<p>Nicola Corna has uploaded this change for <strong>review</strong>.</p><p><a href="https://review.coreboot.org/25506">View Change</a></p><pre style="font-family: monospace,monospace; white-space: pre-wrap;">util/me_cleaner: Update to v1.2<br><br>Changelog:<br> * Add support for the HAP/AltMeDisable bit<br> * Add support for selective partition removal<br> * Fix the ME permission removal on gen. 3<br> * Add public key match<br> * Print the compressed size of the Huffman modules on gen. 2<br> * Wipe the ME6 Ignition firmware images<br> * Fix the removal of the last partition on ME6<br> * Various region size fixes<br> * Add manpage<br> * Add setup.py<br> * Print the value of the HAP/AltMeDisable bit<br><br>Change-Id: I3d5e0d9af0a36cc7476a964cf753914c2f3df9d2<br>Signed-off-by: Nicola Corna <nicola@corna.info><br>---<br>M util/me_cleaner/README.md<br>A util/me_cleaner/man/me_cleaner.1<br>M util/me_cleaner/me_cleaner.py<br>A util/me_cleaner/setup.py<br>4 files changed, 626 insertions(+), 216 deletions(-)<br><br></pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;">git pull ssh://review.coreboot.org:29418/coreboot refs/changes/06/25506/1</pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;"><span>diff --git a/util/me_cleaner/README.md b/util/me_cleaner/README.md</span><br><span>index 72c1598..5723e85 100644</span><br><span>--- a/util/me_cleaner/README.md</span><br><span>+++ b/util/me_cleaner/README.md</span><br><span>@@ -1,44 +1,86 @@</span><br><span style="color: hsl(0, 100%, 40%);">-# me_cleaner</span><br><span style="color: hsl(120, 100%, 40%);">+# me\_cleaner</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">-Intel ME is a coprocessor integrated in all post-2006 Intel boards, for which</span><br><span style="color: hsl(0, 100%, 40%);">-this [Libreboot page](https://libreboot.org/faq.html#intelme) has an excellent</span><br><span style="color: hsl(0, 100%, 40%);">-description. The main component of Intel ME is Intel AMT, and I suggest you to</span><br><span style="color: hsl(0, 100%, 40%);">-read [this Wikipedia page](https://en.wikipedia.org/wiki/Intel_Active_Management_Technology)</span><br><span style="color: hsl(0, 100%, 40%);">-for more information about it. In short, Intel ME is an irremovable environment</span><br><span style="color: hsl(0, 100%, 40%);">-with an obscure signed proprietary firmware, with full network and memory</span><br><span style="color: hsl(0, 100%, 40%);">-access, which poses a serious security threat.</span><br><span style="color: hsl(0, 100%, 40%);">-Even when disabled from the BIOS settings, Intel ME is active: the only way to</span><br><span style="color: hsl(0, 100%, 40%);">-be sure it is disabled is to remove its firmware from the flash chip.</span><br><span style="color: hsl(120, 100%, 40%);">+_me\_cleaner_ is a Python script able to modify an Intel ME firmware image with</span><br><span style="color: hsl(120, 100%, 40%);">+the final purpose of reducing its ability to interact with the system.</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+## Intel ME</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+Intel ME is a co-processor integrated in all post-2006 Intel boards, which is</span><br><span style="color: hsl(120, 100%, 40%);">+the base hardware for many Intel features like Intel AMT, Intel Boot Guard,</span><br><span style="color: hsl(120, 100%, 40%);">+Intel PAVP and many others. To provide such features, it requires full access to</span><br><span style="color: hsl(120, 100%, 40%);">+the system, including memory (through DMA) and network access (transparent to</span><br><span style="color: hsl(120, 100%, 40%);">+the user).</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+Unlike many other firmware components, the Intel ME firmware can't be neither</span><br><span style="color: hsl(120, 100%, 40%);">+disabled nor reimplemented, as it is tightly integrated in the boot process and</span><br><span style="color: hsl(120, 100%, 40%);">+it is signed.</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+This poses an issue both to the free firmware implementations like [coreboot](</span><br><span style="color: hsl(120, 100%, 40%);">+https://www.coreboot.org/), which are forced to rely on a proprietary, obscure</span><br><span style="color: hsl(120, 100%, 40%);">+and always-on blob, and to the privacy-aware users, who are reasonably worried</span><br><span style="color: hsl(120, 100%, 40%);">+about such firmware, running on the lowest privilege ring on x86.</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+## What can be done</span><br><span> </span><br><span> Before Nehalem (ME version 6, 2008/2009) the ME firmware could be removed</span><br><span> completely from the flash chip by setting a couple of bits inside the flash</span><br><span style="color: hsl(0, 100%, 40%);">-descriptor, without the need to reverse-engineer the ME firmware.</span><br><span style="color: hsl(120, 100%, 40%);">+descriptor, effectively disabling it.</span><br><span> </span><br><span> Starting from Nehalem the Intel ME firmware can't be removed anymore: without a</span><br><span style="color: hsl(0, 100%, 40%);">-valid firmware the PC shuts off forcefully after 30 minutes. This project is an</span><br><span style="color: hsl(0, 100%, 40%);">-attempt to remove as much code as possible from such firmware without falling</span><br><span style="color: hsl(0, 100%, 40%);">-into the 30 minutes recovery mode.</span><br><span style="color: hsl(120, 100%, 40%);">+valid firmware the PC shuts off forcefully after 30 minutes, probably as an</span><br><span style="color: hsl(120, 100%, 40%);">+attempt to enforce the Intel Anti-Theft policies.</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">-me_cleaner currently works on most architectures, see [me_cleaner status](https://github.com/corna/me_cleaner/wiki/me_cleaner-status) (or [its discussion](https://github.com/corna/me_cleaner/issues/3))</span><br><span style="color: hsl(0, 100%, 40%);">-for more info about them. me_cleaner works also on the TXE and SPS firmware.</span><br><span style="color: hsl(120, 100%, 40%);">+However, while Intel ME can't be turned off completely, it is still possible to</span><br><span style="color: hsl(120, 100%, 40%);">+modify its firmware up to a point where Intel ME is active only during the boot</span><br><span style="color: hsl(120, 100%, 40%);">+process, effectively disabling it during the normal operation, which is what</span><br><span style="color: hsl(120, 100%, 40%);">+_me\_cleaner_ tries to accomplish.</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">-If you want to understand how me_cleaner works, you can read the ["How does it work?" page](https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F).</span><br><span style="color: hsl(120, 100%, 40%);">+## Platform support</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">-If you want to apply me_cleaner on your platform I suggest you to read the</span><br><span style="color: hsl(0, 100%, 40%);">-["How does it work?" page](https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F)</span><br><span style="color: hsl(0, 100%, 40%);">-and then follow the guide ["How to apply me_cleaner"](https://github.com/corna/me_cleaner/wiki/How-to-apply-me_cleaner).</span><br><span style="color: hsl(120, 100%, 40%);">+_me\_cleaner_ currently works on [most of the Intel platforms](</span><br><span style="color: hsl(120, 100%, 40%);">+https://github.com/corna/me_cleaner/wiki/me_cleaner-status); while this doesn't</span><br><span style="color: hsl(120, 100%, 40%);">+mean it works on all the boards (due to the different firmware implementations),</span><br><span style="color: hsl(120, 100%, 40%);">+it has been proven quite reliable on a great number of them.</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+## Usage</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+_me\_cleaner_ should handle all the steps necessary to the modification of an</span><br><span style="color: hsl(120, 100%, 40%);">+Intel ME firmware with the command:</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ $ python me_cleaner.py -S -O modified_image.bin original_dump.bin</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+However, obtaining the original firmware and flashing back the modified one is</span><br><span style="color: hsl(120, 100%, 40%);">+usually not trivial, as the Intel ME firmware region is often non-writable from</span><br><span style="color: hsl(120, 100%, 40%);">+the OS (and it's not a safe option anyways), requiring the use of an external</span><br><span style="color: hsl(120, 100%, 40%);">+SPI programmer.</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+## Results</span><br><span> </span><br><span> For pre-Skylake firmware (ME version < 11) this tool removes almost everything,</span><br><span style="color: hsl(0, 100%, 40%);">-leaving only the two fundamental modules needed for the correct boot, ROMP and</span><br><span style="color: hsl(0, 100%, 40%);">-BUP. The code size is reduced from 1.5 MB (non-AMT firmware) or 5 MB (AMT</span><br><span style="color: hsl(120, 100%, 40%);">+leaving only the two fundamental modules needed for the correct boot, `ROMP` and</span><br><span style="color: hsl(120, 100%, 40%);">+`BUP`. The code size is reduced from 1.5 MB (non-AMT firmware) or 5 MB (AMT</span><br><span> firmware) to ~90 kB of compressed code.</span><br><span> </span><br><span> Starting from Skylake (ME version >= 11) the ME subsystem and the firmware</span><br><span style="color: hsl(0, 100%, 40%);">-structure have changed, requiring substantial changes in me_cleaner.</span><br><span style="color: hsl(0, 100%, 40%);">-The fundamental modules required for the correct boot are now four (rbe, kernel,</span><br><span style="color: hsl(0, 100%, 40%);">-syslib and bup) and the minimum code size is ~300 kB of compressed code (from</span><br><span style="color: hsl(0, 100%, 40%);">-the 2 MB of the non-AMT firmware and the 7 MB of the AMT one).</span><br><span style="color: hsl(120, 100%, 40%);">+structure have changed, requiring substantial changes in _me\_cleaner_.</span><br><span style="color: hsl(120, 100%, 40%);">+The fundamental modules required for the correct boot are now four (`rbe`, </span><br><span style="color: hsl(120, 100%, 40%);">+`kernel`, `syslib` and `bup`) and the minimum code size is ~300 kB of compressed</span><br><span style="color: hsl(120, 100%, 40%);">+code (from the 2 MB of the non-AMT firmware and the 7 MB of the AMT one).</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">-This project is based on the work of the community; in particular I thank Igor</span><br><span style="color: hsl(0, 100%, 40%);">-Skochinsky, for the core information about Intel ME and its firmware structure,</span><br><span style="color: hsl(0, 100%, 40%);">-and Federico Amedeo Izzo, for its help during the study of Intel ME.</span><br><span style="color: hsl(120, 100%, 40%);">+On some boards the OEM firmware fails to boot without a valid Intel ME firmware;</span><br><span style="color: hsl(120, 100%, 40%);">+in the other cases the system should work with minor inconveniences (like longer</span><br><span style="color: hsl(120, 100%, 40%);">+boot times or warning messages) or without issues at all.