IME version 11.x with ROM BYPASS (ROMB) partition present

Hi,
I’m trying to analyze the IME firmware as described in https://troopers.de/downloads/troopers17…ME11_Static.pdf.
I’m searching for a IME version 11.x image that has the ROMB section present.
According to the paper (page 39) it is version build between 2014-12-15 and 2015-07-01.
It has the jump instruction encoded in the beginning in i486 opcodes: “e9 eb 0f 02 …” coming
before the “$FPT” marker.

Does anyone know where I can find this kind of IME archive?

For instance the Intel Engine: Firmware Repositories (4) page lists
"Added ME 11.0.0.1120_CON_LP_BYP_EXTR" however how can I download it?


//Thanks

@hopsingk @emperor101 @CPL0 @fpmurphy (and everyone else who asks for PRE/BYP firmware):

Only Production Engine firmware based on Production PCH Steppings can be found at my threads. Any Pre-Production or ROM-Bypass or Production for non-Production PCH Steppings firmware, NDA Documentation etc are not shared here upon last year’s Intel demands. Most of you quote the research done by other people, I suggest you ask them instead.

Ok, I understand. There is some interesting research going on right now concerning IME. Will try find it somewhere else.