[Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization

Special Topics Intel Management Engine
1
Guide-How To:
Clean Dumped Intel Engine (CS)ME/(CS)TXE
Regions with Data Initialization

Last Updated: 2020-07-22
This guide is relevant to those who need to clean the DATA section of an Engine (CSME, ME, CSTXE, TXE) Region, which is part of a dumped SPI/BIOS image, in order to flash the latter on a different machine of the same OEM model. It is not meant as a guide on how to completely transform a dumped Engine region into a stock Intel-provided one. Although the guide can be used for that sometimes, the goal is not to update the firmware but to clean the already existing one inside the dumped SPI/BIOS image from any system-specific data while maintaining any configuration settings applied by the OEM of the given model. In this guide, the term "system" means an individual user machine whereas "model" refers to all those "systems" released by the OEM.

A. About Engine Regions & Configuration

The SPI/BIOS chip firmware is divided into regions which control different aspects of an Intel-based system. The mandatory regions are the Flash Descriptor (FD, controls read/write access between the regions among other things), the (Converged Security) Management or Trusted Execution Engine (CSME/CSTXE/ME/TXE, holds the Engine firmware which has been configured for a specific system) and the BIOS. The Type of each (CS)ME/(CS)TXE firmware Region can be either Stock (RGN, clean/stock/unconfigured images provided by Intel to OEMs) or Extracted (EXTR, dirty/extracted/configured images from various SPI/BIOS). The (CS)ME or (CS)TXE firmware at the system's SPI/BIOS chip is always EXTR, generated by the OEM after configuring the equivalent RGN at the factory via Intel Flash Image Tool (FIT).

The Engine firmware Regions (RGN/EXTR) consist of two sections: CODE and DATA. CODE is the actual Engine firmware whereas DATA is where all the system-specific settings are stored, as configured by the OEM at the factory via Intel Flash Image Tool. The Engine firmware is not static as it holds system-specific configuration and can additionally be slightly configured by the Engine co-processor while the system is running in order to provide the proper support and functionality. Any such changes are written into the DATA section of the Engine Region and the firmware is considered initialized. That means that the DATA section can be in one of three states: Unconfigured, Configured or Initialized. Unconfigured means that the Engine firmware image is the stock one Intel provides and not configured at all (RGN). Configured means that the OEM has applied model specific settings and the Engine region is ready for deployment (EXTR). Initialized means that the Engine region comes from a system which was already running and thus the Engine co-processor has further configured the DATA section to suit that particular system better (system specific or dirty EXTR).

ME_DATA.PNG


A dumped SPI/BIOS image comes from a system which was already operating so the contained Engine Region should have a Initialized DATA section. In order for that dump to be usable on another system of the same OEM model we need to clean the "Initialization" extra data and thus end up with an Engine Region which has a Configured-only DATA section. This is important because on some cases these small dumped "initialization" changes made by the Engine co-processor of a system can lead to a malfunctioning or a corrupted Engine Region when transferred to another system even one of the same OEM model.

B. Helpful Resources

First you need to identify what Engine firmware the dumped SPI/BIOS image has inside. For that you can use ME Analyzer tool which is capable of telling you the version, sku, release, type etc of any inputted Engine firmware. You can use it to analyze both the dumped SPI/BIOS image you plan to clean and the firmware with which you plan to achieve that. The latter can be retrieved from Intel (CS)ME, CS(TXE), CS(SPS), PMC, PHY & PCHC Firmware Repositories thread which includes all Engine (CSME, ME, CSTXE, TXE) firmware that we have gathered for such cases.

Before proceeding, make sure to also check the dedicated Intel Management Engine: Drivers, Firmware & System Tools and Intel Trusted Execution Engine: Drivers, Firmware & System Tools threads first. There you can find some more information about each firmware's chipset compatibility as well as the Engine System Tools packages which include the Flash Image Tool (FIT/FITC/FTOOLC) which we will be using for the cleanup process. You will also understand various terms which are used throughout the guide such as FIT, FITC, FTOOLC, CSE, CSME, CSTXE, RGN, EXTR, UPD, FD and so on.

C. Method Compatibility

This method has been tested to work on (CS)ME 2 - 15 and (CS)TXE 1 - 4. The process depending on the generation, so the guide differs. It has not been tested on any (CS)SPS firmware.

Since the purpose of the guide is to clean the DATA section, it is important to choose a clean RGN Engine firmware from the Intel Engine Firmware Repositories thread and not EXTR which is extracted from various SPI/BIOS images/dumps and considered dirty as far as the DATA section is concerned. Moreover, a full RGN Engine Region is required and not an Update (UPD) image. That means that you should look only for Engine firmware of this structure at the Repositories:

Major.Minor.Hotfix.Build_SKU_PRD_RGN

As previously mentioned, the goal is not necessarily to update the Engine firmware so you can choose any RGN firmware of the same SKU as long as the major and minor versions are the same. It is usually recommended to take the exact same RGN firmware from the repositories, otherwise the closest you can find in case that one doesn't exist or it's not RGN, same SKU etc.

