[Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization

Special Topics Intel Management Engine
161



I did not find the windows key, it seems to be encrypted. Can you tell me how to replace the existing key with the original?

PS: This board has a embedded firmware in ec (KB90120F)

Gateway_NE56R.zip (2.86 MB)

162

Append Gateway_NE56R_U42.bin (2nd part) after Gateway_NE56R_U36.bin (1st part) via a Hex Editor or via windows copy command:

1
 
copy /b Gateway_NE56R_U36.bin+Gateway_NE56R_U42.bin spi.bin
 


No, completely unrelated

163
1
 
copy /b Gateway_NE56R_U36.bin+Gateway_NE56R_U42.bin spi.bin
 


Didn't work in windows 10 powershell, but in cmd work

thanks
164

i am trying to clean bios for a lenovo T460 because someone probably put a random dump from the internet and now the laptop takjes a while to display image at startup

I tried to folow the instructions in the guide but i am confused at step 7(guide for CSME version 11)
When i load my image i do not have platform integrity but however i have oem public hash(see printscreen) Does this mean that i have to folow the steps for step 7 or skip them?
also in the repository i am unsure what region to chose NPDM or YPDM
bios image

Capture bios.PNG

Capture mereg.PNG

165

The guide clearly indicates what to do when “Platform Integrity” is missing. For PDM you need to read Intel Management Engine: Drivers, Firmware & System Tools > Warning for PCH-LP 100-series systems.

166

ok, thank you, i understand now, i just skip step 7.
Maybe another stupid question but why don’t we just point flash image tool to the address of the new me region instead of copying our new me region in place of the one extracted from the bios dump?

me r.png

167

Because it resets all settings when the firmware is changed from there.

168

thank you, i folowed the guide and it seems to work, no more delays

169

Hi, I have a Dell Optiplex 9020. It prints the message “ME in Recovery mode”. I was hoping to use your excellent guide to dump the SPI bios, update the ME section and reflash. The Motherboard has a “Service Mode” jumper that allows full read/write access to the flash. Heres the dumped bios (fpt -d spi.bin) from dos.

https://drive.google.com/open?id=1NRVonx…V4S_Op_vVqTs_AR

ME-Analyzer says Version: 9.1.30.1008, Release: Production, Type: Region, Extracted; SKU 5MB; SVU: 1. VCU: 11, Prodtcion: Yes, Date: 2015-06-08, Size 0x4CA000, Flash Image Tool 9.1.1.1120, Chipset Support: LPT/WPT

Loading this in fitc causes fitc to crash consistently. Is this dump corrupted? Would greatly appreciate any help/pointers. Thanks.

170

@bulbmkr - Yes, that ME region was broken - here is your dump with ME fixed + Fixed ME Region only + All files with fixed FIT table too
http://s000.tinyupload.com/index.php?fil…485817169691315

Flash via >> FPTw.exe -me -f me.bin

This BIOS has broken CPU microcode FIT Table (By default, I checked other dumps), terrible work there Dell!
If fixed that for you, if you want to flash BIOS region >> FPTw.exe -bios -f 12MBFIT.bin

171

Thankx a lot Lost_N_BIOS. Your fixed me.bin worked like a super charm I have applied only the me.bin and the ME errors are gone. I am able to get into MEBx and everything seems to be working fine in Windows as well. Totally Amazing ! Keep up the Good Work !!

I spent a fair amount of time getting around the fitc crash due to corrupted bios yesterday. Out of curiosity, how does one handle such an issue? Did you use a different good dump from a different machine?

172

Thanks for quick test and report back @bilbmkr Yes, only the me.bin was needed to fix your actual presented issue.
Yes, I used a good dump from some other same system, pulled it’s ME region, placed into your dump, then ran through the cleaning guide using stock RGN for that same version ME.

173

Hi! What happens if I have active Boot Guard (commited in PCH FPFs) and reflash dump in which Boot Guard is disabled (No_FVME/Legacy)? Will the new dump work correctly?

174

If you’re talking about CSME configuration only, it does not matter anymore once the FPF have been committed.

175

Hi there,

I have been trying to update my Dell X51R3 without much success.
(does not shutdown properly without pressing power switch, heard its due to corrupted ME)
I have attached the dump file here. This was read and saved from the bios chip with CH431A & a test clip.

https://drive.google.com/file/d/1Ro_Vql8…iew?usp=sharing

https://drive.google.com/file/d/1V-F7LsX…iew?usp=sharing

Please do assist. Thank you.

176


Well is it actually corrupt? Run MEInfo -verbose and MEManuf -verbose tools to verify the CSME firmware state before going all in without definite proof.

177

Hi plutomaniac,

Ran the 2 tools as suggested.
The results are as attached.

MEINFO https://drive.google.com/open?id=1dUqHWr…yEQtnWcZuvZrOWH

MEMANUF https://drive.google.com/open?id=1AYiMOu…oKSMfq3LEPOFHWy

How should I proceed please?

178

Ok while waiting I was trying to find more information on this.
Someone in another forum indicated that for some Dell Bios exe files, when run, produces the BIOS.BIN file in a temp folder.
I tried it on Alienware_X51_R3_1.2.13.exe and indeed it was true. I flashed my BIOS the bin file (Test Clip and CH431A) and everything seems to work properly.
Just in case I have gotten the above wrong, I have now attached the new MEINFO and MEMANUF files and the Bin file I have used.

MEINFO https://drive.google.com/open?id=14iZ8NJ…gugiOK2Yz-pQ-HF
MEMANUF https://drive.google.com/open?id=1GRWfTh…FQ5oTA_Wo28GkVm
BIOS IMAGE https://drive.google.com/open?id=11C-lWV…iKP07ZPcNP1ImHV

Hope this helps someone else.
Cheers.

179

Yes the new logs look just fine. The dumped image seemed to have some sort of issue at the Flash Descriptor and that’s what caused the FIT error. You’re good to go now though. :wink:

180

Someone had posted here with help cleaning an Engine firmware but I accidentally deleted that post. Whoever that was, please post again.