ME Analyzer: Intel Engine Firmware Analysis Tool Discussion

Thank you for the report, I saw it a few days ago and it has been added in the next MEA database. As for the issue, there is already a specific thread and any help from someone interested will be posted there.

118903987CONH.png



In BIOS update, hidden inside sp136320 from hp ftp

086FB.RAR (5.55 MB)

╔═══════════════════════════════════════════╗
β•‘ ME Analyzer v1.270.0 r270 β•‘
β•šβ•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•

Error: ME Analyzer v1.270.0 crashed, please report the following:

Traceback (most recent call last):
File β€œMEA.py”, line 12992, in <module>
elif sku_bytes in (0x60A0,0x004D,0x9C64) : pos_sku_ker = β€˜LP’ # 0x004D,0x9C64 for 11.0.0.1100,11.0.0.1109
File β€œMEA.py”, line 6061, in ext_anl
TypeError: argument of type β€˜NoneType’ is not iterable

File/ME dump from [Request] Dell Precision 5510 BIOS flash using CH341 Seems a little unclear if it’s a valid dump

FIT (from r44) doesn’t open this dump either but gives unspecific error

╔═══════════════════════════════════════════╗
β•‘ ME Analyzer v1.270.0 r270 β•‘
β•šβ•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•
╔═════════════════════════════════════════════════════════════════════════════╗
β•‘ Flash Partition Table β•‘
β•Ÿβ”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β•’
β•‘ Name β”‚ Owner β”‚ Start β”‚ Size β”‚ End β”‚ Type β”‚ ID β”‚ Valid β”‚ Empty β•‘
β•Ÿβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β•’
β•‘ FTPR β”‚ β”‚ 0x004000 β”‚ 0x12F000 β”‚ 0x133000 β”‚ Code β”‚ 0001 β”‚ True β”‚ False β•‘
β•Ÿβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β•’
β•‘ FTUP β”‚ β”‚ 0x275000 β”‚ 0x38E000 β”‚ 0x603000 β”‚ Code β”‚ 0001 β”‚ True β”‚ False β•‘
β•Ÿβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β•’
β•‘ DLMP β”‚ β”‚ β”‚ β”‚ β”‚ Code β”‚ 0000 β”‚ False β”‚ True β•‘
β•Ÿβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β•’
β•‘ PSVN β”‚ β”‚ 0x003E00 β”‚ 0x000200 β”‚ 0x004000 β”‚ Data β”‚ 0000 β”‚ True β”‚ False β•‘
β•Ÿβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β•’
β•‘ IVBP β”‚ β”‚ 0x271000 β”‚ 0x004000 β”‚ 0x275000 β”‚ Data β”‚ 0000 β”‚ True β”‚ False β•‘
β•Ÿβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β•’
β•‘ MFS β”‚ β”‚ 0x133000 β”‚ 0x13E000 β”‚ 0x271000 β”‚ Data β”‚ 0000 β”‚ True β”‚ False β•‘
β•Ÿβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β•’
β•‘ NFTP β”‚ β”‚ 0x275000 β”‚ 0x30B000 β”‚ 0x580000 β”‚ Code β”‚ 0001 β”‚ True β”‚ False β•‘
β•Ÿβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β•’
β•‘ ROMB β”‚ β”‚ β”‚ β”‚ β”‚ Code β”‚ 0000 β”‚ False β”‚ True β•‘
β•Ÿβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β•’
β•‘ WCOD β”‚ β”‚ 0x580000 β”‚ 0x080000 β”‚ 0x600000 β”‚ Code β”‚ 24F3 β”‚ True β”‚ False β•‘
β•Ÿβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β•’
β•‘ LOCL β”‚ β”‚ 0x600000 β”‚ 0x003000 β”‚ 0x603000 β”‚ Code β”‚ 0001 β”‚ True β”‚ False β•‘
β•Ÿβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β•’
β•‘ FLOG β”‚ β”‚ 0x603000 β”‚ 0x001000 β”‚ 0x604000 β”‚ Data β”‚ 0000 β”‚ True β”‚ False β•‘
β•Ÿβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β•’
β•‘ UTOK β”‚ β”‚ 0x604000 β”‚ 0x002000 β”‚ 0x606000 β”‚ Data β”‚ 0000 β”‚ True β”‚ True β•‘
β•Ÿβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β”Όβ”€β”€β”€β”€β”€β”€β”€β•’
β•‘ ISHC β”‚ β”‚ β”‚ β”‚ β”‚ Code β”‚ 0000 β”‚ False β”‚ True β•‘
β•šβ•β•β•β•β•β•β•§β•β•β•β•β•β•β•β•§β•β•β•β•β•β•β•β•β•β•β•§β•β•β•β•β•β•β•β•β•β•β•§β•β•β•β•β•β•β•β•β•β•β•§β•β•β•β•β•β•β•§β•β•β•β•β•β•β•§β•β•β•β•β•β•β•β•§β•β•β•β•β•β•β•β•


Error: ME Analyzer v1.270.0 crashed, please report the following:

Traceback (most recent call last):
File β€œMEA.py”, line 12992, in <module>
elif sku_bytes in (0x60A0,0x004D,0x9C64) : pos_sku_ker = β€˜LP’ # 0x004D,0x9C64 for 11.0.0.1100,11.0.0.1109
File β€œMEA.py”, line 6061, in ext_anl
TypeError: argument of type β€˜NoneType’ is not iterable
The text you entered is too long (max. 65.500 chars).

