Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

me_cleaner status #3

Open
corna opened this issue Nov 28, 2016 · 465 comments
Open

me_cleaner status #3

corna opened this issue Nov 28, 2016 · 465 comments

Comments

@corna
Copy link
Owner

corna commented Nov 28, 2016

Please comment here if me_cleaner works on your device.
If this tool does not work on your PC (or it does not behave as expected), don't comment here but open an issue instead.
Specify:

  • CPU architecture
  • CPU model
  • Laptop/motherboard
  • OEM BIOS or coreboot?
  • If you used the -s/-S flag in me_cleaner

Thanks

@corna
Copy link
Owner Author

corna commented Nov 28, 2016

Working on:

  • Intel Core i5-2520M
  • Sandy Bridge
  • Lenovo Thinkpad X220
  • coreboot
  • both with and without the -S flag

Working for more than a month now. Everything works perfectly, and the MEI device has disappeared from the PCI bus.

@afics
Copy link

afics commented Nov 29, 2016

  • Sandy Bridge
  • Lenovo Thinkpad X220
  • coreboot

I can confirm it works on the Lenovo Thinkpad X220, but coreboot then recognizes only one of my two 8GB RAM modules. I'm currently investigating.

@philmb3487
Copy link

philmb3487 commented Nov 30, 2016

  • Intel Celeron 2955U
  • Haswell
  • Chromebook C720p
  • coreboot

Hey there, I build and flashed an image of coreboot for my chromebook (C720p) running a Haswell 2955U.

There is no MEI entry in the lspci list.
Not sure what other tests I can run to see the ME's state, open to running other tests, just tell me.

Passed the 30 minutes mark, seems to work. Thanks

@f-izzo
Copy link
Collaborator

f-izzo commented Dec 1, 2016

Working on:

  • Intel i5-6500
  • Skylake
  • MSI Bazooka B150M
  • Stock AMI Bios
  • 61fd606

Everything works, the HECI (formerly MEI) device disapperars, a screen at boot notifies that the ME firmware is corrupted, but pressing F2 lets the boot continue.
me_message_small

@zamaudio
Copy link
Contributor

zamaudio commented Dec 2, 2016

  • Intel
  • Core i5-2540M
  • Lenovo Thinkpad X220
  • Coreboot
  • 48deb6c

^^ Yes that's right, the experimental branch works on this board folks! No lzma modules!

@corna corna mentioned this issue Dec 12, 2016
@simonepsp
Copy link

simonepsp commented Dec 12, 2016

Working on

  • Intel Core i5 3320M
  • Ivy Bridge
  • Lenovo Thinkpad X230
  • Coreboot
  • d2e2308

@tlaurion
Copy link

tlaurion commented Dec 12, 2016

Working on

  • Intel Core i5 3320M
  • Ivy Bridge
  • Lenovo Thinkpad X230
  • Stock BIOS
  • d2e2308

@ilikenwf
Copy link

ilikenwf commented Dec 19, 2016

  • Intel Core i7 4790k
  • Haswell
  • Desktop, ASRock Z97 Pro4
  • Modded Bios (see below)
  • ffe60d8

ASRock's bios packages are all in a proprietary format, but Windows based tools, specifically the UBU pack (http://www.win-raid.com/t154f16-Tool-Guide-News-quot-UEFI-BIOS-Updater-quot-UBU.html), allow them to be extracted and the firmware inside upgraded or downgraded. One may flash this modified file directly from the UEFI settings themselves, as it doesn't validate them.

It is unclear whether or not ME is properly disabled, as the kernel module loads but is not really usable, and the tools to check ME status segfault.

Removing extra partitions...
Removing extra partition entries in FPT...
Removing EFFS presence flag...
Reading FTPR modules list...
Wiping LZMA section (0xa7680 - 0xcf000)
 UPDATE: removed (0xa7680 - 0xa78aa)
 ROMP: removal of Huffman modules is not supported yet, skipping
 BUP: removal of Huffman modules is not supported yet, skipping
 KERNEL: removal of Huffman modules is not supported yet, skipping
 POLICY: removal of Huffman modules is not supported yet, skipping
 HOSTCOMM: removed (0xa78aa - 0xafbb5)
 TDT: removed (0xafbb5 - 0xb4f71)
 FPF: removed (0xb4f71 - 0xb6a77)
Correcting checksum (0xea)...
Done! Good luck!

@ghost
Copy link

ghost commented Dec 19, 2016

BIOS file name must be same as Instant Flash bios name, or else instant flash in bios does not detect it. In this case, Z97Ex62.70

/dev/mei0 does not exist, intelmetool reports it doesnt support my system (maybe it doesn't?), mei/mei_me modules still required by some ASRock Intel ME pci listing

Of note, Intel's own "Intel® Management Engine Verification Utility" in windows is perpetually spinning, which I should have tested beforehand. Looks like that only works if your cpu supports vPro. Tested on another Intel based machine with ME still in bios.

But everything seems to be working properly so far.

Full image detected

The ME region goes from 0x3000 to 0x1fffff

Found FPT header at 0x3010

Found 20 partition(s)
ME firmware version 9.1.10.1000
Found FTPR header: FTPR partition spans from 0x4a000 to 0xd2000
Removing extra partitions...
Removing extra partition entries in FPT...
Removing EFFS presence flag...
Reading FTPR modules list...
Wiping LZMA section (0xaa680 - 0xd2000)
 UPDATE          : removed (0xaa680 - 0xaa8aa)
 ROMP            : removal of Huffman modules is not supported yet, skipping
 BUP             : removal of Huffman modules is not supported yet, skipping
 KERNEL          : removal of Huffman modules is not supported yet, skipping
 POLICY          : removal of Huffman modules is not supported yet, skipping
 HOSTCOMM        : removed (0xaa8aa - 0xb2bb5)
 TDT             : removed (0xb2bb5 - 0xb7f71)
 FPF             : removed (0xb7f71 - 0xb9a77)
Correcting checksum (0xea)...
Done! Good luck!

@nilesr
Copy link

nilesr commented Dec 19, 2016

I can try to cat /dev/mei0 and I get "no such device" as root...so I guess that's good?

On my system that I've never flashed before (I haven't used me_cleaner yet) I get the same message when trying to read from /dev/mei0. It does not mean that the ME is disabled

@n1zzo
Copy link

n1zzo commented Dec 19, 2016

Working on

  • Intel Core i5 2520M
  • Sandy Bridge
  • Dell Latitude e6220
  • OEM BIOS
  • ffe60d8

MEI is no more present in lspci output.
However, the ethernet card does not show up anymore on "ip a" output.

dmesg says:

e1000e: Intel(R) PRO/1000 Network Driver - 3.2.6-k
e1000e: Copyright(c) 1999 - 2015 Intel Corporation.
e1000e 0000:00:19.0: Interrupt Throttling Rate (ints/sec) set to dynamic conservative mode
e1000e: probe of 0000:00:19.0 failed with error -e

The problem seems identical to the one reported by this user:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/984404
and as he suggests just rebooting the machine temporarily fixes the problem.
When a power cycle is performed again (power off+power on) the ethernet
card is gone again.

