Intel (Converged Security) Management Engine: Drivers, Firmware and Tools (2-15)

Intel ME 11.7 Consumer PCH-H Firmware v11.7.4.3314
For 100/200/300-series SKL/KBL/CFL-S and SKL/KBL/CFL-H systems which come with ME firmware v11.7

Capture1.PNG



Intel ME 11.0 Corporate PCH-H Firmware v11.0.28.3002

Capture2.PNG



Intel ME System Tools v11.7 r1

ME Analyzer v1.16.7 or later can now detect ME 11.x Power Down Mitigation (PDM) firmware status.

Capture3.PNG



Updated the 100/200/300-series warning with KBL-R and CFL. Things are becoming confusing with Intel’s “refreshes” so let me know if you think something is wrong.

Capture4.PNG



@ bkpizza:

Run Flash Programming Tool with the command “fptw -d spi.bin”. Does it complete successfully? Also, have you tried a “fptw -greset”?

@ vickyrcd:

You are using the right firmware. Read about Version Control Number (VCN) at the first post to understand why a downgrade is not possible.

@ vstar:

MEInfo, MEManuf and FPT are command line tools so you need to open a command prompt first to use them. That aside, have you tried to test if running Flash Programming Tool with command “fptw -greset” fixes the problem? Does “fptw -d spi.bin” command complete successfully or do you see an error? If you have a hardware programmer such as CH341A, that would definitely solve the problem.

@ KotTHECat:

FTK is not supported/updated anymore, I don’t recommend its usage. It must use FWUpdate though for the process you mentioned so it has nothing to do with FIT setting configurations and RGN/EXTR.

@plutomaniac :

The meupd.bat contains the following code

1
2
3
4
5
6
7
8
9
 
@echo off
if exist me.bin goto UPD
echo File me.bin not found.
goto EXIT
:UPD
echo Updating ME firmware from me.bin
fwupdlcl -f me.bin
:EXIT
echo Thank you for using FTK. Have a nice day.
 


so yes, it uses FWUpdate.
If i get it right, and update the ME firmware my way, i do not need to worry whether its RGN or EXTR?
I previously flashed 11.6.25.1229 (which exact name is 11.6.25.1229_CON_H_D0_PRD_EXTR.bin), and now i have got 11.7.0.3290 (11.7.0.3290_CON_H_D0_PRD_RGN.bin), and i could not notice any difference/problems.



Thank you for the reply.
I have tried FPT with command "fptw -greset", didn’t fix the problem. (FPT->fptw -greset->PC reboots itself->ME still 0.0.0.0 in BIOS)

The "fptw -d spi.bin" command complete successfully and I get a spi.bin file.
Intel (R) Flash Programming Tool. Version: 11.6.29.3287
Copyright (c) 2007 - 2017, Intel Corporation. All rights reserved.

Reading HSFSTS register… Flash Descriptor: Valid

— Flash Devices Found —
W25Q128FV ID:0xEF4018 Size: 16384KB (131072Kb)


- Reading Flash [0x1000000] 16384KB of 16384KB - 100 percent complete.
Writing flash contents to file "spi.bin"…

Memory Dump Complete
FPT Operation Successful.

I just purchased a CH341A programmer on Amazon, and learning how to reprogram the chip from CodeRush 's guide. Do I need another PC to do the chip progrmming process, since the target PC’s BIOS chip needs to be removed/plug into CH341A for reprogram?

Thank you plutomaniac for your help

@ KotTHECat:

The answers can be found at the first post. Read the RGN/EXTR and UPD explanations at section B and FWupdate at section C1.

@ vstar:

You can do it at the same pc if you like (let it boot, remove chip and place back before next reboot) but it’s preferable to use another one if you have. You need to remove the SPI chip and program it with the programmer by using the latest ASUS BIOS from their website after removing the AMI Capsule. Use UEFITool to easily remove the latter, just save the “Intel Image” as a new file.



