|
|
@@ -0,0 +1,159 @@
|
|
|
+.TH me_cleaner 1 "MARCH 2018"
|
|
|
+.SH me_cleaner
|
|
|
+.PP
|
|
|
+me_cleaner \- Tool for partial deblobbing of Intel ME/TXE firmware images
|
|
|
+.SH SYNOPSIS
|
|
|
+.PP
|
|
|
+\fB\fCme_cleaner.py\fR [\-h] [\-v] [\-O output_file] [\-S | \-s] [\-r] [\-k]
|
|
|
+[\-w whitelist | \-b blacklist] [\-d] [\-t] [\-c] [\-D output_descriptor]
|
|
|
+[\-M output_me_image] \fIfile\fP
|
|
|
+.SH DESCRIPTION
|
|
|
+.PP
|
|
|
+\fB\fCme_cleaner\fR is a tool able to disable parts of Intel ME/TXE by:
|
|
|
+.RS
|
|
|
+.IP \(bu 2
|
|
|
+removing most of the code from its firmware
|
|
|
+.IP \(bu 2
|
|
|
+setting a special bit to force it to disable itself after the hardware
|
|
|
+initialization
|
|
|
+.RE
|
|
|
+.PP
|
|
|
+Using both the modes seems to be the most reliable way on many platforms.
|
|
|
+.PP
|
|
|
+The resulting modified firmware needs to be flashed (in most of the cases) with
|
|
|
+an external programmer, often a dedicated SPI programmer or a Linux board with
|
|
|
+a SPI master interface.
|
|
|
+.PP
|
|
|
+\fB\fCme_cleaner\fR works at least from Nehalem to Coffee Lake (for Intel ME) and on
|
|
|
+Braswell/Cherry Trail (for Intel TXE), but may work as well on newer or
|
|
|
+different architectures.
|
|
|
+.PP
|
|
|
+While \fB\fCme_cleaner\fR have been tested on a great number of platforms, fiddling
|
|
|
+with the Intel ME/TXE firmware is \fIvery dangerous\fP and can easily lead to a
|
|
|
+dead PC.
|
|
|
+.PP
|
|
|
+\fIYOU HAVE BEEN WARNED.\fP
|
|
|
+.SH POSITIONAL ARGUMENTS
|
|
|
+.TP
|
|
|
+\fB\fCfile\fR
|
|
|
+ME/TXE image or full dump.
|
|
|
+.SH OPTIONAL ARGUMENTS
|
|
|
+.TP
|
|
|
+\fB\fC\-h\fR, \fB\fC\-\-help\fR
|
|
|
+Show the help message and exit.
|
|
|
+.TP
|
|
|
+\fB\fC\-v\fR, \fB\fC\-\-version\fR
|
|
|
+Show program's version number and exit.
|
|
|
+.TP
|
|
|
+\fB\fC\-O\fR, \fB\fC\-\-output\fR
|
|
|
+Save the modified image in a separate file, instead of modifying the
|
|
|
+original file.
|
|
|
+.TP
|
|
|
+\fB\fC\-S\fR, \fB\fC\-\-soft\-disable\fR
|
|
|
+In addition to the usual operations on the ME/TXE firmware, set the
|
|
|
+MeAltDisable bit or the HAP bit to ask Intel ME/TXE to disable itself after
|
|
|
+the hardware initialization (requires a full dump).
|
|
|
+.TP
|
|
|
+\fB\fC\-s\fR, \fB\fC\-\-soft\-disable\-only\fR
|
|
|
+Instead of the usual operations on the ME/TXE firmware, just set the
|
|
|
+MeAltDisable bit or the HAP bit to ask Intel ME/TXE to disable itself after
|
|
|
+the hardware initialization (requires a full dump).
|
|
|
+.TP
|
|
|
+\fB\fC\-r\fR, \fB\fC\-\-relocate\fR
|
|
|
+Relocate the FTPR partition to the top of the ME region to save even more
|
|
|
+space.
|
|
|
+.TP
|
|
|
+\fB\fC\-t\fR, \fB\fC\-\-truncate\fR
|
|
|
+Truncate the empty part of the firmware (requires a separated ME/TXE image or
|
|
|
+\fB\fC\-\-extract\-me\fR).
|
|
|
+.TP
|
|
|
+\fB\fC\-k\fR, \fB\fC\-\-keep\-modules\fR
|
|
|
+Don't remove the FTPR modules, even when possible.
|
|
|
+.TP
|
|
|
+\fB\fC\-w\fR, \fB\fC\-\-whitelist\fR
|
|
|
+Comma separated list of additional partitions to keep in the final image.
|
|
|
+This can be used to specify the MFS partition for example, which stores PCIe
|
|
|
+and clock settings.