D. Clean the Initialized DATA section

D0. Index

D1. ME 2 - 3
D2. ME 4 - 6
D3. ME 7 - 10 & TXE 1 - 2
D4. CSME 11 - 15 & CSTXE 3 - 4

D1. ME 2 - 3

In this section we have taken as an example a SPI/BIOS image dump of a model which comes with ME firmware version 9.1.x.xxxx and SKU 1.5MB. However, the same applies to ME 2 - 3 firmware.

1. From Intel Management Engine: Drivers, Firmware & System Tools thread, make sure you have downloaded the correct System Tools package and extract it.

Start1_Pic.PNG


2. From Intel (CS)ME, CS(TXE), CS(SPS), PMC, PHY & PCHC Firmware Repositories thread, make sure you have downloaded the correct Repository pack based on major/minor version and extract it.

Start2_Pic.PNG


3. Open the dumped SPI/BIOS image with ME Analyzer to see what major/minor version we need as well as SKU. In this case we have:

MEA_Pic.PNG


So our SPI/BIOS image dump has a ME 9.1 firmware with 1.5MB SKU.

4. Browse the Repository pack, copy the same (or as similar as possible) ME RGN firmware of the same SKU and major/minor version (as instructed above) somewhere and then rename it to "ME Region.bin". In this case:

Repo_Pic.PNG


So we pick the firmware file 9.1.25.1005_1.5MB_PRD_RGN which matches perfectly what we saw at ME Analyzer. If for example the dumped SPI/BIOS image had ME 9.1.37.1002, we would have picked ME 9.1.32.1002 instead because the one we wanted is EXTR and not RGN. Thus, we rename the "9.1.25.1005_1.5MB_PRD_RGN.bin" copy to "ME Region.bin".

5. From the System Tools folder, go to Flash Image Tool subfolder and run ftoolc.exe. Drag & drop the dumped SPI/BIOS image you want to clean. After it is done loading:

  • Go to Build > Build Settings... , untick the option to "Generate intermediate build files", leave all other settings intact and click OK.

    FITC4_Pic.PNG


6. Keep the FTOOLC window open. At the FITC folder there should now be a folder named after the inputted file, in this case it's named "Z97OCF1.80". Enter "Decomp" subfolder. There should be a number of files there (BIOS Region, Flash Descriptor, OEM Region etc) including a "ME Region.bin" file. Take the previous "ME Region.bin" file you saved at step 4 and copy it where the current "ME Region.bin" file is, effectively replacing it.

FITC5_Pic.PNG


7. Go to the already open FTOOLC window, click the "Build Image" icon (or "Build > Build Image"), save as "intermediate.bin" and it should complete successfully.

FITC7_Pic.PNG


8. At the FTOOLC folder you should now see a file named "intermediate.bin" which is the dumped SPI/BIOS image with an Engine region which has an "Unconfigured" DATA section without any needed "Configuration" or unneeded "Initialization" information stored. Thus, it now needs to be "Configured".

End_Pic.PNG


9. From the System Tools folder, go to iAMTNVM subfolder and open a command prompt there. Copy the original input image (for example: "input.bin") as well as the Unconfigured one ("intermediate.bin") at the iAMTNVM subfolder. At the command prompt, enter "AMTNVM.exe -parse input.bin -out config.txt". A "config.txt" file should be created which holds the input firmware configuration. To transfer it into the Unconfigured image, enter "AMTNVM.exe -edit intermediate.bin config.txt -out outimage.bin" which should build the final "Configured" output SPI/BIOS image.

10. Now, you need to verify that the resulting image has the same configured DATA settings as the imported one.

  • Remove any leftover temporary files from FTOOLC's directory (folders, ftool.ini, ftool.log). Run FTOOLC and drag & drop the output file. Go to "File > Save As" and save the configuration xml file with a descriptive name such as "after.xml". Afterwards, close the FTOOLC window. Repeat this step for the original image and you should end up with two configuration xml files, in this case they are named "before.xml" and "after.xml". Open these two files in any comparison tool that supports XML and check for any differences. All settings should be identical apart from "InputFile" fields.

    XML0_Pic.PNG


  • Go to iAMTNVM subfolder and open a command prompt there. At the command prompt, enter "AMTNVM.exe -parse input.bin -out before.txt" followed by "AMTNVM.exe -parse outimage.bin -out after.txt". You should end up with two configuration txt files, in this case they are named "before.txt" and "after.txt". Open these two files in any comparison tool and check for any differences. All settings should be identical.

  • Import the output file to ME Analyzer and check if the Major/Minor versions & SKU are the same as before. Also, make sure the Type is reported as "Extracted" which means that the inputted image is OEM/FTOOLC configured. Whether the DATA section is now Configured and not Initialized cannot be checked/verified by ME Analyzer but if you followed the above steps properly you should not be having any issues.

    MEA_End_Pic.PNG


D2. ME 4 - 6

In this section we have taken as an example a SPI/BIOS image dump of a model which comes with ME firmware version 9.1.x.xxxx and SKU 1.5MB. However, the same applies to ME 4 - 6 firmware.

1. From Intel Management Engine: Drivers, Firmware & System Tools thread, make sure you have downloaded the correct System Tools package and extract it.

Start1_Pic.PNG


2. From Intel (CS)ME, CS(TXE), CS(SPS), PMC, PHY & PCHC Firmware Repositories thread, make sure you have downloaded the correct Repository pack based on major/minor version and extract it.