Error: ME Analyzer v1.270.0 crashed, please report the following:

Traceback (most recent call last):
File β€œMEA.py”, line 12978, in <module>
File β€œMEA.py”, line 5517, in cse_unpack
with open(bpdt_fname + β€˜.json’, β€˜a’, encoding = β€˜utf-8’) as bpdt_file :
File β€œMEA.py”, line 7924, in mfs_anl
col_y + β€˜Group ID’ + col_e, col_y + β€˜Unknown Access’ + col_e, col_y + β€˜Unknown Options’ + col_e, col_y + β€˜HMAC MD5’ + col_e, col_y + β€˜AES-GCM Nonce’ + col_e,
File β€œMEA.py”, line 8165, in mfs_home_anl
# Initialize Integrity related variables
File β€œMEA.py”, line 8165, in mfs_home_anl
# Initialize Integrity related variables
File β€œMEA.py”, line 8021, in mfs_home_anl
if file_index == 8 and file_name == β€˜.’ : # MFS Low Level File 8 at Current (.) directory
UnicodeDecodeError: β€˜utf-8’ codec can’t decode byte 0xff in position 0: invalid start byte

Yeah, it must be badly corrupt based on that output. So not an issue with MEA or FIT.

Confirmed, 4 "backups", all 4 different, 3 crash MEA, one is readable.

Hello,

is it possible to dump a BIOS EEPROM using a programmer, and then analyze the dump-file with ME Analyzer? Or is a "stock" Rom from the motherboard vendor necessary?

BR,
Lebedev

I just tried it. I made a dump of the BIOS EEPROM using a ch341a_spi programmer.
I dropped the file into ME Analyer, and got this result:



It’s an Atom based C2xxx Plattform, so it should have a (CS)SPS…

If it says that, the dump does not contain Engine firmware. Maybe bad/wrong/incomplete dump. Check it manually with a hex editor first.

I am pretty sure, the dump is valid and intact. I made 3 separate dumps (re-attached the SOIC-clamp every time). All 3 dumps have the same hash value. The EEPROM chip was known by flashrom. The validation of flashrom was also successful every time.

Is there a guide on howto check the file with a hex editor? What do i have to look for?
Maybe use UEFITool to see if there’s a ME area?

I am able to open the dump using UEFITool. I can browse everything, see all modules, drivers, etc.
But there’s no ME Region, like in other Bios files. Looks like that Bios indeed has no Management Engine.

Post a link to/attach the file.

original_dump.bin sha256: 69f9646b87a141474296df6dd92063b11b32e410e2152e5faf87a10b0782e260

Complete firmware, but empty pad where ME should be and almost empty FD:

1.jpg

Nice! I’m glad, i don’t have that shitty thing in my firewall.
What is β€œFD”?

@ plutomaniac ME Analyzer v1.274.0 r277 not working on windows 7 x86 x64.
even latest dell pfs extractor version 4.9 above not working.
while previous version of dell pfs extractor from 4.9 working ok.
me analyzer v1220 .0 DB r265 working ok.
i change latest DB version DB r286 with v1220 .0 DB r265
now its showing v1220 .0 DB r286 & working ok with old bios but not with latest bios.
when i try to use v1.274.0 r277 not working with DBr286 too.
i am uploading .exe bios of dell inspiron 7506 for checking.
please check on windows 7 x86 or x64 plateform for batter understang.
i reformate pc windows with latest iso & install .net latest version with paython 3.7 with all coloroma & plt tables …but not successed.
please check dell exe latest bios here
https://www.dell.com/support/home/en-in/drivers/driversdetails?driverid=ncw6p&oscode=wt64a&productcode=inspiron-15-7506-2-in-1-laptop

@earth007 here u go Inspiron_7506_1.13.0.exe_extracted.rar - Google Drive

@Koekieezz i do not need its extracted files. i said in my previous post that me analyzer & dell pfs extractor latest version do not support windows 7 x64 or x86 os while its previous version done.
but with win 10 its working okay.
so need support to run these softwares on windows 7.

You got the same error with missing DLL ?

Read C2 (GitHub - platomav/MEAnalyzer: Intel Engine & Graphics Firmware Analysis Tool)