|
|
|
+.TP
|
|
|
+\fB\fC\-b\fR, \fB\fC\-\-blacklist\fR
|
|
|
+Comma separated list of partitions to remove from the image. This option
|
|
|
+overrides the default removal list.
|
|
|
+.TP
|
|
|
+\fB\fC\-d\fR, \fB\fC\-\-descriptor\fR
|
|
|
+Remove the ME/TXE Read/Write permissions to the other regions on the flash
|
|
|
+from the Intel Flash Descriptor (requires a full dump).
|
|
|
+.TP
|
|
|
+\fB\fC\-D\fR, \fB\fC\-\-extract\-descriptor\fR
|
|
|
+Extract the flash descriptor from a full dump; when used with \fB\fC\-\-truncate\fR
|
|
|
+save a descriptor with adjusted regions start and end.
|
|
|
+.TP
|
|
|
+\fB\fC\-M\fR, \fB\fC\-\-extract\-me\fR
|
|
|
+Extract the ME firmware from a full dump; when used with \fB\fC\-\-truncate\fR save a
|
|
|
+truncated ME/TXE image.
|
|
|
+.TP
|
|
|
+\fB\fC\-c\fR, \fB\fC\-\-check\fR
|
|
|
+Verify the integrity of the fundamental parts of the firmware and exit.
|
|
|
+.SH SUPPORTED PLATFORMS
|
|
|
+.PP
|
|
|
+Currently \fB\fCme_cleaner\fR has been tested on the following platforms:
|
|
|
+.TS
|
|
|
+allbox;
|
|
|
+cb cb cb cb
|
|
|
+c c c c
|
|
|
+c c c c
|
|
|
+c c c c
|
|
|
+c c c c
|
|
|
+c c c c
|
|
|
+c c c c
|
|
|
+c c c c
|
|
|
+c c c c
|
|
|
+.
|
|
|
+PCH CPU ME SKU
|
|
|
+Ibex Peak * Nehalem/Westmere 6.0 Ignition
|
|
|
+Ibex Peak * Nehalem/Westmere 6.x 1.5/5 MB
|
|
|
+Cougar Point Sandy Bridge 7.x 1.5/5 MB
|
|
|
+Panther Point Ivy Bridge 8.x 1.5/5 MB
|
|
|
+Lynx/Wildcat Point Haswell/Broadwell 9.x 1.5/5 MB
|
|
|
+Wildcat Point LP Broadwell Mobile 10.0 1.5/5 MB
|
|
|
+Sunrise Point Skylake/Kabylake 11.x CON/COR
|
|
|
+Union Point Kabylake 11.x CON/COR
|
|
|
+.TE
|
|
|
+.TS
|
|
|
+allbox;
|
|
|
+cb cb cb
|
|
|
+c c c
|
|
|
+.
|
|
|
+SoC TXE SKU
|
|
|
+Braswell/Cherry Trail 2.x 1.375 MB
|
|
|
+.TE
|
|
|
+.PP
|
|
|
+* Not working on coreboot
|
|
|
+.PP
|
|
|
+All the reports are available on the project's GitHub page \[la]https://github.com/corna/me_cleaner/issues/3\[ra]\&.
|
|
|
+.SH EXAMPLES
|
|
|
+.PP
|
|
|
+Check whether the provided image has a valid structure and signature:
|
|
|
+.IP
|
|
|
+\fB\fCme_cleaner.py \-c dumped_firmware.bin\fR
|
|
|
+.PP
|
|
|
+Remove most of the Intel ME firmware modules but don't set the HAP/AltMeDisable
|
|
|
+bit:
|
|
|
+.IP
|
|
|
+\fB\fCme_cleaner.py \-S \-O modified_me_firmware.bin dumped_firmware.bin\fR
|
|
|
+.PP
|
|
|
+Remove most of the Intel ME firmware modules and set the HAP/AltMeDisable bit,
|
|
|
+disable the Read/Write access of Intel ME to the other flash region, then
|
|
|
+relocate the code to the top of the image and truncate it, extracting a modified
|
|
|
+descriptor and ME image:
|
|
|
+.IP
|
|
|
+\fB\fCme_cleaner.py \-S \-r \-t \-d \-D ifd_shrinked.bin \-M me_shrinked.bin \-O modified_firmware.bin full_dumped_firmware.bin\fR
|
|
|
+.SH BUGS
|
|
|
+.PP
|
|
|
+Bugs should be reported on the project's GitHub page \[la]https://github.com/corna/me_cleaner\[ra]\&.
|
|
|
+.SH AUTHOR
|
|
|
+.PP
|
|
|
+Nicola Corna \[la]nicola@corna.info\[ra]
|
|
|
+.SH SEE ALSO
|
|
|
+.PP
|
|
|
+.BR flashrom (8),
|
|
|
+me_cleaner's Wiki \[la]https://github.com/corna/me_cleaner/wiki\[ra]
|
Nicola Corna