-
Notifications
You must be signed in to change notification settings - Fork 273
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
1 changed file
with
36 additions
and
20 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,26 +1,42 @@ | ||
# ME cleaner | ||
# me_cleaner [![Donation](https://img.shields.io/badge/Donate-PayPal-green.svg)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=B5HCXCLZVCVZ8) | ||
|
||
A cleaner for Intel ME/TXE images. | ||
Intel ME is a coprocessor integrated in all post-2006 Intel boards, for which | ||
this [Libreboot page](https://libreboot.org/faq.html#intelme) has an excellent | ||
description. The main component of Intel ME is Intel AMT, and I suggest you to | ||
read [this Wikipedia page](https://en.wikipedia.org/wiki/Intel_Active_Management_Technology) | ||
for more informations about it. In short, Intel ME is an unremovable environment | ||
with an obscure signed proprietary firmware, with full network and memory | ||
access, which poses a serious security threat. | ||
Even when disabled from the BIOS settings, Intel ME is active: the only way to | ||
be sure it is disabled is to remove its firmware from the flash chip. | ||
|
||
This tools removes any unnecessary partition from an Intel ME/TXE firmware, reducing | ||
its size and its ability to interact with the system. | ||
It should work both with coreboot and with the factory firmware. | ||
Before Nehalem (ME version 6, 2008/2009) the ME firmware could be removed | ||
completely from the flash chip by setting a couple of bits inside the flash | ||
descriptor, without the need of reverse-engineer the ME firmware. | ||
|
||
Currently this tool: | ||
* Scans the FPT (partition table) and checks that everything is correct | ||
* Removes any partition entry (except for FTPR) from FPT | ||
* Removes any partition except for the fundamental one (FTPR) | ||
* Removes the EFFS presence flag | ||
* Corrects the FPT checksum | ||
* Removes any non-essential LZMA or Huffman compressed module from the FTPR partition (pre-Skylake only) | ||
* Relocates the remaining parts of the FTPR partition to the top of the ME region (pre-Skylake only) | ||
* Checks the validity of the RSA signature of the FTPR partition | ||
Starting from Nehalem the Intel ME firmware can't be removed anymore: without a | ||
valid firmware the PC shuts off forcefully after 30 minutes. This project is an | ||
attempt to remove as much code as possible from such firmware without falling | ||
into the 30 minutes window mode. | ||
|
||
Don't forget to power cycle your PC after flashing the modified ME/TXE image | ||
(power off and power on, not just reboot). | ||
me_cleaner currently works on most architectures, see [me_cleaner status](https://github.com/corna/me_cleaner/wiki/me_cleaner-status) (or [its discussion](https://github.com/corna/me_cleaner/issues/3)) | ||
for more info about them. me_cleaner works also on the TXE and SPS firmware. | ||
|
||
See the [current status](https://github.com/corna/me_cleaner/wiki/me_cleaner-status) | ||
or [a more detailed description](https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F) | ||
of me_cleaner. | ||
If you want to understand how me_cleaner works, you can read the ["How does it work?" page](https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F). | ||
|
||
Special thanks to Federico Amedeo Izzo for his help during the study of Intel ME. | ||
If you want to apply me_cleaner on your plaform I suggest you to read the | ||
["How does it work?" page](https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F) | ||
and then follow the guide ["How to apply me_cleaner"](https://github.com/corna/me_cleaner/wiki/How-to-apply-me_cleaner). | ||
|
||
For pre-Skylake firmware (ME version < 11) this tool removes almost everything, | ||
leaving only the two fundamental modules needed for the correct boot, ROMP and | ||
BUP. The code size is reduced from 1.5 MB (non-AMT firmware) or 5 MB (AMT | ||
firmware) to ~90 kB of compressed code. | ||
|
||
For Skylake and the later architectures (ME version >= 11), since the internal | ||
structure of the partitions is not yet known, the FTPR partition is left intact. | ||
The code size is reduced from 1.5 MB/5 MB to ~650 kB of compressed code. | ||
|
||
This project is based on the work of the community; in particular I thank Igor | ||
Skochinsky, for the core informations about Intel ME and its firmware structure, | ||
and Federico Amedeo Izzo, for its help during the study of Intel ME. |