches I have in mind to be tested.

 

So, if anyone is up for this, please let me know. Please, note that you will need an SPI Flash programmer to do this. Also, always back up your original flash dumps!!! They will not only be useful if(when) my modded dumps render your machine unbootable, but will also contain your Windows license code, which can be later integrated into modded dumps if they're successful.

 

Also, I'd appreciate any links or advice on modding the Lenovo bios update exes to allow flashing of the patched image (haven't looked into this yet). Other than that, does anyone have a working download link for V2.07 bios installer? Found it.

Hi, I am interested in modding bios so I can use nvidia cards,

Can you tell me what programs do you use to look into bios files?

 

Thanks in advance.

Share this post


Link to post
Share on other sites
On 11.02.2018 at 2:01 PM, MWichni said:

Can you tell me what programs do you use to look into bios files?

Sure!

 

First of all, I find the Universal BIOS Backup Toolkit 2.0 to be extremely useful for dumping the UEFI image under Windows without the need for bootable DOS flash drive. Fptw64 which was recommended by Svl7 does not work for me for some reason (got it to work right now, the backup file it returns is identical).

 

The Y510p holds its BIOS in two flash chips, 2MB and 4MB one in configuration 2+4. In this case the 2MB one contains about 1.5MB of Intel ME region and the rest is possibly EC firmware. To be precise, EC firmware is contained on the EC chip itself, however I suspect that it includes a bootloader which allows firmware to rewrite itself from data stored on BIOS chip during update. There should be some trigger bit in BIOS flash that the EC checks to decide whether to trigger self-flash or not. But the EC is not important to us. The 4MB chip holds the UEFI image, which is what we're looking for.

 

Once executed under administrator privileges, the Universal BIOS Backup Toolkit 2.0 will spit out a file of approximately 4.5MB. This consists of 0.5MB of rubbish header in the beginning and remaining 4MB are the contents of the 4MB flash chip (the one of two, that actually holds the UEFI image.). The offset is 0x80000 and mine starts from signature 38 00 00 00 00 00 00 00 FF. Yours might have a different first byte, I suspect. The 0.5MB header has to be deleted. (Also, if you don't have a hex editor, I recommend HxD).

 

Once you have dumped your 4MB UEFI image, it can be decompressed by using either PhoenixTool (despite the name, actually works perfectly with InsydeH2O) or UEFItool. This will separate it into individual UEFI PE files (UEFI modules). The one responsible for GPU initialisation appears to be the A6F691AC-31C8-4444-854C-E2C1A6950F92_284. It can be found by using the UEFItool to search for the unicode text phrase "Unauthorized Slave VGA".

 

The A6F691AC-31C8-4444-854C-E2C1A6950F92_284 can then be disassembled using IDA Freeware v7.0, where searching for the same text phrase will point you at the subroutine that determines whether the adapter is valid and either does nothing or outputs this error and runs some sort of infinite loop (which possibly makes the PC freeze at the error screen) and some additional subroutines.

 

I can't be 100% certain, but having looked around the cross references to this subroutine and that variable it checks, you can find such interesting things as explicit declaration of variable with value 0x10DE, which is Nvidia's Vendor ID. Or that the variable which determines whether the error occurs is written by a code that compares return values from two similar routines accessing some (similar) hardcoded addresses. All of this suggests that the thing might be checking whether the Ultrabay is Nvidia GPU, and if it is, whether it is the same as the built-in one. This could explain why AMD cards work perfectly fine.

 

After you decided to do something to the code (for example, in my first patch attempt, I have changed conditional jump (JZ) (or was it a JNZ, I don't remember) that decides whether to throw an error to an unconditional JMP that jumps to No Error no matter what. This is done by highlighting the instruction and looking up its location in the HEX view. You can then manually replace it in your hex file with an op code of the instruction you want there instead.

 

When you have modified the desired PE UEFI module, you can reassemble your UEFI image using the same utility you used to decompress it.

 

That's it! The resulting 4MB file can be flashed. And that's where it stops, because I have no idea how to reliably flash this file by software means, and therefore can't provide any installer solution for everyone to test. When I have more free time, I'll have a look at the method Slv7 used to flash his mod, however I'd appreciate if anyone explained it to me (especially the reason for v2.07 bios rollback being necessary for the installation).