Thank you plutomaniac.
I have owned different ASUS ROG boards for the past 6 years, never had any problem. This ASUS ROG Z170 HeroAlpha gave me ME 0.0.0.0 problems twice, even a RMA replacement showed the problem again. So this time I’m gona try reprogram the chip by myself.
I’m still learning to program the original MAC ADDRESS, UUID and MB/SN to new BIOS by using FD44Editor.

Thanks again! =D I will report back if I fixed the ME 0.0.0.0 issue by reprogram the BIOS chip successfully.


I have read the whole first post twice, but as my English is poor and its difficult for me to understand all the nice stuff you have written, i still dont understand why "Never flash RGN without first configuring, but you can flash it via FWUpdate without first configuring".
What am i missing?

@vstar
You can also buy a SPI chip for a few bucks on >>ebay<< and do with it whatever you want :slight_smile:

@ KotTHECat:

FWUpdate is a special tool which sends the update firmware to the ME itself to be validated and then flashed while keeping settings intact. Anything else (generic SPI flashers such as FPT, AFU & Flashrom, hardware programmers etc) requires a ME region which has been configured first by FIT.



Thanks KotTHECat. =D
Since I have purchased CH341A programmer, I will try to reprogram the BIOS chip which comes with my motherboard 1st.

Intel MEI Driver v11.7.0.1037 MEI-Only Installer

Intel ME 11.10 Consumer PCH-H Firmware v11.10.0.1287 (EXTR → RGN)



Hello plutomaniac,
I have fixed the ME 0.0.0.0 problem with CH341A programmer with original mac address, UUID and S/N.
I used the programmer to program BIOS v3401 into the chip, then use ASUS EZ FLASH to update to v3501(the latest) just to make sure the normal BIOS update still works, and prefer to use ASUS stock BIOS instead the modified programmer version.

Thanks alot for your help!

hi,
Before this 5 years the processor worked at a frequency of 4.2 GHz, and memory at 1866 MHz).
The computer did not go into hibernation mode, a black monitor, the fan of the systemic noise, there is no reaction to the buttons of the system. block and keyboard, when pulling out of the power grid and restarting again the same thing, there is no way to go into the BIOS. Dropped the jumper SMOS. I went to the BIOS, and there:
Instead of 16 GB of RAM shows 8 GB (4 slots of 4 GB worth) supposedly do not work 1 slot and 3 slots of four slots. He pulled out 2 slots and 4 slots, left only 1 and 3 slots. Now it began to show that 1 slot and 3 memory slots are available, but 2 and 4 slots were removed. I put two bars in place, again shows that there are no dice in 1 and 3 slot and only 2 and 4 are active. Total 8 GB of RAM. In the task manager, too, 8 GB. AIDA sees 4 slats of 4 GB, but says it’s a syst. Memory only 8GB.
I dropped the SMOS, pulled out the battery, rebuilt BIOS with the same version. Does not help.
In BIOS, it is not possible to overclock the CPU and RAM frequencies, keeping their frequencies by default.
Overclocking at the RAM: earlier the choice of frequencies 1333, 1600, 1866, 2133 MHz was shown, now these values ​​are not present, there are only 1066,1333 and auto.
z68 pro3 Asrock.
2500K processor
Windows 7 64 maximum
4 slats of 4GB RAM Corsair

I do not know what to do, can update ME through a USB flash drive.
I want to update ME, I chose the firmware and installer 8 series 1,5 Mb (FWupdlcl.exe for bios ) as shown in the picture below. I created a flash drive with the ms-dos environment, downloaded the installer and firmware there, wrote the installer’s name and put the enter and shows me the error, tell me please what I’m doing wrong.

11.png

12.jpg

13.jpg

5.jpg

6.png

8.png

Intel ME 11.20 Corporate PCH-H Firmware v11.20.0.1249
For C620-series SKL-SP systems which come with ME firmware v11.20

Capture.PNG



@ leonid:

You are using the correct tools for your system. To use FWUpdate you need to use “FWUpdLcl -f fw_name.bin” parameter. However, you may not be able to update the ME if it is currently corrupt. To verify that, please create proper “MEInfo -verbose” and “MEManuf -verbose” reports by saving them into a text file (example: MEInfoWin64 -verbose > meinfo.txt). Then compress the two .txt files into zip/rar and attach them here. Run Flash Programming Tool with command “fptw64 -greset” and check if the problem persists after the reboot. Make sure you have the latest ASRock BIOS flashed via the in-BIOS menu (ASRock InstantFlash).

