Intel Converged Security and Management Engine Version Detection Tool 12.0.4
Hi
Trying to build ME image for a Lenovo IdeaPad 3 14ITL05 Type 81X7 (TGP LP B), in MEAnalyser the PHY is reported as TGP v11 (from the last Lenovo upload gcme38ww.exe - extracted)
the repository lists TGP v12 (or does it? Seemingly N/A from the graphic)
When I try to insert the v12 at PHY Binary in FIT, I get an error
Dumped BIOS using command FPTw.exe -bios -d biosreg.bin
Ran it in MeInfo, MEAnalyser says doesnāt contain a ME
TGP N PHY 11.225.276.2043 is not at the Repository.
Dump attached
biosreg.zip (4.8 MB)
Interesting interpretion of āN/Aā. So you think Lenovo got it wrong?
Youāre making assumptions. See post #1
If unsure about versions: dump your own firmware and run it through MEA. Looks
1 Like
Which fptw command used? (biosreg.bin naming convention??)
Screendump of MEA- output?
Whatās the objective?
What machine are we talking about?
1 Like
TGP SKU P - PHY P TGP v12.14.215.2015 
Type C IOM Region.bin 
Yours TGP SKU N - Type C North PHY Region.bin 
1 Like
I only accidentically recognized that you updated an earlier post with the missing information.
Thatās intended. A bios region isnāt supposed to have even the smallest piece of ME in it. Thatās the reason why itās called bios region and not ME region
The output of MEInfo gives you the correct information.
Since your syntax and knowledge about Intel firmware structure still has some potential:
What do you mean by ME image? Do you want to stich a ME firmware update- binary or build an ME region?
1 Like
Yeah, stitching is something itās clear I understand the mechanics, but little else once it goes āoff pisteā. So, I am stitching an update.
I will post my (new) questions here for the benefit of all @MeatWar has communicated via direct message and Iām grateful.
So, the bits I grab for stitching I just download from the links in the post.
My initial question is for Tiger Lake we have P PHY and N PHY SKUs, only the P PHY is linked from the master thread and they are different.
So I understand āwhyā my error (now), the last download from Lenovo contains the N PHY v11.xxx.xxx.xxxx; the repository contains v16.xxx.xxx.xxxx (which Iāve stitched without error in FIT).
The N PHY in the older Lenovo download is v11, whilst Iām okay using v11.xxx.xxx.xxxx if itās the same or newer, Iām less comfortable using v15.xxx.xxx.xxxx or v16.xxx.xxx.xxxx as this is a no-no at CSME version (i.e. 11.8.xxx.xxxx is not the same as 11.40.xxx.xxxx). Will this be an issue?
Plus the v11 in the Lenovo download is not in the repository (build ending 2043), 2042 and 2041 ARE present, how can I contribute / is it required?
For further reference, Iād appreciate a signposting for further reading on firmware dumping, specifically to understand why what I provided (by attachment) was insufficient and how to dump what I should provide.
Iām at a crossroads, I either try to understand what I donāt know or simply revert to continuing as I have with a little knowledge (believe me, I know how dangerous that can be 
). But I have several of these machines in the field and I like to have closed what vulnerabilities I can, or at least am aware of, a constant game of āwhack-a-moleā and the patchy (Iām being diplomatic here) support from vendors and OEMs, depending on the importance of the model and itās many variants that are seemingly inevitably produced.
An Intel support representative just sent me the latest driver link and I read the Installation instructions (more fool me, it looks a ādogās breakfastā of issues and caveats), quite honestly I just want to let Windows install whatever CSME driver it deems sufficient and when I run the vulnerability tool the machine gets a clean bill of health (until the next time).
Sorry for the lengthy post, but I am acutely aware that if I get any of these updates wrong I can brick a machine or at least make it near impossible to be restored to full health. So, I proceed with caution.
Fptw64 has - as many other programs - a help switch. In addition the basic regions of an Intel firmware image should be known ideallly before using this tool.
fptw command options
Intel (R) Flash Programming Tool Version: 15.0.35.1951
Copyright (C) 2005 - 2021, Intel Corporation. All rights reserved.
FPTW64.exe [-H|?] [-VER] [-EXP] [-VERBOSE] [-NORESET] [-Y] [-I]
[-F] [-VERIFY] [-NOVERIFY] [-D] [-DESC] [-BIOS] [-ME] [-GBE]
[-PDR] [-EC] [-SAVEMAC] [-SAVESXID] [-E] [-REWRITE]
[-ADDRESS|A] [-LENGTH|L] [-CVARS] [-MASTERACCESSGEN] [-CFGGEN] [-U]
[-CLEAR] [-O] [-IN] [-N] [-V] [-CLOSEMNF] [-GRESET] [-PAGE] [-R]
[-VARS] [-COMMIT] [-DISABLEME] [-FPFS] [-PROVHDCP] [-READHDCP]
[-GETPID] [-WRITETOKEN] [-ERASETOKEN] [-PROVKB] [-COMMITARBSVN]
[-STRAPUPDATE] [-READSTRAPS]
-H|? Display help screen
-VER Displays version information.