 

Speaking of my own machine, I just had an so8 ic clip arrive from e-bay and immediately flashed my modded image. Raspberry pi zero w with flashrom, accessed via SSH was used as a programmer and also to power the memory chips. Anyone with extra 15 bucks, a soldering iron and a screwdriver could probably just hardware-flash. My machine is still working fine with modded BIOS, however I have no way of checking whether the fix actually worked or not.

 

If you or anyone else is interested in doing a hardware flash, I could provide you with test ROMs or mod your own backup dump, thus retaining your Windows license key.

Edited by High_Voltage
Clarified IDA version
  • Thumbs Up 2

Share this post


Link to post
Share on other sites

Hi, thanks for the reply.

I will try to work with the bios files during this weekend. 

Share this post


Link to post
Share on other sites

Good news, everyone!

 

Having studied Svl7's BIOS modding method, I've been able to create my own installer for the nvidia patch discussed in previous posts.

It works in a similar fashion and installation instructions are pretty much the same (although applications I recommend for backup and DOS drive creation are IMHO easier to use). Also, note that this mod is applied to Version 3.08 of BIOS whereas original Svl7's mod is applied over V3.05!

 

You will find detailed installation guide in the Readme file.

 

Download link:

https://mega.nz/#!yd41hBJK!E76XI_NbCG-3q1VDbF9XMePwImkOyiGwjFZAg-wJzNQ

 

DISCLAIMER: Follow the instructions carefully and thoroughly when applying the patch! Although I have successfully tested it on my own machine, I provide ABSOLUTELY NO WARRANTY that it will not damage yours. ALL THE ACTIONS YOU PERFORM DURING INSTALLATION PROCESS ARE DONE AT YOUR OWN RISK ONLY!!!

 

Now, it would be interesting to see whether it actually works for anyone. If it doesn't, we will continue our search through BIOS's disassembled code. Also, if anyone is interested, I can tell you more about this installation procedure and the reason the BIOS rollback is necessary. I can also explain how to extract EC image from factory BIOS installer, and list my interesting findings about the general structure of official updater's .bin files.

 

Also, if anyone wants the patcher's source code, I'll be happy to provide that too.

 

Yours Faithfully,

High_Voltage.

Edited by High_Voltage
Can't type
  • Thumbs Up 2

Share this post


Link to post
Share on other sites

@High_VoltageThat's very cool!

 

I am afraid I won't be able to help as I've already invested in an AMD Vega card and don't want to risk bricking my system, but hope that you will succeed as it'll give Y510p users even more choice.

 

Best of luck!

Share this post


Link to post
Share on other sites

@Bos Maior Thanks a lot for support!

 

Even though the flashing procedure is not really that dangerous (except for the EC flash, but we flash stock FW so it's OK), I'd discourage anyone who is happy with their AMD-based rig from flashing the mod (unless one wants to do it just out of curiosity, of course).

Share this post


Link to post
Share on other sites

Hi las weekend was a bit busy. But this weekend I definitely try your mod. I have an old gtx275 so I'll test it out. 

 

Thanks for your work!

 

Regards,

Mariusz.

Edited by MWichni

Share this post


Link to post
Share on other sites

Hi, I followed the guide though one thing didn't work as should. When I executed ec to flash the soft DOS gave me something like this: DOS memory buffer 2 allocate failed.

1.png

2.png

3.png

Edited by MWichni

Share this post


Link to post
Share on other sites

@MWichni No idea why this happened... Worked perfectly on my machine. Have you tried running the EC command several times?

 

More importantly, does your PC still boot? (I don't see any reason why it wouldn't) And if it does, Does the NVidia card work?

 

One more question: Did you have anything installed in your ultrabay while flashing?

 

Edit: Yeah, this could possibly be due to different graphical configuration. On my machine I was flashing while original secondary GPU was inserted into Ultrabay, meaning Intel graphics and thus Optimus were disabled. EC flasher part of flashit uses some sort of pseudo-graphical interface, so that could have been what has failed. Alternatively, you should maybe try different version of FreeDOS.