Start2_Pic.PNG


3. Open the dumped SPI/BIOS image with ME Analyzer to see what major/minor version we need as well as SKU. In this case we have:

MEA_Pic.PNG


So our SPI/BIOS image dump has a ME 9.1 firmware with 1.5MB SKU.

4. Browse the Repository pack, copy the same (or as similar as possible) ME RGN firmware of the same SKU and major/minor version (as instructed above) somewhere and then rename it to "ME Region.bin". In this case:

Repo_Pic.PNG


So we pick the firmware file 9.1.25.1005_1.5MB_PRD_RGN which matches perfectly what we saw at ME Analyzer. If for example the dumped SPI/BIOS image had ME 9.1.37.1002, we would have picked ME 9.1.32.1002 instead because the one we wanted is EXTR and not RGN. Thus, we rename the "9.1.25.1005_1.5MB_PRD_RGN.bin" copy to "ME Region.bin".

5. From the System Tools folder, go to Flash Image Tool subfolder and run fitc.exe. Drag & drop the dumped SPI/BIOS image you want to clean. After it is done loading:

  • Go to Build > Build Settings... , untick the option to "Generate intermediate build files", leave all other settings intact and click OK.

    FITC4_Pic.PNG


  • If you are working on an Engine region only (extracted via Flash Programming Tool with "-me" parameter or via UEFITool > ME region > Extract as is...) and not a full SPI/BIOS image (Flash Descriptor + Engine + BIOS), go to "Flash Image > Descriptor Region > Descriptor Map" and set "Number of Flash Components" to "0".

    FITC4F_Pic.PNG


  • If you are working on ME 5 - 6, go to Flash Image > Configuration > "Features Supported" or "Intel Anti-Theft Technology" and set "Intel (R) Anti-Theft Technology Permanently Disabled?" to "Yes" or "Enable Intel Anti-Theft Technology" to "false". Intel Anti-Theft Technology has been EOL since January 2015 and can cause issues if left activated nowadays.

    FITC4C_Pic.PNG



    FITC4D_Pic.PNG


6. Keep the FITC window open. At the FITC folder there should now be a folder named after the inputted file, in this case it's named "Z97OCF1.80". Enter "Decomp" subfolder. There should be a number of files there (BIOS Region, Flash Descriptor, OEM Region etc) including a "ME Region.bin" file. Take the previous "ME Region.bin" file you saved at step 4 and copy it where the current "ME Region.bin" file is, effectively replacing it.

FITC5_Pic.PNG


7. Go to the already open FITC window, click the "Build Image" icon (or "Build > Build Image") and it should complete successfully.

FITC7_Pic.PNG


8. At the FITC folder you should now see a file named "outimage.bin" which is the dumped full SPI/BIOS (or ME) image with an Engine region which has a Configured DATA section without any unneeded "Initialization" information stored.

End_Pic.PNG


9. Now, you need to verify that the resulting image has the same configured DATA settings as the imported one.

  • Remove any leftover temporary files from FITC's directory (folders, fitc.ini, fitc.log). Run FITC and drag & drop the output file. Go to "File > Save As" and save the configuration xml file with a descriptive name such as "after.xml". Afterwards, close the FITC window. Repeat this step for the original image and you should end up with two configuration xml files, in this case they are named "before.xml" and "after.xml". Open these two files in any comparison tool that supports XML and check for any differences. All settings should be identical apart from "InputFile" fields and possibly Intel Anti-Theft related ones such as "SmBusMctpAddrEn", "SmBusMctpAddr" & "ATPerm", if those required changes at step 5.

    XML0_Pic.PNG



    XML1_Pic.PNG



    XML2_Pic.PNG


  • If you are working on ME 6, remove any leftover temporary files from FITC's directory (folders, fitc.ini, fitc.log, before.xml, after.xml etc). Run FITC and drag & drop the output file. Rename the file "ConfigParams.txt" to "before.txt" and close FITC. Run FITC and drag & drop the original file. Rename the file "ConfigParams.txt" to "after.txt" and close FITC. You should end up with two configuration txt files, in this case they are named "before.txt" and "after.txt". Open these two files in any comparison tool and check for any differences. All settings should be identical apart from any Intel Anti-Theft related ones, if those required changes at step 5.

  • If you are working on ME 4 - 5, remove any leftover temporary files from FITC's directory (folders, fitc.ini, fitc.log, before.xml, after.xml etc). Run FITC, drag & drop the output file and close it. Run FITC, drag & drop the original file and close it. At the FITC folder there should now be two folders named after the inputted files. At each input file folder, enter "Decomp" subfolder, copy "Configuration.txt" (ME 5) or "NVARs.txt" (ME 4) file and rename them to "before.txt" and "after.txt" respectively. You should end up with two configuration txt files, in this case they are named "before.txt" and "after.txt". Open these two files in any comparison tool and check for any differences. All settings should be identical apart from any Intel Anti-Theft related ones, if those required changes at step 5.

  • Import the output file to ME Analyzer and check if the Major/Minor versions & SKU are the same as before. Also, make sure the Type is reported as "Extracted" which means that the inputted image is OEM/FITC configured. Whether the DATA section is now Configured and not Initialized cannot be checked/verified by ME Analyzer but if you followed the above steps properly you should not be having any issues.

