ME Analyzer: Intel Engine Firmware Analysis Tool Discussion

ME Analyzer v1.6.4 & DB r65

ME Analyzer v1.6.5 & DB r66

Performance:

  • 1.6.4 (Unoptimized, UEFIFind disabled) vs 1.6.5 (Optimized, UEFIFind disabled)

    0.73 sec
    0.15 sec

    Improvement: 80%

  • 1.6.4 (Unoptimized, UEFIFind enabled) vs 1.6.5 (Optimized, UEFIFind enabled)

    2.05 sec
    1.46 sec

    Improvement: 30%

  • 1.6.4 (Unoptimized, UEFIFind enabled by default) vs 1.6.5 (Optimized, UEFIFind disabled by default)

    2.05 sec
    0.15 sec

    Improvement: 1350%

  • Note 1: UEFIFind is not included with MEA anymore by default. If you want to use Engine GUID detection (-enuf) then make sure to include it alongside MEA’s executable.

    Note 2: Most people use default settings with no parameters so they should see the 1350% improvement at MEA v1.6.5. People who had UEFIFind disabled (UBU and UEFIStrip) will see an 80% or so improvement . Even with UEFIFind Engine GUID detection enabled, you should expect at least 30% improvement.

    @SoniX @lordkag

    Remove the old “-disuf” from UBU and UEFIStrip as UEFIFind Engine GUID Detection is disabled by default now. If you want it enabled somewhere, use “-enuf” instead. MEA will ignore any “-disuf” parameter/filename input until your tools are adjusted accordingly.

    ME Analyzer v1.6.6 Dev 1

    Fixed issue that caused temporary files to not be deleted

    Note: You should clean your %temp% folder and update MEA

    Note: Affected versions are v1.6.3 - v1.6.5

    @SoniX

    Please update UBU with this Dev version

    ME Analyzer v1.6.7 & DB r67

    ME Analyzer DB r68

    ME Analyzer DB r69

    ME Analyzer DB r70

    ME Analyzer v1.6.8 & DB r71

    ME Analyzer DB r72

    ME Analyzer DB r73

    Can I use MEA to update the MEI fw in a BIOS file?

    ME Analyzer v1.7.0 Dev 21 & DB r74

    ME Analyzer v1.7.0 Dev 35 RC & DB r75 Dev 3

    The next version of MEA is almost ready with big changes all around. So please test and let me know of any issues.

    ME Analyzer v1.8.0 & DB r75

    v1.8.0

    Added Engine firmware size validation and display
    Added ME 11.x FIT SKU detection (11.0 - 11.6)
    Added $FPT header checksum validation check
    Added $FPT Entry Counter validation check
    Added Manifest detection from $FPT directly
    Added parameter to display $FPT header details
    Added early support for TXE 3.x APL firmware
    Added ME 11.x Flash Descriptor EC lock detection
    Added info to fix FWUpdate-buggy ME 11.x images
    Added SPS 3.x $FPT checksum validation check
    Added support for ME2-ME6 SPI Flash Descriptor
    Added support for ME 6.x ROM-Bypass firmware
    Improved detection & analysis of $FPT header
    Improved VCN detection of post-SKL ME,TXE firmware
    Improved Engine Release detection (PRD/PRE/BYP)
    Fixed wrong Engine $FPT selection when multiple exist
    Fixed wrong error messages at special TXE 1.x images
    Fixed various code issues and errors under rare cases
    Removed irrelevant info shown at Partial Update images
    Removed option to extract Dell HDR RBU ImagME Regions
    Removed option to print whole DB without SHA1 hashes
    Removed option to encode all textual output to Unicode
    MEA now pauses automatically at unexpected exceptions
    Various code optimizations and performance improvements
    Updated Engine Firmware Repository Database to r75