This is the related bug on the ubuntu kernel bug tracker:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1576953

@citypw
Copy link

citypw commented Dec 20, 2016

Working on:

  • Intel Core i7-3770
  • IvyBridge
  • Motherboard: GA-B75M-D3V
  • OEM BIOS and Coreboot
  • ffe60d8f

OEM BIOS: MEI device has disappeared from the PCI bus.
Coreboot: MEI device won't go away and confirmed that ME is broken:

**Bad news, you have a B75 Express Chipset LPC Controller so you have ME hardware on board and you can't control or disable it, continuing...

MEI not hidden on PCI, checking if visible
MEI found: [8086:1e3a] 7 Series/C210 Series Chipset Family MEI Controller #1

ME Status : 0x304181
ME Status 2 : 0x153b0160

ME: FW Partition Table : OK
ME: Bringup Loader Failure : NO
ME: Firmware Init Complete : NO
ME: Manufacturing Mode : NO
ME: Boot Options Present : NO
ME: Update In Progress : NO
ME: Current Working State : Initializing
ME: Current Operation State : Bring up
ME: Current Operation Mode : Normal
ME: Error Code : Debug Failure
ME: Progress Phase : BUP Phase
ME: Power Management Event : Intel ME reset due to exception
ME: Progress Phase State : 0x3b

ME: Extend Register not valid

ME: has a broken implementation on your board with this BIOS
ME: failed to become ready
ME: failed to become ready
ME: GET FW VERSION message failed
ME: failed to become ready
ME: failed to become ready
ME: GET FWCAPS message failed
**

@citypw
Copy link

citypw commented Dec 24, 2016

Working on:

  • Intel Core i3-2370m
  • SandyBridge
  • Motherboard: Thinkpad x220i
  • OEM BIOS and Coreboot
  • ffe60d8f

MEI device has disappeared from the PCI bus.

@persmule
Copy link

persmule commented Dec 24, 2016

Working on:

  • Intel Core i7-3770T
  • IvyBridge
  • Motherboard: GA-B75M-D3H
  • Coreboot
  • ffe60d8

Sadly I failed to extract a valid OEM BIOS image this time. MEI device has disappeared from the PCI bus initially, but after programming back from the scheme below the MEI reappears and keeps present. ME is confirmed broken.
It seems whether ME remains present on desktop depends on the content of nvram.

@persmule
Copy link

persmule commented Dec 24, 2016

Working on:

  • Intel Core i7-3770T
  • IvyBridge
  • Motherboard: GA-B75M-D3H
  • Coreboot
  • ffe60d8
  • Neutralized ME from SnB/IvB laptop (e.g. samsung lumpy's ME image located at 3rdparty/blobs/mainboard/samsung/lumpy/me.bin, with ifd adjusted via modified layout file)

MEI device won't go away and confirmed that ME is broken, and integrated graphic card conpletely ceases to work, and goes away.

@ehmry
Copy link

ehmry commented Dec 24, 2016

Works on:

  • Core i5-2520M
  • SandyBridge
  • Lenovo Thinkpad T420
  • OEM BIOS
  • ffe60d8

@jantatje
Copy link

jantatje commented Dec 25, 2016

  • Intel Core i5-2520M
  • Lenovo Thinkpad X220
  • Coreboot-4.5
  • Seabios 1.9.3
  • ffe60d8
  • 1.5MiB Management Engine
  • SPI replaced with a 128mbit chip, IFD layout changed to span entire chip and give all remaining space to CBFS.

Everything works, but laptop hangs for ~15 seconds after suspend. I also updated coreboot, so not 100% sure this is me_cleaners fault. 100% working now.

@persmule
Copy link

persmule commented Dec 27, 2016

Works on:

  • Core i5-2520M
  • SandyBridge
  • Lenovo Thinkpad T420
  • Coreboot-4.5
  • Seagrub scheme from libreboot
  • 1.5MiB Management Engine
  • ffe60d8

MEI device has disappeared from the PCI bus. However, the ethernet card needs a warm reboot to be functional.

@persmule
Copy link

persmule commented Dec 28, 2016

Working on

  • Intel Core i3 2330M
  • Sandy Bridge
  • Dell Latitude e6220
  • OEM BIOS
  • ffe60d8

MEI is no more present in lspci output. However, the ethernet card needs a warm reboot to be functional.

@Kokokokoka
Copy link

Kokokokoka commented Dec 28, 2016

Working on:

  • T420
  • Intel core i7 3632qm
  • Ivy Bridge
  • Coreboot with seabios payload+windows
    screen goes blank after a while, running a background game app seems to help this somehow.
  • X220
  • Intel core i5 2540M
  • Sandy Bridge
  • Coreboot with linux payload+qubes, worked fine, don't remember the blank screen issue.
    using: 48deb6 on both laptops

@persmule
Copy link

persmule commented Dec 28, 2016

Working on

  • Intel Core i5 2520M
  • Sandy Bridge
  • HP EliteBook 8460P
  • OEM BIOS
  • ffe60d8

MEI is no more present in lspci output. However, the ethernet card needs a warm reboot to be functional.

@JohnnyLeone
Copy link

Working on

  • Intel Core i5 3320M
  • Ivy Bridge
  • Lenovo Thinkpad X230
  • Coreboot
  • ffe60d8

@al3xtjames
Copy link

al3xtjames commented Jan 2, 2017

Working on:

  • Intel Core i5-3570K (Ivy Bridge)
  • Gigabyte GA-Z77X-UD5H
  • coreboot with TianoCore UEFI payload
  • ffe60d8

The MEI Controller device still appears in lspci. I am unsure of the status of the Intel 82579V Ethernet controller, as I haven't gotten it to work yet (e1000e: probe of 0000:00:19.0 failed with error -3; this remains the same with normal ME or cleaned ME). The ME appears to have been disabled:

[   19.881125] mei_me 0000:00:16.0: wait hw ready failed
[   19.881131] mei_me 0000:00:16.0: hw_start failed ret = -62
[   19.881144] mei_me 0000:00:16.0: H_RST is set = 0x80000015
[   21.929169] mei_me 0000:00:16.0: wait hw ready failed
[   21.929175] mei_me 0000:00:16.0: hw_start failed ret = -62
[   21.929188] mei_me 0000:00:16.0: H_RST is set = 0x80000015
[   23.977227] mei_me 0000:00:16.0: wait hw ready failed
[   23.977233] mei_me 0000:00:16.0: hw_start failed ret = -62
[   23.977236] mei_me 0000:00:16.0: reset: reached maximal consecutive resets: disabling the device
[   23.977238] mei_me 0000:00:16.0: reset failed ret = -19
[   23.977239] mei_me 0000:00:16.0: link layer initialization failed.
[   23.977241] mei_me 0000:00:16.0: init hw failure.
[   23.977366] mei_me 0000:00:16.0: initialization failed.
Bad news, you have a `Z77 Express Chipset LPC Controller` so you have ME hardware on board and it is very difficult to remove, continuing...
RCBA at 0xfed1c000
MEI not hidden on PCI, checking if visible
MEI found: [8086:1e3a] 7 Series/C216 Chipset Family MEI Controller #1

