corna / me_cleaner Goto Github PK

Hi,
I'm thrilled that the community has made progress into disabling the ME for modern intel chipsets. I have an Intel Skylake processor, and I was wondering what should work meant. How does that differ from untested? I'm considering attempting the fix on my CPU/motherboard, and would love some guidance on that. Is there a way to restore it if the 30 min limit is not bypassed?

Apologies if this is the wrong place, happy holidays!

Please comment here if me_cleaner works on your device.
If this tool does not work on your PC (or it does not behave as expected), don't comment here but open an issue instead.
Specify:

• CPU architecture
• CPU model
• Laptop/motherboard
• OEM BIOS or coreboot?
• If you used the -s/-S flag in me_cleaner

Thanks

Is there any data or reports on Macbook Pros?
I'm personally interested in experiences with i7-3720QM's but also generally if anyone has tried this on Macbooks in general.

May it be useful to you.
Disabling Intel ME 11 via undocumented mode

me_cleaner applied successfully and flashed using Raspberry Pi Model B+.

Laptop now experiences what I can only describe as a boot delay from cold boot. During the delay the power LED, wifi indicator, and ThinkLight flash a few times while the screen remains black. After this period the bios screen appears and system seems to boot normally. Issue does not arise during reboot.

I noticed two people in #3 mentioned the same delay/slow boot but there seems to be no resolution so far. Looks like it's some kind of time out.

I decided to update the OEM bios from 1.25 to 1.43 but it made no difference. I'm at a loss.

• CPU architecture: Intel Core i5-2520M
• CPU model: Sandy Bridge
• Laptop: Lenovo Thinkpad X220
• OEM bios

intelmetool output:

Bad news, you have a `QM67 Express Chipset Family LPC Controller` so you have ME hardware on board and you can't control or disable it, continuing...

MEI was hidden on PCI, now unlocked
MEI found: [8086:1c3a] 6 Series/C200 Series Chipset Family MEI Controller #1

ME Status   : 0x1e003052
ME Status 2 : 0x1b320002

ME: FW Partition Table      : OK
ME: Bringup Loader Failure  : NO
ME: Firmware Init Complete  : NO
ME: Manufacturing Mode      : YES
ME: Boot Options Present    : NO
ME: Update In Progress      : NO
ME: Current Working State   : Recovery
ME: Current Operation State : M0 with UMA
ME: Current Operation Mode  : Normal
ME: Error Code              : Image Failure
ME: Progress Phase          : BUP Phase
ME: Power Management Event  : Power cycle reset through Moff
ME: Progress Phase State    : M0 kernel load

ME: Extend SHA-256: 0311dee9ea06e2ed7a972729ddbefd07e4406ed70f136e3bcca940fa0b705e13

ME: has a broken implementation on your board with this BIOS
ME: failed to become ready
ME: failed to become ready
ME: GET FW VERSION message failed
ME: failed to become ready
ME: failed to become ready
ME: GET FWCAPS message failed
Re-hiding MEI device...done

lspci output: lspci.txt

My setup: #3 (comment)

After testing for a few weeks, it seems that removing ME caused my computer to stop waking up properly from suspend to RAM (sleep in windows 7). Both my Arch and Win 7 are affected (I dualboot). When I switch back to backup bios with ME, everything works properly (My motherboard has DualBios).

When you wake up the system it powers on, fans start working, etc but monitors do not lit up, only thing that works to resuscitate the system is power cycle. Post-mortem examination of systemd logs shows nothing.

P.S. Also, probably relevant note, one of the first times it didn't woke up properly it went into a nasty reboot loop after powercycle. Only thing that helped was resetting CMOS.

Everything went properly, flasher used is a raspberry pi model b. CPU is i5-3320M, Coreboot bios.

Hi @corna ,

I have this toshiba l50-a-165 (vgst/vgstg motherboard - I5-4200u Haswell) and i have done me_cleaner on the bios dump and effectivelly removes all intel management engine interface but dont remove the 30 minutes shutdown.

Anyone can give me some solution? the notebook works very well except the 30 minutes shutdown. i have tried many bios dump and no one solve my problem.

Thanks

Wondering how I can help. This is my processor. It pitches itself as using AMT ("Active Management Technology") instead of ME -- not sure if they're the same thing.

What's the worst that could happen? I have a Sandy Bridge Intel i5 2410m and I don't really want to blow off firmware for the ME without knowing the possible consequences.

another thing that would be nice to have in the wiki is a brief comparison of a system cleaned by me_cleaner vs a libreboot system such as X200: in which cases would somebody be satisfied with me_cleaner and in which cases would somebody need to go all the way with libreboot?