    MEA_End_Pic.PNG


  • As an extra verification step, you can open your original SPI/BIOS image dump in one FITC window and the output image in another and manually check quickly if the Engine Region settings are identical at both. This method is not needed if you have already checked via the configuration xml & txt files, it is not recommended because some settings are not visible at the FITC window but only at the configuration files and it requires a lot of time for manual comparisons.

    FITC_End.PNG


10. Last but not least, if you are working on ME 5 - 6, once your new cleaned+configured full SPI/BIOS dump or Engine region is flashed on the target system, run Flash Programming Tool with command fpt -greset and wait for the system to reset (no settings are lost). This step is very important because it forces the Engine co-processor to re-initialize and properly accept any changes to its SPI/BIOS image region counterpart.

FPT_GR_Pic.PNG


  • If you are working on an Engine region only (extracted via Flash Programming Tool with "-me" parameter or via UEFITool > ME region > Extract as is...) and not a full SPI/BIOS image (Flash Descriptor + Engine + BIOS), make sure that the output region has the same size at the input/dumped one. To do that, subtract the output region size from the input/dumped one to get the difference, which is the amount of 0xFF padding that needs to be appended at the end of the output region using a hex editor. For example, in a hypothetical case in which the size difference is 0xA000, the output region would need to be adjusted in HxD Hex Editor like so:

    ENG_RGN_FF_FIX.png


D3. ME 7 - 10 & TXE 1 - 2

In this section we have taken as an example a SPI/BIOS image dump of a model which comes with ME firmware version 9.1.x.xxxx and SKU 1.5MB. However, the same applies to all ME 7 - 10 and TXE 1 - 2 firmware.

1. From Intel Management Engine: Drivers, Firmware & System Tools or Intel Trusted Execution Engine: Drivers, Firmware & System Tools threads, make sure you have downloaded the correct System Tools package and extract it.

Start1_Pic.PNG


2. From Intel (CS)ME, CS(TXE), CS(SPS), PMC, PHY & PCHC Firmware Repositories thread, make sure you have downloaded the correct Repository pack based on major/minor version and extract it.

Start2_Pic.PNG


3. Open the dumped SPI/BIOS image with ME Analyzer to see what major/minor version we need as well as SKU. In this case we have:

MEA_Pic.PNG


So our SPI/BIOS image dump has a ME 9.1 firmware with 1.5MB SKU.

4. Browse the Repository pack, copy the same (or as similar as possible) ME/TXE RGN firmware of the same SKU and major/minor version (as instructed above) somewhere and then rename it to "ME Region.bin" or "TXE Region.bin" depending on what you're working with. In this case:

Repo_Pic.PNG


So we pick the firmware file 9.1.25.1005_1.5MB_PRD_RGN which matches perfectly what we saw at ME Analyzer. If for example the dumped SPI/BIOS image had ME 9.1.37.1002, we would have picked ME 9.1.32.1002 instead because the one we wanted is EXTR and not RGN. Thus, we rename the "9.1.25.1005_1.5MB_PRD_RGN.bin" copy to "ME Region.bin".

5. From the System Tools folder, go to Flash Image Tool subfolder and run fitc.exe. Drag & drop the dumped SPI/BIOS image you want to clean. After it is done loading:

  • Go to Build > Build Settings... , untick the option to "Generate intermediate build files", leave all other settings intact and click OK.

    FITC4_Pic.PNG


  • If you are working on FITC v8.1.40.1456 with ME 8 firmware which is configured as any "Intel (R) C600 Series Chipset" (Patsburg SKU), then you must use a ME region only for the cleanup process and not a SPI/BIOS image. So if you have a SPI/BIOS image, first extract the ME region and then load it to FITC. That is due to a FITC bug in which Patsburg settings are not properly shown/transferred when using anything but a bare Engine region image (extracted via Flash Programming Tool with "-me" parameter or via UEFITool > ME region > Extract as is...). More info can be found here. When you load the bare ME region at FITC, if the SKU at the top bars does not match what you see when loading the full SPI/BIOS image, make sure to first adjust that accordingly and don't leave it empty or different.

    FITC_ME8_Bug_Pic.PNG


  • If you are working on ME 9, go to "Flash Image > ME Region > Configuration > Boot Guard" and make sure that "Boot Guard Profile Configuration" is not set to "Unknown". If it is set to "Unknown", change it to the default value of "Boot Guard Profile 0 - No_FVME". Also, go to "Flash Image > ME Region > Configuration > Integrated Clock Controller" and make sure that "Default Lock Enables Mask" is not set to "Unknown". If it is set to "Unknown", change it to the default value of "0:Default".

    FITC_ME9_Bug_1.PNG



    FITC_ME9_Bug_2.PNG


  • If you are working on an Engine region only (extracted via Flash Programming Tool with "-me" parameter or via UEFITool > ME region > Extract as is...) and not a full SPI/BIOS image (Flash Descriptor + Engine + BIOS), go to "Flash Image > Descriptor Region > Descriptor Map" and set "Number of Flash Components" to "0".

