MetalMonday/me_cleaner
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Set the HAP bit (ME >= 11) or the AltMeDisable bit (ME < 11)

Browse source 
Positive Technologies discovered the presence of an undocumented HAP bit
in the PCHSTRP0 field of the descriptor which, when set to 1, disables
completely Intel ME just after the initialization. This is confirmed both
by an analysis of the status of Intel ME after the setting of the bit and
by reverse engineering the BUP module.

More information in their blog post:
http://blog.ptsecurity.com/2017/08/disabling-intel-me.html

Moreover Igor Skochinsky discovered a bit in the PCHSTRP10, which achieves
more or less the same result as the HAP bit for ME < 11.

With this commit one of these bits is set to 1: instead of halting due to
corrupted modules, Intel ME now halts before trying to load them, possibly
leading to a cleaner shutoff of the ME subsystem.
This commit is contained in:
Nicola Corna 2017-08-28 18:41:49 +02:00
parent 5ffeaffb40
commit ced3b46ba2
1 changed files with 17 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
me_cleaner.py
View file

@ -501,6 +501,7 @@ if __name__ == "__main__":
flmap0, flmap1 = unpack("<II", f.read(8))
frba = flmap0 >> 12 & 0xff0
fmba = (flmap1 & 0xff) << 4
fpsba = flmap1 >> 12 & 0xff0
f.seek(frba)
flreg = unpack("<III", f.read(12))
@ -590,7 +591,7 @@ if __name__ == "__main__":
mef = RegionFile(f, me_start, me_end)
if args.descriptor or args.extract_descriptor:
if me_start > 0:
fdf = RegionFile(f, fd_start, fd_end)
print("Removing extra partitions...")
@ -651,6 +652,21 @@ if __name__ == "__main__":
print("Truncating file at {:#x}...".format(end_addr))
f.truncate(end_addr)
if me_start > 0:
if me11:
print("Setting the HAP bit in PCHSTRP0 to disable Intel ME...")
fdf.seek(fpsba)
pchstrp0 = unpack("<I", fdf.read(4))[0]
pchstrp0 |= (1 << 16)
fdf.write_to(fpsba, pack("<I", pchstrp0))
else:
print("Setting the AltMeDisable bit in PCHSTRP10 to disable "
"Intel ME...")
fdf.seek(fpsba + 0x28)
pchstrp10 = unpack("<I", fdf.read(4))[0]
pchstrp10 |= (1 << 7)
fdf.write_to(fpsba + 0x28, pack("<I", pchstrp10))
if args.descriptor:
print("Removing ME/TXE R/W access to the other flash regions...")
fdf.write_to(fmba + 0x4, pack("<I", 0x04040000))