Intel (Converged Security) Management Engine: Drivers, Firmware and Tools (2-15)

For such desktop systems the “whole SPI image” is basically what ASUS lists under their BIOS without the AMI Capsule which can be easily removed with UEFITool. I have attached the latest BIOS without the capsule just in case. I’ve also unlocked the flash descriptor but the image needs to be flashed via a programmer first for the latter to apply later.

Getting a programmer is the best solution as it’s the fastest and can be used for anything else you like down the line. However, if you don’t want to, you can try (it’s difficult to perform sometimes) another method to unlock the flash descriptor. Basically, while the system is off, find the audio chip (Realtek 1150 in your case), use tweezers or a paper clip to short together pins 1 and 5 (DVDD + SDATA-OUT), power the pc, wait for POST to complete and then stop shorting the two pins.

Realtek_1150.PNG



If successful (those pins are small, it’s not always easy), you should boot into Windows with the flash descriptor temporarily unlocked until the next reboot. You can check by trying again fptw -d SPI.bin or fptw -d ME.bin -me (no error 26 in both cases). If you manage to unlock the descriptor that way, you can a) repair the ME region by reflashing it and b) unlock the flash descriptor permanently for future maintenance.

Z97-PRO-ASUS-2702.rar (4.91 MB)

fptw -dumplock will show locked values regardless of ME override, so please use fptw -d bios.bin to check if it’s locked or not.

@plutomaniac

Thank you again for your time on this, the information and the files you kindly provide.

I have been looking for the ALC1150 chip but couldn’t locate it. Actually I think it’s inside a metal box tagged “Crystal Sound 2” but the chip itself can’t be seen nor accessed. Is there any other end where the short could be applied?

Edit: according to the documentation the ALC1150 is inside that metal box…

@ CodeRush:

Right, thank you for letting me know CodeRush.

@ abstract:

Ah, EM Shield. Nothing you can do with the audio chip then, get a programmer as previously mentioned.

Note: You don’t have to use @username for me in this thread, I monitor it regardless.

Intel® Management Engine (Intel® ME) Driver v11.0.4.1186

(Consumer installer)

https://downloadmirror.intel.com/25880/e…1.0.10.1002.zip

(Consumer Drivers & Software)

https://downloadmirror.intel.com/25881/e…11.0.2.1000.zip

DriverVer= 02/04/2016,11.0.0.1181

Hello :slight_smile:

This file from HP contains the following tools:

FWUpdate(DOS): 11.0.0.1205
FWUpdate(EFI64): 11.0.0.1205
FWUpdate(Win): 11.0.0.1205
FWUpdate(Win64): 11.0.0.1205
MEInfo(DOS): 11.0.0.1205
MEInfo(EFI64): 11.0.0.1205
MEInfo(Windows): 11.0.0.1205
MEInfo(Windows64): 11.0.0.1205

Intel MEI Drivers & Software v11.0.4.1186 for Consumer systems

Intel ME System Tools v11.0 r17:

Flash Image Tool: 11.0.0.1202
FWUpdate(DOS, EFI64, Win, Win64): 11.0.0.1205
MEInfo(DOS, EFI64, Windows, Windows64): 11.0.0.1205
MEManuf(DOS, EFI64, Windows, Windows64): 11.0.0.1202
CCT(DOS, EFI, Windows): 11.0.0.1202
Manifest Extension Utility: 11.0.0.1202

Intel ME 11.0 Corporate PCH-LP Firmware v11.0.0.1205


Capture.PNG



Note: VCN was increased to 12. No downgrade via FWUpdate possible after updating.

MEA: 11.0.0.1205_COR_LP_XX_PRD_RGN_5C3D7000598989D9B168E3F4BD11FB020043722A_SHA1

Thanks to Intel for the driver and HP for MEInfo/FWUpdate. Also ex58 and Pacman for letting me know.

Intel MEI Driver v11.0.3.1184 MEI-Only Installer

Intel MEI Drivers & Software v11.0.3.1184 for Corporate systems

Intel ME 11.0 Consumer PCH-H Firmware v11.0.2.1003


Capture.PNG



MEA: 11.0.2.1003_CON_H_XX_PRD_EXTR_C40CAED447089B8A203AC9C044FCFC76AC4CADBF_SHA1

Thanks to SD/Pacman for the new ME firmware.

@plutomaniac

Update on MBP.

I found the issue from those errors, i installed windows 10 in UEFI mode whereas the 2011 MBP does not support it, only EFI. So reinstalled in MBR mode and it fixed the issue.

Now the FWUPDLCL tells me Error 8706: firmware update not initiated due to integrity failure or invalid FW image. (same under dos)

Maybe you can use the fw i sent you and update the contents to the latest?

@ PhatAgent:

Reinstalling Windows and changing the boot sector shouldn’t change anything as far as your ME issue is concerned. Did you try anything on the ME firmware besides the os reinstall? Make sure you are using FWUpdate v7 and try to flash the attached file under Windows or DOS. If the same error occurs then it may be that Apple has a custom version of FWUpdate which works with that unique SKU and firmware components they use. I cannot verify it but it wouldn’t be unlikely based on Apple’s tendencies and the fact that their ME region cannot be reproduced with the Flash Image Tool (FITC) we have, meaning the removal of some missing partitions inside is not possible to my knowledge and quick testing. However, as I said earlier, you have read/write access to ME through the unlocked flash descriptor. So you can replace the entire ME region if you like provided that you have read what I wrote in this post carefully first.