</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+Obviously, the features provided by Intel ME won't be functional anymore after</span><br><span style="color: hsl(120, 100%, 40%);">+the modifications.</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+## Documentation</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+The detailed documentation about the working of _me\_cleaner_ can be found on</span><br><span style="color: hsl(120, 100%, 40%);">+the page ["How does it work?" page](</span><br><span style="color: hsl(120, 100%, 40%);">+https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F).</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+Various guides and tutorials are available on the Internet, however a good</span><br><span style="color: hsl(120, 100%, 40%);">+starting point is the ["How to apply me_cleaner" guide](</span><br><span style="color: hsl(120, 100%, 40%);">+https://github.com/corna/me_cleaner/wiki/How-to-apply-me_cleaner).</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span>diff --git a/util/me_cleaner/man/me_cleaner.1 b/util/me_cleaner/man/me_cleaner.1</span><br><span>new file mode 100644</span><br><span>index 0000000..a7a90d8</span><br><span>--- /dev/null</span><br><span>+++ b/util/me_cleaner/man/me_cleaner.1</span><br><span>@@ -0,0 +1,159 @@</span><br><span style="color: hsl(120, 100%, 40%);">+.TH me_cleaner 1 "MARCH 2018"</span><br><span style="color: hsl(120, 100%, 40%);">+.SH me_cleaner</span><br><span style="color: hsl(120, 100%, 40%);">+.PP</span><br><span style="color: hsl(120, 100%, 40%);">+me_cleaner \- Tool for partial deblobbing of Intel ME/TXE firmware images </span><br><span style="color: hsl(120, 100%, 40%);">+.SH SYNOPSIS</span><br><span style="color: hsl(120, 100%, 40%);">+.PP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fCme_cleaner.py\fR [\-h] [\-v] [\-O output_file] [\-S | \-s] [\-r] [\-k]</span><br><span style="color: hsl(120, 100%, 40%);">+[\-w whitelist | \-b blacklist] [\-d] [\-t] [\-c] [\-D output_descriptor]</span><br><span style="color: hsl(120, 100%, 40%);">+[\-M output_me_image] \fIfile\fP</span><br><span style="color: hsl(120, 100%, 40%);">+.SH DESCRIPTION</span><br><span style="color: hsl(120, 100%, 40%);">+.PP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fCme_cleaner\fR is a tool able to disable parts of Intel ME/TXE by:</span><br><span style="color: hsl(120, 100%, 40%);">+.RS</span><br><span style="color: hsl(120, 100%, 40%);">+.IP \(bu 2</span><br><span style="color: hsl(120, 100%, 40%);">+removing most of the code from its firmware</span><br><span style="color: hsl(120, 100%, 40%);">+.IP \(bu 2</span><br><span style="color: hsl(120, 100%, 40%);">+setting a special bit to force it to disable itself after the hardware</span><br><span style="color: hsl(120, 100%, 40%);">+initialization</span><br><span style="color: hsl(120, 100%, 40%);">+.RE</span><br><span style="color: hsl(120, 100%, 40%);">+.PP</span><br><span style="color: hsl(120, 100%, 40%);">+Using both the modes seems to be the most reliable way on many platforms.</span><br><span style="color: hsl(120, 100%, 40%);">+.PP</span><br><span style="color: hsl(120, 100%, 40%);">+The resulting modified firmware needs to be flashed (in most of the cases) with</span><br><span style="color: hsl(120, 100%, 40%);">+an external programmer, often a dedicated SPI programmer or a Linux board with</span><br><span style="color: hsl(120, 100%, 40%);">+a SPI master interface.</span><br><span style="color: hsl(120, 100%, 40%);">+.PP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fCme_cleaner\fR works at least from Nehalem to Coffee Lake (for Intel ME) and on</span><br><span style="color: hsl(120, 100%, 40%);">+Braswell/Cherry Trail (for Intel TXE), but may work as well on newer or</span><br><span style="color: hsl(120, 100%, 40%);">+different architectures.</span><br><span style="color: hsl(120, 100%, 40%);">+.PP</span><br><span style="color: hsl(120, 100%, 40%);">+While \fB\fCme_cleaner\fR have been tested on a great number of platforms, fiddling</span><br><span style="color: hsl(120, 100%, 40%);">+with the Intel ME/TXE firmware is \fIvery dangerous\fP and can easily lead to a</span><br><span style="color: hsl(120, 100%, 40%);">+dead PC.</span><br><span style="color: hsl(120, 100%, 40%);">+.PP</span><br><span style="color: hsl(120, 100%, 40%);">+\fIYOU HAVE BEEN WARNED.\fP</span><br><span style="color: hsl(120, 100%, 40%);">+.SH POSITIONAL ARGUMENTS</span><br><span style="color: hsl(120, 100%, 40%);">+.TP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fCfile\fR</span><br><span style="color: hsl(120, 100%, 40%);">+ME/TXE image or full dump.</span><br><span style="color: hsl(120, 100%, 40%);">+.SH OPTIONAL ARGUMENTS</span><br><span style="color: hsl(120, 100%, 40%);">+.TP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fC\-h\fR, \fB\fC\-\-help\fR</span><br><span style="color: hsl(120, 100%, 40%);">+Show the help message and exit.</span><br><span style="color: hsl(120, 100%, 40%);">+.TP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fC\-v\fR, \fB\fC\-\-version\fR</span><br><span style="color: hsl(120, 100%, 40%);">+Show program's version number and exit.</span><br><span style="color: hsl(120, 100%, 40%);">+.TP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fC\-O\fR, \fB\fC\-\-output\fR</span><br><span style="color: hsl(120, 100%, 40%);">+Save the modified image in a separate file, instead of modifying the</span><br><span style="color: hsl(120, 100%, 40%);">+original file.</span><br><span style="color: hsl(120, 100%, 40%);">+.TP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fC\-S\fR, \fB\fC\-\-soft\-disable\fR</span><br><span style="color: hsl(120, 100%, 40%);">+In addition to the usual operations on the ME/TXE firmware, set the</span><br><span style="color: hsl(120, 100%, 40%);">+MeAltDisable bit or the HAP bit to ask Intel ME/TXE to disable itself after</span><br><span style="color: hsl(120, 100%, 40%);">+the hardware initialization (requires a full dump).</span><br><span style="color: hsl(120, 100%, 40%);">+.TP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fC\-s\fR, \fB\fC\-\-soft\-disable\-only\fR</span><br><span style="color: hsl(120, 100%, 40%);">+Instead of the usual operations on the ME/TXE firmware, just set the</span><br><span style="color: hsl(120, 100%, 40%);">+MeAltDisable bit or the HAP bit to ask Intel ME/TXE to disable itself after</span><br><span style="color: hsl(120, 100%, 40%);">+the hardware initialization (requires a full dump).</span><br><span style="color: hsl(120, 100%, 40%);">+.TP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fC\-r\fR, \fB\fC\-\-relocate\fR</span><br><span style="color: hsl(120, 100%, 40%);">+Relocate the FTPR partition to the top of the ME region to save even more</span><br><span style="color: hsl(120, 100%, 40%);">+space.</span><br><span style="color: hsl(120, 100%, 40%);">+.TP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fC\-t\fR, \fB\fC\-\-truncate\fR</span><br><span style="color: hsl(120, 100%, 40%);">+Truncate the empty part of the firmware (requires a separated ME/TXE image or</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fC\-\-extract\-me\fR).</span><br><span style="color: hsl(120, 100%, 40%);">+.TP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fC\-k\fR, \fB\fC\-\-keep\-modules\fR</span><br><span style="color: hsl(120, 100%, 40%);">+Don't remove the FTPR modules, even when possible.</span><br><span style="color: hsl(120, 100%, 40%);">+.TP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fC\-w\fR, \fB\fC\-\-whitelist\fR</span><br><span style="color: hsl(120, 100%, 40%);">+Comma separated list of additional partitions to keep in the final image.</span><br><span style="color: hsl(120, 100%, 40%);">+This can be used to specify the MFS partition for example, which stores PCIe</span><br><span style="color: hsl(120, 100%, 40%);">+and clock settings.</span><br><span style="color: hsl(120, 100%, 40%);">+.TP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fC\-b\fR, \fB\fC\-\-blacklist\fR</span><br><span style="color: hsl(120, 100%, 40%);">+Comma separated list of partitions to remove from the image. This option</span><br><span style="color: hsl(120, 100%, 40%);">+overrides the default removal list.</span><br><span style="color: hsl(120, 100%, 40%);">+.TP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fC\-d\fR, \fB\fC\-\-descriptor\fR</span><br><span style="color: hsl(120, 100%, 40%);">+Remove the ME/TXE Read/Write permissions to the other regions on the flash</span><br><span style="color: hsl(120, 100%, 40%);">+from the Intel Flash Descriptor (requires a full dump).</span><br><span style="color: hsl(120, 100%, 40%);">+.TP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fC\-D\fR, \fB\fC\-\-extract\-descriptor\fR</span><br><span style="color: hsl(120, 100%, 40%);">+Extract the flash descriptor from a full dump; when used with \fB\fC\-\-truncate\fR</span><br><span style="color: hsl(120, 100%, 40%);">+save a descriptor with adjusted regions start and end.</span><br><span style="color: hsl(120, 100%, 40%);">+.TP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fC\-M\fR, \fB\fC\-\-extract\-me\fR</span><br><span style="color: hsl(120, 100%, 40%);">+Extract the ME firmware from a full dump; when used with \fB\fC\-\-truncate\fR save a</span><br><span style="color: hsl(120, 100%, 40%);">+truncated ME/TXE image.</span><br><span style="color: hsl(120, 100%, 40%);">+.TP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fC\-c\fR, \fB\fC\-\-check\fR</span><br><span style="color: hsl(120, 100%, 40%);">+Verify the integrity of the fundamental parts of the firmware and exit.</span><br><span style="color: hsl(120, 100%, 40%);">+.SH SUPPORTED PLATFORMS</span><br><span style="color: hsl(120, 100%, 40%);">+.PP</span><br><span style="color: hsl(120, 100%, 40%);">+Currently \fB\fCme_cleaner\fR has been tested on the following platforms:</span><br><span style="color: hsl(120, 100%, 40%);">+.TS</span><br><span style="color: hsl(120, 100%, 40%);">+allbox;</span><br><span style="color: hsl(120, 100%, 40%);">+cb cb cb cb</span><br><span style="color: hsl(120, 100%, 40%);">+c c c c</span><br><span style="color: hsl(120, 100%, 40%);">+c c c c</span><br><span style="color: hsl(120, 100%, 40%);">+c c c c</span><br><span style="color: hsl(120, 100%, 40%);">+c c c c</span><br><span style="color: hsl(120, 100%, 40%);">+c c c c</span><br><span style="color: hsl(120, 100%, 40%);">+c c c c</span><br><span style="color: hsl(120, 100%, 40%);">+c c c c</span><br><span style="color: hsl(120, 100%, 40%);">+c c c c</span><br><span style="color: hsl(120, 100%, 40%);">+.</span><br><span style="color: hsl(120, 100%, 40%);">+PCH CPU ME SKU</span><br><span style="color: hsl(120, 100%, 40%);">+Ibex Peak * Nehalem/Westmere 6.0 Ignition</span><br><span style="color: hsl(120, 100%, 40%);">+Ibex Peak * Nehalem/Westmere 6.x 1.5/5 MB</span><br><span style="color: hsl(120, 100%, 40%);">+Cougar Point Sandy Bridge 7.x 1.5/5 MB</span><br><span style="color: hsl(120, 100%, 40%);">+Panther Point Ivy Bridge 8.x 1.5/5 MB</span><br><span style="color: hsl(120, 100%, 40%);">+Lynx/Wildcat Point Haswell/Broadwell 9.x 1.5/5 MB</span><br><span style="color: hsl(120, 100%, 40%);">+Wildcat Point LP Broadwell Mobile 10.0 1.5/5 MB</span><br><span style="color: hsl(120, 100%, 40%);">+Sunrise Point Skylake/Kabylake 11.x CON/COR</span><br><span style="color: hsl(120, 100%, 40%);">+Union Point Kabylake 11.x CON/COR</span><br><span style="color: hsl(120, 100%, 40%);">+.TE</span><br><span style="color: hsl(120, 100%, 40%);">+.TS</span><br><span style="color: hsl(120, 100%, 40%);">+allbox;</span><br><span style="color: hsl(120, 100%, 40%);">+cb cb cb</span><br><span style="color: hsl(120, 100%, 40%);">+c c c</span><br><span style="color: hsl(120, 100%, 40%);">+.