I have reported that a coreboot image with a cleansed and truncated ME region may cause the first boot costing more than 5 minutes. Now I confirm that in order to prevent this, the bios region should be aligned to 64KiB (0x10000) on ivybridges. Sandybridges do not have such limitation.

I saw you mentioned at the readme that the ME 11.x FTPR structure is not yet know. Actually it has been since November 2015 or so. Of course it's not 100% understood yet like ME 2-10 but it's getting close. I created a wiki page with the structure of ME 11.x FTPR partition which is what me_cleaner targets.

Also, the Huffman modules can be separated into compressed parts based on their "header". What's interesting is that I haven't seen so far anything which may restrict us from moving FTPR directly this time like we did in the past with the LUT.

Edit: Removed my wiki page as it is very outdated compared to the recent presentation by Dmitry Sklyarov when it comes to FTPR extensions. I'll write some "ctype" structures at the next version of MEA instead for anyone interested.

Edit 2: Added all $CPD extensions at MEA v1.12.0

Hi,
First of all, thanks for the script! It does something I really wanted to apply to my computers, but is way beyond my technical capabilities!
This is not much of an issue, but more of a suggestion and a question. According to the documentation:

You are losing something. Intel ME doesn't only provides some services (that you may or may not use), but it also does low-level stuff (like silicon workaround, thermal management, fan control...). Most of these things are often controlled by something else, so they're not really needed, but who can be sure?

Have there been any reports of (noticeable) changes due to using me_cleaner (in the latest version)? Either way, might be worth adding something something to that effect, like: "So far, no one has reported any adverse effects" or "In previous versions, some NICs has been found to respond adversely to me_cleaner, but workarounds are available and fixes implemented"

Now for the question, has anyone noticed any difference in power consumption? I imagine the ME chip is probably very efficient, but I just wanted to check if not running the RTOS could potentially offer other advantages to the system.

At some future date, will me_cleaner be able to remove just the potentially malicious parts of the Intel Management Engine?

I’m curious because currently me_cleaner removes the entire Intel Management Engine, which includes useful and (in my opinion) necessary things like fan control and thermal management. I would like to be able to remove the malicious part of Intel Management Engine without having to give up useful stuff (mentioned above), and also without the high risk of bricking my next laptop (currently using Late 2011 13” MacBook Pro).

In general, I have no problem with proprietary firmware - I try to be practical in such matters. I only have a problem with proprietary firmware when it actually does something malicious. The Intel Management Engine is the first malicious firmware I’m aware of - though only part of it is malicious while the rest of it is useful.

The ability of the CPU to allow an independent or government hacker to spy on me and possibly plant evidence of a crime is a big concern to me. I thought I had gotten away from that sort of thing when I switched over from Windows to MacOS, and eventually from MacOS to Linux - I never thought such functionality would be built into a piece of hardware, making it far more difficult to remove. It used to be that you could get away from that sort of stuff just by installing Linux on your PC, but now Intel has put it in firmware. While I would like to be able to get rid of the backdoor which is part of the Intel Management Engine, I would like to be able to do so without removing useful and/or important functionality, and also without possibly bricking my next laptop.

Laptop/Motherboard: Dell XPS 9550 (i7-6700HQ)
BIOS: OEM BIOS 1.2.21
Issue: Does not boot at all.

I dumped XPS BIOS using bus pirate. I need to do some hack as described in #33, and it successfully removed tables.

After flashing, it does not boot at all. It shuts itself after few seconds. No screen output.

I tried 0ac4b4.

Hardware notes: This motherboard has two flash. One is 1MB one with some device descriptor things and other thing is 16MB which stores BIOS.

I have heard that Nehalem platforms (at least some) are possible to survive completely without ME inside the flash, just as GM45, but fail to retrieve the source of the information.

Have you ever heard such things? Is that true?

This me clean was done with coreboot (make menuconfig) so maybe is a coreboot issue. Anyway, I installed coreboot with me_cleaner, and compiling seemed to indicate that me was removed.

Then I tested as explained on the wiki: https://github.com/corna/me_cleaner/wiki/External-flashing

$ cd coreboot/util/intelmetool
$ make
# ./intelmetool -s

Report:

Bad news.  You have a 'QM67 Express Chipset Family Controller' so you have ME hardware on board and you can't control or disable it continuing...

