News for hackers. Stuff that matters.

A comment on Disabling the Intel Management Engine.

Re:Disabling the Intel Management Engine by hilmipilmi on Wednesday October 11, 2017 @03:17AM (#15447841)
It feels reassuring that you can actually get access and read the assembly of the IME now, thanks to https://github.com/ptresearch/unME11. For instance using the the Gigabrix-BSi5ha-6200 IME Firmware update archive:

1. Download and unzip the Gigabrix-BSi5ha-6200 IME update archive (http://download.gigabyte.us/FileList/BIOS/brix_bios_bsi5-h-a...). Use F5_BIOS/image.bin from that archive.

2. Start "python unME11.py image.bin"

3. The uncompressed modules are located in image/00004000.FTPR/* after that

4. You can i.e. load image/00004000.FTPR/kernel.mod in IDA using 80486 in 32bit real-mode or use "objdump -m i386 -b binary -D kernel.mod --adjust-vma=0x80000" with entry point being 0x80000 or "objdump -m i386 -b binary -D bup.mod --adjust-vma=0x2d000" with entry point being 0x2D04C

[ Parent | on HN ]
Re:Disabling the Intel Management Engine by celeritascelery on Wednesday October 11, 2017 @10:06AM (#15449842)
Any insights from the code?
[ Parent | on HN ]
Re:Disabling the Intel Management Engine by hilmipilmi on Wednesday October 11, 2017 @02:55PM (#15452291)
I used it to look into Gigabytes response to Intel SA 00075 described in https://embedi.com/files/presentations/BH-Las-Vegas-2017-Int....

before: http://download.gigabyte.us/FileList/BIOS/brix_bios_bsi5ha(a...

after: http://download.gigabyte.us/FileList/BIOS/brix_bios_bsi5ha(a...

You can see that there is an extra function call added that tests for response.length.

Given the easy availability of the assembler dump you can expect progress towards demystifying IME. I'm not a professional in the security field, but I sense that there is lots of possibilities by just doing a "strings image/00275000.NFTP/amt.mod". Gigabyte might be special, but they have left their assert prints in the code and you can get a sense what the thing is doing...

[ Parent | on HN ]