me_cleaner
me_cleaner copied to clipboard
Wiki article proposal: Internal flashing via FPT
I have wrote an article that describes a method of internal flashing that was not fully described for disabling ME before, considering it would ideally fit as a new flashing method for me_cleaner wiki:
Neutralizing Intel ME via internal flashing with Intel FPT - https://github.com/mostav02/me_cleaner_wiki/blob/master/Internal-flashing-with-FPT.md
My intention to research this method was because I had some laptops around and wanted to disable Intel ME on them, but since I am a software developer that is not a big fan of messing with external programmers and hardware in general, I presumed that Intel Flash Programming Tool would be able to perform the same task as people do with external programmers.
Lurking around issues in this repo I have found the issue Disable ME by setting HDA_SDO pin high? #135, which made me reading some Intel datasheets that mention "HDA_SDO" and turned out there was a lot of information around on this already.
Since the main challenge of internal flashing is unlocking the flash descriptor, I have found that this method worked perfectly on all my machines (that I reported recently in #3) so I decided to make the detailed guide and I think this could serve a lot for people who are not familiar with external chip programming or just don't have the necessary hardware by hand.
Moreover, I think this method should be preferred over external programming due to its relative safety, let me show its cons and pros:
PROS:
- Intel PCH SPI is the original and built-in programming interface for your motherboard, thus the risks are equal to upgrading the BIOS
- Data consistency and integrity / Possibility of making an original full flash dump without garbled data
- Increased simplicity
- Programming speed
- No risk of damage by overvoltage / reversed polatity / accident shorting / wrong pinout unlike during in-circuit external programming
- No pins wear by soldering/unsoldering the chip unlike during off-circuit external programming
- More ergonomic when performing a reverse engineering research (however, in that specific case an external programmer is still needed because bricks are inevitable)
CONS:
- Less forgiving than doing external programming. In case of brick you will need to use an external programmer to restore the dump (which was supposed to be made)
- Still requires an external programming if you're performing a reverse engineering task (however may require less interaction with the external programmer, depending on the bricking frequency, so it's a con at the same time)
- FD unlocking method may be a subject to additional research
Please consider adding this guide to the wiki. (There is no way of making PR's for wiki in a repo on Github thus this needs to be done manually)
@mostav02 just wanted to say I followed your guide and was able to flash a HAP disable FD. The Linux FPT didn't work, but I created a bootable DOS disk and it did. Thanks!