-EXP [arg_name] Displays example usage of this tool.
-VERBOSE Display the debug information of the tool.
-NORESET Cancel reset.
-Y Do NOT prompt when a warning occurs.
-I Displays information about the flash image.
-F [NOVERIFY] Load binary file into flash. āNoVerifyā skips verify.
-VERIFY Compare binary file to flash.
-NOVERIFY Disable the automatic verify when flashing a new file to flash.
-D Dump flash contents to file or āSTDOUTā.
-DESC Load/verify/dump Descriptor region.
-BIOS Load/verify/dump BIOS region.
-ME Load/verify/dump Intel ME region.
-GBE Load/verify/dump Legacy GbE region.
-PDR Load/verify/dump PDR region.
-EC Load/verify/dump Embedded Controller region.
-SAVEMAC Saves the GbE MAC when GbE is being reflashed.
-SAVESXID Saves the GbE SSID and SVID when GbE is being reflashed.
-E Do NOT erase area before writing to flash.
-REWRITE Rewrite the SPI with file data even if flash is identical.
-ADDRESS|A Flash address to load/verify/dump file.
-LENGTH|L Number of bytes to load/verify/dump.
-CVARS Displays a list of Manufacturing Line Configurable NVARs supported.
-MASTERACCESSGEN Generates a Manufacturing Line Configurable Master Access Input File.
-CFGGEN Generates a Manufacturing Line Configurable NVAR Input File.
-U Update Manufacturing Line Configurable NVAR.
-CLEAR Overwrites a pending NVAR value update request with the file systemās current.
-O Sets an output file name.
-IN Input Manufacturing Line Configurable NVAR/MasterAccess file.
-N Name of variable.
-V Value for variable.
-CLOSEMNF End of Manufacturing. Details on NoReset use -exp option.
-GRESET Global reset. Details on NoReset use -exp option.
-PAGE Pauses the screen when a page of text is reached.
-R Read a variable.
-VARS Display supported variables.
-COMMIT Commit Manufacturing Line Configurable NVARs.
-DISABLEME Disable ME.
-FPFS Displays the list of FPFs.
-PROVHDCP <xxkey.bin><xxcert.bin> Provision platform with the key and cert provided.
-READHDCP Displays the HDCP Rx provisioning status.
-GETPID [file] Retrieve the part id.
-WRITETOKEN Write the token where the filename is the token name.
-ERASETOKEN Delete the token.
-PROVKB Provide keybox to firmware.
-COMMITARBSVN Send the minimum supported Anti Rollback Security Version (SVN)
-STRAPUPDATE Update Manufacturing Line Configurable SoftStrap.
-READSTRAPS Read all the softStraps.
The initial thread isnāt updated in a long time!
I strongly advise against switching main versions of IUPs! In addition all IUPs are stitched in unchanged, if thereās no newer version one can simply reuse the old one! Only CSME has to be ānewā.
The only newer IUP is PHY N āTGP_N_11.225.284.2044ā (old 11.225.276.2043)
Otherwise FIT 15 has itās own tab for firmware updates:
1 Like
I found PHY N 11.225.276.2043 from Station Drivers, so Iāve stitched a FWUpdate.bin that checks through MEAnalyser OK.
Thanks to all for their input. 
But you already had PHY N 11.225.276.2043- itās part of the Lenovo update you mentioned? Unpack it, drag Cons_prod_Base_FWUpdate.bin into a FIT 15 window and FIT will decompose it. All elements you need for an update image except for the CSME part will be in the decomposed folder!
Anyway, thanks for the feedback!
1 Like
I couldnāt work out a quick way of finding 2044 here, so I set about seeing if I could try elsewhere. Wasnāt quick either, but there was order.
I was a bit unsuccessful with that tab in FIT 15, but Iāll try again next time I need to update.
What do you mean?
Open FIT
Drag the CSE ME 15.0.50.2633 ConsLP binary into the window
Go to the āFW Update Image Buildā tab
Fill in / choose PMC, PHY, PCHC
click the right build button
(For other CSME like corporate or H- versions you might have to select the correct chipset)
Done it in the normal tabs. It was already filled I think. Then I think I was expecting a build button but theyāre still in the usual place. Typical programmer haha.