Edited by High_Voltage

Share this post


Link to post
Share on other sites

I had nothing installed in the slot, I will try with second gt750m attached and see what happens. PC boots without any problem so far.

Share this post


Link to post
Share on other sites

Glad to hear that! Also, would be interesting to see whether it allows you to flash the EC without rolling back to V2.07. If not, just roll back and follow the steps from 7) onwards. Also, if it flashes successfully on V3.08, don't forget to change boot mode to UEFI and UEFI first when done, otherwise windows won't boot.

Edited by High_Voltage

Share this post


Link to post
Share on other sites

Just tried to flash BIOS and EC with second vga but still no luck so far. Still EC gives the same error. What would you suggest about freedos?

 

Both cards work, and other parts of the PC works as well.

 

Thanks in advance.

Edited by MWichni

Share this post


Link to post
Share on other sites

@MWichni Something might really be wrong with the DOS version then. Were you using the latest Rufus to prepare the flash? And if so, was it a portable version of rufus or the one that has to be installed? I've been using portable version.

 

Just trying to follow my steps through once again to see what might be different.

 

Can you confirm, that apart from bios files and autorun files, the only content of the flash drive is the LOCALE folder? if so, can you take a SHA-256 of it? (this should be available on right click menu, then CRC SHA, then SHA-256, if you have 7zip installed). Comparing our checksums will tell whether we're using the same version of FreeDOS.

 

Also, what is the label of your flash drive (the one displayed next to the drive letter in My Computer)? This shouldn't really matter, but try changing that to something below 8 characters long, like "FLASH" for example.

Edited by High_Voltage
  • Thumbs Up 1

Share this post


Link to post
Share on other sites

I've done whole procedure using portable rufus. I attached the SHA-256 of the locale, beside you can see that I have only what is needed. 

Maybe the problem is that modded bios was made when the second vga was removed. I will retry the whole procedure with second vga attached and then we will see what happens.

 

Thanks!

4.png

Share this post


Link to post
Share on other sites

@MWichni Right, this is to confirm our DOS versions are identical. Also, I've just reflashed my EC once again from modded V3.08 bios.

 

Whether the BIOS has been installed with Ultrabay GPU or without, should not make any difference. Better not touch it once it's installed successfully.

 

Have you checked the flash drive label? Could you maybe try another flash drive?

Edited by High_Voltage
  • Thumbs Up 1

Share this post


Link to post
Share on other sites

The label is just simple 8GB. I just tried whole procedure with second vga and it still make the same error message.

Share this post


Link to post
Share on other sites

@MWichni I see. This appears to be some FreeDOS error. Maybe it just doesn't like your flash drive. I can see two options to try:

 

1) Try different flash drive.

2) Try different DOS. (For example, you could follow Svl7's original procedure of creating DOS drive)

 

OH ALSO, I think I know what the issue is. You should try smaller flash drive. I've been using a 2gig one. This could be because DOS can't allocate as much memory as 8 gig.

Edited by High_Voltage

Share this post


Link to post
Share on other sites

Ok, I am creating freeDOS on my 4GB pendrive. Will test it out.

 

Tried it even with 1GB one, still doesn't work.

Edited by MWichni

Share this post


Link to post
Share on other sites

Unfortunattely I don't know why but this hp program tells me that my pendrive is write protected...

 

I'm on win 10.

Share this post


Link to post
Share on other sites

Right, an update:

 

We've spent some time with @MWichni trying to get this to work. The mod doesn't help at all with getting Nvidia card to work. The EC flashing issue seems to be unrelated to the mod or its performance though. Such issue has also occurred several times in Svl7's thread, but nobody knows the exact reason why it happens.

 

@MWichni and I will now test several other varieties of the mod (over the course of undefined amount of time) to see if anything works at all.

 

-High_Voltage.

Share this post


Link to post
Share on other sites

Im just waiting for the NVIDIA support so I can buy a 1080 Ti to play on my 4k TV.

 

Maybe it could help if we look for help on this matter outside this forums. I will spread the word around, maybe someone can help.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Similar Content

    • By raqall
      Hi!