ME Status   : 0x4181
ME Status 2 : 0x163b0160

ME: FW Partition Table      : OK
ME: Bringup Loader Failure  : NO
ME: Firmware Init Complete  : NO
ME: Manufacturing Mode      : NO
ME: Boot Options Present    : NO
ME: Update In Progress      : NO
ME: Current Working State   : Initializing
ME: Current Operation State : Bring up
ME: Current Operation Mode  : Normal
ME: Error Code              : Debug Failure
ME: Progress Phase          : BUP Phase
ME: Power Management Event  : Pseudo-global reset
ME: Progress Phase State    : 0x3b

PCI READ [bc] : 0x000000bc
ME: Extend Register not valid

ME has a broken implementation on your board with this BIOS
ME: failed to become ready
WRITE    [00] : CB: 0x80040007
WRITE    [00] : CB: 0x000002ff
ME: failed to become ready
ME: GET FW VERSION message failed
ME: failed to become ready
WRITE    [00] : CB: 0x80080007
WRITE    [00] : CB: 0x00000203
WRITE    [00] : CB: 0x00000000
ME: failed to become ready
ME: GET FWCAPS message failed
exiting

@persmule
Copy link

persmule commented Jan 6, 2017

Working on:

  • Intel Core i5-2520M
  • Sandy Bridge
  • Lenovo Thinkpad X220
  • Coreboot
  • 4e9fc2e

After the KERNEL module of ME is removed, the integrated NIC works after a COLD reboot now.

@Kokokokoka
Copy link

  • Intel Core i5-2520M
  • Sandy Bridge
  • Lenovo Thinkpad X220 tablet
  • Coreboot
  • 4e9fc2e

@Krakonos
Copy link

  • Skylake
  • i5-6400
  • Lenovo IH110MS ver. 1.0 (Lenovo M700)
  • OEM BIOS M05KT93A
  • both -s and -S work, however -S seems to break r8168 driver on linux (r8169, the in-kernel version, still works fine) - there is a chance the windows driver will break too, but I didn't test

@AndrusK
Copy link

AndrusK commented Sep 24, 2022

  • Broadwell
  • i3-5005U
  • Dell Latitude 3350
  • OEM BIOS
  • I've only tested -s since I'd assumed it would probably work. It does indeed work, and I haven't noticed any side effects.
Bad news, you have a `Wildcat Point-LP LPC Controller` so you have ME hardware on board and you can't control or disable it, continuing...

MEI found: [8086:9cba] Wildcat Point-LP MEI Controller #1

ME Status   : 0x1e020181
ME Status 2 : 0x164d2106

ME: FW Partition Table      : OK
ME: Bringup Loader Failure  : NO
ME: Firmware Init Complete  : NO
ME: Manufacturing Mode      : NO
ME: Boot Options Present    : NO
ME: Update In Progress      : NO
ME: Current Working State   : Initializing
ME: Current Operation State : Bring up
ME: Current Operation Mode  : Debug
ME: Error Code              : No Error
ME: Progress Phase          : BUP Phase
ME: Power Management Event  : Pseudo-global reset
ME: Progress Phase State    : 0x4d

ME: Extend SHA-256: 8f994e9777f0c2ee5dcd891e2453880f810d461738e9d8b836c00f5505c53d1c

ME: failed to become ready
ME: failed to become ready
ME: GET FW VERSION message failed

@mccloud7
Copy link

  • Skylake
  • i5-6600
  • MSI H170 gaming m3
  • OEM BIOS
  • -s and -S
  1. External flashing by ch341a with msi jspi1 cable interface.
  2. "MW FW abnormal etc" message appeared instead of msi logo (like Nimayer post on 1 December 2016), and system boots further. ME version is N/A in bios menu after flashing. ME device disappeared from device manager in WIN7.
  3. Integrated graphics HD530 in i5-6600 could not initialize after flashing (OS starts with welcome sound and blank screen). System works flawless only with discrete graphics.
  4. Successfully tested on Win7 and Ubuntu for a week. The -s and -S works the same.

@Manoa1911
Copy link

Manoa1911 commented Oct 18, 2022

  • Haswell
  • i7-4790K
  • Asus Z97-A
  • OEM BIOS beta v3503
  • -S
  • Internal

internally flashed with the instructions from 62
the system is ok in terms of functionality but I have a hard time determining if it is successful:

  • the MEI drivers won't install with error this platform is not supported and log shows this error "Extended error text: 'Error in device matching'
  • the CSME version detection tool says: Based on the analysis performed by this tool: Detection Error: This system may be vulnerable, either the Intel(R) MEI/TXEI driver is not installed (available from your system manufacturer) or the system manufacturer does not permit access to the ME/TXE from the host driver.
  • MeInfoWin.exe says: Error 9270: Fail to load driver (PCI access for Windows)
  • MeInfoWin.exe also says: Error 9260: Unknown or unsupported hardware platform
  • I dumped the BIOS from the mobo with AFUWin and gave it to ME analyzer, he says: File does not contain Intel Engine/Graphics Firmware
  • the BIOS shows the version correctly (9.1.25.1005) and not N/A
  • me_cleaner -c (on the BIOS from the mobo with AFUWin) says: Full image detected
    The ME/TXE region is corrupted or missing
  • device manager does not show the management engine even after updating chipset drivers

@np22-jpg
Copy link

Working On:
Kaby Lake
I7 7700HQ
MSI GS63VR 7RF Stealth Pro
OEM BIOS (with some tweaks)
Working with -S, did not try any others

TPM no longer functions.

@Manoa1911
Copy link

  • Haswell
  • i7-4790K
  • Asus Z97-Pro Gamer
  • OEM BIOS latest v2202
  • External, ch341a, flashrom -S

successful, BIOS shows N/A as expected unlike my previous test, no 30 minute shutdown and network card is fully operational. but one small problem BCLK overclocking is not functional, whenever I set a cosmetic BCLK like 101.0 it treats it as if it is set to 100.0, clock monitoring tools from inside windows (HWINFO) confirm the BCLK is unchanged from 100.0 even when set to 101.0

@marwenius
Copy link

marwenius commented Nov 25, 2022

Working on:

  • Haswell
  • Xeon E3-1275L v3
  • Lenovo ThinkCentre M93p Tiny
  • OEM BIOS (Version FBKTE0A)
  • -s/-S flag

(The -S parameter seems to work, the system boots for example and everything seems to continue working normally for now. But I know too little to see if this causes any problems at all. So I tried again with the -s parameter, which also worked according to intelmetool -m and the BIOS also shows N/A, just like the -S parameter.)

Output with -s parameter:

Bad news, you have a `Q87 Express LPC Controller` so you have ME hardware on board and you can't control or disable it, continuing...