Error mapping physical memory 0x..... [0x4000] ERRNO=1 Operation not permitted
Could not map MEI PCI device memory

And that's it. I do NOT see

ME: Error Code : Image Failure
ME: Progress Phase State : M0 kernel load

So does that mean the me_cleaner didn't work? Or is this a false negative and should I be posting a success story? Is there another way to test?

Hi!
I've just discovered the Intel ME huge issue, after wondering why my network light were still on when my computer was off...
Maybe I have a good idea to get rid -temporary - of it.

If I understood well, it is something quite slow compared to the main computer. So, what if I send it lots of orders to make it crash after booting? Say, 10'000 orders to ask the status of the ME, in 1 second.

The main CPU should be powerful enough to kick out the ME, or at last slow it enough to make it inoperative.

I'm using an haswell cpu and I cannot offer me the luxury to brick my hardware - but I think this kind of attack would be quite simple, effective and reversible (=no brick)

What do you think of it?

System

Lenovo Thinkpad X201 with MX25L6445E chip; has an SSD with GRUB2 and minimal Debian Jessie (both installed via a Debian Jessie AMD64 netinstall DVD).

Results

• Stock BIOS: boots fine.
• Stock BIOS, neutralised: doesn't boot boots fine after a delay of <1 minute.
• Coreboot with SeaBIOS payload, based on descriptor & ME regions from stock BIOS: boots fine.
• Coreboot with SeaBIOS payload, based on descriptor & ME regions from neutralised BIOS: doesn't boot.

In the external flashing doc you describe how to change layout.txt from something like:

00000000:00000fff fd
**00500000**:007fffff bios
00003000:**004fffff** me
00001000:00002fff gbe

to something like:

00000000:00000fff fd
**00018000**:007fffff bios
00003000:**00017fff** me
00001000:00002fff gbe

What is unclear is how you went from 00500000 to 00018000 in the bios region. The me region is more clear as it is in the previous step. Maybe you can explain or make this more clear to people like me who are not so low level? Would be apreciated.

Thanks for providing the current status and boot guard information in the wiki.

Can you provide any more tips to help people choosing or about to buy a PC/laptop, what strategy should they follow for choosing what to buy if they hope to neutralize ME and how effective such efforts might be on the CPUs currently on the market?

I failed to dump the ROM via flashrom but chipsec works for dump:

sudo chipsec_util spi dump rom.bin

[CHIPSEC] Version 1.2.5
****** Chipsec Linux Kernel module is licensed under GPL 2.0
[CHIPSEC] API mode: using CHIPSEC kernel module API
[CHIPSEC] Executing command 'spi' with args ['dump', 'rom.bin']

[CHIPSEC] dumping entire SPI flash memory to 'rom.bin'
[CHIPSEC] it may take a few minutes (use DEBUG or VERBOSE logger options to see progress)
[CHIPSEC] BIOS region: base = 0x00800000, limit = 0x00FFFFFF
[CHIPSEC] dumping 0x01000000 bytes (to the end of BIOS region)
[spi] reading 0x1000000 bytes from SPI at FLA = 0x0 (in 262144 0x40-byte chunks + 0x0-byte remainder)
[CHIPSEC] completed SPI flash dump to 'rom.bin'
[CHIPSEC] (spi dump) time elapsed 67.021

shawn@shawn-fortress /tmp/rerun $ ifdtool -x rom.bin
File rom.bin is 16777216 bytes
Flash Region 0 (Flash Descriptor): 00000000 - 00000fff
Flash Region 1 (BIOS): 00800000 - 00ffffff
Flash Region 2 (Intel ME): 00001000 - 007fffff
Flash Region 3 (GbE): 07fff000 - 00000fff (unused)
Flash Region 4 (Platform Data): 07fff000 - 00000fff (unused)
Flash Region 5 (Reserved): 07fff000 - 00000fff (unused)
Flash Region 6 (Reserved): 07fff000 - 00000fff (unused)
Flash Region 7 (Reserved): 07fff000 - 00000fff (unused)
Flash Region 8 (EC): 07fff000 - 00000fff (unused)
shawn@shawn-fortress /tmp/rerun $ me_cleaner.py flashregion_2_intel_me.bin
Unknown image

I uploaded the ROM into:
https://github.com/hardenedlinux/hardenedlinux_profiles/raw/master/coreboot/shitty_me/rom.bin

Seems working on:

Intel Core i3-2377M
Sandy Bridge
Acer Aspire S3-371
OEM BIOS
d1abbca

MEI device has NOT disappeared on this platform, but seems to have been neutralized according to intelmetool's output.
superiotool.txt
lspci.txt
dmidecode.txt
intelmetool_deme.txt

