Activate AMT on Dell T3620

Special Topics Intel Management Engine
21

The tool needs the correct Windows MEI driver and to be run as ADMIN CMD, under windows enviroment, there’s also variables for UEFI, Linux, etc…

The Service jumper will disable the CS(ME) engine for getting read/write access to regions/blocks, so you could try dumps with the jumper in Default position and see what outputs as acess permissions.

fptw64. exe -i
fptw64.exe -d ful_spi.bin (Full dump with all accessible regions)
fptw64.exe -bios -d bios_region.bin (Bios region dump only)
fptw64.exe -me -d csme_region.bin (CSME region dump only)
etc…

22

Thank you. You reference fptw64.exe; Is FWUpdLcl64.exe also ok? I notice that it has fewer options in the older version that is the one which works with my system, particularly, it lacks the -d options and region-specific suboptions.

So, with the SERVICE_MODE jumper removed, DEVMGMT again shows the Management Engine Interface #1 (I’m glad I wasn’t just losing my mind!), and the v11 FWUpdLcl64.exe -SAVE option seems to have worked.
I got “STATUS: restore point operation success.”
And I have the file as specified in the -SAVE option, 4,968,448 bytes.

MEAnalyzer on this dumped file gives:

╔═══════════════════════════════════════════╗
║         ME Analyzer v1.307.0 r366         ║
╚═══════════════════════════════════════════╝

╔════════════════════════════════════════════╗
║          MonsterOrigFW.bin (1/1)           ║
╟─────────────────────────────┬──────────────╢
║            Family           │    CSE ME    ║
╟─────────────────────────────┼──────────────╢
║           Version           │ 11.8.97.4739 ║
╟─────────────────────────────┼──────────────╢
║           Release           │  Production  ║
╟─────────────────────────────┼──────────────╢
║             Type            │    Update    ║
╟─────────────────────────────┼──────────────╢
║             SKU             │ Corporate H  ║
╟─────────────────────────────┼──────────────╢
║       Chipset Stepping      │     D, A     ║
╟─────────────────────────────┼──────────────╢
║ TCB Security Version Number │      3       ║
╟─────────────────────────────┼──────────────╢
║    Version Control Number   │     343      ║
╟─────────────────────────────┼──────────────╢
║       Production Ready      │     Yes      ║
╟─────────────────────────────┼──────────────╢
║     Workstation Support     │      No      ║
╟─────────────────────────────┼──────────────╢
║      OEM Configuration      │      No      ║
╟─────────────────────────────┼──────────────╢
║             Date            │  2024-08-25  ║
╟─────────────────────────────┼──────────────╢
║      File System State      │ Unconfigured ║
╟─────────────────────────────┼──────────────╢
║       Chipset Support       │   SPT/KBP    ║
╚═════════════════════════════╧══════════════╝

Reading further through the “Clean” guide, I downloaded the 11.8 repository; MEA shows me v11.8.97.4739; the latest number in the 11.8 repository is a little older - 11.8.92.4249, with two variants, _CON_H_DA_PRD_RGN, or COR_H_DA_PRD_RGN; from the Clean guide’s text, I think I understand that this slightly older version, with the PRD matching Production and COR matching Corporate H, though the information output by MEA is a little bit different in the Chipset information (MEA says of my dumped firmware “Chipset Stepping” “D, A” whereas MEA says of the slightly older firmware from the repository “Chipset” “KBP/BSF/GCF-H A SPT-H D”; the date is two years older than my dumped firmware; the version control number is 331 vs 343. I notice a comment in the thread Intel (Conv.Sec.) Management Engine: Drivers, Firmware and Tools (2-15) that “A downgrade to a lower VCN value via FWUpdate tool is prohibited”.

Is it okay to continue? Or must I find a more exact repository version to match the 11.8.97… of what is currently in my T3620’s firmware?

The Guide then says to run ftoolc.exe; I find instead mfit.exe, which I think is the new name of the same Flash Image Tool? That opens a program that calls itself “Intel Modular Flash Image Tool”. (Version information MFitCore version 1.1.0, MFitTool version 16.1.25.2901).

Hm. But. I dragged and dropped the file that I dumped from my T3620 with FWUpdLcl64.exe -SAVE, and the Intel Modular Flash Image Tool complains:
“Import failed
The file ‘MyOriginalFirmware.bin’ is not recognized as a valid input.”