</span><br><span style="color: hsl(120, 100%, 40%);">+SoC TXE SKU</span><br><span style="color: hsl(120, 100%, 40%);">+Braswell/Cherry Trail 2.x 1.375 MB</span><br><span style="color: hsl(120, 100%, 40%);">+.TE</span><br><span style="color: hsl(120, 100%, 40%);">+.PP</span><br><span style="color: hsl(120, 100%, 40%);">+* Not working on coreboot</span><br><span style="color: hsl(120, 100%, 40%);">+.PP</span><br><span style="color: hsl(120, 100%, 40%);">+All the reports are available on the project's GitHub page \[la]https://github.com/corna/me_cleaner/issues/3\[ra]\&.</span><br><span style="color: hsl(120, 100%, 40%);">+.SH EXAMPLES</span><br><span style="color: hsl(120, 100%, 40%);">+.PP</span><br><span style="color: hsl(120, 100%, 40%);">+Check whether the provided image has a valid structure and signature:</span><br><span style="color: hsl(120, 100%, 40%);">+.IP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fCme_cleaner.py \-c dumped_firmware.bin\fR</span><br><span style="color: hsl(120, 100%, 40%);">+.PP</span><br><span style="color: hsl(120, 100%, 40%);">+Remove most of the Intel ME firmware modules but don't set the HAP/AltMeDisable</span><br><span style="color: hsl(120, 100%, 40%);">+bit:</span><br><span style="color: hsl(120, 100%, 40%);">+.IP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fCme_cleaner.py \-S \-O modified_me_firmware.bin dumped_firmware.bin\fR</span><br><span style="color: hsl(120, 100%, 40%);">+.PP</span><br><span style="color: hsl(120, 100%, 40%);">+Remove most of the Intel ME firmware modules and set the HAP/AltMeDisable bit,</span><br><span style="color: hsl(120, 100%, 40%);">+disable the Read/Write access of Intel ME to the other flash region, then</span><br><span style="color: hsl(120, 100%, 40%);">+relocate the code to the top of the image and truncate it, extracting a modified</span><br><span style="color: hsl(120, 100%, 40%);">+descriptor and ME image:</span><br><span style="color: hsl(120, 100%, 40%);">+.IP</span><br><span style="color: hsl(120, 100%, 40%);">+\fB\fCme_cleaner.py \-S \-r \-t \-d \-D ifd_shrinked.bin \-M me_shrinked.bin \-O modified_firmware.bin full_dumped_firmware.bin\fR</span><br><span style="color: hsl(120, 100%, 40%);">+.SH BUGS</span><br><span style="color: hsl(120, 100%, 40%);">+.PP</span><br><span style="color: hsl(120, 100%, 40%);">+Bugs should be reported on the project's GitHub page \[la]https://github.com/corna/me_cleaner\[ra]\&.</span><br><span style="color: hsl(120, 100%, 40%);">+.SH AUTHOR</span><br><span style="color: hsl(120, 100%, 40%);">+.PP</span><br><span style="color: hsl(120, 100%, 40%);">+Nicola Corna \[la]nicola@corna.info\[ra]</span><br><span style="color: hsl(120, 100%, 40%);">+.SH SEE ALSO</span><br><span style="color: hsl(120, 100%, 40%);">+.PP</span><br><span style="color: hsl(120, 100%, 40%);">+.BR flashrom (8), </span><br><span style="color: hsl(120, 100%, 40%);">+me_cleaner's Wiki \[la]https://github.com/corna/me_cleaner/wiki\[ra]</span><br><span>diff --git a/util/me_cleaner/me_cleaner.py b/util/me_cleaner/me_cleaner.py</span><br><span>index 11f077d..03fbbcb 100755</span><br><span>--- a/util/me_cleaner/me_cleaner.py</span><br><span>+++ b/util/me_cleaner/me_cleaner.py</span><br><span>@@ -1,7 +1,7 @@</span><br><span> #!/usr/bin/python</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">-# me_cleaner - Tool for partial deblobbing of Intel ME/TXE firmware images</span><br><span style="color: hsl(0, 100%, 40%);">-# Copyright (C) 2016, 2017 Nicola Corna <nicola@corna.info></span><br><span style="color: hsl(120, 100%, 40%);">+# me_cleaner - Tool for partial deblobbing of Intel ME/TXE firmware images</span><br><span style="color: hsl(120, 100%, 40%);">+# Copyright (C) 2016-2018 Nicola Corna <nicola@corna.info></span><br><span> #</span><br><span> # This program is free software; you can redistribute it and/or modify</span><br><span> # it under the terms of the GNU General Public License as published by</span><br><span>@@ -14,12 +14,14 @@</span><br><span> # GNU General Public License for more details.</span><br><span> #</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">-import sys</span><br><span style="color: hsl(0, 100%, 40%);">-import itertools</span><br><span style="color: hsl(120, 100%, 40%);">+from __future__ import division, print_function</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+import argparse</span><br><span> import binascii</span><br><span> import hashlib</span><br><span style="color: hsl(0, 100%, 40%);">-import argparse</span><br><span style="color: hsl(120, 100%, 40%);">+import itertools</span><br><span> import shutil</span><br><span style="color: hsl(120, 100%, 40%);">+import sys</span><br><span> from struct import pack, unpack</span><br><span> </span><br><span> </span><br><span>@@ -27,6 +29,23 @@</span><br><span> spared_blocks = 4</span><br><span> unremovable_modules = ("ROMP", "BUP")</span><br><span> unremovable_modules_me11 = ("rbe", "kernel", "syslib", "bup")</span><br><span style="color: hsl(120, 100%, 40%);">+unremovable_partitions = ("FTPR",)</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+pubkeys_md5 = {</span><br><span style="color: hsl(120, 100%, 40%);">+ "763e59ebe235e45a197a5b1a378dfa04": ("ME", ("6.x.x.x",)),</span><br><span style="color: hsl(120, 100%, 40%);">+ "3a98c847d609c253e145bd36512629cb": ("ME", ("6.0.50.x",)),</span><br><span style="color: hsl(120, 100%, 40%);">+ "0903fc25b0f6bed8c4ed724aca02124c": ("ME", ("7.x.x.x", "8.x.x.x")),</span><br><span style="color: hsl(120, 100%, 40%);">+ "2011ae6df87c40fba09e3f20459b1ce0": ("ME", ("9.0.x.x", "9.1.x.x")),</span><br><span style="color: hsl(120, 100%, 40%);">+ "e8427c5691cf8b56bc5cdd82746957ed": ("ME", ("9.5.x.x", "10.x.x.x")),</span><br><span style="color: hsl(120, 100%, 40%);">+ "986a78e481f185f7d54e4af06eb413f6": ("ME", ("11.x.x.x",)),</span><br><span style="color: hsl(120, 100%, 40%);">+ "bda0b6bb8ca0bf0cac55ac4c4d55e0f2": ("TXE", ("1.x.x.x",)),</span><br><span style="color: hsl(120, 100%, 40%);">+ "b726a2ab9cd59d4e62fe2bead7cf6997": ("TXE", ("1.x.x.x",)),</span><br><span style="color: hsl(120, 100%, 40%);">+ "0633d7f951a3e7968ae7460861be9cfb": ("TXE", ("2.x.x.x",)),</span><br><span style="color: hsl(120, 100%, 40%);">+ "1d0a36e9f5881540d8e4b382c6612ed8": ("TXE", ("3.x.x.x",)),</span><br><span style="color: hsl(120, 100%, 40%);">+ "be900fef868f770d266b1fc67e887e69": ("SPS", ("2.x.x.x",)),</span><br><span style="color: hsl(120, 100%, 40%);">+ "4622e3f2cb212a89c90a4de3336d88d2": ("SPS", ("3.x.x.x",)),</span><br><span style="color: hsl(120, 100%, 40%);">+ "31ef3d950eac99d18e187375c0764ca4": ("SPS", ("4.x.x.x",))</span><br><span style="color: hsl(120, 100%, 40%);">+}</span><br><span> </span><br><span> </span><br><span> class OutOfRegionException(Exception):</span><br><span>@@ -40,59 +59,71 @@</span><br><span> self.region_end = region_end</span><br><span> </span><br><span> def read(self, n):</span><br><span style="color: hsl(0, 100%, 40%);">- return self.f.read(n)</span><br><span style="color: hsl(120, 100%, 40%);">+ if f.tell() + n <= self.region_end:</span><br><span style="color: hsl(120, 100%, 40%);">+ return self.f.read(n)</span><br><span style="color: hsl(120, 100%, 40%);">+ else:</span><br><span style="color: hsl(120, 100%, 40%);">+ raise OutOfRegionException()</span><br><span> </span><br><span> def readinto(self, b):</span><br><span style="color: hsl(0, 100%, 40%);">- return self.f.readinto(b)</span><br><span style="color: hsl(120, 100%, 40%);">+ if f.tell() + len(b) <= self.region_end:</span><br><span style="color: hsl(120, 100%, 40%);">+ return self.f.readinto(b)</span><br><span style="color: hsl(120, 100%, 40%);">+ else:</span><br><span style="color: hsl(120, 100%, 40%);">+ raise OutOfRegionException()</span><br><span> </span><br><span> def seek(self, offset):</span><br><span style="color: hsl(0, 100%, 40%);">- return self.f.seek(offset)</span><br><span style="color: hsl(120, 100%, 40%);">+ if self.region_start + offset <= self.region_end:</span><br><span style="color: hsl(120, 100%, 40%);">+ return self.f.seek(self.region_start + offset)</span><br><span style="color: hsl(120, 100%, 40%);">+ else:</span><br><span style="color: hsl(120, 100%, 40%);">+ raise OutOfRegionException()</span><br><span> </span><br><span> def write_to(self, offset, data):</span><br><span style="color: hsl(0, 100%, 40%);">- if offset >= self.region_start and \</span><br><span style="color: hsl(0, 100%, 40%);">- offset + len(data) <= self.region_end:</span><br><span style="color: hsl(0, 100%, 40%);">- self.f.seek(offset)</span><br><span style="color: hsl(120, 100%, 40%);">+ if self.region_start + offset + len(data) <= self.region_end:</span><br><span style="color: hsl(120, 100%, 40%);">+ self.f.seek(self.region_start + offset)</span><br><span> return self.f.write(data)</span><br><span> else:</span><br><span> raise OutOfRegionException()</span><br><span> </span><br><span> def fill_range(self, start, end, fill):</span><br><span style="color: hsl(0, 100%, 40%);">- if start >= self.region_start and end <= self.region_end:</span><br><span style="color: hsl(120, 100%, 40%);">+ if self.region_start + end <= self.region_end:</span><br><span> if start < end:</span><br><span> block = fill * 4096</span><br><span style="color: hsl(0, 100%, 40%);">- self.f.seek(start)</span><br><span style="color: hsl(120, 100%, 40%);">+ self.f.seek(self.region_start + start)</span><br><span> self.f.writelines(itertools.repeat(block,</span><br><span> (end - start) // 4096))</span><br><span> self.f.write(block[:(end - start) % 4096])</span><br><span> else:</span><br><span> raise OutOfRegionException()</span><br><span> </span><br><span style="color: hsl(120, 100%, 40%);">+ def fill_all(self, fill):</span><br><span style="color: hsl(120, 100%, 40%);">+ self.fill_range(0, self.region_end - self.region_start, fill)</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span> def move_range(self, offset_from, size, offset_to, fill):</span><br><span style="color: hsl(0, 100%, 40%);">- if offset_from >= self.region_start and \</span><br><span style="color: hsl(0, 100%, 40%);">- offset_from + size <= self.region_end and \</span><br><span style="color: hsl(0, 100%, 40%);">- offset_to >= self.region_start and \</span><br><span style="color: hsl(0, 100%, 40%);">- offset_to + size <= self.region_end:</span><br><span style="color: hsl(120, 100%, 40%);">+ if self.region_start + offset_from + size <= self.region_end and \</span><br><span style="color: hsl(120, 100%, 40%);">+ self.region_start + offset_to + size <= self.region_end:</span><br><span> for i in range(0, size, 4096):</span><br><span style="color: hsl(0, 100%, 40%);">- self.f.seek(offset_from + i, 0)</span><br><span style="color: hsl(0, 100%, 40%);">- block = self.f.read(4096 if size - i >= 4096 