Intel (Converged Security) Management Engine: Drivers, Firmware and Tools (2-15)

Hi,

Got an Asus Z170-WS on ME 11.6.10.1196 H and wonder if the 11.7 release is safe to upgrade? Or should I stay on the 11.6 branch?

Reason for upgrading was benchmarking with 3Dmark and new video cards and 3DMark invalidated my score stating there was a timing inconsistency issue and read that could be because of
wrong bios settings. Maybe ME you guys think?

Also the Intel ME System Tools v11.6 r11 download like is dead.

Thanks.

Edit: Also the ME 11.7 H consumer download is dead. Someone please share a download link for latest 11.6 + 11.7 Consumer firmware and drivers? Thanks a million!

Updated the notice regarding INTEL-SA-00075/CVE-2017-5689 (all firmware have been found, table finalized):

bug.PNG



Also added OEM advisories from Acer, ASUS, Dell EMC, HP Enterprise & Panasonic. Generally it took 12 days for all the fixed firmware to be found. The fastest OEM response was by far from HP followed by Fujitsu, Lenovo and Dell.

@ davidm71:

Wrong BIOS settings does not mean problematic ME. Reset BIOS defaults or similar. Stay at 11.6 and if you want update to the latest CON H. No links are dead, make sure you can access mediafire in general.

Well actually Mediafireā€™s site is down. Canā€™t get through. Iā€™ll stay on 11.6 then but let me tell you the history behind this. Couple months ago I tried updating to a new bios update ver 3200 from ver 901. It was a disaster. Had to roll back to 901. Not sure if ME got updated or not. Release notes not say if ME was updated but besides 3DMark rejecting my score system has been running fine.

Thanks.

Edit: Anyone know how to manually update the ME part of oneā€™s bios file with the ME firmware bin file and also how by reading the header tell what version it is??

Plutomaniac,

I got a little problem I used UEFITool to study the firmware versions of the 3002 Asus bios vs the 902 Asus bios. The latter 902ā€™s ME ver is 11.0.0.1168. Couple months ago I flashed to the 3002 Asus release which was a newer release offering Kaby Lake support and not known by me 11.6.10.1196. So after the 3002 flash I immediately had problems with not getting any video on the screen until I removed my second video card. This was a deal breaker because I am an SLI user so I flashed back to 902. There were other problems as well as the 3002 bios incorrectly recognizing the cpu as Kaby Lake. Asus bios engineers were asleep at the wheel I guess. So I thought my bios was a 11.6 capable bios when I ran diagnostic tool to check on the 902 because you canā€™t go backwards with ME and flashed up to 11.6.27.xxxx release. As I havenā€™t noticed any problems so far should I retry to flash back to 3002 as I recently updated my video card to two newer models or just leave it as is?

Thanks

These issues are neither related to this thread nor ME. If the latest ASUS BIOS has issues then ASUS needs to be contacted.

Yeah itā€™s ME related. I updated to newer bios with newer ME version unbeknownst to myself, and had to roll back to previous bios version and updated ME version stayed. Considering on start of thread was stated not to go from 11.0 to 11.6 unless bios supports it Iā€™m slightly concerned now Iā€™m back on the older bios version with newer ME.

While running MEManuf:
Warning 463: A test returned from FW does not match known test by the tool: App(34) Comp(0) Test(2)
Warning 463: A test returned from FW does not match known test by the tool: App(33) Comp(2) Test(2)
is this something to worry about? Win 10 Creators Update x64, Asus H110M-K D3 w/ Intel ME FW 10.0.10.1002 H


Edit: Found the solution via Google. Simply by using the 11.0.x Tools - I thought theyā€™re all backwards compatible? Hm, whatever.
Also, am I blind or is there no guide on how to update? I know flashing a firmware isnā€™t something for non-techies, but something like ā€œ1) Run ā€œFWUpdate -SAVE OLD.binā€ 2) ā€œFWUpdate -F downloadedFW.binā€ to updateā€ could save the day.

Another thing after upgrading now however:
MEInfo shows no errors, but MEManuf does:

1
2
3
Ā 
Error 237: No valid OEM ICC data programmed
Ā 
Error 117: MEManuf Operation Failed
Ā 


Should I reflash with a OEM ID provided, or doesn't it matter? (MEInfo shows OEM ID 0000-0000-....)


No there is not. People who want to deal with firmware updates should be capable enough to run FWUpdate to see the possible commands. There used to be instructions as you said but that lead to stupid questions like "how to open command prompt", "I write FWUpdate and it says it cannot find the file", "you say FWUpdLcl but I see FWUpdLcl64" etc.


Besides what I said above, that command is useless and people should not perform it before flashing. It only keeps a backup of the CODE section of the ME firmware, not CODE + DATA. Basically Update (UPD) images.


That error should not be there. It cannot occur after flashing with FWUpdate tool. Make sure you do a "fptw -greset" first and try again.


No, that is irrelevant

Thank you a lot, that worked. MEManuf now shows the success message.