MEI found: [8086:8c3a] 8 Series/C220 Series Chipset Family MEI Controller #1

ME Status   : 0x1e020181
ME Status 2 : 0x164d0106

ME: FW Partition Table      : OK
ME: Bringup Loader Failure  : NO
ME: Firmware Init Complete  : NO
ME: Manufacturing Mode      : NO
ME: Boot Options Present    : NO
ME: Update In Progress      : NO
ME: Current Working State   : Initializing
ME: Current Operation State : Bring up
ME: Current Operation Mode  : Debug
ME: Error Code              : No Error
ME: Progress Phase          : BUP Phase
ME: Power Management Event  : Pseudo-global reset
ME: Progress Phase State    : 0x4d

ME: Extend SHA-256: 80e6f9c223162ef567282bdff22e274369465d7af5d6d97badb0e4a15ed79cca

ME: failed to become ready
ME: failed to become ready
ME: GET FW VERSION message failed

@twelho
Copy link

twelho commented Dec 25, 2022

(Not) working on:

  • Intel Core i5-7200U
  • Kaby Lake
  • HP EliteBook 840 G4
  • OEM BIOS (01.29)
  • -S/-s flag

One must disconnect all probes from the SPI flash before the machine can boot (stray capacitance is an issue).

-S flag:

UEFI BIOS has a long timeout waiting for ME to show up so booting takes around 80 seconds instead of less than 5 seconds (and there's a delay on shutdown as well). Fan will go to full blast for a while. Saving BIOS settings also takes a while now. MEI device has disappeared from PCI bus and BootGuard (which is forcibly enabled) now reports as Not found in fwupdmgr security --force. NIC is working, 30 minute timeout does not occur. However, Linux reports a constant flood of (correctable) PCIe errors for the NVMe disk, which eventually result in a full system freeze after a couple of hours of operation. Same deal with BIOS 01.43.

-s flag:

Upon flashing the soft-disabled BIOS back into the SPI flash and booting the system, it reboots a couple of times where the BIOS disables the HAP bit on its own and proceeds to boot the OS with the ME running normally. Verified by re-reading the SPI flash contents and perfoming a binary diff, the HAP bit is indeed involuntarily cleared by the BIOS.


Thus, while me_cleaner worked correctly, the ME cannot be disabled on this machine (or any other based on the HP P78 platform). Hard disable leads to system hang, and firmware forcibly clears the soft disable bit.

@parker-stephens
Copy link

Success on an ASRock Z270 Killer SLI/ac.

  • Kaby Lake
  • i7-7700
  • ASRock Z270 Killer SLI/ac
  • OEM BIOS 2.30
  • Used both -s and -S and both worked successfully.

The Intel ME region was left unlocked, while the flash descriptor was not. So originally I dumped the ME region, and flashed it back with the removed contents.

Then I went back, using the BIOS found online for the motherboard, and tried both of the flags and was able to flash both of them using the Instant Flash (internal) BIOS feature.

Boot time is the same, so no noticable differences except for of course the Intel PTT not working.

@nullquine
Copy link

nullquine commented Jan 14, 2023

Works on Asus X502C notebook

  • Ivy Bridge
  • Celeron 1007U
  • Asus X502C
  • OEM AMI BIOS 203
  • used with -S flag
  • external flashing with CH341a

The board is used as a standalone, extracted from the laptop chassis. keyboard and monitor are standard system peripherals (USB and VGA respectively), cannot test with the original LVDS screen and the integrated keyboard.

interestingly, the OEM ASUS logo disappeared from the POST screen despite no relevant changes applied in the OEM BIOS. Linux loading remains normal, albeit the kernel sometimes stops for varying times (fraction of second to minutes) at "verifying modloop". Cannot determine whether me_cleaner related or not as the board was not extensively tested before the modification outside the scope of basic functionality.

IME is no longer visible in lspci output, /dev/mei* no longer exists

@nullquine
Copy link

Works on ThinkStation E31 desktop

  • Ivy Bridge
  • Xeon E3-1245v2
  • system model number: 255321G (not sure if applicable to motherboard too)
  • OEM AMI Aptio BIOS, revision level 9SKT58AUS, date 20121224
  • used with the -S flag
  • external flashing with CH341a

the board has at least 3 SPI flash chips. The one next to the proprietary power connector did not report type. This leaves the two chips next to the SATA connectors: the one closer to the CMOS battery (U5) is a 2M one with content I couldn't identify. The one relevant in the present case is the one further from the battery holder (U4), this is a 8M chip.

the ME version and build number is N/A in the OEM BIOS setup utility after flashing. The particular device I had already had issues with some setup data corruption, this remained in the first boot but disappeared at the second, not sure if related, needs further investigation.

The board has a ME_DISABLE jumper, it was left set for the entire time, did not investigate the possible effect (only realized after the flashing was done). It is worth mentioning originally the ME version was still visible even when this jumper was set.

Boots normally, Ethernet controller available, lspci doesn't show IME and /dev/mei* not present after flashing (albeit I have no definite record of it being present before)

@seth586
Copy link

seth586 commented Feb 8, 2023

Success on Asrock Rack E3C226D2I motherboard

  • Haswell
  • E3-1231 v3
  • Asrock Rack E3C226D2I motherboard
  • OEM BIOS '3.50'
  • lowercase -s flag in me_cleaner
  • External flashing with CH341a

IPMI works just fine, no abnormal boot messages. ubuntu 22.04.1 and FreeBSD 13.1 seem to run just fine.

BIOS setup reports:
SPS Version : 0.0.0.0
ME FW State : N/A

Some oddities:
BIOS reports CPU Temp - 0.0C
BIOS sometimes reports 0MB total memory but memory will POST and work fine
Windows 10 reports an ACPI BIOS ERROR BSOD

If I try uppercase -S:

The bios gives a warning upon boot:

Warning! Intel SPS FW is working in Recovery mode!
Please change ME_RECOVERY jump to Normal mode.
Press F1 to Continue

My ME_RECOVERY jumper is in the normal position despite the message.
BIOS setup reports SPS Version : 0.0.255.0
ME FW State : Recovery

Unfortunately only 1 core / 2 threads are enabled. But the threads will ramp up to maximum x38 multiplier when under load. I tried loading up the modified ROM into MMTool5 and remove File Name recovery, but this didn't seem to have any effect.

If anyone has experience with disabling this "Recovery Mode" and enable the rest of the processor cores, let me know!

@D-FL4K
Copy link

D-FL4K commented Feb 20, 2023

Working for me using Internal flashing with unlocked OEM BIOS.