    r75

    Latest ME 11.6 CON LP SKU to 11.6.10.1196
    Latest TXE 2.1 1.375MB SKU to 2.1.5.3105
    Added ME 11.6.10.1196_CON_H_D0_NOPDM_PRD_RGN
    Removed ME 11.6.10.1196_CON_H_D0_NOPDM_PRD_EXTR
    Added ME 11.6.10.1196_CON_LP_C0_UKPDM_PRD_EXTR
    Added ME 11.6.1.1142_CON_H_D0_UKPDM_PRD_RGN
    Removed ME 11.6.1.1142_CON_H_D0_UKPDM_PRD_EXTR
    Added ME 11.6.1.1142_CON_LP_C0_PDM_PRD_RGN
    Added ME 11.6.0.1121_CON_H_D0_NOPDM_PRD_RGN
    Added ME 11.6.0.1121_CON_LP_C0_NOPDM_PRD_RGN
    Removed ME 11.6.0.1121_CON_LP_C0_UKPDM_PRD_RGN
    Added ME 11.6.0.1121_CON_H_D0_NOPDM_PRE_RGN
    Added ME 11.6.0.1121_CON_LP_C0_NOPDM_PRE_RGN
    Renamed ME 11.0.18.1002_CON_H_D0_NOPDM_PRD_RGN
    Added TXE 2.1.5.3105_1.375MB_PRD_EXTR
    Added SPS 04.00.03.137_PRD_REC
    Added SPS 04.00.03.137_PRD_OPR

    Hi, it seems that ME Analyzer v1.8.0 & DB r75 wrongly detects size of ME FW blob in my case.

    File: P67DS_F5.BIN
    Family: ME
    Version: 7.1.20.1119
    Release: Production
    Type: Region, Extracted
    FD: Unlocked
    SKU: 1.5MB
    Date: 08/08/2011
    Size: 0x17D000
    Platform: CPT
    Latest: No

    But FIT 7.1.60.1191 unpacked ME Region.bin file only 839680B and when I checked with hexaeditor I can see only FFh blank behind 839680+4k descriptor offset. FIT doesn’t show ME size anywhere. I’m not sure if it’s right as other 7.x ME FW blob, e.g. 7.1.80.1214 has 1335296B. Maybe GB used some stripped version? You can check yourself, BIOS image is
    here

    I haven’t tested the file but I know MEA is correct. If you load the FITC “ME Region.bin” at MEA you’ll see a Warning about possible data loss. FITC v2 to v10 used to cut all the padding from extracted ME images even if that violated region boundaries. Before reinserting the file back to the BIOS/SPI image, FITC would just readd the padding. Stupid but that’s how it worked. MEA detects the size intelligently from what the actual firmware reports. At bare Engine regions it can check for extra (useless) padding, less (possible data loss) padding and at full SPI images it can check if there are extra/unknown data after the ME firmware size but before the ME region actually ends as described at the Flash Descriptor.

    Is the total ME size stored inside the blob or you have to calculate it according parsig the ME partition table or so? Yeah, interesting that FIT is cutting the paddings. I see more ME FW blobs that differ slightly in size, seems there’s no standard. But it it seems to be safe to cut off unnecessary padding as when inserted to flashROM empty pages are blanked and no used anyway… Thanks for explanation.

    Thank you for your interest in ME Analyzer and for using it.


    It has to be calculated manually and after taking in mind all the differences, weirdness, uncharted sections etc which have appeared in all the firmware that MEA supports (10 ME, 3 TXE and 4 SPS major generations). MEA is open source so if you are interested, the full code on how it calculates the sizes can be found at its github page.


    The size of the ME region does not matter as long as data are not lost. MEA checks that but also reports extra padding to lower the required filesize. For example, you can find a 8MB ME region at an SPI image with only the first 1.5MB taken by the ME code and everything being unneeded padding. This is due to various reasons but the most usual is that, by design/default, any extra space of the SPI image is appended to the ME region. So, if a system uses a 16MB chip and the BIOS is 9MB for example, the ME will be padded at the end if its region to fill the rest, meaning approximately 7MB (minus the Flash Descriptor which is 4KB at the start).


    I don’t understand this sentence.

    ME Analyzer v1.8.1 & DB r76

    ME Analyzer v1.8.2 & DB r77