[Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization

If you have a dump of such a machine - clean the ME region according to this guide and you have what you want.

Right, this is the full dump here, with ME in there as well:

I guess it’s a bit older version of ME (Version: 9.1.25.1005) in there:

Fixed: Yes

Base: 5000h

Address: FF005000h

Offset: 5000h

Full size: 5FB000h (6270976)

Version: 9.1.25.1005

Hi, I followed the instructions to clean ME region, but after flashing with fptw command, ME Firmware Version in BIOS still shows 0.0.0.0. My laptop has a replaced PCH so I need to clean ME region.
The original BIOS I extracted from another laptop of the same model: GF63_8RD_BIOS_Stock.bin - Google Drive
And the BIOS I cleaned myself: GF63_8RD_BIOS_Stock_Clean.bin - Google Drive
I tried to extract the BIOS back to the flashed version and the File System State was Initialized. Once I entered the BIOS I saw that the ME Firmware Version was there and displayed the correct version, but after a few restarts, it returned to 0.0.0.0.
Sorry my English is not good, I hope everyone can help me check if my file is wrong, thank you!

What model are we talking about here? And why are you attaching the dumps of two different models?

Sorry I sent it by mistake!

MSI provides complete firmware images (at least for the two types mentioned). Use the ME region from a stock MSI bios corresponding to your machine type. The ME region has a state of ‘configured’ = ‘cleaned’.

1 Like

I managed to follow the steps for CSME 11 (section D4) all the way to Step 14. Unfortunately even though I have read access to the FD, I don’t have write access at all. I have my cleaned image ready to flash and everything. My HP EliteDesk G3 800 SFF’s motherboard has an FDO jumper pin that I can utilize, but when I attempt to boot the machine with those pins shorted, all it did was power on the system for like maybe 10 seconds, then it just suddenly powers back off (the BIOS logo never shows in that time).

I’ve also tried treating the jumper pins like the pinmod method - power on with the pins shorted, then removing the jumper after it powers up. Unfortunately that didn’t do anything either.

Does anyone know how the FDO pins on these boards are supposed to be used?

@ plutomaniac

There are several reports of Microsoft Surface machines loosing touch after cleaning ME. One proposed solution was to change settings for ISH in FIT (link to badcaps), but that did only work for some machines.

I happened to come over a Surface pro 4 with still working firmware after a memory exchange (link to thread)

The user was able to run MEInfo on a firmware with a cleaned ME and and his own still working firmware.

The firmware with the cleaned ME had an identical bios region and identical flash descriptor, so settings in FD and bios region (NVRAM) can’t be relevant here. Still the cleaned ME didn’t have touch and the output of MEInfo was different:

I searched here, closest was this thread, but these are FD bits as far as I could find out and FD is unchanged.

I unpacked ME regions of the working (old118.bin) and cleaned (031024e.bin) firmware (MEA -unp86) but couldn’t find any hint where this settings could be stored in MFS.

Tried several FIT versions down to 11.0.0.1202 - the version the Surface firmware originally was composed with. But these settings aren’t covered by FIT and accordingly don’t show in the xml- files.

Read the bringup- guides as far as available, but there’s only information on Flash Descriptor Records.

Do you have an idea where to search from here?

Files

Surface 4 touch MEInfo.zip (4.1 KB)

old118_mem.zip (6.0 MB)
031024e.zip (5.8 MB)

@lfb6 It has been a couple of years since I dealt with ME, and I’m already forgetting, but I think this kind of thing can be changed via Flash Programming Tool, by modifying NVAR configuration (-cfggen etc). Check the FPT NVAR chapter of the System Tools User Guide.

I also found this, when searching the forum, in case it helps (no idea if these apply to CSME 11, but the year might indicate that it does):

1 Like

OK, Thank you, I’ll have a look into the fpt commands!

Tried already, but don’t have a ME 11 machine at hand, unfortunately. ME 14 already has a FIT section for precise touch, so there wasn’t anything to find there.

Edit:
Of course youwere right! I could read the variable for ME 14, too:

Now it’s just finding the syntax for ME11 to update it…(and check if this is really what was missing)

Edit 2:
Any idea why the “FeatureShipState” is 47 50 F6 01 (0x01F65047) (reported by fptw64)

but MEInfo reports

FW Capabilities value is 0x7DF6D147
Feature enablement is 0x5DF6D147

image

OK, and touch can’t be enabled after EOM

1 Like

Makes sense from a security standpoint

2 Likes


440 G8 failed to decompose

Attach / post a link to the dump you’re trying to decompose

Hi need help with this bios file. I failed to do me region clean on it. Hoping someone with better knowledge can help. here is link https://www.mediafire.com/file/xlcosq0vy9fhm89/X133GV3.1_-_my_dump.zip/file

Well, file opens fine in FIT, so I’d assume it’s just following the guide to the letter…

can you send me a link to your fit app, mine got an error unrecognized binary format

Wrong version. The image you attached isn’t Intel ME 5! Use MEA.

I used fit 4 also same result. Can you tell me which version you used. In picture above i used v5 because i have used v4 with same error

And what does MEA show to you? We could be seeing the wrong files…

This is MEA

And this is fit 4

Any help please. What did I do wrong here