ME Analyzer: Intel Engine Firmware Analysis Tool Discussion

Hey SoniX,

MEA always reports “Not Updated” for 9.0 because it has been replaced by 9.1 firmware. In general, for 5MB there’s 9.0.31.3488 and for 1.5MB it’s the same old 9.0.31.1487.

@ plutomaniac

Well, But mostly version 9.1 is not compatible for the board on the 8th chipset.

ME firmware 9.1 by itself, is fully compatible with 8-series systems. It was up to OEMs to update the BIOS to work with the newer ME. I’ll re-enable Latest for 9.0 since people want it.

I get a “Found Unknown Intel Engine Flash Partition Table” when I try ME Analyzer on Lenovo’s latest ME formware for a T450 laptop. Actual version of ME firmware is 10.0.55.3000

What does that message mean?

Capture.PNG

Based on the picture, the file you loaded is invalid, corrupt etc. As MEA says, no Engine firmware was found, only a FPT section.

Humm. File installs correctly on my laptop and meinfo sees the update. See fpmurphy.com/public/ME10.0_5M_Production.bin.

Can you download Intel ME 10.0 Firmware Repository from Intel Engine: Firmware Repositories and and check the binaries there in MEA? Do you see the same error?

Tried the file you offered for download with MEA just out of curiosity- reads out fine

I don’t understand what you’re doing. Do you rename all files you test to the stock firmware filename of ME10.0_5M_Production? If the binary from the Repository works with MEA then the one you have has some sort of issue. Doesn’t matter what really, just take the RGN from the repo.

How can I access "ME 11.0.0.1120_CON_LP_BYP_EXTR" ? Is it possible to download it.
I am searching for a ME firmware with ROM bypass present.

Hi Plutomaniac, I found a variation of ME (11.8.50.3425 CON_X) in the latest beta BIOS for my motherboard GA-Z170-HD3 DDR3, BIOS F21c (link1, link2, link3, link4, link5)

I updated to latest ME Analyzer and ran it:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
 
Family:   ME
Version: 11.8.50.3425
Release: Production
Type: Region, Extracted
FD: Unlocked
SKU: Error, unknown ME 11.x Minor version! *
Rev: D0
SVN: 3
VCN: 275
PDM: Unknown
LBG: No
PV: Yes
Date: 2017-10-25
FIT Ver: 11.8.50.3425
FIT SKU: PCH-H Z170
Size: 0x1BF000
 
SKU from Kernel: H
SKU from Extension 0C: H
SKU from Flash Image Tool: H
SKU from ME Analyzer Database: NaN
 
* Please report this issue!
 
Note: This firmware was not found at the database, please report it!
 

@ chinobino:

You are certainly using an old version of ME Analyzer. Support for 11.8 was added back in October. Thank you for using MEA.

The link on the first page redirects to (https://github.com/platomav/MEAnalyzer) MEA v1.38.0 r108.zip (r108 = release candidate?) which says;

1
 
Note: This firmware was not found at the database, please report it!
 


The link you posted above redirects to a different URL (https://github.com/platomav/MEAnalyzer/releases) which is ME_Analyzer_v1.38.0.rar and that one has the firmware in the database.

The links are the same, one goes to the main page and the other just to the Releases tab of said page. v1.38.0 is the version of MEA and r108 of the database.

I understand now, thanks for your time.

Thanks also for making such a useful tool and maintaining all of the ME related repositories!

ME Analyzer v1.42.0 r110

v1.42.0

Added full support for CSME 12.0 firmware
Added CSE Extensions 0x11, 0x16 and 0x14 R2
Added CSE Layout Table (LT) v1.6 & v1.7 support
Added Flash Partition Table ($FPT) v2.1 support
Added Boot Partition Descriptor Table (BPDT) v2-3 support
Added $FPT, BPDT & CSE LT partition overlap detection
Added CSE $FPT, BPDT & CSE Layout Table unpacking
Added CSE Partition Instance ID unpacking display
Added CSE partition OEM/FIT customization detection
Added CSE partition Hash & Size validation in all cases
Added CSE partition out-of-bounds Module detection
Added CSE UTFL structure at UTOK/STKN unpacking
Added CSE Layout Table entries info display (-dfpt)
Added ME 8-10 $FPT Partition Instance ID display
Improved CSE Extensions 0x3, 0xE, 0xF, 0x10 & 0x14 R1
Improved $FPT and BPDT entries info display (-dfpt)
Improved $CPD Entry Counter for end offset detection
Fixed CSE unpacking metadata text filename collision
Fixed false positive BPDT S-BPDT & CSE_BUP detection
Fixed wrong Manifest detection at Intel SPS capsules
Fixed wrong CSE firmware analysis messages position

r110

CSME 11.21.50.1429_COR_H_B0-S0_PRD_RGN
CSME 11.11.50.1436_CON_H_D0_PRD_RGN
CSME 11.8.50.3425_SLM_H_D0_PRD_EXTR
CSME 11.8.50.3425_SLM_LP_C0_NPDM_PRD_EXTR
CSME 11.6.12.1201_CON_H_D0_PRD_EXTR
ME 7.1.92.3273_5MB_PRD_UPD
TXE 1.1.5.2162_1.375MB_IT_PRD_EXTR

thinks you help me for my works good job

What does this error mean, I’ve never seen before. I assumed this BIOS maybe didn’t contain ME, since board has two roms and other larger dump did contain ME, but I ran this one through anyway to check and it just looks like BIOS without ME

Unidentifiable ME.png



I dropped the file in FIT too, errors there and would not open. Other larger BIOS no problem for MC Extractor or FIT. So I assume there is NO ME in this file, but wanted to ask here due to the “Found” but error and it seems like maybe there is some hidden ME and it’s corrupted or something possibly?
BIOS is here - https://mega.nz/#!UGgHwQBT!lZ3mN-MIZke4H…r-ugMbg_5k38N4I
Thanks!

This is not really MCE related but rather MEA. It means that a FD was detected with (CS)ME region offset/size but the region is not present. This usually indicates that something went wrong during dumping or similar.

Sorry man, I was sleep-posting I think, thought I put this into the MEA thread. This boards BIOS are made that way I think, both BIOS are fine as he’s overwritten them with modified and programmed back the originals.
I think one BIOS just never has ME and the other always does, but it concerned me that is detected ME but unidentifiable. Dump is OK though, so it’s not corrupted dump.