else size - i)</span><br><span style="color: hsl(0, 100%, 40%);">- self.f.seek(offset_from + i, 0)</span><br><span style="color: hsl(120, 100%, 40%);">+ self.f.seek(self.region_start + offset_from + i, 0)</span><br><span style="color: hsl(120, 100%, 40%);">+ block = self.f.read(min(size - i, 4096))</span><br><span style="color: hsl(120, 100%, 40%);">+ self.f.seek(self.region_start + offset_from + i, 0)</span><br><span> self.f.write(fill * len(block))</span><br><span style="color: hsl(0, 100%, 40%);">- self.f.seek(offset_to + i, 0)</span><br><span style="color: hsl(120, 100%, 40%);">+ self.f.seek(self.region_start + offset_to + i, 0)</span><br><span> self.f.write(block)</span><br><span> else:</span><br><span> raise OutOfRegionException()</span><br><span> </span><br><span> def save(self, filename, size):</span><br><span style="color: hsl(0, 100%, 40%);">- self.f.seek(self.region_start)</span><br><span style="color: hsl(0, 100%, 40%);">- copyf = open(filename, "w+b")</span><br><span style="color: hsl(0, 100%, 40%);">- for i in range(0, size, 4096):</span><br><span style="color: hsl(0, 100%, 40%);">- copyf.write(self.f.read(4096 if size - i >= 4096 else size - i))</span><br><span style="color: hsl(0, 100%, 40%);">- return copyf</span><br><span style="color: hsl(120, 100%, 40%);">+ if self.region_start + size <= self.region_end:</span><br><span style="color: hsl(120, 100%, 40%);">+ self.f.seek(self.region_start)</span><br><span style="color: hsl(120, 100%, 40%);">+ copyf = open(filename, "w+b")</span><br><span style="color: hsl(120, 100%, 40%);">+ for i in range(0, size, 4096):</span><br><span style="color: hsl(120, 100%, 40%);">+ copyf.write(self.f.read(min(size - i, 4096)))</span><br><span style="color: hsl(120, 100%, 40%);">+ return copyf</span><br><span style="color: hsl(120, 100%, 40%);">+ else:</span><br><span style="color: hsl(120, 100%, 40%);">+ raise OutOfRegionException()</span><br><span> </span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">-def get_chunks_offsets(llut, me_start):</span><br><span style="color: hsl(120, 100%, 40%);">+def get_chunks_offsets(llut):</span><br><span> chunk_count = unpack("<I", llut[0x04:0x08])[0]</span><br><span style="color: hsl(0, 100%, 40%);">- huffman_stream_end = sum(unpack("<II", llut[0x10:0x18])) + me_start</span><br><span style="color: hsl(120, 100%, 40%);">+ huffman_stream_end = sum(unpack("<II", llut[0x10:0x18]))</span><br><span> nonzero_offsets = [huffman_stream_end]</span><br><span> offsets = []</span><br><span> </span><br><span>@@ -101,7 +132,7 @@</span><br><span> offset = 0</span><br><span> </span><br><span> if chunk[3] != 0x80:</span><br><span style="color: hsl(0, 100%, 40%);">- offset = unpack("<I", chunk[0:3] + b"\x00")[0] + me_start</span><br><span style="color: hsl(120, 100%, 40%);">+ offset = unpack("<I", chunk[0:3] + b"\x00")[0]</span><br><span> </span><br><span> offsets.append([offset, 0])</span><br><span> if offset != 0:</span><br><span>@@ -131,11 +162,11 @@</span><br><span> flags = unpack("<I", mod_header[0x50:0x54])[0]</span><br><span> comp_type = (flags >> 4) & 7</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- sys.stdout.write(" {:<16} ({:<7}, ".format(name, comp_str[comp_type]))</span><br><span style="color: hsl(120, 100%, 40%);">+ print(" {:<16} ({:<7}, ".format(name, comp_str[comp_type]), end="")</span><br><span> </span><br><span> if comp_type == 0x00 or comp_type == 0x02:</span><br><span style="color: hsl(0, 100%, 40%);">- sys.stdout.write("0x{:06x} - 0x{:06x}): "</span><br><span style="color: hsl(0, 100%, 40%);">- .format(offset, offset + size))</span><br><span style="color: hsl(120, 100%, 40%);">+ print("0x{:06x} - 0x{:06x} ): "</span><br><span style="color: hsl(120, 100%, 40%);">+ .format(offset, offset + size), end="")</span><br><span> </span><br><span> if name in unremovable_modules:</span><br><span> end_addr = max(end_addr, offset + size)</span><br><span>@@ -146,7 +177,6 @@</span><br><span> print("removed")</span><br><span> </span><br><span> elif comp_type == 0x01:</span><br><span style="color: hsl(0, 100%, 40%);">- sys.stdout.write("fragmented data ): ")</span><br><span> if not chunks_offsets:</span><br><span> f.seek(offset)</span><br><span> llut = f.read(4)</span><br><span>@@ -158,16 +188,25 @@</span><br><span> chunk_size = unpack("<I", llut[0x30:0x34])[0]</span><br><span> </span><br><span> llut += f.read(chunk_count * 4)</span><br><span style="color: hsl(0, 100%, 40%);">- chunks_offsets = get_chunks_offsets(llut, me_start)</span><br><span style="color: hsl(120, 100%, 40%);">+ chunks_offsets = get_chunks_offsets(llut)</span><br><span> else:</span><br><span> sys.exit("Huffman modules found, but LLUT is not present")</span><br><span> </span><br><span style="color: hsl(120, 100%, 40%);">+ module_base = unpack("<I", mod_header[0x34:0x38])[0]</span><br><span style="color: hsl(120, 100%, 40%);">+ module_size = unpack("<I", mod_header[0x3c:0x40])[0]</span><br><span style="color: hsl(120, 100%, 40%);">+ first_chunk_num = (module_base - base) // chunk_size</span><br><span style="color: hsl(120, 100%, 40%);">+ last_chunk_num = first_chunk_num + module_size // chunk_size</span><br><span style="color: hsl(120, 100%, 40%);">+ huff_size = 0</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ for chunk in chunks_offsets[first_chunk_num:last_chunk_num + 1]:</span><br><span style="color: hsl(120, 100%, 40%);">+ huff_size += chunk[1] - chunk[0]</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ print("fragmented data, {:<9}): "</span><br><span style="color: hsl(120, 100%, 40%);">+ .format("~" + str(int(round(huff_size / 1024))) + " KiB"),</span><br><span style="color: hsl(120, 100%, 40%);">+ end="")</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span> if name in unremovable_modules:</span><br><span> print("NOT removed, essential")</span><br><span style="color: hsl(0, 100%, 40%);">- module_base = unpack("<I", mod_header[0x34:0x38])[0]</span><br><span style="color: hsl(0, 100%, 40%);">- module_size = unpack("<I", mod_header[0x3c:0x40])[0]</span><br><span style="color: hsl(0, 100%, 40%);">- first_chunk_num = (module_base - base) // chunk_size</span><br><span style="color: hsl(0, 100%, 40%);">- last_chunk_num = first_chunk_num + module_size // chunk_size</span><br><span> </span><br><span> unremovable_huff_chunks += \</span><br><span> [x for x in chunks_offsets[first_chunk_num:</span><br><span>@@ -176,8 +215,8 @@</span><br><span> print("removed")</span><br><span> </span><br><span> else:</span><br><span style="color: hsl(0, 100%, 40%);">- sys.stdout.write("0x{:06x} - 0x{:06x}): unknown compression, "</span><br><span style="color: hsl(0, 100%, 40%);">- "skipping".format(offset, offset + size))</span><br><span style="color: hsl(120, 100%, 40%);">+ print("0x{:06x} - 0x{:06x}): unknown compression, skipping"</span><br><span style="color: hsl(120, 100%, 40%);">+ .format(offset, offset + size), end="")</span><br><span> </span><br><span> if chunks_offsets:</span><br><span> removable_huff_chunks = []</span><br><span>@@ -228,14 +267,13 @@</span><br><span> "ME/TXE image valid?")</span><br><span> </span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">-def relocate_partition(f, me_start, me_end, partition_header_offset,</span><br><span style="color: hsl(120, 100%, 40%);">+def relocate_partition(f, me_end, partition_header_offset,</span><br><span> new_offset, mod_headers):</span><br><span> </span><br><span> f.seek(partition_header_offset)</span><br><span> name = f.read(4).rstrip(b"\x00").decode("ascii")</span><br><span> f.seek(partition_header_offset + 0x8)</span><br><span> old_offset, partition_size = unpack("<II", f.read(0x8))</span><br><span style="color: hsl(0, 100%, 40%);">- old_offset += me_start</span><br><span> </span><br><span> llut_start = 0</span><br><span> for mod_header in mod_headers:</span><br><span>@@ -251,8 +289,7 @@</span><br><span> f.seek(llut_start + 0x9)</span><br><span> lut_start_corr = unpack("<H", f.read(2))[0]</span><br><span> new_offset = max(new_offset,</span><br><span style="color: hsl(0, 100%, 40%);">- lut_start_corr + me_start - llut_start - 0x40 +</span><br><span style="color: hsl(0, 100%, 40%);">- old_offset)</span><br><span style="color: hsl(120, 100%, 40%);">+ lut_start_corr - llut_start - 0x40 + old_offset)</span><br><span> new_offset = ((new_offset + 0x1f) // 0x20) * 0x20</span><br><span> </span><br><span> offset_diff = new_offset - old_offset</span><br><span>@@ -262,15 +299,14 @@</span><br><span> </span><br><span> print(" Adjusting FPT entry...")</span><br><span> f.write_to(partition_header_offset + 0x8,</span><br><span style="color: hsl(0, 100%, 40%);">- pack("<I", new_offset - me_start))</span><br><span style="color: hsl(120, 100%, 40%);">+ pack("<I", new_offset))</span><br><span> </span><br><span> if mod_headers:</span><br><span> if llut_start != 0:</span><br><span> f.seek(llut_start)</span><br><span> if f.read(4) == b"LLUT":</span><br><span> print(" Adjusting LUT start offset...")</span><br><span style="color: hsl(0, 100%, 40%);">- lut_offset = llut_start + offset_diff + 0x40 - \</span><br><span style="color: hsl(0, 100%, 40%);">- lut_start_corr - me_start</span><br><span style="color: hsl(120, 100%, 40%);">+ lut_offset = llut_start + offset_diff + 0x40 - lut_start_corr</span><br><span> f.write_to(llut_start + 0x0c, pack("<I", lut_offset))</span><br><span> </span><br><span> print(" Adjusting Huffman start offset...")</span><br><span>@@ -303,7 +339,7 @@</span><br><span> return new_offset</span><br><span> </span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">-def check_and_remove_modules(f, me_start, me_end, offset, min_offset,</span><br><span style="color: hsl(120, 100%, 40%);">+def check_and_remove_modules(f, me_end, offset, min_offset,</span><br><span> relocate, keep_modules):</span><br><span> </span><br><span> f.seek(offset + 0x20)</span><br><span>@@ -311,29 +347,27 @@</span><br><span> f.seek(offset + 0x290)</span><br><span> data = f.read(0x84)</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- module_header_size = 0</span><br><span style="color: hsl(120, 100%, 40%);">+ mod_header_size = 0</span><br><span> if data[0x0:0x4] == b"$MME":</span><br><span> if data[0x60:0x64] == b"$MME" or num_modules == 1:</span><br><span style="color: hsl(0, 100%, 40%);">- module_header_size = 0x60</span><br><span style="color: hsl(120, 100%, 40%);">+ mod_header_size = 0x60</span><br><span> elif data[0x80:0x84] == b"$MME":</span><br><span style="color: hsl(0, 100%, 40%);">- module_header_size = 0x80</span><br><span style="color: hsl(120, 100%, 40%);">+ mod_header_size = 0x80</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- if module_header_size != 0:</span><br><span style="color: hsl(120, 100%, 40%);">+ if mod_header_size != 0:</span><br><span> f.seek(offset + 0x290)</span><br><span style="color: hsl(0, 100%, 40%);">- mod_headers = [f.read(module_header_size)</span><br><span style="color: hsl(120, 100%, 40%);">+ data = f.read(mod_header_size * num_modules)</span><br><span style="color: hsl(120, 100%, 40%);">+ mod_headers = [data[i * mod_header_size:(i + 1) * mod_header_size]</span><br><span> for i in range(0, num_modules)]</span><br><span> </span><br><span> if all(hdr.startswith(b"$MME") for hdr in mod_headers):</span><br><span> if args.keep_modules:</span><br><span style="color: hsl(0, 