Knowledge on Firmware Images for Intel Platforms

The knowledge here focuses on firmware images, their partitioning and data structures.

Official resources

Intel publishes general information on firmware in their developer portal: https://www.intel.com/content/www/us/en/developer/topic-technology/firmware/overview.html Note that the public information mainly focuses on host processor firmware.

Other projects

• me_cleaner wiki
• ME Analyzer
• coreboot
  • Intel SoC documentation
  • Authenticated Code Module
  • ifdtool
  • intelmetool
• UEFITool
  • IFD
  • ME parser
  • FIT parser
• Positive Technologies research
  • TXE MFS exploit PoC
  • ME disablement
  • many other repositories

Research

Many researchers have looked into the Intel Management Engine over the years and presented on their findings:

• https://media.ccc.de/v/34c3-8762-inside_intel_management_engine
• https://media.ccc.de/v/36c3-10694-intel_management_engine_deep_dive

Forums

People keep asking in Intel’s community forum for tools and information around Intel platform firmware, resorting to third-party forums because Intel does not publish what they need or limits access to necessary resources to certain customers only, notably not end users. Here is a short list of places to find useful information and tools.

• Win-Raid (Level1Techs) Forum
  • (CS)ME firmware and tools
  • (CS)ME etc firmware repositories
  • ME Analyzer
  • EFFS in ME Gen 2
• Badcaps Forum
• Indiafix Forum
• Vinafix Forum
• AliSaler
• mostav02’s notes on FPT and removals

Extraction

For older FIT tools, use binwalk to extract resources and then grep for LayoutEntry to find descriptions of straps, which include the HAP bit, e.g.:

<LayoutEntry name="PCH_Strap_CSME_CSE_HAP_Mode" type="bitfield32"
    value="0x0" offset="0x68" bitfield_high="16" bitfield_low="16" />

Note that later generation XML files just call the HAP bit “reserved”. Educated guessing by looking at neighboring bits will help you to locate it.

Newer FIT tools (e.g., v18) contain Python code that can be extracted with pyinstxtractor. Relevant code is in the plugins/ directory:

pyinstxtractor.py ../mfit_18.exe
ls -l tools.exe_extracted/plugins/