    FITC4F_Pic.PNG


  • If you are working on ME 7 - 9 or TXE 1, go to Flash Image > ME/TXE Region > Configuration > Features Supported and set "Intel (R) Anti-Theft Technology Permanently Disabled? " to "Yes". Intel Anti-Theft Technology has been EOL since January 2015 and can cause issues if left activated nowadays.

    FITC4B_Pic.PNG


  • If you are working on a SPI/BIOS image with ME 7 - 9, go to Flash Image > Descriptor Region > PCH Straps > PCH Strap 2 and set "Intel (R) ME SMBus MCTP Address Enable" to "false". Also, set "Intel (R) ME SMBus MCTP Address" to "0x00". These are Intel Anti-Theft Technology settings and these changes will stop the "MCTP 3G" error seen at Intel MEManuf tool when the former is disabled.

    FITC4E_Pic.PNG


    Note: These two settings are set at the Flash Descriptor (first 4KB of a full SPI/BIOS image) and not at the Engine Region (extracted via Flash Programming Tool with "-me" parameter or via UEFITool > ME region > Extract as is...). So for these to apply, you need to reflash the FD as well either by preparing a full SPI/BIOS image (Flash Descriptor + Engine + BIOS) or by flashing it manually via a tool such as Flash Programming Tool with -desc command.

6. Go to "File > Save As" and save the configuration xml file, in this case it's named "config.xml". Afterwards, close the FITC window.

FITC4G_Pic.PNG


7. At the FITC folder there should now be a folder named after the inputted file, in this case it's named "Z97OCF1.80". Enter "Decomp" subfolder. There should be a number of files there (BIOS Region, Flash Descriptor, OEM Region etc) including a "ME Region.bin" or "TXE Region.bin" file. Take the previous "ME Region.bin" or "TXE Region.bin" file you saved at step 4 and copy it where the current "ME Region.bin" or "TXE Region.bin" file is, effectively replacing it.

FITC5_Pic.PNG


8. Run FITC again. From "File > Open" select the saved configuration xml file from step 6 and open it.

FITC6_Pic.PNG


9. Click the "Build Image" icon (or "Build > Build Image") and it should complete successfully.

FITC7_Pic.PNG


10. At the FITC folder you should now see a file named "outimage.bin" which is the dumped SPI/BIOS (or ME/TXE) image with an Engine region which has a Configured DATA section without any unneeded "Initialization" information stored.

End_Pic.PNG


11. Now, you need to verify that the resulting image has the same configured DATA settings as the imported one.

  • Remove any leftover temporary files from FITC's directory (folders, fitc.ini, fitc.log). Run FITC and drag & drop the output file. Go to "File > Save As" and save the configuration xml file with a descriptive name such as "after.xml". Afterwards, close the FITC window. Repeat this step for the original image and you should end up with two configuration xml files, in this case they are named "before.xml" and "after.xml". Open these two files in any comparison tool that supports XML and check for any differences. All settings should be identical apart from "InputFile" fields and possibly Intel Anti-Theft related ones such as "SmBusMctpAddrEn", "SmBusMctpAddr" & "ATPerm", if those required changes at step 5.

    XML0_Pic.PNG



    XML1_Pic.PNG



    XML2_Pic.PNG


  • Import the output file to ME Analyzer and check if the Major/Minor versions & SKU are the same as before. Also, make sure the Type is reported as "Extracted" which means that the inputted image is OEM/FITC configured. Whether the DATA section is now Configured and not Initialized cannot be checked/verified by ME Analyzer but if you followed the above steps properly you should not be having any issues.

    MEA_End_Pic.PNG


  • As an extra verification step, you can open your original SPI/BIOS image dump in one FITC window and the output image in another and manually check quickly if the Engine Region settings are identical at both. This method is not needed if you have already checked via the configuration xml files, it is not recommended because some settings are not visible at the FITC window but only at the configuration file and it requires a lot of time for manual comparisons.

    FITC_End.PNG


12. Last but not least, once your new cleaned+configured full SPI/BIOS dump or Engine region is flashed on the target system, run Flash Programming Tool with command fpt -greset and wait for the system to reset (no settings are lost). This step is very important because it forces the Engine co-processor to re-initialize and properly accept any changes to its SPI/BIOS image region counterpart.

FPT_GR_Pic.PNG


  • If you are working on an Engine region only (extracted via Flash Programming Tool with "-me" parameter or via UEFITool > ME region > Extract as is...) and not a full SPI/BIOS image (Flash Descriptor + Engine + BIOS), make sure that the output region has the same size at the input/dumped one. To do that, subtract the output region size from the input/dumped one to get the difference, which is the amount of 0xFF padding that needs to be appended at the end of the output region using a hex editor. For example, in a hypothetical case in which the size difference is 0xA000, the output region would need to be adjusted in HxD Hex Editor like so:

    ENG_RGN_FF_FIX.png

2 Likes
2

D4. CSME 11 - 15 & CSTXE 3 - 4

In this section we have taken as an example a SPI/BIOS image dump of a model which comes with CSME firmware version 11.0.x.xxxx and SKU Consumer H. However, the same applies to all CSME 11 - 15 and CSTXE 3 - 4 firmware.