I tried this on my msi x99s mpower motherboard described here: https://ca.msi.com/Motherboard/X99S-MPOWER.html#hero-overview. Specifically I tried the newest M.B revision of bios. After flashing, my computer rebooted to a black screen. It looks like the video card did not initialize at all. I waited for 5 minutes but nothing happened. After, I force restarted the computer and it went into a boot loop. Tries to turn on, turns off turns on again. Luckily the motherboard has 2 bios chips so I used the secondary bios to flash the primary one with an unmodified M.B revision and everything is ok now. Thank you for your hard work in this project. I suppose I might be willing to try it again since recovering a bricked bios is pretty easy for this motherboard.

Here's the output when I run the script:

[Daniel@Daniel8 me_clean]$ python3 me_cleaner.py E7885IMS.MB0
Full image detected
The ME region goes from 0x1000 to 0x7fffff
Found FPT header at 0x1010
Found 20 partition(s)
ME firmware version 9.1.10.1000
Found FTPR header: FTPR partition spans from 0x48000 to 0xd0000
Removing extra partitions...
Removing extra partition entries in FPT...
Removing EFFS presence flag...
Correcting checksum (0xea)...
Reading FTPR modules list...
Wiping LZMA section (0xadbb4 - 0xd0000)
UPDATE (LZMA, 0x0adbb4 - 0x0addde): removed
ROMP (Huffman, 0x04eac0 - 0x04eec9): NOT removed, essential
BUP (Huffman, 0x04eec9 - 0x05fd1f): NOT removed, essential
KERNEL (Huffman, 0x05fd1f - 0x095093): removed
POLICY (Huffman, 0x095093 - 0x0adbb4): removed
ClsPriv (LZMA, 0x0addde - 0x0ae1b7): removed
SESSMGR (LZMA, 0x0ae1b7 - 0x0b9b51): removed
SESSMGR_PRIV (LZMA, 0x0b9b51 - 0x0bf430): removed
HOSTCOMM (LZMA, 0x0bf430 - 0x0c773a): removed
TDT (LZMA, 0x0c773a - 0x0ccaef): removed
FPF (LZMA, 0x0ccaef - 0x0ce5f2): removed
Done! Good luck!

My HP Spectre x360's bios uses AMI Aptio V, however it also uses a proprietary RSA based .sig file along with the factory .bin bios file.

In the past I had success flashing with me_cleaner (see the issue about the project status), but the current version breaks signature validation resulting in an error message instead of a flash.

Going back, I do find that revision fbc123e and earlier versions work, even on the current F.46 bios version (ME 11.0) but the newer ones do something that causes the invalidation of the signature.

At the very least we know that the ME should be crippled/disabled with the older version, but some of the newer enhancements are surely safe, except for any that may change file size or otherwise invalidate the key somehow.

I noticed that after a while of use on my sandybridge board, the screen goes a random colour while in X11 and can no longer reset the display. Needs to hard shutdown.
I seemed to fix it by wiping the firmware modules with 0x00 instead of 0xff. This seems to do the trick.
I suggest changing 0xff -> 0x00.

Can you help me for my rig? http://valid.x86.fr/cd8mqc
BIOS - http://dlcdnet.asus.com/pub/ASUS/mb/LGA1150/MAXIMUS-VI-HERO/MAXIMUS-VI-HERO-ASUS-1603.zip?_ga=1.74670609.2045972994.1490991781

Genuine Intel® CPU 0000 @ 2.60GHz
Threading 1 CPU - 4 Core - 8 Threads
Frequency 2992.86 MHz (30 * 99.76 MHz) - Uncore: 2992.9 MHz
Multiplier Current: 30 / Min: 8 / Max: 30
Architecture Haswell / B0-Step (22 nm)
Cpuid / Ext. 6.C.2 / 6.3C
IA Extensions MMX, SSE, SSE2, SSE3, SSSE3, SSE4.1, SSE4.2, EM64T, VT-x, AES, AVX, AVX2, FMA3, TSX
Caches L1D : 32 KB / L2 : 256 KB / L3 : 8192 KB
Caches Assoc. L1D : 8-way / L2 : 8-way / L3 : 16-way
Microcode Rev. 0x00000FFFF0006
TDP / Vcore 65 Watts / 0.976 Volts
Temperature 53 °C / 127 °F
Type Engineering Sample
Motherboard
Model Asus MAXIMUS VI HERO
Socket Socket 1150 LGA
North Bridge Intel Haswell rev 02
South Bridge Intel Z87 rev C2
BIOS American Megatrends Inc. 1603 (08/15/2014)

Hey,

is it possible to reduce the size of the ME instead of 0xFF the space ?
So that the people can have more space in their spi rom.