100%, 40%);">- end_addr = offset + ftpr_lenght</span><br><span style="color: hsl(120, 100%, 40%);">+ end_addr = offset + ftpr_length</span><br><span> else:</span><br><span style="color: hsl(0, 100%, 40%);">- end_addr = remove_modules(f, mod_headers,</span><br><span style="color: hsl(0, 100%, 40%);">- offset, me_end)</span><br><span style="color: hsl(120, 100%, 40%);">+ end_addr = remove_modules(f, mod_headers, offset, me_end)</span><br><span> </span><br><span> if args.relocate:</span><br><span style="color: hsl(0, 100%, 40%);">- new_offset = relocate_partition(f, me_start, me_end,</span><br><span style="color: hsl(0, 100%, 40%);">- me_start + 0x30,</span><br><span style="color: hsl(0, 100%, 40%);">- min_offset + me_start,</span><br><span style="color: hsl(120, 100%, 40%);">+ new_offset = relocate_partition(f, me_end, 0x30, min_offset,</span><br><span> mod_headers)</span><br><span> end_addr += new_offset - offset</span><br><span> offset = new_offset</span><br><span>@@ -350,14 +384,14 @@</span><br><span> return -1, offset</span><br><span> </span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">-def check_and_remove_modules_me11(f, me_start, me_end, partition_offset,</span><br><span style="color: hsl(0, 100%, 40%);">- partition_lenght, min_offset, relocate,</span><br><span style="color: hsl(120, 100%, 40%);">+def check_and_remove_modules_me11(f, me_end, partition_offset,</span><br><span style="color: hsl(120, 100%, 40%);">+ partition_length, min_offset, relocate,</span><br><span> keep_modules):</span><br><span> </span><br><span> comp_str = ("LZMA/uncomp.", "Huffman")</span><br><span> </span><br><span> if keep_modules:</span><br><span style="color: hsl(0, 100%, 40%);">- end_data = partition_offset + partition_lenght</span><br><span style="color: hsl(120, 100%, 40%);">+ end_data = partition_offset + partition_length</span><br><span> else:</span><br><span> end_data = 0</span><br><span> </span><br><span>@@ -365,7 +399,7 @@</span><br><span> module_count = unpack("<I", f.read(4))[0]</span><br><span> </span><br><span> modules = []</span><br><span style="color: hsl(0, 100%, 40%);">- modules.append(("end", partition_lenght, 0))</span><br><span style="color: hsl(120, 100%, 40%);">+ modules.append(("end", partition_length, 0))</span><br><span> </span><br><span> f.seek(partition_offset + 0x10)</span><br><span> for i in range(0, module_count):</span><br><span>@@ -390,8 +424,8 @@</span><br><span> else:</span><br><span> compression = comp_str[modules[i][2]]</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- sys.stdout.write(" {:<12} ({:<12}, 0x{:06x} - 0x{:06x}): "</span><br><span style="color: hsl(0, 100%, 40%);">- .format(name, compression, offset, end))</span><br><span style="color: hsl(120, 100%, 40%);">+ print(" {:<12} ({:<12}, 0x{:06x} - 0x{:06x}): "</span><br><span style="color: hsl(120, 100%, 40%);">+ .format(name, compression, offset, end), end="")</span><br><span> </span><br><span> if name.endswith(".man"):</span><br><span> print("NOT removed, partition manif.")</span><br><span>@@ -408,8 +442,7 @@</span><br><span> end_data = max(end_data, end)</span><br><span> </span><br><span> if relocate:</span><br><span style="color: hsl(0, 100%, 40%);">- new_offset = relocate_partition(f, me_start, me_end, me_start + 0x30,</span><br><span style="color: hsl(0, 100%, 40%);">- min_offset + me_start, [])</span><br><span style="color: hsl(120, 100%, 40%);">+ new_offset = relocate_partition(f, me_end, 0x30, min_offset, [])</span><br><span> end_data += new_offset - partition_offset</span><br><span> partition_offset = new_offset</span><br><span> </span><br><span>@@ -436,40 +469,72 @@</span><br><span> parser = argparse.ArgumentParser(description="Tool to remove as much code "</span><br><span> "as possible from Intel ME/TXE firmware "</span><br><span> "images")</span><br><span style="color: hsl(120, 100%, 40%);">+ softdis = parser.add_mutually_exclusive_group()</span><br><span style="color: hsl(120, 100%, 40%);">+ bw_list = parser.add_mutually_exclusive_group()</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ parser.add_argument("-v", "--version", action="version",</span><br><span style="color: hsl(120, 100%, 40%);">+ version="%(prog)s 1.2")</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span> parser.add_argument("file", help="ME/TXE image or full dump")</span><br><span style="color: hsl(0, 100%, 40%);">- parser.add_argument("-O", "--output", help="save the modified image in a "</span><br><span style="color: hsl(0, 100%, 40%);">- "separate file, instead of modifying the original "</span><br><span style="color: hsl(0, 100%, 40%);">- "file")</span><br><span style="color: hsl(120, 100%, 40%);">+ parser.add_argument("-O", "--output", metavar='output_file', help="save "</span><br><span style="color: hsl(120, 100%, 40%);">+ "the modified image in a separate file, instead of "</span><br><span style="color: hsl(120, 100%, 40%);">+ "modifying the original file")</span><br><span style="color: hsl(120, 100%, 40%);">+ softdis.add_argument("-S", "--soft-disable", help="in addition to the "</span><br><span style="color: hsl(120, 100%, 40%);">+ "usual operations on the ME/TXE firmware, set the "</span><br><span style="color: hsl(120, 100%, 40%);">+ "MeAltDisable bit or the HAP bit to ask Intel ME/TXE "</span><br><span style="color: hsl(120, 100%, 40%);">+ "to disable itself after the hardware initialization "</span><br><span style="color: hsl(120, 100%, 40%);">+ "(requires a full dump)", action="store_true")</span><br><span style="color: hsl(120, 100%, 40%);">+ softdis.add_argument("-s", "--soft-disable-only", help="instead of the "</span><br><span style="color: hsl(120, 100%, 40%);">+ "usual operations on the ME/TXE firmware, just set "</span><br><span style="color: hsl(120, 100%, 40%);">+ "the MeAltDisable bit or the HAP bit to ask Intel "</span><br><span style="color: hsl(120, 100%, 40%);">+ "ME/TXE to disable itself after the hardware "</span><br><span style="color: hsl(120, 100%, 40%);">+ "initialization (requires a full dump)",</span><br><span style="color: hsl(120, 100%, 40%);">+ action="store_true")</span><br><span> parser.add_argument("-r", "--relocate", help="relocate the FTPR partition "</span><br><span> "to the top of the ME region to save even more space",</span><br><span> action="store_true")</span><br><span style="color: hsl(120, 100%, 40%);">+ parser.add_argument("-t", "--truncate", help="truncate the empty part of "</span><br><span style="color: hsl(120, 100%, 40%);">+ "the firmware (requires a separated ME/TXE image or "</span><br><span style="color: hsl(120, 100%, 40%);">+ "--extract-me)", action="store_true")</span><br><span> parser.add_argument("-k", "--keep-modules", help="don't remove the FTPR "</span><br><span> "modules, even when possible", action="store_true")</span><br><span style="color: hsl(120, 100%, 40%);">+ bw_list.add_argument("-w", "--whitelist", metavar="whitelist",</span><br><span style="color: hsl(120, 100%, 40%);">+ help="Comma separated list of additional partitions "</span><br><span style="color: hsl(120, 100%, 40%);">+ "to keep in the final image. This can be used to "</span><br><span style="color: hsl(120, 100%, 40%);">+ "specify the MFS partition for example, which stores "</span><br><span style="color: hsl(120, 100%, 40%);">+ "PCIe and clock settings.")</span><br><span style="color: hsl(120, 100%, 40%);">+ bw_list.add_argument("-b", "--blacklist", metavar="blacklist",</span><br><span style="color: hsl(120, 100%, 40%);">+ help="Comma separated list of partitions to remove "</span><br><span style="color: hsl(120, 100%, 40%);">+ "from the image. This option overrides the default "</span><br><span style="color: hsl(120, 100%, 40%);">+ "removal list.")</span><br><span> parser.add_argument("-d", "--descriptor", help="remove the ME/TXE "</span><br><span> "Read/Write permissions to the other regions on the "</span><br><span> "flash from the Intel Flash Descriptor (requires a "</span><br><span> "full dump)", action="store_true")</span><br><span style="color: hsl(0, 100%, 40%);">- parser.add_argument("-t", "--truncate", help="truncate the empty part of "</span><br><span style="color: hsl(0, 100%, 40%);">- "the firmware (requires a separated ME/TXE image or "</span><br><span style="color: hsl(0, 100%, 40%);">- "--extract-me)", action="store_true")</span><br><span style="color: hsl(120, 100%, 40%);">+ parser.add_argument("-D", "--extract-descriptor",</span><br><span style="color: hsl(120, 100%, 40%);">+ metavar='output_descriptor', help="extract the flash "</span><br><span style="color: hsl(120, 100%, 40%);">+ "descriptor from a full dump; when used with "</span><br><span style="color: hsl(120, 100%, 40%);">+ "--truncate save a descriptor with adjusted regions "</span><br><span style="color: hsl(120, 100%, 40%);">+ "start and end")</span><br><span style="color: hsl(120, 100%, 40%);">+ parser.add_argument("-M", "--extract-me", metavar='output_me_image',</span><br><span style="color: hsl(120, 100%, 40%);">+ help="extract the ME firmware from a full dump; when "</span><br><span style="color: hsl(120, 100%, 40%);">+ "used with --truncate save a truncated ME/TXE image")</span><br><span> parser.add_argument("-c", "--check", help="verify the integrity of the "</span><br><span> "fundamental parts of the firmware and exit",</span><br><span> action="store_true")</span><br><span style="color: hsl(0, 100%, 40%);">- parser.add_argument("-D", "--extract-descriptor", help="extract the "</span><br><span style="color: hsl(0, 100%, 40%);">- "flash descriptor from a full dump; when used with "</span><br><span style="color: hsl(0, 100%, 40%);">- "--truncate save a descriptor with adjusted regions "</span><br><span style="color: hsl(0, 100%, 40%);">- "start and end")</span><br><span style="color: hsl(0, 100%, 40%);">- parser.add_argument("-M", "--extract-me", help="extract the ME firmware "</span><br><span style="color: hsl(0, 100%, 40%);">- "from a full dump; when used with --truncate save a "</span><br><span style="color: hsl(0, 100%, 40%);">- "truncated ME/TXE image")</span><br><span> </span><br><span> args = parser.parse_args()</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- if args.check:</span><br><span style="color: hsl(0, 100%, 40%);">- if args.relocate:</span><br><span style="color: hsl(0, 100%, 40%);">- sys.exit("-c and -r can't be used together")</span><br><span style="color: hsl(0, 100%, 40%);">- elif args.truncate:</span><br><span style="color: hsl(0, 100%, 40%);">- sys.exit("-c and -t can't be used together")</span><br><span style="color: hsl(120, 100%, 40%);">+ if args.check and (args.soft_disable_only or args.soft_disable or</span><br><span style="color: hsl(120, 100%, 40%);">+ args.relocate or args.descriptor or args.truncate or args.output):</span><br><span style="color: hsl(120, 100%, 40%);">+ sys.exit("-c can't be used with -S, -s, -r, -d, -t or -O")</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ if args.soft_disable_only and (args.relocate or args.truncate):</span><br><span style="color: hsl(120, 100%, 40%);">+ sys.exit("-s can't be used with -r or -t")</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ if (args.whitelist or args.blacklist) and args.relocate:</span><br><span style="color: hsl(120, 100%, 40%);">+ sys.exit("Relocation is not yet supported with custom