I have cleaned the ME region on a few Apple Macbook BIOS but this A1706 Model BIOS doesnā€™t look correct to me. When I run the ME Analyzer v1.1, I see that it is a Consumer LP ME v11.0.12.1010 with a length of 0x127000. The closest ME I can find to it is the Intel ME Firmware v11.0.24.1000 (CON LP) here t596f39-Inteā€¦tem-Tools.html. The size of the v11.0.24.1000 ME is length 0x1F0000. When I copy the v11.0.24.1000 ME into the A1706 BIOS, it seems to run into another area that has valid data (not FFFFFFFFFFF that I have seen in the past). This doesnā€™t seem right. Its almost like the v11.0.24.1000 firmware is too big. BIOS is attached. Am I doing something wrong?

MacBook Pro 13 inch Late 2016 A1706 TOUCH 820-00239-09 SN-QWASZXERDFCV .zip (4.88 MB)

Intel ME 11.6 Consumer PCH-H Firmware v11.6.29.3287

Capture.PNG



Intel ME 11.0 Corporate PCH-LP Firmware v11.0.26.3000

Capture1.PNG



Intel ME System Tools v11.6 r12

@ X7JAY7X:

First of all read these three posts to understand why your case differs. As you can see, one thing we havenā€™t out is if Apple is using a custom ME11 SKU for their laptops, in which case all the other firmware are not compatible. What guide are you following which says to ā€œcopyā€? That is extremely wrong.

Hello plutomaniac,

Fujitsu informations are that the C5731 will receive a Intel ME update, but that model has been released with Intel ME 5.2
Do you think they had a typo there or is it really possible to place a ME 6.2 onto a 5.2 ?

@ FM:

Clearly a mistake, there is no such upgrade path

Well, I guess itā€™s possible they managed to convince Intel to fix 5.2 too (assuming it has the same bug) but Iā€™m doubtfulā€¦

Hi, Iā€™m trying to update asus maximus viii formula z270 with firmware Intel ME 11.7 Consumer PCH-H Firmware v11.7.0.1229 but error
Error 8758: The image provided is not supported by the platform.
Excuse my english use google

Intel ME System Tools v11.7 r0 link off-line

Can someone help me?

Update to the latest 11.6 firmware, ignore 11.7 for now. Also, if you currently are at 11.6.27.3264 or 11.6.29.3287, you cannot update to 11.7.0.1229. There are no 11.7 tools posted, thus the "Placeholder" text.

I successfully "downgraded" from v11.7.0.1229 to v11.6.29.3287 on my motherboard, Asrock Fatal1ty Z270 Gaming K6.


Yeap, 11.7.0.1229 is based on 11.6.25.1229 and has a VCN of 178 whereas 11.6.27.3264 and 11.6.29.3287 have VCN of 192 and 193 respectively. Thus, 11.7.0.1229 is a downgrade compared to anything after 11.6.25.1229.

plutomaniac,

Thanks for your help. I am new to this so I must have got lucky the few other times I cleaned an Apple ME.

I am using the guide here: https://www.ghostlyhaks.com/blog/apple-eā€¦clean-me-region Which is not very detailed.

Can you link to the guide you referenced in post #129? How do I know if Apple is using custom firmware? My ME is 11.0.x and there is 11.0.x in the repo on the first page of this post but that one is too big. Should I always assume Apple is using a custom ME then?

That guide is dangerously wrong on many levels. The ME is not static firmware, it needs to be configured first for each system by the OEM via Intelā€™s Flash Image Tool before deployment. So we never replace a dumped SPI image with a stock (RGN as I call them) ME region, which is what is provided at the ME or Repositories threads, without prior configuration. Searching for the ME region via the string ā€œKRIDā€ is also wrong because a) it may not lead to the actual ME region (some OEMs implement a 2nd partial ME Flash Partition Table for recovery purposes) and b) not all firmware have that string based on their generation. Also, the size of the ME firmware is not always 0x17D000, which is especially wrong for recent versions, and the actual ME region of the SPI image is never at that size so leftover data may be left after that length which can cause a brick. For some older firmware like ME 6.x, even from Apple, replacing at that size will probably extend to the BIOS region and effectively brick the system. Generally, that guide is horrible and shouldnā€™t be followed by anyone who wants a working system afterwards.

I donā€™t know what ā€œpost #129ā€ is, you need to be more specific. As for the SKU: In the past, Apple had their own ME firmware SKU for mobile systems aside from the usual two from Intel for everyone else (1.5MB & 5MB). They had their own ā€œ1.5MB Apple Macā€ as I called it. For ME 11.x (SKL/KBL) I am not able to verify if that still applies (maybe ā€œConsumer Apple Macā€) because Apple users tend to not be able to help in order to figure something like that out, with all due respect. I had explained at the three previously linked posts with the other Mac user exactly why it cannot be ā€œcleanedā€ easily and in under which cases that is possible. So please read those three posts again first.

Okay, I have a stupid question, you have been warned! Is there any way of going back to an older version, if latest doesnā€™t work? Next question, if the flash process fails, am i able to get back the system, like a recovery backup or something? Thank you for your time!