ME Analyzer: Intel Engine Firmware Analysis Tool Discussion

@ plutomaniac:
Thanks for the quick reply and the clear statement.
I must admit, that I didn’t know, that the ME Analyzer, which is part of the UBU tool, shows something else than the MEInfo tool, but after having run the latest MEA.exe with the command suffix -info I got clarity:

MEA Info.png

Ah no, just like UBU shows what Intel oROMs/Modules a given SPI image has, it also calles MEA which it turn shows what ME a given SPI image comes with.

Capture.PNG



When it comes to what firmware the actual system has at it’s SPI chip you can use MEA (only for firmware & driver versions) or MEInfo of course. MEA -info is just a lot faster to perform (and multi-platform) when only the firmware or driver version is what you are looking for.

Yes, my previous post was the result of an error of reasoning.
There is a big difference between the Intel ME Firmware, which is within a BIOS file, and the Intel ME Firmware, which is within the BIOS chip of the user.
Thanks again for the clarification.

Hi.

I was using your tools to see wich firmware version had and Me Analyzer shows a message to report it here.

screen.jpg

I have a Gigabyte GA-Q77M-D2H (rev. 1.0) motherboard.

By the way, can’t extract Intel ME System Tools v8.1 r7.rar. 7-zip says it can’t be opened as a compressed file.

Regards.

@ PsyduckAP:

Thank you very much for registering to let me know of this. To extract the System Tools you need WinRar 5.x or the latest version of 7-zip. Are you planning to update your firmware? Can you do me a quick small favor? At the System Tools package, go to FWUpdate folder (let’s say Windows64), open a command prompt and run FWUpdLcl64 -save ME.bin. Then attach here the ME.bin file that appeared. I am looking for people who have “corporate” systems with 5MB firmware like yours and thus the message you saw.


Ooops, old version of 7-zip.
ME.bin has 4MB size. How can I upload it?

Here it is. renamed to jpg because can’t upload .7z
Anything else before upgrading?

ME.rar (2.38 MB)

Put it into a WinRAR archive and attach it to your post.

screen.PNG


Okay, now I know my firmware (and driver) version. And now?
What benefit do I have if I update Intel ME firmware? More NSA surveillance?

@ PsyduckAP:

Thank you for the file you attached. I downloaded it with difficulty due to forum weirdness with certain filetyes so I re-packaged/attached it as a .rar archive. Check the other thread you opened for a reply regarding your update problem.

@ pustekuchencake:

Thank you for using ME Analyzer. You need to determine the platform as well to know whether you need 1.5MB or 5MB firmware. Afterwards you can proceed to update to the latest ME8 firmware which is 8.1.65.1586. The ME is practically the backbone of a modern Intel system, more info on it’s uses and “hidden” benefits at the ME thread.

ME Analyzer v1.3.13

Fixed issue that caused Multi Drop to rename wrong files
Adjusted latest ME 11.0 CON H SKU to 11.0.0.1194
Adjusted latest ME 11.0 CON LP SKU to 11.0.0.1191
Adjusted latest ME 11.0 COR H SKU to 11.0.0.1191
Adjusted latest ME 10.0 5MB SKU to 10.0.47.1006
Adjusted latest ME 9.5 1.5MB SKU to 9.5.55.1948
Adjusted latest ME 9.1 1.5MB SKU to 9.1.37.1002
Updated pre-fixed detection of ME 11.0 Firmware SKUs
Updated Engine Firmware Repository Database to r34