whitelist or "</span><br><span style="color: hsl(120, 100%, 40%);">+ "blacklist")</span><br><span> </span><br><span> f = open(args.file, "rb" if args.check or args.output else "r+b")</span><br><span> f.seek(0x10)</span><br><span>@@ -478,18 +543,14 @@</span><br><span> if magic == b"$FPT":</span><br><span> print("ME/TXE image detected")</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- if args.descriptor:</span><br><span style="color: hsl(0, 100%, 40%);">- sys.exit("-d requires a full dump")</span><br><span style="color: hsl(120, 100%, 40%);">+ if args.descriptor or args.extract_descriptor or args.extract_me or \</span><br><span style="color: hsl(120, 100%, 40%);">+ args.soft_disable or args.soft_disable_only:</span><br><span style="color: hsl(120, 100%, 40%);">+ sys.exit("-d, -D, -M, -S and -s require a full dump")</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- if args.extract_descriptor:</span><br><span style="color: hsl(0, 100%, 40%);">- sys.exit("-D requires a full dump")</span><br><span style="color: hsl(0, 100%, 40%);">-</span><br><span style="color: hsl(0, 100%, 40%);">- if args.extract_me:</span><br><span style="color: hsl(0, 100%, 40%);">- sys.exit("-M requires a full dump")</span><br><span style="color: hsl(0, 100%, 40%);">-</span><br><span style="color: hsl(0, 100%, 40%);">- me_start = 0</span><br><span> f.seek(0, 2)</span><br><span style="color: hsl(120, 100%, 40%);">+ me_start = 0</span><br><span> me_end = f.tell()</span><br><span style="color: hsl(120, 100%, 40%);">+ mef = RegionFile(f, me_start, me_end)</span><br><span> </span><br><span> elif magic == b"\x5a\xa5\xf0\x0f":</span><br><span> print("Full image detected")</span><br><span>@@ -501,6 +562,7 @@</span><br><span> flmap0, flmap1 = unpack("<II", f.read(8))</span><br><span> frba = flmap0 >> 12 & 0xff0</span><br><span> fmba = (flmap1 & 0xff) << 4</span><br><span style="color: hsl(120, 100%, 40%);">+ fpsba = flmap1 >> 12 & 0xff0</span><br><span> </span><br><span> f.seek(frba)</span><br><span> flreg = unpack("<III", f.read(12))</span><br><span>@@ -512,8 +574,10 @@</span><br><span> if me_start >= me_end:</span><br><span> sys.exit("The ME/TXE region in this image has been disabled")</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- f.seek(me_start + 0x10)</span><br><span style="color: hsl(0, 100%, 40%);">- if f.read(4) != b"$FPT":</span><br><span style="color: hsl(120, 100%, 40%);">+ mef = RegionFile(f, me_start, me_end)</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.seek(0x10)</span><br><span style="color: hsl(120, 100%, 40%);">+ if mef.read(4) != b"$FPT":</span><br><span> sys.exit("The ME/TXE region is corrupted or missing")</span><br><span> </span><br><span> print("The ME/TXE region goes from {:#x} to {:#x}"</span><br><span>@@ -521,17 +585,16 @@</span><br><span> else:</span><br><span> sys.exit("Unknown image")</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- print("Found FPT header at {:#x}".format(me_start + 0x10))</span><br><span style="color: hsl(120, 100%, 40%);">+ end_addr = me_end</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- f.seek(me_start + 0x14)</span><br><span style="color: hsl(0, 100%, 40%);">- entries = unpack("<I", f.read(4))[0]</span><br><span style="color: hsl(120, 100%, 40%);">+ print("Found FPT header at {:#x}".format(mef.region_start + 0x10))</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.seek(0x14)</span><br><span style="color: hsl(120, 100%, 40%);">+ entries = unpack("<I", mef.read(4))[0]</span><br><span> print("Found {} partition(s)".format(entries))</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- f.seek(me_start + 0x14)</span><br><span style="color: hsl(0, 100%, 40%);">- header_len = unpack("B", f.read(1))[0]</span><br><span style="color: hsl(0, 100%, 40%);">-</span><br><span style="color: hsl(0, 100%, 40%);">- f.seek(me_start + 0x30)</span><br><span style="color: hsl(0, 100%, 40%);">- partitions = f.read(entries * 0x20)</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.seek(0x30)</span><br><span style="color: hsl(120, 100%, 40%);">+ partitions = mef.read(entries * 0x20)</span><br><span> </span><br><span> ftpr_header = b""</span><br><span> </span><br><span>@@ -543,21 +606,20 @@</span><br><span> if ftpr_header == b"":</span><br><span> sys.exit("FTPR header not found, this image doesn't seem to be valid")</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- ftpr_offset, ftpr_lenght = unpack("<II", ftpr_header[0x08:0x10])</span><br><span style="color: hsl(0, 100%, 40%);">- ftpr_offset += me_start</span><br><span style="color: hsl(120, 100%, 40%);">+ ftpr_offset, ftpr_length = unpack("<II", ftpr_header[0x08:0x10])</span><br><span> print("Found FTPR header: FTPR partition spans from {:#x} to {:#x}"</span><br><span style="color: hsl(0, 100%, 40%);">- .format(ftpr_offset, ftpr_offset + ftpr_lenght))</span><br><span style="color: hsl(120, 100%, 40%);">+ .format(ftpr_offset, ftpr_offset + ftpr_length))</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- f.seek(ftpr_offset)</span><br><span style="color: hsl(0, 100%, 40%);">- if f.read(4) == b"$CPD":</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.seek(ftpr_offset)</span><br><span style="color: hsl(120, 100%, 40%);">+ if mef.read(4) == b"$CPD":</span><br><span> me11 = True</span><br><span style="color: hsl(0, 100%, 40%);">- num_entries = unpack("<I", f.read(4))[0]</span><br><span style="color: hsl(120, 100%, 40%);">+ num_entries = unpack("<I", mef.read(4))[0]</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- f.seek(ftpr_offset + 0x10)</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.seek(ftpr_offset + 0x10)</span><br><span> ftpr_mn2_offset = -1</span><br><span> </span><br><span> for i in range(0, num_entries):</span><br><span style="color: hsl(0, 100%, 40%);">- data = f.read(0x18)</span><br><span style="color: hsl(120, 100%, 40%);">+ data = mef.read(0x18)</span><br><span> name = data[0x0:0xc].rstrip(b"\x00").decode("ascii")</span><br><span> offset = unpack("<I", data[0xc:0xf] + b"\x00")[0]</span><br><span> </span><br><span>@@ -566,94 +628,214 @@</span><br><span> break</span><br><span> </span><br><span> if ftpr_mn2_offset >= 0:</span><br><span style="color: hsl(0, 100%, 40%);">- check_mn2_tag(f, ftpr_offset + ftpr_mn2_offset)</span><br><span style="color: hsl(120, 100%, 40%);">+ check_mn2_tag(mef, ftpr_offset + ftpr_mn2_offset)</span><br><span> print("Found FTPR manifest at {:#x}"</span><br><span> .format(ftpr_offset + ftpr_mn2_offset))</span><br><span> else:</span><br><span> sys.exit("Can't find the manifest of the FTPR partition")</span><br><span> </span><br><span> else:</span><br><span style="color: hsl(0, 100%, 40%);">- check_mn2_tag(f, ftpr_offset)</span><br><span style="color: hsl(120, 100%, 40%);">+ check_mn2_tag(mef, ftpr_offset)</span><br><span> me11 = False</span><br><span> ftpr_mn2_offset = 0</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- f.seek(ftpr_offset + ftpr_mn2_offset + 0x24)</span><br><span style="color: hsl(0, 100%, 40%);">- version = unpack("<HHHH", f.read(0x08))</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.seek(ftpr_offset + ftpr_mn2_offset + 0x24)</span><br><span style="color: hsl(120, 100%, 40%);">+ version = unpack("<HHHH", mef.read(0x08))</span><br><span> print("ME/TXE firmware version {}"</span><br><span> .format('.'.join(str(i) for i in version)))</span><br><span> </span><br><span style="color: hsl(120, 100%, 40%);">+ mef.seek(ftpr_offset + ftpr_mn2_offset + 0x80)</span><br><span style="color: hsl(120, 100%, 40%);">+ pubkey_md5 = hashlib.md5(mef.read(0x104)).hexdigest()</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ if pubkey_md5 in pubkeys_md5:</span><br><span style="color: hsl(120, 100%, 40%);">+ variant, pubkey_versions = pubkeys_md5[pubkey_md5]</span><br><span style="color: hsl(120, 100%, 40%);">+ print("Public key match: Intel {}, firmware versions {}"</span><br><span style="color: hsl(120, 100%, 40%);">+ .format(variant, ", ".join(pubkey_versions)))</span><br><span style="color: hsl(120, 100%, 40%);">+ else:</span><br><span style="color: hsl(120, 100%, 40%);">+ if version[0] >= 6:</span><br><span style="color: hsl(120, 100%, 40%);">+ variant = "ME"</span><br><span style="color: hsl(120, 100%, 40%);">+ else:</span><br><span style="color: hsl(120, 100%, 40%);">+ variant = "TXE"</span><br><span style="color: hsl(120, 100%, 40%);">+ print("WARNING Unknown public key {}\n"</span><br><span style="color: hsl(120, 100%, 40%);">+ " Assuming Intel {}\n"</span><br><span style="color: hsl(120, 100%, 40%);">+ " Please report this warning to the project's maintainer!"</span><br><span style="color: hsl(120, 100%, 40%);">+ .format(pubkey_md5, variant))</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ if not args.check and args.output:</span><br><span style="color: hsl(120, 100%, 40%);">+ f.close()</span><br><span style="color: hsl(120, 100%, 40%);">+ shutil.copy(args.file, args.output)</span><br><span style="color: hsl(120, 100%, 40%);">+ f = open(args.output, "r+b")</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ mef = RegionFile(f, me_start, me_end)</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ if me_start > 0:</span><br><span style="color: hsl(120, 100%, 40%);">+ fdf = RegionFile(f, fd_start, fd_end)</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ if me11:</span><br><span style="color: hsl(120, 100%, 40%);">+ fdf.seek(fpsba)</span><br><span style="color: hsl(120, 100%, 40%);">+ pchstrp0 = unpack("<I", fdf.read(4))[0]</span><br><span style="color: hsl(120, 100%, 40%);">+ print("The HAP bit is " +</span><br><span style="color: hsl(120, 100%, 40%);">+ ("SET" if pchstrp0 & 1 << 16 else "NOT SET"))</span><br><span style="color: hsl(120, 100%, 40%);">+ else:</span><br><span style="color: hsl(120, 100%, 40%);">+ fdf.seek(fpsba + 0x28)</span><br><span style="color: hsl(120, 100%, 40%);">+ pchstrp10 = unpack("<I", fdf.read(4))[0]</span><br><span style="color: hsl(120, 100%, 40%);">+ print("The AltMeDisable bit is " +</span><br><span style="color: hsl(120, 100%, 40%);">+ ("SET" if pchstrp10 & 1 << 7 else "NOT SET"))</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ # ME 6 Ignition: wipe everything</span><br><span style="color: hsl(120, 100%, 40%);">+ me6_ignition = False</span><br><span style="color: hsl(120, 100%, 40%);">+ if not args.check and not args.soft_disable_only and \</span><br><span style="color: hsl(120, 100%, 40%);">+ variant == "ME" and version[0] == 6:</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.seek(ftpr_offset + 0x20)</span><br><span style="color: hsl(120, 100%, 40%);">+ num_modules = unpack("<I", mef.read(4))[0]</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.seek(ftpr_offset + 0x290 + (num_modules + 1) * 0x60)</span><br><span style="color: hsl(120, 100%, 40%);">+ data = mef.read(0xc)</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ if data[0x0:0x4] == b"$SKU" and data[0x8:0xc] == b"\x00\x00\x00\x00":</span><br><span style="color: hsl(120, 100%, 40%);">+ print("ME 6 Ignition firmware detected, removing everything...")