If, instead of dragging and dropping the file, I click the Decompose option, I get a different error:
“Decompose failed
Exception: Decompose ‘C:/path/to/MyOriginalFirmware.bin’ image failed.
Details: Corrupted buffer detected.
Details: Could not find decompose metadata in image…”

I hope that I’m not providing too much step-by-step detail of how I’ve gotten to here, and you can help me get past the mfit can’t-decompose problem.

thank you again,
-Jay

23

Sir…read and be carefull, we are not talking of the same Intel tools, i did NOT mention any FWUpdLcl64…read slow and learn or you will damage the system.

And if the system has CSME v11.8 why are you messing with mFIT v16…
again, redo your learning and actions…

Tools versions are platform SKU’s specific…

24

Thanks again MeatWar. Yes, I recognize that the tools are platform/version specific; the problem is I have failed to find the matching tools. I find the links to repositories, but these links seem to go to the top of the station-drivers website, and then when I search within that site, I fail to locate fptw.
In terms of NOT damaging my system, I attempted to read (not write) with various tool versions; prior to attempting any modification of my system I would have re-confirmed everything. (I was hacking hardware and firmware in the 1980s, and I understand the concepts and the concerns in general, but the complexities of Intel AMT and having to fix Dell-broken firmware are new and confusing to me).
regards,

I rarely have this much trouble finding and figuring out things; I suspect some links may have become a bit stale, and of course Intel has absolutely not made this easy for us.
Where specifically may the CSME v11.8 compatible firmware dump and edit tools be found?

25

Already pointed out the links… as you know them/also linked them
The CSME System Tools v11 r46 package contains all the tools needed… these tools performs several actions and specific ones for each tool.

Use a temp root folder named as you wish and tools separated ones, from each tool folder run from there as CMD Admin.

Do the necessary backups/dumps (full or regions) as these files will be your safe archive/working files copy, in your case to open and modify them with the Intel FIT tool v11

I need to mention, no ofense… that these linked threads/most of the guides are very well detailed and almost fullproof fail, when followed to the mark…
And they are like this… because users on the forum cant give a “teaching” lesson to no one in a few posts in a remote forum, users have to achieve some degree of knowlodge.

26

Thank you. Yes, I understand about running as Admin, about separate folders, about making backups, and about being careful. And, I take no offense. I truly do understand how you feel!

I don’t know why before I failed to find the v11 r46 package at all. And every attempt that I made to search for FPTW64 for version 11 failed.
All of this trouble has been my confusion at finding the right files and versions. I’m sorry that I’m imperfect. Six years ago I suffered a brain hemorrhage that had me in hospital for a month. Supposedly “I recovered fully”. Per the doctors. I didn’t. I’ve never been the same, and it’s frustrating. And then COVID hit me two and a half years ago, from which I never fully recovered.
I have “knowledge” - in some areas, vast amounts (ask me about InfoSec, or global Data Protection); but reading through pages and pages has become difficult; new information is hard to absorb.
And much of my information-absorbing-capacity now is necessarily focused on medicine and health. So, everything else is harder. (Although, lately, I am hopeful that things are improving; that I’m even trying to clean the AMT firmware on my system is something that three months ago I wouldn’t have done).

I appreciate you sticking with me here to help. Thank you.

Now I have found the v11 r46, and I have successfully dumped a 16MB file using FPTW64.exe, and I have successfully opened (decomposed) that dumped file in FIT.exe
It gives the output:

Loading F:\OneDrive - Felines 'R' Us\Distributions\Intel AMT\Monster\MonsterOrigFW_v11Tools.bin

Decomposed SKU Value: "Intel (R) H Series Chipset - Intel (R) C236 - Workstation".

Decomposed PCH Strap Length: 0x58

Warning: The ME FW image loaded has been pulled from a previously booted system. Some FW settings will not be allowed to be changed.
Writing map file F:\path\to\Flash Image\MonsterOrigFW_v11Tools.map

I hope that the “pulled from a previously booted system … Some FW settings will not be allowed to be changed” warning does not create a problem.

MEA on this new dump reports:

╔═══════════════════════════════════════════╗
║         ME Analyzer v1.307.0 r366         ║
╚═══════════════════════════════════════════╝

╔═════════════════════════════════════════════════════╗
║           MonsterOrigFW_v11Tools.bin (1/1)          ║
╟─────────────────────────────────┬───────────────────╢
║              Family             │       CSE ME      ║
╟─────────────────────────────────┼───────────────────╢
║             Version             │    11.8.97.4739   ║
╟─────────────────────────────────┼───────────────────╢
║             Release             │     Production    ║
╟─────────────────────────────────┼───────────────────╢
║               Type              │     Extracted     ║
╟─────────────────────────────────┼───────────────────╢
║               SKU               │    Corporate H    ║
╟─────────────────────────────────┼───────────────────╢
║             Chipset             │  KBP/BSF/GCF-H A  ║
║                                 │      SPT-H D      ║
╟─────────────────────────────────┼───────────────────╢
║   TCB Security Version Number   │         3         ║
╟─────────────────────────────────┼───────────────────╢
║      Version Control Number     │        343        ║
╟─────────────────────────────────┼───────────────────╢
║         Production Ready        │        Yes        ║
╟─────────────────────────────────┼───────────────────╢
║       Workstation Support       │         No        ║
╟─────────────────────────────────┼───────────────────╢
║        OEM Configuration        │         No        ║
╟─────────────────────────────────┼───────────────────╢
║               Date              │     2024-08-25    ║
╟─────────────────────────────────┼───────────────────╢
║        File System State        │    Initialized    ║
╟─────────────────────────────────┼───────────────────╢
║               Size              │      0x603000     ║
╟─────────────────────────────────┼───────────────────╢
║         Flash Image Tool        │    11.6.29.3287   ║
╚═════════════════════════════════╧═══════════════════╝

I replaced the “ME Region.bin” file with the previously found slightly-older “11.8.92.4249_COR_H_DA_PRD_RGN.bin” file, and built the output in FIT.

(It warned that Boot Guard profile 5 FVMW is selected; in principle, that’s desirable; I trust that this current process does not conflict with this Boot Guard profile?)

FIT Build produced:

Executing pre-build actions

Warning: Did not update "IshSigningPolicy" because the ME FW is from a previously booted system.

Warning: Did not update "OdmIDIntelServices" because the ME FW is from a previously booted system.

Warning: Did not update "SysIntIdIntelServices" because the ME FW is from a previously booted system.

Warning: Did not update "ReservedIdIntelServices" because the ME FW is from a previously booted system.

Warning: Did not update "NvarPostManUnLckd" because the ME FW is from a previously booted system.

Warning: Did not update "PkiDomainSuffix" because the ME FW is from a previously booted system.

Warning: Did not update "PkiDomainSuffix" because the ME FW is from a previously booted system.

Warning: Did not update "EhbcEnable" because the ME FW is from a previously booted system.

Warning: Did not update "Lspcon4kdisp" because the ME FW is from a previously booted system.

Warning: Did not update "PttRtcClearDetect" because the ME FW is from a previously booted system.

Warning: Did not update "NfcSmbusAddress" because the ME FW is from a previously booted system.

Warning: Did not update "ChipsetInitBinary" because the ME FW is from a previously booted system.

Building objects

Processing attribute: BuildSettings

Processing attribute: FlashLayout

Committing CSE configuration.

Building image with Chipset Initialization version: 176.11

Processing attribute: FlashSettings

Processing attribute: IntelMeKernel

Processing attribute: IntelAmt

Processing attribute: PlatformProtection

Processing attribute: IntegratedTouch

Processing attribute: Icc

Processing attribute: NetworkingConnectivity

Processing attribute: FlexIo

Processing attribute: InternalPchBuses

Processing attribute: Gpio

Processing attribute: Power

Processing attribute: IntegratedSensorHub

Processing attribute: Debug

Processing attribute: CpuStraps

Executing post-build actions

Full Flash image written to F:\path\to\outimage.bin

Writing map file F:\path\to\outimage.map

While I do not know what any of the variables which FIT “Did not update” mean, I guess that these are current configuration settings, and should not cause the created new firmware .bin file to fail?

Running MEA on the new created .bin file produces the same output as before, with the exception that now the Flash Image Tool version is 11.8.86.3877 (on the original dumped .bin it was 11.6.29.3287).

The next instructions in the Clean Guide says to run a tool “AMTNVM.exe” from a folder “iAMTNVM” under “System Tools”, however I do not find any file containing the substring “amtnvm” anywhere in the name anywhere in the tools that I have downloaded until now.

Where may this AMTNVM.exe be found?

thank you,
-Jay

27

Sir… the “cleaning guide” here on this forum is not a “AMT activation method”, its a guide when the CSME Firmware partition gets corrupted and we need to -re-initilaize the FW Engine to original OEM factory state, still the guide has usefull information on how to deal with it and the correct use of Intel FIT and image generation.

I do believe what you need is to follow the initial Plato guidance on this thread top posts…
And from here im not, as i said previously, the best user to guide you.

28

I very much appreciate your assistance. And I repeat my offer of beer money, or security-consulting-in-kind. Warm regards.