  • Architecture: Coffee Lake
  • Model: Intel(R) Core(TM) i7-8750H CPU @ 2.20GHz
  • Laptop: Gigabyte AERO 15xV8
  • BIOS: OEM unlocked BIOS
  • -S flag in me_cleaner

Bios shows ME version 0.0.0.0
sudo ./MEInfo  > no output
sudo ./intelmetool -s > Can't find ME PCI device
lspci > No intel HECI controller present in output

Note: I haven't tried -s flag or using a stock oem bios. I had to Enable Me FW Image Reflash in bios as well. I am not 100% sure why or maybe i was invoking the FPTw.exe command incorrectly

@jroovy
Copy link

jroovy commented Feb 25, 2023

Works on my laptop, had to flash externally using CH341a programmer

  • Kaby Lake
  • i5-7200U
  • Lenovo Ideapad 320-14IKB
  • OEM BIOS, version 4wcn23ww
  • Works with -S flag
  • No issues with suspend and hibernate
  • Passes the 30 minutes test

Note: sudo intelmetool -m gives me this error message: Can't find ME PCI device, but other than that everything seems to work fine

Output of -S flag:

% me_cleaner -S -O cleaned.bin backup1.bin
Full image detected
The ME/TXE region goes from 0x1000 to 0x210000
Found FPT header at 0x1010
Found 11 partition(s)
Found FTPR header: FTPR partition spans from 0x1000 to 0xa8000
Found FTPR manifest at 0x1448
ME/TXE firmware version 11.6.13.1212
Public key match: Intel ME, firmware versions 11.x.x.x
The HAP bit is NOT SET
Reading partitions list...
 FTPR (0x00001000 - 0x0000a8000, 0x000a7000 total bytes): NOT removed
 FTUP (0x00110000 - 0x0001bc000, 0x000ac000 total bytes): removed
 DLMP (      no data here      , 0x00000000 total bytes): nothing to remove
 PSVN (0x00000e00 - 0x000001000, 0x00000200 total bytes): removed
 IVBP (0x0010c000 - 0x000110000, 0x00004000 total bytes): removed
 MFS  (0x000a8000 - 0x00010c000, 0x00064000 total bytes): removed
 NFTP (0x00110000 - 0x0001bc000, 0x000ac000 total bytes): removed
 ROMB (      no data here      , 0x00000000 total bytes): nothing to remove
 FLOG (0x001bc000 - 0x0001bd000, 0x00001000 total bytes): removed
 UTOK (0x001bd000 - 0x0001bf000, 0x00002000 total bytes): removed
 ISHC (      no data here      , 0x00000000 total bytes): nothing to remove
Removing partition entries in FPT...
Removing EFFS presence flag...
Correcting checksum (0xc9)...
Reading FTPR modules list...
 FTPR.man     (uncompressed, 0x001448 - 0x002018): NOT removed, partition manif.
 rbe.met      (uncompressed, 0x002018 - 0x0020ae): NOT removed, module metadata
 kernel.met   (uncompressed, 0x0020ae - 0x00213c): NOT removed, module metadata
 syslib.met   (uncompressed, 0x00213c - 0x0021a0): NOT removed, module metadata
 bup.met      (uncompressed, 0x0021a0 - 0x00274a): NOT removed, module metadata
 pm.met       (uncompressed, 0x00274a - 0x0027f8): NOT removed, module metadata
 vfs.met      (uncompressed, 0x0027f8 - 0x003158): NOT removed, module metadata
 evtdisp.met  (uncompressed, 0x003158 - 0x0032e6): NOT removed, module metadata
 loadmgr.met  (uncompressed, 0x0032e6 - 0x00340e): NOT removed, module metadata
 busdrv.met   (uncompressed, 0x00340e - 0x0037b4): NOT removed, module metadata
 gpio.met     (uncompressed, 0x0037b4 - 0x0038fe): NOT removed, module metadata
 prtc.met     (uncompressed, 0x0038fe - 0x003aae): NOT removed, module metadata
 policy.met   (uncompressed, 0x003aae - 0x003c72): NOT removed, module metadata
 crypto.met   (uncompressed, 0x003c72 - 0x003dfc): NOT removed, module metadata
 heci.met     (uncompressed, 0x003dfc - 0x003fc8): NOT removed, module metadata
 storage.met  (uncompressed, 0x003fc8 - 0x0042c4): NOT removed, module metadata
 pmdrv.met    (uncompressed, 0x0042c4 - 0x0043e8): NOT removed, module metadata
 maestro.met  (uncompressed, 0x0043e8 - 0x0044d2): NOT removed, module metadata
 fpf.met      (uncompressed, 0x0044d2 - 0x0045de): NOT removed, module metadata
 hci.met      (uncompressed, 0x0045de - 0x0046e0): NOT removed, module metadata
 fwupdate.met (uncompressed, 0x0046e0 - 0x0047ea): NOT removed, module metadata
 ptt.met      (uncompressed, 0x0047ea - 0x0048f6): NOT removed, module metadata
 touch_fw.met (uncompressed, 0x0048f6 - 0x004a40): NOT removed, module metadata
 rbe          (Huffman     , 0x004a40 - 0x007100): NOT removed, essential
 kernel       (Huffman     , 0x007100 - 0x016d00): NOT removed, essential
 syslib       (Huffman     , 0x016d00 - 0x028bc0): NOT removed, essential
 bup          (Huffman     , 0x028bc0 - 0x050b00): NOT removed, essential
 pm           (LZMA/uncomp., 0x050b00 - 0x053100): removed
 vfs          (LZMA/uncomp., 0x053100 - 0x05ae00): removed
 evtdisp      (LZMA/uncomp., 0x05ae00 - 0x05c800): removed
 loadmgr      (LZMA/uncomp., 0x05c800 - 0x05f580): removed
 busdrv       (LZMA/uncomp., 0x05f580 - 0x060e40): removed
 gpio         (LZMA/uncomp., 0x060e40 - 0x0620c0): removed
 prtc         (LZMA/uncomp., 0x0620c0 - 0x062c80): removed
 policy       (LZMA/uncomp., 0x062c80 - 0x0678c0): removed
 crypto       (LZMA/uncomp., 0x0678c0 - 0x075440): removed
 heci         (LZMA/uncomp., 0x075440 - 0x079340): removed
 storage      (LZMA/uncomp., 0x079340 - 0x07d9c0): removed
 pmdrv        (LZMA/uncomp., 0x07d9c0 - 0x07eb40): removed
 maestro      (LZMA/uncomp., 0x07eb40 - 0x0808c0): removed
 fpf          (LZMA/uncomp., 0x0808c0 - 0x082140): removed
 hci          (LZMA/uncomp., 0x082140 - 0x082a00): removed
 fwupdate     (LZMA/uncomp., 0x082a00 - 0x087540): removed
 ptt          (LZMA/uncomp., 0x087540 - 0x09c640): removed
 touch_fw     (LZMA/uncomp., 0x09c640 - 0x0a8000): removed
The ME minimum size should be 348160 bytes (0x55000 bytes)
The ME region can be reduced up to:
 00001000:00055fff me
Setting the HAP bit in PCHSTRP0 to disable Intel ME...
Checking the FTPR RSA signature... VALID
Done! Good luck!