1. From Intel (Converged Security) Management Engine: Drivers, Firmware and Tools or Intel (Converged Security) Trusted Execution Engine: Drivers, Firmware and Tools threads, make sure you have downloaded the correct System Tools package and extract it.

11_Start_1.PNG


2. From Intel (CS)ME, (CS)TXE, (CS)SPS, GSC, PMC, PCHC, PHY & OROM Firmware Repositories thread, make sure you have downloaded the correct Repository pack based on major/minor version and extract it.

11_Start_2.PNG


3. Open the dumped SPI/BIOS image with ME Analyzer to see what major/minor version we need as well as SKU. In this case we have:

11_MEA_Pic.PNG


So our SPI/BIOS image dump has a CSME 11.0 firmware with Consumer SKU.

4. Browse the Repository pack, copy the same (or as similar as possible) CSME/CSTXE RGN firmware of the same SKU and major/minor version (as instructed above) somewhere and then rename it to "ME Region.bin" for CSME 11, "TXE Region.bin" for CSTXE 3, "ME Sub Partition.bin" for CSME 12 or "TXE Sub Partition.bin" for CSTXE 4, depending on what you're working with. In this case:

11_Repo_Pic.PNG


So we pick the firmware file 11.0.1.1001_CON_H_XX_PRD_RGN which matches perfectly what we saw at ME Analyzer. If for example the dumped SPI/BIOS image had CSME 11.0.0.1196 with LP SKU, we would have picked CSME 11.0.0.1197 instead because the one we wanted is EXTR and not RGN. Thus, we rename the "11.0.1.1001_CON_H_XX_PRD_RGN.bin" copy to "ME Region.bin".

5. Open the dumped SPI/BIOS image with ME Analyzer. In order to verify that the SPI/BIOS dump has Initialization data, make sure that File System State is reported as "Initialized".

11_MEA_Init_Pic.PNG


6. From the System Tools folder, go to Flash Image Tool > WIN subfolder and run fit.exe. Drag & drop the dumped SPI/BIOS image you want to clean. Go to "Build > Build Settings", select "No" at the option to "Generate Intermediate Files", leave all other settings intact and click Close.

11_FIT5_Pic.png


Note: If you are working on a CSME 11 Engine region only (extracted via Flash Programming Tool with "-me" parameter or via UEFITool > ME region > Extract as is...) and not a full SPI/BIOS image (Flash Descriptor + Engine + BIOS), you also need to change three additional settings. Set "Flash Settings > Flash Components > Number of Flash Components" to 0 and remove the path from both "Flash Layout > Intel(R) ME Region > Intel (R) Trace Hub Binary" and "Integrated Sensor Hub > ISH Data > PDT Binary File" only if these are not present at your dumped CSME 11 Engine region (indicated by the zero-byte size of these modules at the "Decomp" subfolder).

7. If you are working on a CSTXE 3 - 4 SPI/BIOS image, go to "Platform Protection > Platform Integrity" section.

  • Check if "OEM Public Key Hash" field exists and whether it is empty/zeroed or not. If "OEM Public Key Hash" field is either missing or empty/zeroed, proceed to the next step of the guide.

    11_Sign_1.PNG


  • If "OEM Public Key Hash" is populated then it is highly probable that your SPI/BIOS image is signed by the OEM and their OEM Public Key Hash is stored permanently in the Chipset hardware. In such case, you cannot easily/quickly clean the Engine firmware because the platform will reject it without the OEM's RSA Private Key.

    11_Sign_4.PNG


  • If you happen to have the OEM's Private RSA Key (unlikely unless you're the OEM), you can input it at "SMIP Signing Key" field. Then go to "Build > Build Settings", input the Manifest Extension Utility (MEU) executable location at "Intel(R) Manifest Extension Utility Path" field, input Win32 OpenSSL Lite executable location at "Signing Tool Path" field, make sure that "OpenSSL" is selected at "Signing Tool" field, make sure that "Verify manifest signing keys against the OEM Key Manifest" is set to "Yes", leave all other settings intact and click Close. Now proceed to the next step of the guide.

    11_Sign_2.PNG



    11_Sign_3.PNG


  • If you don't have the OEM's Private RSA Key (expected end-user situation), you can still clean the Engine firmware section(s) of the SPI/BIOS image but more steps are needed. That's because the Engine firmware is signed independently and thus protected on its own so any FIT-configurable RSA Public Key Hashes & Signatures relate only to the rest of the BIOS/IAFW/IFWI components of the SPI/BIOS chip image. For example, the "SMIP Signing Key" found above "OEM Public Key Hash" field is used to sign/re-sign the SMIP BIOS/IAFW module which may interact with the Engine firmware but it's not actually a part of it. Thus, the goal is to update the Engine firmware only, without touching the BIOS/IAFW modules, like SMIP or DnX, which require re-signing upon rebuilding the SPI/BIOS image at FIT.