There’s a mention in today’s “Security Now” podcast of disabling the Intel ME:
Show notes:
https://www.grc.com/sn/SN-626-Notes.pdf
Linked article here:
http://blog.ptsecurity.com/2017/08/disabling-intel-me.html


This is very interesting,
I would like to hear other people’s thoughts as well.

Hi,

i got an intel core i7 5820k,
Coulnd some1 link me the Intel Management Engine drivers + Chipsatz + AHCi pls, becuz i want to reinstall my os ( win 10x64 bit)
maybe other drivers for my system,
thx

@DarkneZ

The Intel ME drivers are found at page 1 of this thread. The Recommended AHCI/RAID and NVMe Drivers are found here: Recommended AHCI RAID and NVMe Drivers.

You should also go to the maker of your motherboards web site for drivers and BIOS updates.

@myDNA
i dont know which 1 is for me (Intel core i7 5820k,)thats why i asked ^^
ntel 5-, 6- or 7-Series Chipse ( which series is my intel core) i dont know about that,
cuz i need my other drivers too like MEI, Chipset

@DarkneZ

The Intel i7-5820k is a 5th gen CPU, but you do not need to know what gen your CPU is. What you need to know is the chipset, which is X99.

I suggest that you first go to ASUS website for your motherboards chipset, MEI and SATA / RST etc. drivers here :
Asus x99 M-WS drivers and software updates

Choose your version of Windows, e.g., Windows 10 X64 so that the correct drivers are listed, and then see what versions the drivers are. That way you have a good idea of which version drivers to download from here at win-raid.

However, Fernando has also modded many of these driver’s inf files so that you can install higher numbered versions of the drivers you are after.

Maybe someone with more experience with your motherboard can help you better than me, for I have no experience with the X99 chipset.

H i folks,

I have this Dell Inspiron 15 5000 series notebook with an Intel i5-6200U and 100 series chipset. I would like to update the ME firmware but before I do I would like to find out what you folks think is the correct version [currently is v11.0.0.1194 LP please see spoiler for MEInfo output].

I can usually figure this out for myself, however I do not want to make a mistake because there are 2 different types of the firmware. I would like to clarify if I need the “Intel ME 11.0 Consumer PCH-LP Firmware v11.0.26.3000”, or the “Intel ME 11.0 Slim PCH-LP Firmware v11.0.12.1010” ? Please let me know if you need more info.

TIA for any feedback in this matter.


Intel(R) ME code versions:

BIOS Version 1.2.9
MEBx Version 0.0.0.0000
GbE Region does not exist.
GbE Version Unknown
Vendor ID 8086
PCH Version 21
FW Version 11.0.0.1194 LP
LMS Version 11.0.0.1173
MEI Driver Version 11.7.0.1032
Wireless Hardware Version 2.1.77
Wireless Driver Version 18.33.7.2

FW Capabilities 0x31111A40

Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
Intel(R) Platform Trust Technology - PRESENT/ENABLED

TLS Disabled
Last ME reset reason Global system reset
Local FWUpdate Enabled
BIOS Config Lock Enabled
GbE Config Lock Enabled
Host Read Access to ME Disabled
Host Write Access to ME Disabled
Host Read Access to EC Disabled
Host Write Access to EC Disabled
SPI Flash ID 1 EF4018
SPI Flash ID 2 Unknown
BIOS boot State Post Boot
OEM ID 00000000-0000-0000-0000-000000000000
Capability Licensing Service Enabled
OEM Tag 0x00000000
Slot 1 Board Manufacturer 0x00001028
Slot 2 System Assembler 0x00000000
Slot 3 Reserved 0x00000000
M3 Autotest Disabled
C-link Status Enabled
Independent Firmware Recovery Disabled
EPID Group ID 0xF8B
OEM Public Key Hash FPF 0CBFCFA9742F99CDFBB2C6035B5D8BDCDA1C6BEBDF693C667A9D0E6997200A27
OEM Public Key Hash ME 0CBFCFA9742F99CDFBB2C6035B5D8BDCDA1C6BEBDF693C667A9D0E6997200A27
ACM SVN FPF 0x2
KM SVN FPF 0x0
BSMM SVN FPF 0x0
GuC Encryption Key FPF 0000000000000000000000000000000000000000000000000000000000000000
GuC Encryption Key ME 0000000000000000000000000000000000000000000000000000000000000000