Engine Firmware Repository Database r34

Added ME 11.0.0.1194_CON_H_PRD_EXTR
Added ME 11.0.0.1191_CON_LP_C0_PRD_RGN
Added ME 11.0.0.1191_COR_H_PRD_RGN
Added ME 11.0.0.1183_CON_H_PRD_RGN
Added ME 11.0.0.1183_CON_LP_C0_PRD_RGN
Renamed ME 11.0.0.1169_COR_LP_C0_PRD_EXTR
Renamed ME 11.0.0.1169_CON_LP_C0_PRD_EXTR
Renamed ME 11.0.0.1165_CON_LP_C0_PRD_EXTR
Renamed ME 11.0.0.1165_COR_LP_C0_PRD_EXTR
Added ME 11.0.0.1153_COR_LP_PRE_EXTR
Added ME 11.0.0.1153_COR_LP_BYP_EXTR
Added ME 10.0.47.1006_5MB_PRD_RGN
Added ME 10.0.45.1024_5MB_PRE_RGN
Added ME 10.0.45.1024_5MB_BYP_RGN
Added ME 9.5.55.1948_1.5MB_PRD_RGN
Added ME 9.5.50.1932_1.5MB_PRD_RGN
Added ME 9.5.50.1932_1.5MB_PRE_RGN
Added ME 9.5.50.1932_5MB_PRD_RGN
Added ME 9.5.50.1932_5MB_PRE_RGN
Added ME 9.1.37.1002_1.5MB_PRD_EXTR
Added ME 9.1.32.1002_1.5MB_PRD_RGN
Removed ME 9.1.32.1002_1.5MB_PRD_EXTR
Added ME 9.1.32.1002_1.5MB_PRE_RGN
Added ME 8.1.65.1586_1.5MB_PRE_RGN
Added ME 8.1.65.1586_5MB_PRE_RGN

ME Analyzer v1.4.0

Capture.PNG



Added ME 11.0 Skylake unknown SKU suggestions based on Kernel & FIT
Added ME 11.0 Skylake Kernel/FIT SKU analysis forced display (-dker to view)
Major TXE overhaul at SKU, Platform, Rare Firmware checking
Added obligatory checks that the DB & UEFIFind files exist
Added additional ME 4 ROM-Bypass SKU firmware support
Added simplistic ME3 ASF & QST SKU ROMB UPD detection
Added detection of known Intel Engine EFI GUIDs
Added Extractor support for unknown TXE SKUs
Added very early AMD PSP firmware detection
Added option to hide the temporary 5MB/Corporate note for UPD samples (-updn)
Improved SKU detection across the board (ME 2-10, TXE 1-2, SPS 1-3)
Moved all latest firmware version checks from MEA to DB
Moved all ME11 hash-based SKU detection from MEA to DB
Moved all TXE hash-based validation checks from MEA to DB
Fixed issue that caused detection of old ME 11.0 PRE firmware as PRD
Fixed issue that caused wrong detection of ME4 & ME6 IGN RGN images as EXTR
Fixed rare issue that caused MEA to scan the wrong SKU at ME 2 - ME 6 UPD images
Fixed issue that did not show the relevant ME 11.0 Kernel DB entries under some circumstances
Updated Engine Firmware Repository Database to r35

Engine Firmware Repository Database r35

Latest ME 11.0 COR H SKU to 11.0.0.1194
Latest ME 11.0 CON LP SKU to 11.0.0.1194
Latest ME 11.0 COR LP SKU to 11.0.0.1194
Latest ME 5 AMT Pro SKU to 5.2.71.1048
Latest TXE 2.0 1.375MB SKU to 2.0.2.3094
Added ME 11.0.0.1194_COR_H_XX_PRD_EXTR
Added ME 11.0.0.1194_CON_LP_XX_PRD_RGN
Added ME 11.0.0.1194_COR_LP_XX_PRD_RGN
Added ME 11.0.0.1183_COR_H_XX_PRD_RGN
Added ME 11.0.0.1183_COR_LP_C0_PRD_RGN
Added ME 11.0.0.1177_COR_H_D0_PRD_EXTR
Renamed ME 11.0.0.1133_COR_H_XX_PRE_EXTR
Renamed ME 11.0.0.1115_CON_H_XX_BYP_EXTR
Added ME 9.0.0.1308_5MB_PRD_EXTR
Added ME 7.1.30.1142_5MB_CPT_PRD_RGN
Removed ME 7.1.30.1142_5MB_CPT_PRD_EXTR
Added ME 7.1.30.1142_5MB_CPT_PRE_RGN
Added ME 7.1.4.1068_5MB_CPT_PRD_UPD
Added ME 7.0.10.1203_5MB_CPT_PRD_RGN
Removed ME 7.0.10.1203_5MB_CPT_PRD_EXTR
Added ME 7.0.10.1203_5MB_CPT_PRE_RGN
Added ME 7.0.10.1203_5MB_CPT_PRE_UPD
Renamed ME 6.0.21.1188_IGN_IP_PRD_EXTR
Renamed ME 6.0.20.1185_IGN_IP_PRE_EXTR
Renamed ME 6.0.20.1185_IGN_IP_PRD_EXTR
Added ME 5.2.71.1048_AMT_PRD_UPD
Added ME 5.2.70.1046_AMT_PRD_UPD
Added ME 5.2.60.1043_AMT_PRD_UPD
Added ME 4.0.0.1035_ALL_BYP_RGN
Added ME 4.0.0.1035_ALL_BYP_UPD
Renamed ME 4.2.30.1040_TPM_PRD_RGN
Renamed ME 4.2.21.1037_TPM_PRD_RGN
Renamed ME 4.2.20.1036_TPM_PRE_RGN
Renamed ME 4.2.20.1036_TPM_PRD_RGN
Renamed ME 4.2.20.1036_ALL_PRE_RGN
Renamed ME 4.2.20.1036_ALL_PRD_RGN
Renamed ME 4.2.10.1023_TPM_PRE_RGN
Renamed ME 4.2.10.1023_TPM_PRD_RGN
Renamed ME 4.0.0.1100_ALL_PRE_RGN
Renamed ME 4.0.0.1100_ALL_PRD_RGN
Added ME 3.0.9.1133_AMT_PRD_UPD
Added ME 3.0.5.1125_AMT_PRD_UPD
Added ME 3.0.4.1120_AMT_PRD_UPD
Added ME 2.1.0.1032_AMT_PRD_UPD
Added TXE 2.0.2.3094_1.375MB_PRD_RGN
Added TXE 2.0.2.2092_1.375MB_PRD_RGN
Added TXE 2.0.1.2091_1.375MB_PRD_RGN
Added TXE 2.0.0.2077_1.375MB_PRE_RGN
Added TXE 1.1.4.1145_1.375MB_IT_PRD_RGN
Added TXE 1.1.0.1089_1.375MB_IT_PRD_EXTR
Added TXE 1.0.2.1060_3MB_IT_PRD_RGN
Added SPS 03.00.07.018.0_PRD_EXTR
Added SPS 03.00.03.009.0_PRD_EXTR


???


In folder UBU\MEA only files MEA.exe and MEA.dat
Command string in UBU.bat if exist MEA MEA\MEA.exe bios.bin -ubu -adir

@ SoniX:

Fixed, please redownload.


Many Thanks! :slight_smile: UBU Update 3 upload.



ROM https://yadi.sk/d/MxaHcGQFmFcGJ

asrock b75m-gl

Thank you aragog for using MEA and for reporting your 5MB system. The new 1.4.0 version of MEA does not show that message for ME8 as I’ve already found another user with such system. But if you want, use FWUpdate tool (also attached) with the command FWUpdLcl64.exe -save me.bin and upload/attach the resulting file. I see the system language is not English (Russian I think) and since this message is also language related I’d like to see your own resulting file as well if you may.

FWUpdate v8.1.40.1456.rar (406 KB)

dumps"?" created with modded bios rom
https://yadi.sk/d/Fb5iIBXwmFfcR

Just one with any FWUpdate was enough, thank you for the file aragog.

ME Analyzer v1.4.1

Added ME 11.0 Skylake Secure Version Number (SVN) support
Fixed SPS 3 ckeck for updated firmware issue
Fixed false early detection of unknown AMD PSP firmware
Removed known Intel Engine EFI GUID search at UEFI Strip mode
Removed ME 11.0 COR and added TXE 1.2 at UPD sample note
Updated Engine Firmware Repository Database to r36