I've just tested it and logged my findings here https://nroach44.id.au/index.php/2017/01/24/thinkpad-x220-shrink-the-me-region/
Basically if we truncate the ME region to the last byte, update the ifd, everything works as expected.

Would it be possible to have an option to automatically truncate the file if we are cleaning the just the ME region, and if we are doing the whole firmware ROM spit out a ifdtool layout with the smaller ME region?

I have some socket P laptops with T9600/P9600, etc. The ME is "disabled" because they never paid for it on my particular examples but I know the code and the proc is there in every CPU. Can support be added to knock it out?

Chipsets are PM45 but there are a few around this series. What's worse is that they are exploitable per the initial research on ME. I get the idea that the dormant ME actually isn't.

Motheboard: GA-P55A-UD3R https://www.gigabyte.com/Motherboard/GA-P55A-UD3R-rev-10#sp
BIOS: F14B http://download.gigabyte.eu/FileList/BIOS/motherboard_bios_ga-p55a-ud3r_f14b.exe

Used version 2e8761e.
Follow guide from here: https://github.com/corna/me_cleaner/wiki/Internal-flashing-with-OEM-firmware

ifdtool and me_cleaner passed all checks, both pre- and post-cleaning. Tried flashing cleaned image via built-in motherboard "QFlash" utility, it refused claiming BIOS image was corrupt. Tried via flashrom in Linux, it "worked" (as in: flash succeeded). After power cycling, computer booted but froze during POST (screen is displayed with CPU and memory information but cannot enter BIOS, keyboard is unresponsive, it never reaches the next stage when you see messages from Intel AHCI).

Motherboard has dual BIOS, triggered backup BIOS in order to recover.

This is an old machine and removing ME in it is not critical for me, I was mostly trying it out to check if it worked. I can provide additional logs, BIOS images, etc. if requested.

I would like to package me_cleaner for Debian and having a version number, even 0.0.1 would be nice.

Because the problem is very similar to another thread (#56),
i have copy&pasted some lines and added more information.

CPU architecture: Lynnfield

CPU model: Intel Xeon X3480
Link: http://ark.intel.com/products/48501/Intel-Xeon-Processor-X3480-8M-Cache-3_06-GHz

Motherboard: Gigabyte GA-P55A-UD6
Link: https://www.gigabyte.com/Motherboard/GA-P55A-UD6-rev-10#sp

OEM Bios: F12c "P55AUD6.12C"
Link: download.gigabyte.eu/FileList/BIOS/motherboard_bios_ga-p55a-ud6_f12c.exe

Ignition Runtime Image FW version: 6.0.30.1199
Ignition Factory Default Image FW Version: 6.0.30.1199

Used "me_cleaner.py" Version: It should be the version before 72fff7a

Here are the checksums of the used file "me_cleaner.py"
CRC-32: 1c195e2d
MD5: b431b802f9bed5b80d240335c651d6a1

Follow guide from here: https://github.com/corna/me_cleaner/wiki/Internal-flashing-with-OEM-firmware

ifdtool and me_cleaner passed all checks, both pre- and post-cleaning. Tried flashing cleaned image via built-in motherboard "QFlash" utility, it refused claiming BIOS image was corrupt.

Tried another tool called "@bios" for Windows. Link: https://www.gigabyte.com/webpage/20/HowToReflashBIOS.html

It "worked" (as in: flash succeeded). Everything worked good, when i have rebooted the PC or used the reset switch several times.

But after a shutdown / power cycling, computer booted but froze during POST (screen is displayed with CPU information but cannot enter BIOS, keyboard is unresponsive, it never reaches the next stage when you see messages from Intel AHCI.

Onboard debug LED simplifies motherboard troubleshooting. The last displayed digitnumber is "50".
POST Errorcode 50h = Initialize USB Keyboard & Mouse.

But with PS2-Adapter and no Mouse, the same problem happens.

Motherboard has dual BIOS, triggered backup BIOS in order to recover.

Thank you very much for you effort!
IntelME is the reason why i did not buy a newer PC.

Some firmwares, like Dell XPS 9550 (OEM firmware v1.2.21), has ME firmware but its nr value is zero.