</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.fill_all(b"\xff")</span><br><span style="color: hsl(120, 100%, 40%);">+ me6_ignition = True</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span> if not args.check:</span><br><span style="color: hsl(0, 100%, 40%);">- if args.output:</span><br><span style="color: hsl(0, 100%, 40%);">- f.close()</span><br><span style="color: hsl(0, 100%, 40%);">- shutil.copy(args.file, args.output)</span><br><span style="color: hsl(0, 100%, 40%);">- f = open(args.output, "r+b")</span><br><span style="color: hsl(120, 100%, 40%);">+ if not args.soft_disable_only and not me6_ignition:</span><br><span style="color: hsl(120, 100%, 40%);">+ print("Reading partitions list...")</span><br><span style="color: hsl(120, 100%, 40%);">+ unremovable_part_fpt = b""</span><br><span style="color: hsl(120, 100%, 40%);">+ extra_part_end = 0</span><br><span style="color: hsl(120, 100%, 40%);">+ whitelist = []</span><br><span style="color: hsl(120, 100%, 40%);">+ blacklist = []</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- mef = RegionFile(f, me_start, me_end)</span><br><span style="color: hsl(120, 100%, 40%);">+ whitelist += unremovable_partitions</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- if args.descriptor or args.extract_descriptor:</span><br><span style="color: hsl(0, 100%, 40%);">- fdf = RegionFile(f, fd_start, fd_end)</span><br><span style="color: hsl(120, 100%, 40%);">+ if args.blacklist:</span><br><span style="color: hsl(120, 100%, 40%);">+ blacklist = args.blacklist.split(",")</span><br><span style="color: hsl(120, 100%, 40%);">+ elif args.whitelist:</span><br><span style="color: hsl(120, 100%, 40%);">+ whitelist += args.whitelist.split(",")</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- print("Removing extra partitions...")</span><br><span style="color: hsl(0, 100%, 40%);">- mef.fill_range(me_start + 0x30, ftpr_offset, b"\xff")</span><br><span style="color: hsl(0, 100%, 40%);">- mef.fill_range(ftpr_offset + ftpr_lenght, me_end, b"\xff")</span><br><span style="color: hsl(120, 100%, 40%);">+ for i in range(entries):</span><br><span style="color: hsl(120, 100%, 40%);">+ partition = partitions[i * 0x20:(i + 1) * 0x20]</span><br><span style="color: hsl(120, 100%, 40%);">+ flags = unpack("<I", partition[0x1c:0x20])[0]</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- print("Removing extra partition entries in FPT...")</span><br><span style="color: hsl(0, 100%, 40%);">- mef.write_to(me_start + 0x30, ftpr_header)</span><br><span style="color: hsl(0, 100%, 40%);">- mef.write_to(me_start + 0x14, pack("<I", 1))</span><br><span style="color: hsl(120, 100%, 40%);">+ try:</span><br><span style="color: hsl(120, 100%, 40%);">+ part_name = \</span><br><span style="color: hsl(120, 100%, 40%);">+ partition[0x0:0x4].rstrip(b"\x00").decode("ascii")</span><br><span style="color: hsl(120, 100%, 40%);">+ except UnicodeDecodeError:</span><br><span style="color: hsl(120, 100%, 40%);">+ part_name = "????"</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- print("Removing EFFS presence flag...")</span><br><span style="color: hsl(0, 100%, 40%);">- mef.seek(me_start + 0x24)</span><br><span style="color: hsl(0, 100%, 40%);">- flags = unpack("<I", mef.read(4))[0]</span><br><span style="color: hsl(0, 100%, 40%);">- flags &= ~(0x00000001)</span><br><span style="color: hsl(0, 100%, 40%);">- mef.write_to(me_start + 0x24, pack("<I", flags))</span><br><span style="color: hsl(120, 100%, 40%);">+ part_start, part_length = unpack("<II", partition[0x08:0x10])</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- if me11:</span><br><span style="color: hsl(0, 100%, 40%);">- mef.seek(me_start + 0x10)</span><br><span style="color: hsl(0, 100%, 40%);">- header = bytearray(mef.read(0x20))</span><br><span style="color: hsl(0, 100%, 40%);">- header[0x0b] = 0x00</span><br><span style="color: hsl(0, 100%, 40%);">- else:</span><br><span style="color: hsl(0, 100%, 40%);">- mef.seek(me_start)</span><br><span style="color: hsl(0, 100%, 40%);">- header = bytearray(mef.read(0x30))</span><br><span style="color: hsl(0, 100%, 40%);">- header[0x1b] = 0x00</span><br><span style="color: hsl(0, 100%, 40%);">- checksum = (0x100 - sum(header) & 0xff) & 0xff</span><br><span style="color: hsl(120, 100%, 40%);">+ # ME 6: the last partition has 0xffffffff as size</span><br><span style="color: hsl(120, 100%, 40%);">+ if variant == "ME" and version[0] == 6 and \</span><br><span style="color: hsl(120, 100%, 40%);">+ i == entries - 1 and part_length == 0xffffffff:</span><br><span style="color: hsl(120, 100%, 40%);">+ part_length = me_end - me_start - part_start</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- print("Correcting checksum (0x{:02x})...".format(checksum))</span><br><span style="color: hsl(0, 100%, 40%);">- # The checksum is just the two's complement of the sum of the first</span><br><span style="color: hsl(0, 100%, 40%);">- # 0x30 bytes in ME < 11 or bytes 0x10:0x30 in ME >= 11 (except for</span><br><span style="color: hsl(0, 100%, 40%);">- # 0x1b, the checksum itself). In other words, the sum of those bytes</span><br><span style="color: hsl(0, 100%, 40%);">- # must be always 0x00.</span><br><span style="color: hsl(0, 100%, 40%);">- mef.write_to(me_start + 0x1b, pack("B", checksum))</span><br><span style="color: hsl(120, 100%, 40%);">+ part_end = part_start + part_length</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- print("Reading FTPR modules list...")</span><br><span style="color: hsl(0, 100%, 40%);">- if me11:</span><br><span style="color: hsl(0, 100%, 40%);">- end_addr, ftpr_offset = \</span><br><span style="color: hsl(0, 100%, 40%);">- check_and_remove_modules_me11(mef, me_start, me_end,</span><br><span style="color: hsl(0, 100%, 40%);">- ftpr_offset, ftpr_lenght,</span><br><span style="color: hsl(0, 100%, 40%);">- min_ftpr_offset, args.relocate,</span><br><span style="color: hsl(0, 100%, 40%);">- args.keep_modules)</span><br><span style="color: hsl(0, 100%, 40%);">- else:</span><br><span style="color: hsl(0, 100%, 40%);">- end_addr, ftpr_offset = \</span><br><span style="color: hsl(0, 100%, 40%);">- check_and_remove_modules(mef, me_start, me_end, ftpr_offset,</span><br><span style="color: hsl(0, 100%, 40%);">- min_ftpr_offset, args.relocate,</span><br><span style="color: hsl(0, 100%, 40%);">- args.keep_modules)</span><br><span style="color: hsl(120, 100%, 40%);">+ if flags & 0x7f == 2:</span><br><span style="color: hsl(120, 100%, 40%);">+ print(" {:<4} ({:^24}, 0x{:08x} total bytes): nothing to "</span><br><span style="color: hsl(120, 100%, 40%);">+ "remove"</span><br><span style="color: hsl(120, 100%, 40%);">+ .format(part_name, "NVRAM partition, no data",</span><br><span style="color: hsl(120, 100%, 40%);">+ part_length))</span><br><span style="color: hsl(120, 100%, 40%);">+ elif part_start == 0 or part_length == 0 or part_end > me_end:</span><br><span style="color: hsl(120, 100%, 40%);">+ print(" {:<4} ({:^24}, 0x{:08x} total bytes): nothing to "</span><br><span style="color: hsl(120, 100%, 40%);">+ "remove"</span><br><span style="color: hsl(120, 100%, 40%);">+ .format(part_name, "no data here", part_length))</span><br><span style="color: hsl(120, 100%, 40%);">+ else:</span><br><span style="color: hsl(120, 100%, 40%);">+ print(" {:<4} (0x{:08x} - 0x{:09x}, 0x{:08x} total bytes): "</span><br><span style="color: hsl(120, 100%, 40%);">+ .format(part_name, part_start, part_end, part_length),</span><br><span style="color: hsl(120, 100%, 40%);">+ end="")</span><br><span style="color: hsl(120, 100%, 40%);">+ if part_name in whitelist or (blacklist and</span><br><span style="color: hsl(120, 100%, 40%);">+ part_name not in blacklist):</span><br><span style="color: hsl(120, 100%, 40%);">+ unremovable_part_fpt += partition</span><br><span style="color: hsl(120, 100%, 40%);">+ if part_name != "FTPR":</span><br><span style="color: hsl(120, 100%, 40%);">+ extra_part_end = max(extra_part_end, part_end)</span><br><span style="color: hsl(120, 100%, 40%);">+ print("NOT removed")</span><br><span style="color: hsl(120, 100%, 40%);">+ else:</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.fill_range(part_start, part_end, b"\xff")</span><br><span style="color: hsl(120, 100%, 40%);">+ print("removed")</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- if end_addr > 0:</span><br><span style="color: hsl(0, 100%, 40%);">- end_addr = (end_addr // 0x1000 + 1) * 0x1000</span><br><span style="color: hsl(0, 100%, 40%);">- end_addr += spared_blocks * 0x1000</span><br><span style="color: hsl(120, 100%, 40%);">+ print("Removing partition entries in FPT...")</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.write_to(0x30, unremovable_part_fpt)</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.write_to(0x14,</span><br><span style="color: hsl(120, 100%, 40%);">+ pack("<I", len(unremovable_part_fpt) // 0x20))</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- print("The ME minimum size should be {0} bytes "</span><br><span style="color: hsl(0, 100%, 40%);">- "({0:#x} bytes)".format(end_addr - me_start))</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.fill_range(0x30 + len(unremovable_part_fpt),</span><br><span style="color: hsl(120, 100%, 40%);">+ 0x30 + len(partitions), b"\xff")</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- if me_start > 0:</span><br><span style="color: hsl(0, 100%, 40%);">- print("The ME region can be reduced up to:\n"</span><br><span style="color: hsl(0, 100%, 40%);">- " {:08x}:{:08x} me".format(me_start, end_addr - 1))</span><br><span style="color: hsl(0, 100%, 40%);">- elif args.truncate:</span><br><span style="color: hsl(0, 100%, 40%);">- print("Truncating file at {:#x}...".format(end_addr))</span><br><span style="color: hsl(0, 100%, 40%);">- f.truncate(end_addr)</span><br><span style="color: hsl(120, 100%, 40%);">+ if (not blacklist and "EFFS" not in whitelist) or \</span><br><span style="color: hsl(120, 100%, 40%);">+ "EFFS" in blacklist:</span><br><span style="color: hsl(120, 100%, 40%);">+ print("Removing EFFS presence flag...")</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.seek(0x24)</span><br><span style="color: hsl(120, 100%, 40%);">+ flags = unpack("<I", mef.read(4))[0]</span><br><span style="color: hsl(120, 100%, 40%);">+ flags &= ~(0x00000001)</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.write_to(0x24, pack("<I", flags))</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ if me11:</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.seek(0x10)</span><br><span style="color: hsl(120, 100%, 40%);">+ header = bytearray(mef.read(0x20))</span><br><span style="color: hsl(120, 100%, 40%);">+ header[0x0b] = 0x00</span><br><span style="color: hsl(120, 100%, 40%);">+ else:</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.seek(0)</span><br><span style="color: hsl(120, 100%, 40%);">+ header = bytearray(mef.read(0x30))</span><br><span style="color: hsl(120, 100%, 40%);">+ header[0x1b] = 0x00</span><br><span style="color: hsl(120, 100%, 40%);">+ checksum = (0x100 - sum(header) & 0xff) & 0xff</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ print("Correcting checksum (0x{:02x})...".format(checksum))</span><br><span style="color: hsl(120, 100%, 40%);">+ # The checksum is just the two's complement of the sum of the first</span><br><span style="color: hsl(120, 100%, 40%);">+ # 0x30 bytes in ME < 11 or bytes 0x10:0x30 in ME >= 11 (except for</span><br><span style="color: hsl(120, 100%, 40%);">+ # 0x1b, the checksum itself). In other words, the sum of those</span><br><span style="color: hsl(120, 100%, 40%);">+ # bytes must be always 0x00.