% me_cleaner -c cleaned.bin 
Full image detected
The ME/TXE region goes from 0x1000 to 0x210000
Found FPT header at 0x1010
Found 1 partition(s)
Found FTPR header: FTPR partition spans from 0x1000 to 0xa8000
Found FTPR manifest at 0x1448
ME/TXE firmware version 11.6.13.1212
Public key match: Intel ME, firmware versions 11.x.x.x
The HAP bit is SET
Checking the FTPR RSA signature... VALID

@Sadoon-AlBader
Copy link

Works on the following devices:

  1. Acer S7 392
  • Haswell i7 4500U
  • OEM BIOS
  • Internal flashing using Intel's tools on Windows 7 after unlocking ME region in BIOS:
    • This is done by booting into a modGRUBShell, just place the file on a flash drive under /EFI/boot/bootx64.efi, boot it, enter this command setup_var 0x258 0x01, the BIOS should now have an "Advanced" menu. you'll find under the chipset options (iirc) ME firmware region unlock.
    • After that you will need to disable UEFI, go back to legacy, install Windows 7 and the Intel tools (Do use his guide)
  • Apply me_cleaner on the extracted ME image, I believe the FD region will still be locked though so you can't set the AltMeDisable bit.
  • Voila, the system works as expected, been using it for years this way and liked to share.
  • I would not attempt an external flashing method on this laptop; the chip is a QFN type and the pins cannot be clamped on. Acer S7 393 models (Broadwell) cannot have their ME region unlocked even though the BIOS option is there in the advanced menu, and I attempted de-soldering the chip, applying me_cleaner and soldering it back on, the laptops goes nuts. Only do this on 392 models (Haswell).

  1. Macbook Pro 2011 and 2012 13" (same method applies to many models from those years)
  • Sandy and Ivy Bridge
  • OEM Firmware
  • Internal flashing by booting into Linux from a shutdown state and not entering sleep, with iomem=relaxed kernel option.
    • Use flashrom -p internal -r bios.bin, apply me_cleaner with -S on that, and flash it back with flashrom. Save a backup of your firmware in case things go wrong.

  1. Acer Swift 5 SF514-56T
  • Alder Lake i7 1260P
  • OEM BIOS
  • External flashing with ch341a clone and SOIC8 clamp
  • me_cleaner not supported, need to use ifdtool to enable HAP bit and reflash, need to use latest master branch of flashrom (as of March 1st 2023) since the chip has only been added recently.
  • Works perfectly, but cannot verify because ifdtool can't seem to see ME device with or without the HAP bit set.

  1. ASRock X99 WS
  • Haswell/Broadwell
  • OEM Firmware
  • External flashing with ch341a clone, BIOS is a simple 8-pin socketed chip.
  • Works with -S option just fine.

  1. Asus Z10PE-D16 WS
  • Haswell/Broadwell dual socket
  • OEM Firmware
  • External flashing with ch341a clone, BIOS is a simple 8-pin socketed chip.
  • Works with -S option just fine.

  1. Intel Skulltrail
  • Yorkfield dual socket
  • OEM Firmware
  • Needed no me_cleaner, does not have Intel ME to start

@sense-seeker
Copy link

sense-seeker commented Apr 1, 2023

ECS H55H-CM Motherboard

  • Clarkdale
  • OEM BIOS
  • Both internal & external flash working

running me_cleaner with "-s" does not seem to have any effect, at least
according to intelmetool's output. Running it with "-S" or without flags
results in intelmetool reporting "Can't find ME PCI device", so I guess
it succeeded.

  • Internal flashing:
    The flash utility provided by ECS only supports flashing the BIOS region.
    FPT should work, but tested with flashrom.

    To disable write protection, shorting pins 2-3 of "ME_EN" jumper is needed.
    I couldn't take a photo from it, so I will leave an image to localize it.

    Dump the original contents with flashrom -p internal -r dump.bin,
    run me_cleaner, and reflash with flashrom -p internal -w cleaned.bin.
    Done!

    Remember to undo first step.

  • External flashing:
    The SPI chip is located right next to the PCH.

    Dump it's contents with flashrom or your preferred utility, clean with me_cleaner,
    reflash. Done!

No side effects noticed so far

(sorry for the bad quality)

layout

@set5una
Copy link

set5una commented Apr 19, 2023

Working on

  • Thinkpad T480s
  • i5-8350U w/ vPro
  • Stock firmware N22ET76P (1.53)
  • External flashing with -s flag (-S untested)
  • TPM, TXT and secure boot works and does not require reconfiguration (TPM keys are not wiped)

After flashing modded image the ME version number disappears in the UEFI menu and CSME PCI device could no longer be found
PXL_20230418_162902147

@einfacharthur
Copy link

Hi,

Thinkpad T440p w/ i7-4800MQ

  1. dumped Backups of the 2 Chips:
sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=8000 -r 4mb_backup.bin
sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=8000 -r 8mb_backup.bin
  1. clean 8mb bios w/ me_cleaner
python me_cleaner.py -c 8mb.bin
Full image detected
The ME/TXE region goes from 0x3000 to 0x500000
Found FPT header at 0x3010
Found 28 partition(s)
Found FTPR header: FTPR partition spans from 0x160000 to 0x210000
ME/TXE firmware version 9.1.20.1035
Public key match: Intel ME, firmware versions 9.0.x.x, 9.1.x.x
The AltMeDisable bit is NOT SET
Checking the FTPR RSA signature... VALID
python me_cleaner.py -S -r -t -d -D ifd_shrinked.bin -M me_shrinked.bin -O 8mb_cleaned.bin 8mb.bin