  • We need to create a dummy/placeholder RSA Private Key to insert at "SMIP Signing Key" field. The use of OpenSSL is required for that. Under Windows, install Win32 OpenSSL Lite, go to its directory and execute the command:
    1
     
    openssl.exe genrsa --out dummy.pem 2048
     

    11_OpenSSL_Dummy.PNG


  • At "SMIP Signing Key" field, input the placeholder RSA Private Key (dummy.pem) that was created by the OpenSSL tool. Then go to "Build > Build Settings", input the Manifest Extension Utility (MEU) executable location at "Intel(R) Manifest Extension Utility Path" field, input Win32 OpenSSL Lite executable location at "Signing Tool Path" field, make sure that "OpenSSL" is selected at "Signing Tool" field, make sure that "Verify manifest signing keys against the OEM Key Manifest" is set to "No", leave all other settings intact and click Close.

    11_Sign_5.PNG



    11_Sign_6.PNG


8. Go to "File > Save As" and save the configuration xml file, in this case it's named "config.xml". Afterwards, close the FIT window.

11_FIT6_Pic.png


9. If you are working on a full SPI/BIOS image (Flash Descriptor + Engine + BIOS) and not a CSME 11 Engine region only (extracted via Flash Programming Tool with "-me" parameter or via UEFITool > ME region > Extract as is...), go to the FIT folder and there should now be a folder named after the inputted file, in this case it's named "Z17EX62.00". Enter "Decomp" subfolder. There should be a number of files there (BIOS Region, Flash Descriptor, OEM Region etc) including a "ME Region.bin" or "TXE Region.bin" or "ME Sub Partition.bin" or "TXE Sub Partition.bin" file. Take the previous "ME/TXE Region.bin" or "ME/TXE Sub Partition.bin" file you saved at step 4 and copy it where the current "ME/TXE Region.bin" or "ME/TXE Sub Partition.bin" file is, effectively replacing it.

11_FIT7_Pic.png


If you are working on a CSME 11 Engine region only (extracted via Flash Programming Tool with "-me" parameter or via UEFITool > ME region > Extract as is...) and not a full SPI/BIOS image (Flash Descriptor + Engine + BIOS), take the previous "ME/TXE Region.bin" or "ME/TXE Sub Partition.bin" file you saved at step 4, rename it exactly the same as the input file (Engine region) and copy it where the current input file is, effectively replacing it.

10. Run FIT again. From "File > Open" select the saved configuration xml file from step 8 and open it.

11_FIT8_Pic.png


11. Click the "Build Image" icon (or "Build > Build Image") and it should complete successfully.

11_FIT9_Pic.png


12. At the FIT folder you should now see a file named "outimage.bin" which is the dumped SPI/CSME/CSTXE image with an Engine region which has a Configured DATA section without any unneeded "Initialization" information stored.

11_End_Pic.PNG


13. If you are working on a CSTXE 3 - 4 SPI/BIOS image and you followed the instructions at Step 7 without skipping it, you determined that your SPI/BIOS image is signed by the OEM and thus inputted a placeholder RSA Private Key (dummy.pem) at "SMIP Signing Key" field. You must now restore the original OEM-signed SMIP module. For that you need to use a Hex Editor (example: HxD Hex Editor) and ME Analyzer tool.

  • Drag & drop the dumped SPI/BIOS image you want to clean at ME Analyzer and at Option(s) enter "-dfpt" parameter.

    11_SMIP_1.PNG


  • Find the "Boot Partition Descriptor Table" which includes the entry with Name "SMIP". It must not be Empty ("No"). Note down SMIP partition's "Start" offset & "Size" which in this case are 0x2000 and 0x4000 respectively. Do the same for the "outimage.bin" file which got built at step 12. The SMIP "Start" offset & "Size" of both SPI/BIOS images are usually the same.

    11_SMIP_2.PNG


  • Open the dumped SPI/BIOS image you want to clean as well as "outimage.bin" at the Hex Editor. From the the dumped SPI/BIOS image you want to clean, go to its SMIP "Start" offset and select a block equal to the SMIP "Size" which you noted down earlier. A block equal to the SMIP "Size" should now be selected. Do the same for "outimage.bin" file.

    11_SMIP_3.PNG



    11_SMIP_4.PNG


  • Now you need to "Copy" the selected block from the dumped SPI/BIOS image you want to clean and "Paste write" it at the equivalent selected block of "outimage.bin". Then "Save" the changes at "outimage.bin" file.

    11_SMIP_5.PNG



    11_SMIP_6.PNG


14. Now, you need to verify that the resulting image ("outimage.bin") is indeed not Initialized. Import the output file to ME Analyzer and check if the Major/Minor versions, SKU & Stepping are the same as before. In order to verify that the DATA section is now Configured and not Initialized, make sure that the File System State is reported as "Configured".

11_MEA_End_Pic.PNG


15. Last but not least, once your new cleaned+configured SPI/BIOS dump or Engine region is flashed on the target system, run Flash Programming Tool with command fpt -greset and wait for the system to reset (no settings are lost). This step is very important because it forces the Engine co-processor to re-initialize and properly accept any changes to its SPI/BIOS image region counterpart.