Note: There is no need to use @username for me in this thread. I monitor it regularly regardless.

7.0.1.1205_1.5MB_MAC_PRD_UPD.rar (418 KB)

Reinstalling windows in MBR mode fixed the meinfo and other issues withv7 tools. Many errors under uefi due to the chipset not being UEFI compliant.

Anyways, i was successfully able to update the ME firmware with your provided download.

Is it possible to update to 7.1x me, or are systems with 7.0 firmware stuck with 7.0xx

Thanks!

Plutomaniac, apparently Lenovo has another OEMID for ME Firmware Updating: 00000405-0000-0000-0000-000000000000 After using that OEMID, I managed to update to the latest ME Firmware on my Lenovo X130e.

@ PhatAgent:

Apple has a special SKU, what I call 1.5MB_MAC, so you cannot update to anything other than that. The latest in that case, as provided by Apple’s latest EFI images, is 7.0.1.1205. It seems that Apple follows their own versioning based on the firmware’s date. For example the seemingly newer 7.0.2.1164 firmware has a date of 20/12/2010 compared to Apple’s 7.0.1.1205 which has a date of 17/05/2011. So you are not as outdated as you think and unless Apple releases a new 1.5MB_MAC firmware, you cannot update to something newer.

@ rootuser123:

Are you sure it’s 0405 and not 0406? You can also show a MEInfo picture. I am aware of Lenovo having the 0406 OEMID, not 0405. The former OEMID is placed at MEA but disabled because it can lead to many false positives due to it’s lack of pattern uniqueness.

Yeah, I can show you a screenshot. I have to use MEInfo in DOS since I get errors on Windows 10 that it can’t create the PCI Driver even though I ran on Admin Mode.

DSC01237.JPG

Alright, good. I’ll add it to MEA for reference but I don’t think it can be checked, just like 0406. Thank you for letting me know rootuser123.



Gotcha.

I figured that part of the ME firmware would be what intel provides and the manufacturer adds their custom bits to it, ie you can update the base of the firmware but leave what is specifically modified for the device.

Thanks for the info

I’m running Windows 10 x64 Enterprise LTSB on an ASUS Sabertooth X99 motherboard with the latest published BIOS. I updated to the latest IME driver and am thinking about flashing the latest firmware. Not sure if there will be any benefit but seems like a good idea since ASUS is so slow at providing updates. I assume this is a consumer board and the correct firmware is “Intel ME Firmware v9.1.37.1002 (1.5MB)”?

ME Analyzer report

-------[ ME Analyzer v1.4.13 ]-------
Database r46

File: SABERTOOTH-X99-ASUS-2101.CAP

Firmware: Intel ME
Version: 9.1.10.1005
Release: Production
Type: Region, Extracted
FD: Unlocked
SKU: 1.5MB
VCN: 11
PV: Yes
Date: 13/06/2014
FITC Ver: 9.1.10.1000
Latest: No

MEInfo Report
Intel(R) MEInfo Version: 9.1.20.1020
Copyright(C) 2005 - 2014, Intel Corporation. All rights reserved.

Intel(R) ME code versions:

BIOS Version: 2101
MEBx Version: 0.0.0.0000
Gbe Version: 0.1
VendorID: 8086
PCH Version: 5
FW Version: 9.1.10.1005 H
LMS Version: 11.0.0.1156
MEI Driver Version: 11.0.0.1181
Wireless Hardware Version: Not Available
Wireless Driver Version: Not Available

FW Capabilities: 0x40100940

Intel(R) Capability Licensing Service - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
Service Advertisement & Discovery - PRESENT/ENABLED

TLS: Disabled
Last ME reset reason: Power up
Local FWUpdate: Enabled
BIOS Config Lock: Enabled
GbE Config Lock: Enabled
Host Read Access to ME: Disabled
Host Write Access to ME: Disabled
SPI Flash ID #1: EF4018
SPI Flash ID VSCC #1: 20252025
SPI Flash BIOS VSCC: 20252025
BIOS boot State: Post Boot
OEM Id: 00000000-0000-0000-0000-000000000000
Capability Licensing Service: Enabled
OEM Tag: 0x00000000
Localized Language: Unknown
Independent Firmware Recovery: Enabled

@ WetMacula:

You assume correctly.

I got an Asrock P67 carrying ME FW 7.0.4.1197. I tried to update it to 7.1.80.1214 but similar to what other members had encountered, the updated FW was reverted back upon reboot. When I used MEA to check the bios file I noticed GUID B3160739 was detected. I then extracted from this GUID a block of 146000 by searching for $MN2. I then compared this to the FW of the existing system by FWUpdLl -save. The 2 files matched perfectly.

My question is: can I replace the old FW within this GUID with the new one to avoid reverting upon reboot? Will the GUID be reflashed if I simply modify the flash descriptor? I don’t have a spare bios chip and I would like to get advices before I try it out.

Which Asrock P67 motherboard exactly? These have been updated to ME8 in order to additionally support Ivy Bridge.

Changing the contents of the GUID to those of the new firmware will cause a boot loop as it will constantly try to restore to a version which it cannot find. The proper method is to modify the AMITSE BIOS module to not initiate the me reflash upon system reboot. That requires dissassembly knowledge though which I don’t have. Lordkag should be able to help you with that.

EDIT: Upon closer inspection, this conversation, between Lordkag and shurik, is more relevant to you as it involves ASRock ME7 and the same recovery GUID. Once again though, Lordkag was able to mod the AMITSE module to get it to work.