FPF ME
— –
Force Boot Guard ACM Enabled Enabled
Protect BIOS Environment Enabled Enabled
CPU Debugging Enabled Enabled
BSP Initialization Enabled Enabled
Measured Boot Enabled Enabled
Verified Boot Enabled Enabled
Key Manifest ID 0xF 0xF
Enforcement Policy 0x3 0x3
PTT Enabled Enabled
PTT Lockout Override Counter 0x1
EK Revoke State Not Revoked
PTT RTC Clear Detection FPF 0x0


@plutomaniac

Thanks for your input, very much appreciated.

To update. I updated the ME firmware and all went well. I will include the MEInfo output in the spoiler.

Intel(R) ME code versions:

BIOS Version 1.2.9
MEBx Version 0.0.0.0000
GbE Region does not exist.
GbE Version Unknown
Vendor ID 8086
PCH Version 21
FW Version 11.0.26.3000 LP
LMS Version 11.0.0.1173
MEI Driver Version 11.7.0.1032
Wireless Hardware Version 2.1.77
Wireless Driver Version 18.33.7.2

FW Capabilities 0x31111A40

Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
Intel(R) Platform Trust Technology - PRESENT/ENABLED

TLS Disabled
Last ME reset reason Global system reset
Local FWUpdate Enabled
BIOS Config Lock Enabled
GbE Config Lock Enabled
Host Read Access to ME Disabled
Host Write Access to ME Disabled
Host Read Access to EC Disabled
Host Write Access to EC Disabled
SPI Flash ID 1 EF4018
SPI Flash ID 2 Unknown
BIOS boot State Post Boot
OEM ID 00000000-0000-0000-0000-000000000000
Capability Licensing Service Enabled
OEM Tag 0x00000000
Slot 1 Board Manufacturer 0x00001028
Slot 2 System Assembler 0x00000000
Slot 3 Reserved 0x00000000
M3 Autotest Disabled
C-link Status Enabled
Independent Firmware Recovery Disabled
EPID Group ID 0xF8B
OEM Public Key Hash FPF 0CBFCFA9742F99CDFBB2C6035B5D8BDCDA1C6BEBDF693C667A9D0E6997200A27
OEM Public Key Hash ME 0CBFCFA9742F99CDFBB2C6035B5D8BDCDA1C6BEBDF693C667A9D0E6997200A27
ACM SVN FPF 0x2
KM SVN FPF 0x0
BSMM SVN FPF 0x0
GuC Encryption Key FPF 0000000000000000000000000000000000000000000000000000000000000000
GuC Encryption Key ME 0000000000000000000000000000000000000000000000000000000000000000

FPF ME
— –
Force Boot Guard ACM Enabled Enabled
Protect BIOS Environment Enabled Enabled
CPU Debugging Enabled Enabled
BSP Initialization Enabled Enabled
Measured Boot Enabled Enabled
Verified Boot Enabled Enabled
Key Manifest ID 0xF 0xF
Enforcement Policy 0x3 0x3
PTT Enabled Enabled
PTT Lockout Override Counter 0x1
EK Revoke State Not Revoked
PTT RTC Clear Detection FPF 0x0

@myDNA

yes i gonna check it, cuz atm my pc not shutting down,and i dunno where is the problem,
and when i get all the drivers for my system i gonna do a fresh reinstall for my pc

thx