FPT_GR_Pic.PNG


  • If you are working on a CSME 11 Engine region only (extracted via Flash Programming Tool with "-me" parameter or via UEFITool > ME region > Extract as is...) and not a full SPI/BIOS image (Flash Descriptor + Engine + BIOS), make sure that the output region has the same size at the input/dumped one. To do that, subtract the output region size from the input/dumped one to get the difference, which is the amount of 0xFF padding that needs to be appended at the end of the output region using a hex editor. For example, in a hypothetical case in which the size difference is 0xA000, the output region would need to be adjusted in HxD Hex Editor like so:

    ENG_RGN_FF_FIX.png

4 Likes
3

Thanks Plutomaniac and Pacman, this tutorial worked for my Gigabyte Z170 Motherboard which enables me to update to the latest ME Firmware since I always get Error 8719 using FWUpdLcl.

4


That’s a BIOS issue, Gigabyte needs to Enable the Local ME Firmware Update capability. If your flash descriptor is unlocked though, you can always use the latest RGN and adjust settings via FIT manually.

5

That is very good information, thanks. Never heard of it before though, but it makes perfect sense.
I’m going to give it a go on an old P5Q Deluxe (with the EFI beta bios, modded though), which i’m having issue’s with. Don’t have the spare time yet, but asap. This system has seen many different bioses, and including a lot from user posts and even a brainfart version(wrong model).

Thanks again, i’ll let you know how it.

p.s. While i come to think about it, this probably is my first post, heh! I’ve been a loooong time lurker, but only recently created an account . Thanks for all the work you guys are doing, it’s clear, works and takes a lot of effort!

6

This guide also works to update from non-PDM ME Firmware to PDM Firmware on Skylake motherboards. I updated it from 1168 ME Firmware to the latest ME Firmware using this method and ran FPT -greset after flashing the BIOS in DOS. Also the edit year on the guide says 2015 instead of 2016 :wink:

7

Yes, it works with everything. For the purposes of this guide, the same FW version is used. Although higher/lower FW and/or FITC/FIT version combinations usually work, it might not always be the case when new settings are added to FW releases or FITC/FIT is altered. So always check for any errors and compare old and new saved .xml configurations for differences. Also, thank you for the date typo report, fixed.

8

Hello!!!
It is necessary to clean a SPI image in all systems that have ME firmware (HM76, for exemple)?
Thanks!!!

9

If you want to flash a ME region from a dump then yes, you need to clean it first.

10

I followed step by step and got 3 outimage.bin:

outimage(1).bin (2,048 MB)
outimage(2).bin (4,096 MB)
outimage.bin (6,144 MB)

Which one should I flash?
The dumped SPI image I plan to clean take 2,048 MB. It’s this one?
Thanks!!!

11

The full SPI image is 6MB in size as outimage.bin shows. What model are you talking about? Does it have two SPI chips? Attach the SPI dump(s).

12



Yes, it have 2 spi chips. HM76 chipset.

I attach the SPI image dumps that I plan to clean.

Thanks!!! (^_^)

Itautec W7730 - W3450.rar (2.52 MB)

13

You haven’t attached any files.

14



Sorry!!! And now???

15

Updates:

  • Added references to TXE 3.x, SPS 4.x & ME 11.5/6 (D2) and renamed all “ME/TXE” to “Engine” Regions instead
  • Added D1 > Step 12 and D2 > Step 16 with instructions to perform a FPT -greset after flashing the new Engine region
  • Rewritten D1 (Pre-Skylake) > Step 8 in sub-steps and added disabling of Intel Anti-Theft (EOL), AT settings at FD and more images
  • Rewritten D1 (Pre-Skylake) > Step 11 in sub-steps and added xml file comparison, what to expect and recommendations
  • Rewritten D2 (Post-Skylake) > Step 15 in sub-steps and added xml file comparison, what to expect and recommendations

@ toniu-massa:

Yes, you needed the 2MB outimage part. The first 2MB chip includes the FD+ME whereas the second holds the EC/BIOS. Today I added various new instructions, mostly for pre-Skylake, so you may want to follow the guide again if you prefer to do it yourself. Otherwise, here are the cleaned, configured and updated files for your system. Depending on how you flash, use either the ME region (FPT -f) or the full 2MB SPI image (programmer or FPT -f). As said at step 12, don’t forget FPT -greset command when you are done.

mod_toniu-massa.rar (975 KB)

16

Can someone clean ME region of this BIOS for Asus K52Jb?

25Q32BVSIG.zip (1.75 MB)

17

@dj-dave

Normally, I would have told you to follow the guide yourself but since FITC is not currently available at the ME thread, I have created the cleaned SPI image for you. It’s attached.

25Q32BVSIG_CleanME.rar (1.7 MB)

18

Not working. I have only black screen. BIOS I upload working, but laptop switch of for 60 sec. (sorry for my english).

19

The ME is cleaned properly and the image looks just fine. Why did you want the ME region cleaned in the first place? After the new SPI image is flashed with cleaned ME region, remove power from the laptop (cord + battery), press the power button a few times (nothing visible should happen) and leave it for 1 minute. Then plug the battery and cord again and try again.

20

HI. can anybody clear this asus X554L bios for me.
i found this bios from web but this is not clear.
this bios secure boot function is disabled, so if enabled it no display.
and display comes after 45 sec late.
i already try to clean the me but never couldnot success.
when flash my working bios and try to greset with fpt it also not success. but given me this following error.

X554L old.rar (3.4 MB)

after clear but not success.rar (3.25 MB)

IMG_20161102_013347.jpg