Full image detected
The ME/TXE region goes from 0x3000 to 0x500000
Found FPT header at 0x3010
Found 28 partition(s)
Found FTPR header: FTPR partition spans from 0x160000 to 0x210000
ME/TXE firmware version 9.1.20.1035
Public key match: Intel ME, firmware versions 9.0.x.x, 9.1.x.x
The AltMeDisable bit is NOT SET
Reading partitions list...
 PSVN (0x00000bc0 - 0x000000c00, 0x00000040 total bytes): removed
 FOVD (0x00000c00 - 0x000001000, 0x00000400 total bytes): removed
 MDES (0x00001000 - 0x000002000, 0x00001000 total bytes): removed
 FCRS (0x00002000 - 0x000003000, 0x00001000 total bytes): removed
 EFFS (0x00003000 - 0x0000df000, 0x000dc000 total bytes): removed
 BIAL (NVRAM partition, no data, 0x0000add3 total bytes): nothing to remove
 BIEL (NVRAM partition, no data, 0x00003522 total bytes): nothing to remove
 BIIS (NVRAM partition, no data, 0x00036000 total bytes): nothing to remove
 NVCL (NVRAM partition, no data, 0x000069c9 total bytes): nothing to remove
 NVCM (NVRAM partition, no data, 0x0000439b total bytes): nothing to remove
 NVCP (NVRAM partition, no data, 0x0000a3c0 total bytes): nothing to remove
 NVHM (NVRAM partition, no data, 0x00000058 total bytes): nothing to remove
 NVJC (NVRAM partition, no data, 0x00003da0 total bytes): nothing to remove
 NVKR (NVRAM partition, no data, 0x00005fb4 total bytes): nothing to remove
 NVNF (NVRAM partition, no data, 0x0000175f total bytes): nothing to remove
 NVOS (NVRAM partition, no data, 0x0003a34b total bytes): nothing to remove
 NVSH (NVRAM partition, no data, 0x000022c0 total bytes): nothing to remove
 NVSM (NVRAM partition, no data, 0x00001de8 total bytes): nothing to remove
 NVTD (NVRAM partition, no data, 0x00001feb total bytes): nothing to remove
 NVUK (NVRAM partition, no data, 0x00008940 total bytes): nothing to remove
 PLDM (NVRAM partition, no data, 0x000043c5 total bytes): nothing to remove
 TMNN (NVRAM partition, no data, 0x000001a6 total bytes): nothing to remove
 GLUT (0x000df000 - 0x0000e8000, 0x00009000 total bytes): removed
 LOCL (0x000e8000 - 0x0000ec000, 0x00004000 total bytes): removed
 WCOD (0x000ec000 - 0x000160000, 0x00074000 total bytes): removed
 FTPR (0x00160000 - 0x000210000, 0x000b0000 total bytes): NOT removed
 NFTP (0x00210000 - 0x00048a000, 0x0027a000 total bytes): removed
 MDMV (0x0048a000 - 0x0004ca000, 0x00040000 total bytes): removed
Removing partition entries in FPT...
Removing EFFS presence flag...
Correcting checksum (0xda)...
Reading FTPR modules list...
 UPDATE           (LZMA   , 0x1c02c0 - 0x1c04ea       ): removed
 ROMP             (Huffman, fragmented data, ~1 KiB   ): NOT removed, essential
 BUP              (Huffman, fragmented data, ~70 KiB  ): NOT removed, essential
 KERNEL           (Huffman, fragmented data, ~203 KiB ): removed
 POLICY           (Huffman, fragmented data, ~98 KiB  ): removed
 HOSTCOMM         (LZMA   , 0x1c04ea - 0x1c87fd       ): removed
 TDT              (LZMA   , 0x1c87fd - 0x1cdb9a       ): removed
 FPF              (LZMA   , 0x1cdb9a - 0x1cf69e       ): removed
Relocating FTPR from 0x160000 - 0x210000 to 0xf00 - 0xb0f00...
 Adjusting FPT entry...
 Adjusting LUT start offset...
 Adjusting Huffman start offset...
 Adjusting chunks offsets...
 Moving data...
The ME minimum size should be 118784 bytes (0x1d000 bytes)
The ME region can be reduced up to:
 00003000:0001ffff me
Setting the AltMeDisable bit in PCHSTRP10 to disable Intel ME...
Removing ME/TXE R/W access to the other flash regions...
Extracting the descriptor to "ifd_shrinked.bin"...
Modifying the regions of the extracted descriptor...
 00003000:004fffff me   --> 00003000:0001ffff me
 00500000:00bfffff bios --> 00020000:00bfffff bios
Extracting and truncating the ME image to "me_shrinked.bin"...
Checking the FTPR RSA signature of the extracted ME image... VALID
Checking the FTPR RSA signature... VALID
Done! Good luck!
  1. unlock with ifdtool
./ifdtool -u 8mb_patched.bin
File 8mb_patched.bin is 8388608 bytes
Writing new image to 8mb_patched.bin.new
  1. write to bottom 8mb chip
sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=8000 -w 8mb_patched.bin.new
flashrom v1.2 on Linux 6.1.21-v8+ (aarch64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Winbond flash chip "W25Q64.V" (8192 kB, SPI) on linux_spi.
Reading old flash chip contents... done.
Erasing and writing flash chip... Erase/write done.
Verifying flash... VERIFIED.

thanks to:
https://notthebe.ee/blog/removing-the-wifi-whitelist/
https://colincogle.name/blog/thinkpad-liberation/
https://blog.0xcb.dev/lenovo-t440p-coreboot/
https://libreboot.org/docs/install/t440p_external.html
https://libreboot.org/docs/install/spi.html
https://doc.coreboot.org/mainboard/lenovo/t440p.html
https://github.com/merge/skulls/blob/master/t440p/README.md
https://github.com/digmorepaka/thinkpad-firmware-patches
https://github.com/thrimbor/thinkpad-uefi-sign
https://imgur.com/gallery/9l8V4

@kabal-pl
Copy link

kabal-pl commented Dec 9, 2023

Hello,
Works on ASUS X401A-WX095V:

  • Sandy Bridge
  • Intel Core i5-2410M
  • Asus X401A / Asus motherboard rev2.0 (HM70 chipset)
  • original BIOS dumped using external flash reader method (CH341) and script runed in Linux
  • used the -S flag in me_cleaner script

30 min restriction gone. Works from 8 December. So far so good.
More info how I done it here: #186 and here: #341

Thanks!! :)

@silentJET85
Copy link

  • Dell Optiplex 7020 SFF
  • Intel i3 4150
  • Haswell
  • Modified OEM BIOS ( I previously added an NVME driver to it.)
  • I used the -S flag.

I used the internal flash method following this guide:
https://github.com/mostav02/Remove_IntelME_FPT

Everything seems to be working fine.

@THE-ERZAEEL
Copy link

Everything seems to be working.
Noticed that POST & boot times are much faster now.

Stock firmware (pre flash):

$ python me_cleaner.py stock.bin
Full image detected
The ME/TXE region goes from 0x1000 to 0x181000
Found FPT header at 0x1010
Found 11 partition(s)
Found FTPR header: FTPR partition spans from 0x37000 to 0xa1000
ME/TXE firmware version 7.1.13.1088
Public key match: Intel ME, firmware versions 7.x.x.x, 8.x.x.x
The AltMeDisable bit is NOT SET
Reading partitions list...
 FOVD (0x00000400 - 0x000001000, 0x00000c00 total bytes): removed
 MDES (0x00001000 - 0x000002000, 0x00001000 total bytes): removed
 FCRS (0x00002000 - 0x000003000, 0x00001000 total bytes): removed
 EFFS (0x00003000 - 0x000037000, 0x00034000 total bytes): removed
 NVCL (NVRAM partition, no data, 0x000095d9 total bytes): nothing to remove
 NVJC (NVRAM partition, no data, 0x00005000 total bytes): nothing to remove
 NVKR (NVRAM partition, no data, 0x0000f650 total bytes): nothing to remove
 NVQS (NVRAM partition, no data, 0x00000def total bytes): nothing to remove
 NVTD (NVRAM partition, no data, 0x00001e44 total bytes): nothing to remove
 FTPR (0x00037000 - 0x0000a1000, 0x0006a000 total bytes): NOT removed
 NFTP (0x000a1000 - 0x00017d000, 0x000dc000 total bytes): removed
Removing partition entries in FPT...
Removing EFFS presence flag...
Correcting checksum (0x05)...
Reading FTPR modules list...
 UPDATE           (LZMA   , 0x0799f7 - 0x079a89       ): removed
 BUP              (Huffman, fragmented data, ~43 KiB  ): NOT removed, essential
 KERNEL           (Huffman, fragmented data, ~120 KiB ): removed
 POLICY           (Huffman, fragmented data, ~84 KiB  ): removed
 HOSTCOMM         (LZMA   , 0x079a89 - 0x07f013       ): removed
 RSA              (LZMA   , 0x07f013 - 0x083aa4       ): removed
 CLS              (LZMA   , 0x083aa4 - 0x088458       ): removed
 TDT              (LZMA   , 0x088458 - 0x08e51e       ): removed
 FTCS             (Huffman, fragmented data, ~16 KiB  ): removed
The ME minimum size should be 303104 bytes (0x4a000 bytes)
The ME region can be reduced up to:
 00001000:0004afff me
Checking the FTPR RSA signature... VALID
Done! Good luck!