I looked around some other project like https://github.com/skochinsky/me-tools, they overrides nr>2 detection. (https://github.com/skochinsky/me-tools/blob/master/me_unpack.py#L1009)

So I tried overriding that detection routine at https://github.com/corna/me_cleaner/blob/master/me_cleaner.py#L335, like if nr > 2 or True and it removed ME blobs from my firmware dump like this:

Full image detected
The ME/TXE region goes from 0x3000 to 0x6ff000
Found FPT header at 0x3010
Found 13 partition(s)
Found FTPR header: FTPR partition spans from 0x4000 to 0x133000
ME/TXE firmware version 11.0.18.1002
Removing extra partitions...
Removing extra partition entries in FPT...
Removing EFFS presence flag...
Correcting checksum (0x0c)...
Modules removal in ME v11 or greater is not yet supported
Checking FTPR RSA signature... VALID
Done! Good luck!

So I think we need commandline param to override nr > 2 check.

Hi,
I'm trying to deblob the intel ME image of my Thinkpad X230 but the script reports "FPT not found".
I checked with an hex editor and the issue seems related to the $FPT position. The script is looking for "$FPT"on 0x30 but on my Intel ME image it is located on 0x3010...

Fixing the seek to 0x3010 isn't enough 'cause even the FPTR partition is "wrongly" located and the script can't find it.
Thanks for your help

ME Backup rom

P.S. I'm sure that the dump is correct. I have already double-checked it. :)

today I decided to play a little bit with old x58 platform that I have and remove intel ME from my ex58-ud3r board, the problem was when I pulled the firmware of the flash chip ifdtool got fatal error, it couldnt find flash descriptor, and when I tried me_cleaner it would just print unknown image

so my question is what does that mean, is it possible there is no ME firmware installed?

PS the firmware that is written in the chip is 2MB in size, I did snoop a bit with hex editor and found a ton of padding inside the image
oh and I forgot BIOS version is FK2, it is not officialy released, I got it directly from gigabyte support, although FK version that is released doesnt work either with these tools

Following internal flashing instructions with coreboot, and the process without shrinking works fine, however I am unable to execute the instructions around shrinking the ME. I'm using me_cleaner f4e3d14, and ifdtool is from coreboot 5cb2263. The steps and output I followed are below:

$ me_cleaner.py -O stock-BIOS-compressed.rom -r ../original/stock-BIOS.rom
Full image detected
The ME/TXE region goes from 0x3000 to 0x4ff000
Found FPT header at 0x3010
Found 19 partition(s)
Found FTPR header: FTPR partition spans from 0xcf000 to 0x145000
ME/TXE firmware version 7.1.40.1161
Removing extra partitions...
Removing extra partition entries in FPT...
Removing EFFS presence flag...
Correcting checksum (0xed)...
Reading FTPR modules list...
 UPDATE           (LZMA   , 0x1131bd - 0x11324f): removed
 BUP              (Huffman, fragmented data    ): NOT removed, essential
 KERNEL           (Huffman, fragmented data    ): removed
 POLICY           (Huffman, fragmented data    ): removed
 HOSTCOMM         (LZMA   , 0x11324f - 0x118808): removed
 RSA              (LZMA   , 0x118808 - 0x11d2b9): removed
 CLS              (LZMA   , 0x11d2b9 - 0x121ccb): removed
 TDT              (LZMA   , 0x121ccb - 0x127e79): removed
 FTCS             (Huffman, fragmented data    ): removed
Relocating FTPR from 0xcf000 - 0x145000 to 0x3400 - 0x79400...
 Adjusting FPT entry...
 Adjusting LUT start offset...
 Adjusting Huffman start offset...
 Adjusting chunks offsets...
 Moving data...
The ME minimum size should be 86016 bytes (0x15000 bytes)
The ME region can be reduced up to:
 00003000:00017fff me
Checking FTPR RSA signature... VALID
Done! Good luck!

Execute ifdtool to extract layout from original stock BIOS:

$ ifdtool -f layout.txt ../original/stock-BIOS.rom
File ../original/stock-BIOS.rom is 8388608 bytes
Wrote layout to layout.txt

Modify layout.txt to reflect shrinking ME from:

00000000:00000fff fd
00500000:007fffff bios
00003000:004fffff me
00001000:00002fff gbe

to:

00000000:00000fff fd
00018000:007fffff bios
00003000:00017fff me
00001000:00002fff gbe

Executed ifdtool with the new layout.txt:

$ ifdtool -n layout.txt stock-BIOS-compressed.rom
File stock-BIOS-compressed.rom is 8388608 bytes
DANGER: Region Intel ME is shrinking.
    The region will be truncated to fit.
    This may result in an unusable image.
Copy Descriptor 0 (Flash Descriptor) (4096 bytes)
   from 00000000+00000000:00000fff (      4096)
     to 00000000+00000000:00000fff (      4096)
Copy Descriptor 1 (BIOS) (3145728 bytes)
   from 00500000+00000000:007fffff (   3145728)
     to 00018000+004e8000:007fffff (   8290304)
Copy Descriptor 2 (Intel ME) (86016 bytes)
   from 00003000+004e8000:004fffff (   5230592)
     to 00003000+00000000:00017fff (     86016)
Copy Descriptor 3 (GbE) (8192 bytes)
   from 00001000+00000000:00002fff (      8192)
     to 00001000+00000000:00002fff (      8192)
Writing new image to stock-BIOS-compressed.rom.new

Checked the integrity of the resulting BIOS file with me_cleaner and found that it was corrupted:

$ me_cleaner.py -c stock-BIOS-compressed.rom.new
Full image detected
The ME/TXE region is corrupted or missing

Running the same check on the original file looks fine:

$ me_cleaner.py -c stock-BIOS-compressed.rom
Full image detected
The ME/TXE region goes from 0x3000 to 0x4ff000
Found FPT header at 0x3010
Found 1 partition(s)
Found FTPR header: FTPR partition spans from 0x3400 to 0x79400
ME/TXE firmware version 7.1.40.1161
Checking FTPR RSA signature... VALID

I don't know if it helps, but below is a diff of the ifdtool dump from the two images:

1c1
< File stock-BIOS-compressed.rom is 8388608 bytes
---
> File stock-BIOS-compressed.rom.new is 8388608 bytes
150,153c150,153
< FLREG1:    0x07ff0500
<   Flash Region 1 (BIOS): 00500000 - 007fffff
< FLREG2:    0x04ff0003
<   Flash Region 2 (Intel ME): 00003000 - 004fffff
---
> FLREG1:    0x07ff0018
>   Flash Region 1 (BIOS): 00018000 - 007fffff
> FLREG2:    0x00170003
>   Flash Region 2 (Intel ME): 00003000 - 00017fff
156c156
< FLREG4:    0x00001fff
---
> FLREG4:    0x00000fff

Any ideas or suggestions? Thanks!

Hi,

Just a suggestion to save time for people...

Update readme to state which operating system you have run and tested the script under (example: linux or windows, or both) And which version of python you are using, example python 2 or python 3, or both.

Bill

I successfully applied me_cleaner to B75 and Z87 OEM bios.
Just to learn how it works on skylake I downloaded several bios images from newer motherboards and tried me_cleaner on them. Looks like it cant work with full bios images.

Full image detected
This image does not contains a ME/TXE firmware NR = 0)

However it looks working on extracted ME region blob.

ME/TXE image detected
Found FPT header at 0x10
Found 1 partition(s)
Found FTPR header: FTPR partition spans from 0x1000 to 0xa8000
ME/TXE firmware version 11.6.25.1229
Removing extra partitions...
Removing extra partition entries in FPT...
Removing EFFS presence flag...
Correcting checksum (0xd0)...
Modules removal in ME v11 or greater is not yet supported
Checking FTPR RSA signature... VALID
Done! Good luck!

Then I tried to use FIT v11 to integrate ME image into full image. It checks integrity and rejects modified blob. I tried to 'dd' modified me to offset 0x1000 of full image but FIT also refused to open modified image.
I'm wondering if its safe to flash this modified image ?
If I have ME region not write locked will it be good to "fpt -me -f modified_me.bin" ?

http://pastebin.com/Py8r1bFc

http://pastebin.com/GkQjrZBu

https://www.dropbox.com/s/dxs1p7kv1en7mo1/me_2.0.5.3105.rar?dl=0

Also size of the .rgn is 8GB after the script stops.

Has anyone tried using a ME image with zero partitions and fixing the entries/checksum?
ie, something like this:

$ hd flashregion_2_intel_me.bin
00000000  20 20 80 0f 40 00 00 10  00 00 00 00 00 00 00 00  |  ..@...........|
00000010  24 46 50 54 00 00 00 00  20 10 30 ed 07 00 64 00  |$FPT.... .0...d.|
00000020  20 00 00 00 01 fc ff ff  00 00 00 00 00 00 00 00  | ...............|
00000030  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
004fd000

For ifdtool has been integrated into coreboot's build process, I believe it is better to have ifdtool handle all IFD-related operations, so I am going to backport those IFD-related features to ifdtool.