      I would love to have my BIOS modded to disable the wireless whitelist.
      I tried to do it myself (dump BIOS from chip, disassemble, locate the reference to the error message "Unauthorized Wireless network card is plugged in..." memory address and modify the condition in the binary file so not to "land" in the infinite loop) but I couldn't dig to anything meaningful I could easily change.

      Laptop: Lenovo ThinkPad S440 (TYPE 20BB-S00400)
      BIOS version: 73ET71WW (1.71)
      Original WiFi/BT card: Intel Wireless-N 7260 (7260HMW BN) (vendor: 0x8086, device: 0x08B2, subdevice: 0x4262)
      Target WiFi/BT card: Broadcom BCM94352HMB (I haven't received it yet, waiting for delivery)

      Manufacturer BIOS download: bootable ISO, updater for Windows
      My BIOS dump (using CH341A SPI Programmer under Linux): http://www.mediafire.com/file/mn0gfr9ext7yqrn/S440_73ET71WW.bin/file
       
      Thanks!
    • By Klem
      In this thread you can post your requests for Lenovo Y50-70, Lenovo Y70-70, Lenovo Z50-70, Lenovo Z70-70, Lenovo G50-70, Lenovo G70-70.
      If someone want upgrade Wi-Fi card and remove whitelist, or unlock hidden additional menus and settings in bios setup menu, or unlocked vbios for overclock NVIDIA card, then you can post your request in this thread. Also, if you have a problem with fan pulsating/clicking on any modified bios then you can post your request in this thread.
       
      The flashing procedure include two steps:
      1.  Flash main system bios.
      2.  Flash EC firmware.
    • By damianalex
      Hi,
      I want to show you my new project.
      I bought my laptop about 5 years ago.  It was never speed deamon, but for every day use, it was enough to me.
       
      Its specification:
      Intel i7-4700MQ
      Nvidia GeForce GT745M
      16GB RAM
      512 SSD Adata SU800

       
      Yesterday I bought Witcher 3. Of course on 1080p it's impossible to play, because of about 10fps
       
      So I make a decision to buy external grahpic card.
      I choose GTX970 and now I am looking for occasion to buy it.
       
      I've already bought EXP GDC v8.4d mPCI-E. It is used and cost about 30$.

       
      I will use ATX PSU to supply graphic card, because I have old desktop PSU at home.
       
      My plan:
      1) unlock bios
      2) buy GTX 970
      3) enjoy Witcher 3!
       
      BTW I try to cool down my laptop, so I replaced thermal paste to Kryonout Thermal Grizzly and make some tests. Temperatures and fps are on screenshots.
       
      1) laptop on table, playing GTA V 1080p

       
      - first minute (GPU core 1045MHz)

       
      -after some time, because of high temperature and GPU throlttling (GPU core drop down even to 400MHz)

       
      2) with thermalpad Glacier NC400 SilentiumPC

      - 30 minute and longer (GPU core drop to about 900MHz)
       
      3) without down case of laptop (like on picture with thermal paste) on thermalpad.
      Here laptop never drops down MHz and max temp are about 72 Celsius degrees.

       
       
      Bacause of that I bought second down case for my laptop and I will cut there additional holes.
       
      Greetings!
       
      I will describe next step when I get all stuff I need!
       
       
    • By popozitos
      Hello everyone
      I created a case for egpu using 2.5mm acrylic sheets. The first time I created a case to support a GPU + ATX psu
      Now I created another one for the GPU with an external Xbox 360 203w psu.
      the finish was not good but for my use it is already good.
       
      *both cases album
      *Construction of the second case 
      *adapting xbox psu to 8pin power (taken from 24pin)
       
      all made by hand with the tools I had.

      from Brazil.

    • By jcrcarmo
      Hi folks,
        Greetings from Brazil!  Not sure I'm posting in the right place, but I have a question:  how do I find out the brand and model of my BIOS chip without having to open my laptop?  I can't find this information anywhere.  Been searching for days... I have a Lenovo Ideapad 300-15ISK 80RS (motherboard Paris 5A8).  Thanks a lot for your time and help! I really appreciate it!   Best regards,   JC.
×

Important Information

By using this site, you agree to our Terms of Use. We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.