</span><br><span style="color: hsl(120, 100%, 40%);">+ mef.write_to(0x1b, pack("B", checksum))</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ print("Reading FTPR modules list...")</span><br><span style="color: hsl(120, 100%, 40%);">+ if me11:</span><br><span style="color: hsl(120, 100%, 40%);">+ end_addr, ftpr_offset = \</span><br><span style="color: hsl(120, 100%, 40%);">+ check_and_remove_modules_me11(mef, me_end,</span><br><span style="color: hsl(120, 100%, 40%);">+ ftpr_offset, ftpr_length,</span><br><span style="color: hsl(120, 100%, 40%);">+ min_ftpr_offset,</span><br><span style="color: hsl(120, 100%, 40%);">+ args.relocate,</span><br><span style="color: hsl(120, 100%, 40%);">+ args.keep_modules)</span><br><span style="color: hsl(120, 100%, 40%);">+ else:</span><br><span style="color: hsl(120, 100%, 40%);">+ end_addr, ftpr_offset = \</span><br><span style="color: hsl(120, 100%, 40%);">+ check_and_remove_modules(mef, me_end, ftpr_offset,</span><br><span style="color: hsl(120, 100%, 40%);">+ min_ftpr_offset, args.relocate,</span><br><span style="color: hsl(120, 100%, 40%);">+ args.keep_modules)</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ if end_addr > 0:</span><br><span style="color: hsl(120, 100%, 40%);">+ end_addr = max(end_addr, extra_part_end)</span><br><span style="color: hsl(120, 100%, 40%);">+ end_addr = (end_addr // 0x1000 + 1) * 0x1000</span><br><span style="color: hsl(120, 100%, 40%);">+ end_addr += spared_blocks * 0x1000</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ print("The ME minimum size should be {0} bytes "</span><br><span style="color: hsl(120, 100%, 40%);">+ "({0:#x} bytes)".format(end_addr))</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ if me_start > 0:</span><br><span style="color: hsl(120, 100%, 40%);">+ print("The ME region can be reduced up to:\n"</span><br><span style="color: hsl(120, 100%, 40%);">+ " {:08x}:{:08x} me"</span><br><span style="color: hsl(120, 100%, 40%);">+ .format(me_start, me_start + end_addr - 1))</span><br><span style="color: hsl(120, 100%, 40%);">+ elif args.truncate:</span><br><span style="color: hsl(120, 100%, 40%);">+ print("Truncating file at {:#x}...".format(end_addr))</span><br><span style="color: hsl(120, 100%, 40%);">+ f.truncate(end_addr)</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ if args.soft_disable or args.soft_disable_only:</span><br><span style="color: hsl(120, 100%, 40%);">+ if me11:</span><br><span style="color: hsl(120, 100%, 40%);">+ print("Setting the HAP bit in PCHSTRP0 to disable Intel ME...")</span><br><span style="color: hsl(120, 100%, 40%);">+ pchstrp0 |= (1 << 16)</span><br><span style="color: hsl(120, 100%, 40%);">+ fdf.write_to(fpsba, pack("<I", pchstrp0))</span><br><span style="color: hsl(120, 100%, 40%);">+ else:</span><br><span style="color: hsl(120, 100%, 40%);">+ print("Setting the AltMeDisable bit in PCHSTRP10 to disable "</span><br><span style="color: hsl(120, 100%, 40%);">+ "Intel ME...")</span><br><span style="color: hsl(120, 100%, 40%);">+ pchstrp10 |= (1 << 7)</span><br><span style="color: hsl(120, 100%, 40%);">+ fdf.write_to(fpsba + 0x28, pack("<I", pchstrp10))</span><br><span> </span><br><span> if args.descriptor:</span><br><span> print("Removing ME/TXE R/W access to the other flash regions...")</span><br><span style="color: hsl(0, 100%, 40%);">- fdf.write_to(fmba + 0x4, pack("<I", 0x04040000))</span><br><span style="color: hsl(120, 100%, 40%);">+ if me11:</span><br><span style="color: hsl(120, 100%, 40%);">+ flmstr2 = 0x00400500</span><br><span style="color: hsl(120, 100%, 40%);">+ else:</span><br><span style="color: hsl(120, 100%, 40%);">+ fdf.seek(fmba + 0x4)</span><br><span style="color: hsl(120, 100%, 40%);">+ flmstr2 = (unpack("<I", fdf.read(4))[0] | 0x04040000) & 0x0404ffff</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ fdf.write_to(fmba + 0x4, pack("<I", flmstr2))</span><br><span> </span><br><span> if args.extract_descriptor:</span><br><span> if args.truncate:</span><br><span>@@ -664,12 +846,14 @@</span><br><span> if bios_start == me_end:</span><br><span> print("Modifying the regions of the extracted descriptor...")</span><br><span> print(" {:08x}:{:08x} me --> {:08x}:{:08x} me"</span><br><span style="color: hsl(0, 100%, 40%);">- .format(me_start, me_end - 1, me_start, end_addr - 1))</span><br><span style="color: hsl(120, 100%, 40%);">+ .format(me_start, me_end - 1,</span><br><span style="color: hsl(120, 100%, 40%);">+ me_start, me_start + end_addr - 1))</span><br><span> print(" {:08x}:{:08x} bios --> {:08x}:{:08x} bios"</span><br><span style="color: hsl(0, 100%, 40%);">- .format(bios_start, bios_end - 1, end_addr, bios_end - 1))</span><br><span style="color: hsl(120, 100%, 40%);">+ .format(bios_start, bios_end - 1,</span><br><span style="color: hsl(120, 100%, 40%);">+ me_start + end_addr, bios_end - 1))</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- flreg1 = start_end_to_flreg(end_addr, bios_end)</span><br><span style="color: hsl(0, 100%, 40%);">- flreg2 = start_end_to_flreg(me_start, end_addr)</span><br><span style="color: hsl(120, 100%, 40%);">+ flreg1 = start_end_to_flreg(me_start + end_addr, bios_end)</span><br><span style="color: hsl(120, 100%, 40%);">+ flreg2 = start_end_to_flreg(me_start, me_start + end_addr)</span><br><span> </span><br><span> fdf_copy.seek(frba + 0x4)</span><br><span> fdf_copy.write(pack("<II", flreg1, flreg2))</span><br><span>@@ -678,31 +862,33 @@</span><br><span> "isn't equal to the end address of the ME\n region: if "</span><br><span> "you want to recover the space from the ME region you "</span><br><span> "have to\n manually modify the descriptor.\n")</span><br><span style="color: hsl(0, 100%, 40%);">-</span><br><span style="color: hsl(0, 100%, 40%);">- fdf_copy.close()</span><br><span> else:</span><br><span> print("Extracting the descriptor to \"{}\"..."</span><br><span> .format(args.extract_descriptor))</span><br><span style="color: hsl(0, 100%, 40%);">- fdf.save(args.extract_descriptor, fd_end - fd_start).close()</span><br><span style="color: hsl(120, 100%, 40%);">+ fdf_copy = fdf.save(args.extract_descriptor, fd_end - fd_start)</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ fdf_copy.close()</span><br><span> </span><br><span> if args.extract_me:</span><br><span> if args.truncate:</span><br><span> print("Extracting and truncating the ME image to \"{}\"..."</span><br><span> .format(args.extract_me))</span><br><span style="color: hsl(0, 100%, 40%);">- mef_copy = mef.save(args.extract_me, end_addr - me_start)</span><br><span style="color: hsl(120, 100%, 40%);">+ mef_copy = mef.save(args.extract_me, end_addr)</span><br><span> else:</span><br><span> print("Extracting the ME image to \"{}\"..."</span><br><span> .format(args.extract_me))</span><br><span> mef_copy = mef.save(args.extract_me, me_end - me_start)</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- sys.stdout.write("Checking the FTPR RSA signature of the extracted ME "</span><br><span style="color: hsl(0, 100%, 40%);">- "image... ")</span><br><span style="color: hsl(0, 100%, 40%);">- print_check_partition_signature(mef_copy, ftpr_offset +</span><br><span style="color: hsl(0, 100%, 40%);">- ftpr_mn2_offset - me_start)</span><br><span style="color: hsl(120, 100%, 40%);">+ if not me6_ignition:</span><br><span style="color: hsl(120, 100%, 40%);">+ print("Checking the FTPR RSA signature of the extracted ME "</span><br><span style="color: hsl(120, 100%, 40%);">+ "image... ", end="")</span><br><span style="color: hsl(120, 100%, 40%);">+ print_check_partition_signature(mef_copy,</span><br><span style="color: hsl(120, 100%, 40%);">+ ftpr_offset + ftpr_mn2_offset)</span><br><span> mef_copy.close()</span><br><span> </span><br><span style="color: hsl(0, 100%, 40%);">- sys.stdout.write("Checking the FTPR RSA signature... ")</span><br><span style="color: hsl(0, 100%, 40%);">- print_check_partition_signature(f, ftpr_offset + ftpr_mn2_offset)</span><br><span style="color: hsl(120, 100%, 40%);">+ if not me6_ignition:</span><br><span style="color: hsl(120, 100%, 40%);">+ print("Checking the FTPR RSA signature... ", end="")</span><br><span style="color: hsl(120, 100%, 40%);">+ print_check_partition_signature(mef, ftpr_offset + ftpr_mn2_offset)</span><br><span> </span><br><span> f.close()</span><br><span> </span><br><span>diff --git a/util/me_cleaner/setup.py b/util/me_cleaner/setup.py</span><br><span>new file mode 100755</span><br><span>index 0000000..9928e5d</span><br><span>--- /dev/null</span><br><span>+++ b/util/me_cleaner/setup.py</span><br><span>@@ -0,0 +1,23 @@</span><br><span style="color: hsl(120, 100%, 40%);">+#!/usr/bin/python</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+from setuptools import setup</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+setup(</span><br><span style="color: hsl(120, 100%, 40%);">+ name="me_cleaner",</span><br><span style="color: hsl(120, 100%, 40%);">+ version="1.2",</span><br><span style="color: hsl(120, 100%, 40%);">+ description="Tool for partial deblobbing of Intel ME/TXE firmware images",</span><br><span style="color: hsl(120, 100%, 40%);">+ url="https://github.com/corna/me_cleaner",</span><br><span style="color: hsl(120, 100%, 40%);">+ author="Nicola Corna",</span><br><span style="color: hsl(120, 100%, 40%);">+ author_email="nicola@corna.info",</span><br><span style="color: hsl(120, 100%, 40%);">+ license="GPLv3+",</span><br><span style="color: hsl(120, 100%, 40%);">+ scripts=['me_cleaner.py'],</span><br><span style="color: hsl(120, 100%, 40%);">+ classifiers=[</span><br><span style="color: hsl(120, 100%, 40%);">+ 'Development Status :: 4 - Beta',</span><br><span style="color: hsl(120, 100%, 40%);">+ 'Intended Audience :: Developers',</span><br><span style="color: hsl(120, 100%, 40%);">+ 'License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)',</span><br><span style="color: hsl(120, 100%, 40%);">+ 'Operating System :: OS Independent',</span><br><span style="color: hsl(120, 100%, 40%);">+ 'Programming Language :: Python :: 2',</span><br><span style="color: hsl(120, 100%, 40%);">+ 'Programming Language :: Python :: 3',</span><br><span style="color: hsl(120, 100%, 40%);">+ ]</span><br><span style="color: hsl(120, 100%, 40%);">+)</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span></span><br></pre><p>To view, visit <a href="https://review.coreboot.org/25506">change 25506</a>. To unsubscribe, or for help writing mail filters, visit <a href="https://review.coreboot.org/settings">settings</a>.</p><div itemscope itemtype="http://schema.org/EmailMessage"><div itemscope itemprop="action" itemtype="http://schema.org/ViewAction"><link itemprop="url" href="https://review.coreboot.org/25506"/><meta itemprop="name" content="View Change"/></div></div>
<div style="display:none"> Gerrit-Project: coreboot </div>
<div style="display:none"> Gerrit-Branch: master </div>
<div style="display:none"> Gerrit-MessageType: newchange </div>
<div style="display:none"> Gerrit-Change-Id: I3d5e0d9af0a36cc7476a964cf753914c2f3df9d2 </div>
<div style="display:none"> Gerrit-Change-Number: 25506 </div>
<div style="display:none"> Gerrit-PatchSet: 1 </div>
<div style="display:none"> Gerrit-Owner: Nicola Corna <nicola@corna.info> </div>