@corna I remember that you have said that ifdtool's manipulation may somtimes breaks IFD. Could you point out which data get broken, and how me_cleaner prevents this, please?

Laptop/motherboard: ThinkPad x131e (Intel Core i3-3227U, Ivy Bridge)
BIOS: OEM BIOS 2.92 (latest version from manufacturer's website)
Issue: After flashing me_cleaned BIOS, laptop doesn't boot. Fan starts spinning and power LED lights up as normal, but the screen stays off. No network activity. Power button has to be held down to turn off the laptop. After restoring the BIOS backup, the laptop boots normally again.

I tried the following with the same results:

• ffe60d8 (latest as of this writing)
• 61fd606
• Removing all power (battery, AC, RTC button cell) after flashing for a few minutes.
• Booting with an external monitor.

Notes:

• OEM BIOS has an option to set Intel AT and Computrace to Permanently Disabled, and this was already set before the attempt to neutralize IME.

Hardware notes:

• This laptop has 2 EEPROM ICs under the bottom cover, right next to each other:
  • EON EN25Q32B (4MB), sits under the RTC button cell, which is stuck to it with double-sided foam tape. The contents are not recognized by ifdtool.
  • EON EN25Q64 (8MB), sits under a plastic strut from the bottom chassis. The strut is in the way for a SOIC clip. I decided to snip it off.
    ifdtool only recognizes the contents of the 8MB EEPROM so I ignored the 4MB one.
• The flasher was a Raspberry Pi 2 Model B with a SOIC clip. Wake-on-LAN method did not power the EEPROM. I had to supply 3.3V from GPIO pin 17 on the Raspberry, but also leave the battery in - otherwise flashrom did not see the IC.

me_cleaner seems to not like my fresh images pulled from my T430. v2.72 of BIOS, pulled with flashrom.

Just tested two coreboot + SeaBios images on a T530 that were identical
except one time with ME and one time without (using the compile option,
rev 54db255529ce8afc689ae425c24b7fb1d45654e8).

Unfortunately it seems that ME does some CPU fan initialization (ACPI?)
that coreboot doesn't, i.e. on the image without ME the CPU fan didn't
start anymore = not usable. I tested with Fedora 26 and ubuntu 14.02 LTS
up to temperatures of 98 degrees celsius, but it wouldn't start. I
didn't test manual fan control.

What is interesting:

After re-trying the cleaned ME build right after the one with ME, the
CPU fan did start at first. Then however I did a hard reset (remove
power except for CMOS battery, press and hold the power button multiple
times for some seconds, attach power and boot) and the CPU fan wouldn't
work anymore (it actually spins a couple of times before SeaBios pops
up, but after that it's dead).

So maybe ME writes something to NVram or whatever that makes it work and
the NVram is cleaned upon hard reset? I don't know that topic well enough...

https://mail.coreboot.org/pipermail/coreboot/2017-July/084726.html

How would I use "me_cleaner.py" in a external flasher since I can remove my cmos bios chip from my motherboard OR I have the chip but no motherboard yet.
Also this makes backups effortless.

Hi, I have written a patch that removes all huffman modules in the LLUT table by setting the flag for all huffman chunks to 0, meaning that the chunks get interpreted as already uncompressed data. Then I wiped the actual data. This might work if the hash of each binary huffman module is not verified against its corresponding hash in the module header. It seems the LZMA module hashes are not verified so perhaps the huffman ones are not verified too. Anyway, this is worth a shot...

Please test https://github.com/zamaudio/me_cleaner/tree/experiments_remove_huffman

Hi, I tried to install Coreboot with SeaBIOS and neutralized Intel ME on a Thinkpad X1 Carbon 1st gen and get the following issue: the keyboard briefly lights up and the fan starts spinning, but the laptop doesn't boot. I then restored the lower 8 MB of the original BIOS (which, if I'm correct, contains the Intel ME) and got the same result. I finally had to restore also the upper 4 MB of the original firmware image to be able to boot the machine up again. Maybe the problem is that I have Intel Boot Guard enabled or I did something wrong when compiling Coreboot. How can I find out if I have the Boot Guard activated? I tried intelmetool -s but didn't find any message about that?!

Intel Core i7-4600U
Haswell
Lenovo X1 Carbon Gen2
OEM BIOS
0bf14b8

The keyboard lights up briefly then the computer shuts down (nothing is displayed on the screen).

I followed this tutorial : http://hardenedlinux.org/firmware/2016/11/17/neutralize_ME_firmware_on_sandybridge_and_ivybridge.html