Engine Firmware Repository Database r36

Latest ME 11.0 COR H SKU to 11.0.0.1197
Latest ME 9.1 5MB SKU to 9.1.37.1002
Latest ME 6 1.5MB SKU to 6.2.50.1062
Latest SPS 4 Single SKU to 04.00.03.078.0
Added ME 11.0.0.1197_COR_H_XX_PRD_RGN
Added ME 11.0.0.1194_COR_H_D0_PRD_RGN
Removed ME 11.0.0.1194_COR_H_D0_PRD_EXTR
Renamed ME 11.0.0.1194_CON_H_D0_PRD_EXTR
Renamed ME 11.0.0.1194_COR_LP_C0_PRD_RGN
Renamed ME 11.0.0.1194_CON_LP_C0_PRD_RGN
Added ME 11.0.0.1191_COR_LP_C0_PRD_RGN
Added ME 11.0.0.1191_COR_H_D0_PRE_RGN
Added ME 11.0.0.1191_COR_LP_B1_PRE_RGN
Renamed ME 11.0.0.1191_CON_H_D0_PRD_EXTR
Renamed ME 11.0.0.1191_COR_H_D0_PRD_RGN
Renamed ME 11.0.0.1183_CON_H_D0_PRD_RGN
Renamed ME 11.0.0.1183_COR_H_D0_PRD_RGN
Added ME 9.1.37.1002_5MB_PRD_RGN
Added ME 7.1.70.1198_1.5MB_ALL_PRD_UPD
Added ME 6.2.50.1062_1.5MB_PRD_UPD
Added ME 6.2.40.1045_1.5MB_PRD_UPD
Added ME 6.2.30.1040_1.5MB_PRD_UPD
Added ME 6.2.20.1035_1.5MB_PRD_UPD
Added ME 6.2.0.1022_1.5MB_PRD_UPD
Added ME 6.1.10.1052_1.5MB_PRD_UPD
Added ME 6.0.31.1208_1.5MB_PRD_UPD
Added SPS 04.00.03.078.0_PRD_EXTR
Added SPS 03.01.02.005.0_PRD_EXTR

CSE Firmware Repository Database r37

Added ME 11.0.0.1194_CON_H_D0_PRD_RGN
Removed ME 11.0.0.1194_CON_H_D0_PRD_EXTR
Added ME 10.0.25.1048_5MB_PRD_RGN
Removed ME 10.0.25.1048_5MB_PRD_EXTR
Added ME 9.5.10.1652_5MB_PRD_RGN
Added ME 9.0.12.1397_5MB_PRD_RGN
Added ME 9.0.1.1333_5MB_PRD_RGN
Removed ME 9.0.1.1333_5MB_PRD_EXTR
Added ME 7.1.51.1177_5MB_ALL_PRD_UPD
Added ME 7.1.31.1147_5MB_CPT_PRD_UPD
Added ME 6.2.30.1040_5MB_DT_PRD_UPD
Added ME 6.2.0.1022_5MB_DT_PRD_UPD
Added ME 6.1.10.1052_5MB_DT_PRD_UPD
Added ME 6.1.0.1042_5MB_MB_PRD_UPD
Added ME 6.1.0.1042_1.5MB_PRD_EXTR
Added ME 6.0.4.1205_5MB_MB_PRD_UPD
Added ME 6.0.3.7143_5MB_MB_PRE_UPD
Added ME 6.0.3.1195_5MB_DT_PRD_UPD
Added ME 6.0.2.1194_5MB_MB_PRD_UPD
Added ME 6.0.2.1194_5MB_MB_PRD_EXTR
Added ME 6.0.2.1194_1.5MB_PRD_UPD
Added ME 4.2.40.1048_AMT_PRD_UPD
Added ME 4.2.30.1040_AMT_PRD_UPD
Added ME 4.2.20.1036_AMT_PRD_UPD
Added ME 4.1.10.1046_AMT_PRD_UPD
Added ME 4.0.12.1147_AMT_PRD_UPD
Added ME 4.0.3.1146_AMT_PRD_UPD
Added ME 4.0.3.1124_AMT_PRD_UPD
Added ME 4.0.1.1108_AMT_PRD_UPD
Added TXE 1.1.3.1133_1.375MB_MD_PRD_RGN
Removed TXE 1.1.3.1133_1.375MB_MD_PRD_EXTR