Post flash:

$ python me_cleaner.py modified.bin
Full image detected
The ME/TXE region goes from 0x1000 to 0x181000
Found FPT header at 0x1010
Found 1 partition(s)
Found FTPR header: FTPR partition spans from 0x37000 to 0xa1000
ME/TXE firmware version 7.1.13.1088
Public key match: Intel ME, firmware versions 7.x.x.x, 8.x.x.x
The AltMeDisable bit is SET
Reading partitions list...
 FTPR (0x00037000 - 0x0000a1000, 0x0006a000 total bytes): NOT removed
Removing partition entries in FPT...
Removing EFFS presence flag...
Correcting checksum (0x05)...
Reading FTPR modules list...
 UPDATE           (LZMA   , 0x0799f7 - 0x079a89       ): removed
 BUP              (Huffman, fragmented data, ~43 KiB  ): NOT removed, essential
 KERNEL           (Huffman, fragmented data, ~120 KiB ): removed
 POLICY           (Huffman, fragmented data, ~84 KiB  ): removed
 HOSTCOMM         (LZMA   , 0x079a89 - 0x07f013       ): removed
 RSA              (LZMA   , 0x07f013 - 0x083aa4       ): removed
 CLS              (LZMA   , 0x083aa4 - 0x088458       ): removed
 TDT              (LZMA   , 0x088458 - 0x08e51e       ): removed
 FTCS             (Huffman, fragmented data, ~16 KiB  ): removed
The ME minimum size should be 303104 bytes (0x4a000 bytes)
The ME region can be reduced up to:
 00001000:0004afff me
Checking the FTPR RSA signature... VALID
Done! Good luck!
# ./intelmetool -m
Bad news, you have a `H61 Express Chipset LPC Controller` so you have ME hardware on board and you can't control or disable it, continuing...

MEI found: [8086:1c3a] 6 Series/C200 Series Chipset Family MEI Controller #1

ME Status   : 0x20191
ME Status 2 : 0x160a0000

ME: FW Partition Table      : OK
ME: Bringup Loader Failure  : NO
ME: Firmware Init Complete  : NO
ME: Manufacturing Mode      : YES
ME: Boot Options Present    : NO
ME: Update In Progress      : NO
ME: Current Working State   : Initializing
ME: Current Operation State : Bring up
ME: Current Operation Mode  : Debug
ME: Error Code              : No Error
ME: Progress Phase          : BUP Phase
ME: Power Management Event  : Pseudo-global reset
ME: Progress Phase State    : Check to see if straps say ME DISABLED

ME: Extend SHA-256: 0fe8ec35a73052660528986e61c9f5c93f3e7ee45a770dab8224eabf23392b59

ME: failed to become ready
ME: failed to become ready
ME: GET FW VERSION message failed
# dmesg | grep -i mei
[   15.500791] mei_me 0000:00:16.0: wait hw ready failed
[   15.500826] mei_me 0000:00:16.0: hw_start failed ret = -62 fw status = 00020191 160A0000 
[   15.500869] mei_me 0000:00:16.0: H_RST is set = 0x80000015
[   17.634124] mei_me 0000:00:16.0: wait hw ready failed
[   17.634156] mei_me 0000:00:16.0: hw_start failed ret = -62 fw status = 00020191 160A0000 
[   17.634197] mei_me 0000:00:16.0: H_RST is set = 0x80000015
[   19.767455] mei_me 0000:00:16.0: wait hw ready failed
[   19.767488] mei_me 0000:00:16.0: hw_start failed ret = -62 fw status = 00020191 160A0000 
[   19.767508] mei_me 0000:00:16.0: reset: reached maximal consecutive resets: disabling the device
[   19.767511] mei_me 0000:00:16.0: reset failed ret = -19
[   19.767513] mei_me 0000:00:16.0: link layer initialization failed.
[   19.767515] mei_me 0000:00:16.0: init hw failure.
[   19.767647] mei_me 0000:00:16.0: initialization failed.
$ lspci | grep -i mei
00:16.0 Communication controller: Intel Corporation 6 Series/C200 Series Chipset Family MEI Controller #1 (rev 04)

@Black6spdZ
Copy link

Asus Z10PE-D8 WS (C612 chipset)
Haswell/Broadwell dual socket 2011-3
OEM Firmware with Xeon v3 turbo unlock
Flashed with Asus USB flashback
Works with -S option just fine.

@NateTheSage
Copy link

MacbookAir7,2 (2017 A1466 Model)

Broadwell Mobile
Intel i7-5650U
Laptop
Technically OEM
-S flag not possible / not tried, see below

Per issue #230, but not having seen knowledge on if this worked with a MattCard, I got one myself (it's the entry all the way at the bottom for my model).

Using the method described (sans the installation disk, I used my Pomona 5250 and a spare Pi 4 since the chip on the MattCard is a common Winbond chip), I cleaned my ME region and installed the MattCard. Bootup takes substantially longer (roughly a minute in my testing), and I occasionally don't hear the chime, but I get past the 30 minute mark without issues. YMMV.

@NateTheSage
Copy link

Samsung Slate 7 (XE700T1A)

Sandy Bridge Mobile
Intel i5-2467M
Laptop (really it's a tablet)
OEM
-S flag worked, HAP bit reports set

Uses a common Winbond chip, makes it past the 30 minute mark. Kind of a lethargic tablet considering, but I had it handy, wanted to try it.

@tezeta
Copy link

tezeta commented Mar 30, 2024

Working:

  • Dell Optiplex 5040 SFF
  • i7-6700
  • Q170 chipset
  • BIOS version 1.22, GigaDevice GD25Q128C flash chip
  • Upgraded BIOS to latest version then used external flasher to read then apply
  • -s
  • 43612a6

@erfto1
Copy link

erfto1 commented Apr 17, 2024

  • Comet Lake
  • i5-10300H
  • Tongfang GK5MRFV - GD25B127DSIG flash
  • Modded OEM AMI bios
  • Used ifdtool

@slavafrej
Copy link

  • Sandy Bridge
  • Intel Xeon E5 1620
  • HP z420
  • OEM
  • both with the -S flag (without -S not tested)

@Akadem1kxz
Copy link

  • Comet Lake
  • I7 10700k
  • z490 Vision G
  • OEM (Modded)
  • S

@NateTheSage
Copy link

NateTheSage commented Jul 2, 2024

  • Ivy Bridge
  • Intel® Core™ i5-3610ME
  • Panasonic CF-19 MK8 (CF-19Z model)
  • Unlocked CF-19 MK8 BIOS
  • -S flag used, HAP bit reports set

I wanted to do this one for a while, had to wait and get much MUCH shorter cables as I had just enough voltage drop with my current setup. Passes the 30 minute mark.

EDIT: ME version also reports N/A, so good enough indicator for me.

@BerkayKN
Copy link

BerkayKN commented Jul 3, 2024

  • Haswell
  • Intel® Core™ i7-4770
  • ASUS H81M-C
  • Modified OEM BIOS (Microcode 7, NVMe SSD patch, NvStrapsReBar patch,
  • -S flag used

Boots to Windows fine, result:
20240703_033456

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests