Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

me_cleaner status #3

Open
corna opened this issue Nov 28, 2016 · 434 comments
Open

me_cleaner status #3

corna opened this issue Nov 28, 2016 · 434 comments

Comments

@corna
Copy link
Owner

corna commented Nov 28, 2016

Please comment here if me_cleaner works on your device.
If this tool does not work on your PC (or it does not behave as expected), don't comment here but open an issue instead.
Specify:

  • CPU architecture
  • CPU model
  • Laptop/motherboard
  • OEM BIOS or coreboot?
  • If you used the -s/-S flag in me_cleaner

Thanks

@corna
Copy link
Owner Author

corna commented Nov 28, 2016

Working on:

  • Intel Core i5-2520M
  • Sandy Bridge
  • Lenovo Thinkpad X220
  • coreboot
  • both with and without the -S flag

Working for more than a month now. Everything works perfectly, and the MEI device has disappeared from the PCI bus.

@afics
Copy link

afics commented Nov 29, 2016

  • Sandy Bridge
  • Lenovo Thinkpad X220
  • coreboot

I can confirm it works on the Lenovo Thinkpad X220, but coreboot then recognizes only one of my two 8GB RAM modules. I'm currently investigating.

@sinetek
Copy link

sinetek commented Nov 30, 2016

  • Intel Celeron 2955U
  • Haswell
  • Chromebook C720p
  • coreboot

Hey there, I build and flashed an image of coreboot for my chromebook (C720p) running a Haswell 2955U.

There is no MEI entry in the lspci list.
Not sure what other tests I can run to see the ME's state, open to running other tests, just tell me.

Passed the 30 minutes mark, seems to work. Thanks

@Nimayer
Copy link
Collaborator

Nimayer commented Dec 1, 2016

Working on:

  • Intel i5-6500
  • Skylake
  • MSI Bazooka B150M
  • Stock AMI Bios
  • 61fd606

Everything works, the HECI (formerly MEI) device disapperars, a screen at boot notifies that the ME firmware is corrupted, but pressing F2 lets the boot continue.
me_message_small

@zamaudio
Copy link
Contributor

zamaudio commented Dec 2, 2016

  • Intel
  • Core i5-2540M
  • Lenovo Thinkpad X220
  • Coreboot
  • 48deb6c

^^ Yes that's right, the experimental branch works on this board folks! No lzma modules!

@corna corna mentioned this issue Dec 12, 2016
@simonepsp
Copy link

simonepsp commented Dec 12, 2016

Working on

  • Intel Core i5 3320M
  • Ivy Bridge
  • Lenovo Thinkpad X230
  • Coreboot
  • d2e2308

@tlaurion
Copy link

tlaurion commented Dec 12, 2016

Working on

  • Intel Core i5 3320M
  • Ivy Bridge
  • Lenovo Thinkpad X230
  • Stock BIOS
  • d2e2308

@ilikenwf
Copy link

ilikenwf commented Dec 19, 2016

  • Intel Core i7 4790k
  • Haswell
  • Desktop, ASRock Z97 Pro4
  • Modded Bios (see below)
  • ffe60d8

ASRock's bios packages are all in a proprietary format, but Windows based tools, specifically the UBU pack (http://www.win-raid.com/t154f16-Tool-Guide-News-quot-UEFI-BIOS-Updater-quot-UBU.html), allow them to be extracted and the firmware inside upgraded or downgraded. One may flash this modified file directly from the UEFI settings themselves, as it doesn't validate them.

It is unclear whether or not ME is properly disabled, as the kernel module loads but is not really usable, and the tools to check ME status segfault.

Removing extra partitions...
Removing extra partition entries in FPT...
Removing EFFS presence flag...
Reading FTPR modules list...
Wiping LZMA section (0xa7680 - 0xcf000)
 UPDATE: removed (0xa7680 - 0xa78aa)
 ROMP: removal of Huffman modules is not supported yet, skipping
 BUP: removal of Huffman modules is not supported yet, skipping
 KERNEL: removal of Huffman modules is not supported yet, skipping
 POLICY: removal of Huffman modules is not supported yet, skipping
 HOSTCOMM: removed (0xa78aa - 0xafbb5)
 TDT: removed (0xafbb5 - 0xb4f71)
 FPF: removed (0xb4f71 - 0xb6a77)
Correcting checksum (0xea)...
Done! Good luck!

@ghost
Copy link

ghost commented Dec 19, 2016

BIOS file name must be same as Instant Flash bios name, or else instant flash in bios does not detect it. In this case, Z97Ex62.70

/dev/mei0 does not exist, intelmetool reports it doesnt support my system (maybe it doesn't?), mei/mei_me modules still required by some ASRock Intel ME pci listing

Of note, Intel's own "Intel® Management Engine Verification Utility" in windows is perpetually spinning, which I should have tested beforehand. Looks like that only works if your cpu supports vPro. Tested on another Intel based machine with ME still in bios.

But everything seems to be working properly so far.

Full image detected

The ME region goes from 0x3000 to 0x1fffff

Found FPT header at 0x3010

Found 20 partition(s)
ME firmware version 9.1.10.1000
Found FTPR header: FTPR partition spans from 0x4a000 to 0xd2000
Removing extra partitions...
Removing extra partition entries in FPT...
Removing EFFS presence flag...
Reading FTPR modules list...
Wiping LZMA section (0xaa680 - 0xd2000)
 UPDATE          : removed (0xaa680 - 0xaa8aa)
 ROMP            : removal of Huffman modules is not supported yet, skipping
 BUP             : removal of Huffman modules is not supported yet, skipping
 KERNEL          : removal of Huffman modules is not supported yet, skipping
 POLICY          : removal of Huffman modules is not supported yet, skipping
 HOSTCOMM        : removed (0xaa8aa - 0xb2bb5)
 TDT             : removed (0xb2bb5 - 0xb7f71)
 FPF             : removed (0xb7f71 - 0xb9a77)
Correcting checksum (0xea)...
Done! Good luck!

@nilesr
Copy link

nilesr commented Dec 19, 2016

I can try to cat /dev/mei0 and I get "no such device" as root...so I guess that's good?

On my system that I've never flashed before (I haven't used me_cleaner yet) I get the same message when trying to read from /dev/mei0. It does not mean that the ME is disabled

@n1zzo
Copy link

n1zzo commented Dec 19, 2016

Working on

  • Intel Core i5 2520M
  • Sandy Bridge
  • Dell Latitude e6220
  • OEM BIOS
  • ffe60d8

MEI is no more present in lspci output.
However, the ethernet card does not show up anymore on "ip a" output.

dmesg says:

e1000e: Intel(R) PRO/1000 Network Driver - 3.2.6-k
e1000e: Copyright(c) 1999 - 2015 Intel Corporation.
e1000e 0000:00:19.0: Interrupt Throttling Rate (ints/sec) set to dynamic conservative mode
e1000e: probe of 0000:00:19.0 failed with error -e

The problem seems identical to the one reported by this user:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/984404
and as he suggests just rebooting the machine temporarily fixes the problem.
When a power cycle is performed again (power off+power on) the ethernet
card is gone again.

This is the related bug on the ubuntu kernel bug tracker:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1576953

@citypw
Copy link

citypw commented Dec 20, 2016

Working on:

  • Intel Core i7-3770
  • IvyBridge
  • Motherboard: GA-B75M-D3V
  • OEM BIOS and Coreboot
  • ffe60d8f

OEM BIOS: MEI device has disappeared from the PCI bus.
Coreboot: MEI device won't go away and confirmed that ME is broken:

**Bad news, you have a B75 Express Chipset LPC Controller so you have ME hardware on board and you can't control or disable it, continuing...

MEI not hidden on PCI, checking if visible
MEI found: [8086:1e3a] 7 Series/C210 Series Chipset Family MEI Controller #1

ME Status : 0x304181
ME Status 2 : 0x153b0160

ME: FW Partition Table : OK
ME: Bringup Loader Failure : NO
ME: Firmware Init Complete : NO
ME: Manufacturing Mode : NO
ME: Boot Options Present : NO
ME: Update In Progress : NO
ME: Current Working State : Initializing
ME: Current Operation State : Bring up
ME: Current Operation Mode : Normal
ME: Error Code : Debug Failure
ME: Progress Phase : BUP Phase
ME: Power Management Event : Intel ME reset due to exception
ME: Progress Phase State : 0x3b

ME: Extend Register not valid

ME: has a broken implementation on your board with this BIOS
ME: failed to become ready
ME: failed to become ready
ME: GET FW VERSION message failed
ME: failed to become ready
ME: failed to become ready
ME: GET FWCAPS message failed
**

@citypw
Copy link

citypw commented Dec 24, 2016

Working on:

  • Intel Core i3-2370m
  • SandyBridge
  • Motherboard: Thinkpad x220i
  • OEM BIOS and Coreboot
  • ffe60d8f

MEI device has disappeared from the PCI bus.

@persmule
Copy link

persmule commented Dec 24, 2016

Working on:

  • Intel Core i7-3770T
  • IvyBridge
  • Motherboard: GA-B75M-D3H
  • Coreboot
  • ffe60d8

Sadly I failed to extract a valid OEM BIOS image this time. MEI device has disappeared from the PCI bus initially, but after programming back from the scheme below the MEI reappears and keeps present. ME is confirmed broken.
It seems whether ME remains present on desktop depends on the content of nvram.

@persmule
Copy link

persmule commented Dec 24, 2016

Working on:

  • Intel Core i7-3770T
  • IvyBridge
  • Motherboard: GA-B75M-D3H
  • Coreboot
  • ffe60d8
  • Neutralized ME from SnB/IvB laptop (e.g. samsung lumpy's ME image located at 3rdparty/blobs/mainboard/samsung/lumpy/me.bin, with ifd adjusted via modified layout file)

MEI device won't go away and confirmed that ME is broken, and integrated graphic card conpletely ceases to work, and goes away.

@ehmry
Copy link

ehmry commented Dec 24, 2016

Works on:

  • Core i5-2520M
  • SandyBridge
  • Lenovo Thinkpad T420
  • OEM BIOS
  • ffe60d8

@jantatje
Copy link

jantatje commented Dec 25, 2016

  • Intel Core i5-2520M
  • Lenovo Thinkpad X220
  • Coreboot-4.5
  • Seabios 1.9.3
  • ffe60d8
  • 1.5MiB Management Engine
  • SPI replaced with a 128mbit chip, IFD layout changed to span entire chip and give all remaining space to CBFS.

Everything works, but laptop hangs for ~15 seconds after suspend. I also updated coreboot, so not 100% sure this is me_cleaners fault. 100% working now.

@persmule
Copy link

persmule commented Dec 27, 2016

Works on:

  • Core i5-2520M
  • SandyBridge
  • Lenovo Thinkpad T420
  • Coreboot-4.5
  • Seagrub scheme from libreboot
  • 1.5MiB Management Engine
  • ffe60d8

MEI device has disappeared from the PCI bus. However, the ethernet card needs a warm reboot to be functional.

@persmule
Copy link

persmule commented Dec 28, 2016

Working on

  • Intel Core i3 2330M
  • Sandy Bridge
  • Dell Latitude e6220
  • OEM BIOS
  • ffe60d8

MEI is no more present in lspci output. However, the ethernet card needs a warm reboot to be functional.

@Kokokokoka
Copy link

Kokokokoka commented Dec 28, 2016

Working on:

  • T420
  • Intel core i7 3632qm
  • Ivy Bridge
  • Coreboot with seabios payload+windows
    screen goes blank after a while, running a background game app seems to help this somehow.
  • X220
  • Intel core i5 2540M
  • Sandy Bridge
  • Coreboot with linux payload+qubes, worked fine, don't remember the blank screen issue.
    using: 48deb6 on both laptops

@persmule
Copy link

persmule commented Dec 28, 2016

Working on

  • Intel Core i5 2520M
  • Sandy Bridge
  • HP EliteBook 8460P
  • OEM BIOS
  • ffe60d8

MEI is no more present in lspci output. However, the ethernet card needs a warm reboot to be functional.

@JohnnyLeone
Copy link

JohnnyLeone commented Dec 31, 2016

Working on

  • Intel Core i5 3320M
  • Ivy Bridge
  • Lenovo Thinkpad X230
  • Coreboot
  • ffe60d8

@al3xtjames
Copy link

al3xtjames commented Jan 2, 2017

Working on:

  • Intel Core i5-3570K (Ivy Bridge)
  • Gigabyte GA-Z77X-UD5H
  • coreboot with TianoCore UEFI payload
  • ffe60d8

The MEI Controller device still appears in lspci. I am unsure of the status of the Intel 82579V Ethernet controller, as I haven't gotten it to work yet (e1000e: probe of 0000:00:19.0 failed with error -3; this remains the same with normal ME or cleaned ME). The ME appears to have been disabled:

[   19.881125] mei_me 0000:00:16.0: wait hw ready failed
[   19.881131] mei_me 0000:00:16.0: hw_start failed ret = -62
[   19.881144] mei_me 0000:00:16.0: H_RST is set = 0x80000015
[   21.929169] mei_me 0000:00:16.0: wait hw ready failed
[   21.929175] mei_me 0000:00:16.0: hw_start failed ret = -62
[   21.929188] mei_me 0000:00:16.0: H_RST is set = 0x80000015
[   23.977227] mei_me 0000:00:16.0: wait hw ready failed
[   23.977233] mei_me 0000:00:16.0: hw_start failed ret = -62
[   23.977236] mei_me 0000:00:16.0: reset: reached maximal consecutive resets: disabling the device
[   23.977238] mei_me 0000:00:16.0: reset failed ret = -19
[   23.977239] mei_me 0000:00:16.0: link layer initialization failed.
[   23.977241] mei_me 0000:00:16.0: init hw failure.
[   23.977366] mei_me 0000:00:16.0: initialization failed.
Bad news, you have a `Z77 Express Chipset LPC Controller` so you have ME hardware on board and it is very difficult to remove, continuing...
RCBA at 0xfed1c000
MEI not hidden on PCI, checking if visible
MEI found: [8086:1e3a] 7 Series/C216 Chipset Family MEI Controller #1

ME Status   : 0x4181
ME Status 2 : 0x163b0160

ME: FW Partition Table      : OK
ME: Bringup Loader Failure  : NO
ME: Firmware Init Complete  : NO
ME: Manufacturing Mode      : NO
ME: Boot Options Present    : NO
ME: Update In Progress      : NO
ME: Current Working State   : Initializing
ME: Current Operation State : Bring up
ME: Current Operation Mode  : Normal
ME: Error Code              : Debug Failure
ME: Progress Phase          : BUP Phase
ME: Power Management Event  : Pseudo-global reset
ME: Progress Phase State    : 0x3b

PCI READ [bc] : 0x000000bc
ME: Extend Register not valid

ME has a broken implementation on your board with this BIOS
ME: failed to become ready
WRITE    [00] : CB: 0x80040007
WRITE    [00] : CB: 0x000002ff
ME: failed to become ready
ME: GET FW VERSION message failed
ME: failed to become ready
WRITE    [00] : CB: 0x80080007
WRITE    [00] : CB: 0x00000203
WRITE    [00] : CB: 0x00000000
ME: failed to become ready
ME: GET FWCAPS message failed
exiting

@persmule
Copy link

persmule commented Jan 6, 2017

Working on:

  • Intel Core i5-2520M
  • Sandy Bridge
  • Lenovo Thinkpad X220
  • Coreboot
  • 4e9fc2e

After the KERNEL module of ME is removed, the integrated NIC works after a COLD reboot now.

@Kokokokoka
Copy link

Kokokokoka commented Jan 6, 2017

  • Intel Core i5-2520M
  • Sandy Bridge
  • Lenovo Thinkpad X220 tablet
  • Coreboot
  • 4e9fc2e

@Krixa
Copy link

Krixa commented Jan 27, 2021

I did not use the tool here to disable ME because I could not flash the FD with fpt but in my endeavour I found a simpler way to do it:

  • Dell Latitude 6430u - Bios A15 (latest)
  • Intel IvyBridge i5-3437u
  • Intel ME 8
  • Intel QM77 chipset

The trick is to simply boot on a grub2 shell and issue this command : setup_var 0x240 0x01

It is persistent across reboots/coldboots and validated through lspci on Linux.

@dispuser5132
Copy link

dispuser5132 commented Mar 16, 2021

  • Haswell
  • Intel i3-4030U
  • Lenovo M30-70 ( 80H8 )
  • OEM Bios
  • Laptop

me_cleaner without any option. Works fine. Flashed external using CH341A.

@JTrantow
Copy link

JTrantow commented Mar 28, 2021

Clarkdale Corei3-540
Supermicro C7SIMQ motherboard
OEM BIOS using ami.bat

I tried both me_cleaner.py -S and -s with no success. me_cleaner appears to work and the vendor supplied ami.bat reported success, but this motherboard still fails to boot after I do a linux shutdown command. (Until I clear the CMOS.) Upon clearing the CMOS, I can set bios values and I'm ok as long as I don't shutdown. Restart and Hibernate work fine. But Suspend or Shutdown will cause next power up to fail.

Full image detected
Found FPT header at 0x11010
Found 14 partition(s)
Found FTPR header: FTPR partition spans from 0xf2000 to 0x1b2000
ME/TXE firmware version 6.2.61.3535 (generation 2)
Public key match: Intel ME, firmware versions 6.x.x.x
The AltMeDisable bit is NOT SET
Reading partitions list...
FOVD (0x00000400 - 0x000002000, 0x00001c00 total bytes): removed
EFFS (0x00002000 - 0x0000e2000, 0x000e0000 total bytes): removed
NVKR (NVRAM partition, no data, 0x00010000 total bytes): nothing to remove
BIEL ( no data here , 0x00003000 total bytes): nothing to remove
BIIS ( no data here , 0x00036000 total bytes): nothing to remove
NVTD (NVRAM partition, no data, 0x00002000 total bytes): nothing to remove
NVCM (NVRAM partition, no data, 0x00004000 total bytes): nothing to remove
NVOS (NVRAM partition, no data, 0x00011000 total bytes): nothing to remove
NVSH (NVRAM partition, no data, 0x00007000 total bytes): nothing to remove
BIAL ( no data here , 0x00009000 total bytes): nothing to remove
NVVE (NVRAM partition, no data, 0x00000c00 total bytes): nothing to remove
GLUT (0x000e2000 - 0x0000f2000, 0x00010000 total bytes): removed
FTPR (0x000f2000 - 0x0001b2000, 0x000c0000 total bytes): NOT removed
NFTP (0x001b2000 - 0x00050f000, 0x0035d000 total bytes): removed
Removing partition entries in FPT...
Removing EFFS presence flag...
Correcting checksum (0xe7)...
Reading FTPR modules list...
BUP (Huffman, fragmented data, ~31 KiB ): NOT removed, essential
VE_FW_NAND (Huffman, fragmented data, ~155 KiB ): removed
KERNEL (Huffman, fragmented data, ~100 KiB ): removed
POLICY (Huffman, fragmented data, ~92 KiB ): removed
VENOM (LZMA , 0x151e97 - 0x153cef ): removed
HOSTCOMM (LZMA , 0x153cef - 0x1588c4 ): removed
RSA (LZMA , 0x1588c4 - 0x15e83d ): removed
CLS (LZMA , 0x15e83d - 0x1631b7 ): removed
TDT (LZMA , 0x1631b7 - 0x16638d ): removed
The ME minimum size should be 1060864 bytes (0x103000 bytes)
The ME region can be reduced up to:
00011000:00113fff me
Setting the AltMeDisable bit in PCHSTRP10 to disable Intel ME...
Checking the FTPR RSA signature... VALID

@Kreevoz
Copy link

Kreevoz commented Mar 31, 2021

  • Skylake
  • Intel Pentium G4400
  • ASUS B150M-K D3
  • OEM BIOS, external programmer
  • with -S flag

Works. After ME is disabled, each cold-start will have the board cycle power once before posting normally.
System won't power down after shutdown but stop there, requiring manual power cut.

MEInfoWin64 now reports this:

CurrentState:                         Disabled
ManufacturingMode:                    Disabled
FlashPartition:                       Valid
OperationalState:                     Transitioning
InitComplete:                         Initializing
BUPLoadState:                         Success
ErrorCode:                            Disabled
ModeOfOperation:                      Alt Disable Mode
SPI Flash Log:                        Not Present
Phase:                                BringUp
ICC:                                  No valid OEM data, ICC programmed with default values
ME File System Corrupted:             No
PhaseStatus:                          UNKNOWN

FPF and ME Config Status:             Match

Error 86: Communication error between application and Intel(R) ME module (FWU client)

Error 81: Internal error (Could not determine FW features information)

@JTrantow
Copy link

JTrantow commented Mar 31, 2021

me_cleaner works correctly.
My mistake was not changing bios AC power loss setting as I was using a battery backup power supply.

@dispuser5132
Copy link

dispuser5132 commented Apr 1, 2021

  • Haswell
  • i7-4500U
  • OEM Bios
  • Lenovo Thinkpad S440
  • Laptop

me_cleaner without any option. Works fine. Flashed external using CH341A.

@tezeta
Copy link

tezeta commented Apr 23, 2021

Working on:

  • ASUS P8Z77-V LE PLUS
  • i5-3350P
  • Z77
  • OEM BIOS w/ external flasher
  • -S
  • 43612a6

No apparent issues, fully functional. ME version shows as N/A in BIOS.

Bad news, you have a `Z77 Express Chipset LPC Controller` so you have ME hardware on board and you can't control or disable it, continuing...

MEI found: [8086:1e3a] 7 Series/C216 Chipset Family MEI Controller #1

ME Status   : 0x1e020191
ME Status 2 : 0x160a0140

ME: FW Partition Table      : OK
ME: Bringup Loader Failure  : NO
ME: Firmware Init Complete  : NO
ME: Manufacturing Mode      : YES
ME: Boot Options Present    : NO
ME: Update In Progress      : NO
ME: Current Working State   : Initializing
ME: Current Operation State : Bring up
ME: Current Operation Mode  : Debug
ME: Error Code              : No Error
ME: Progress Phase          : BUP Phase
ME: Power Management Event  : Pseudo-global reset
ME: Progress Phase State    : Check to see if straps say ME DISABLED

ME: Extend SHA-256: 88cdce2cfa55c4884272f0b35648cbb01caa6e7b03bbd7f814da3bd6cc758d71

ME: failed to become ready
ME: failed to become ready
ME: GET FW VERSION message failed

@linjan
Copy link

linjan commented Jun 6, 2021

  • Kaby Lake R
  • i5-8350U
  • Thinkpad T480
  • OEM bios, w/ external flasher
  • -s (-S doesn't boot)
  • 43612a6

As mentioned, there are 2 flash chips, 16M & 1M. Intel ME in 16M, physically located near RAM.
MEI device has disappeared from the PCI bus, ME version shows as empty in BIOS.
Passed 30 minutes. Thanks

@Sadoon-AlBader
Copy link

Sadoon-AlBader commented Jun 28, 2021

CPU architecture: Haswell
CPU model: i7 4500U
Laptop/motherboard: Acer S7 392
OEM BIOS or coreboot? OEM BIOS
If you used the -s/-S flag in me_cleaner: no flags

This laptop is fairly easy to remove ME from without external flashing, but you do need Windows (tested with 7) and the tools from here
1- Download GRUB with the mods
2- Copy the file to the EFI partition or a fat32 USB drive.
3- Add the file as bootable through the secure boot options in the BIOS.
4- Boot into it and set 0x258 to 1 by using setup_var 0x258 0x01
5- Reboot, go to BIOS, now you have the advanced menu, go to chipset, and enable "ME Region Update"
6- Boot into Windows, and follow the steps in the link (boot guard disabled and cleaning ME)
7- Voila, Intel ME has been cleaned. No external programmer needed.

EDIT: Keep in mind you might have to switch between UEFI and legacy modes for the grub EFI shell and Windows 7. Windows 7 doesn't need to be a full fledged install with all the drivers, just install the trial version and wipe it later after you remove ME.

@Sadoon-AlBader
Copy link

Sadoon-AlBader commented Jun 28, 2021

CPU architecture: Broadwell
CPU model: i7 5500U
Laptop/motherboard: Acer S7 393
OEM BIOS or coreboot? OEM BIOS
If you used the -s/-S flag in me_cleaner: -S

The laptop looks exactly the same as the 392 but has Broadwell instead of Haswell. Unfortunately while the "ME Region Unlock" option exists in the BIOS, it does nothing. The only way is to desolder the QFN chip (very annoying job), reprogram and solder it back.
What I've done instead is I ordered the same model of the BIOS chip but in a SOIC8 package instead of QFN, much easier to solder back to the board. Otherwise the steps to remove ME are the same as anything else, just use the -S option because it seems to not work without any options.

@Koenigseggs-and-Crypto
Copy link

Koenigseggs-and-Crypto commented Jun 29, 2021

CPU architecture: Skylake
CPU model: i5-6600k
Laptop/motherboard: Gigabyte GA-Z170-HD3
OEM BIOS or coreboot? OEM BIOS
If you used the -s/-S flag in me_cleaner: -S

Followup to my previous post where I mentioned anything beyond BIOS version F20 failed with me_cleaner. Finally succeeded in getting it to work as previously it couldn't boot into any OS, just cutting out. Process is as follows:

Efiflash is 0.87Mod

In BIOS QFlash, flash original 22f firmware with fully intact option. At this point I had a custom BIOS file with more updated drivers and such. I booted into FreeDOS LiveUSB and flashed this modded BIOS. Then, rebooted into Windows a couple of times. After this I booted back into the FreeDOS LiveUSB and dumped the BIOS ROM. From this file I then applied me_cleaner with the -S option. Afterwards, opening up the resulting file in MMTool5. Then deleted the Dxe file, MeRecoveryDxe, GUID: F1FCD66F-8966-441E-909C-77F211AB9C3E and saved the image as Z170HD3.22f. Hereafter using QFlash again to restore the original, untouched firmware fully intact. Then booting into LiveDOS and flashing the final modded firmware. This finally boots successfully. Dumping the active BIOS with efiflash shows that ME partitions are removed and HAP Bit is set, along with other extraneous modifications.

@duketwo
Copy link

duketwo commented Jul 14, 2021

MSI X99S-SLI-PLUS: Works (regions were unlocked, used Intel ME System Tools v9.1 r7 to flash, booted just fine after the mod, S3 sleep resume does not work after the mod) [edit 2022, S3 sleep went to a working state after a bios settings clear]
ASRock X99 Extreme4: (regions locked, used a CH341A programmer on linux with flashrom, works fine after the mod)
XCY Intel 4200u MiniPC 6x LAN I211-AT: (everything seems to be unlocked, you can even set secureboot keys in the bios?! used Intel ME System Tools v10.0 r7 to flash, works fine)

(Used -S option on all) If MEInfo does not work for whatever reason, I used MEAnalyzer with the full dump to get knowledge about the ME version.

After a year of usage on 3 Computers, the only downside is that the boot process takes 30-40 seconds longer. If you use S3 sleep, everything is smooth.

@legimet
Copy link

legimet commented Aug 18, 2021

Working on:

  • Intel Core i3-4030U
  • Haswell
  • Dell Inspiron 3542
  • OEM BIOS
  • Used -S flag

Output from intelmetool:

Bad news, you have a `8 Series LPC Controller` so you have ME hardware on board and you can't control or disable it, continuing...

MEI found: [8086:9c3a] 8 Series HECI #0

ME Status   : 0x1e020191
ME Status 2 : 0x164d2142

ME: FW Partition Table      : OK
ME: Bringup Loader Failure  : NO
ME: Firmware Init Complete  : NO
ME: Manufacturing Mode      : YES
ME: Boot Options Present    : NO
ME: Update In Progress      : NO
ME: Current Working State   : Initializing
ME: Current Operation State : Bring up
ME: Current Operation Mode  : Debug
ME: Error Code              : No Error
ME: Progress Phase          : BUP Phase
ME: Power Management Event  : Pseudo-global reset
ME: Progress Phase State    : 0x4d

ME: Extend SHA-256: [hash]

ME: failed to become ready
ME: failed to become ready
ME: GET FW VERSION message failed

Everything seems fine so far. The laptop was a bit difficult to take apart to get access to the ROM chip, but after doing so the process was pretty straightforward. I used a Raspberry Pi along with a Pomona SOIC-8 clip and 6 jumper wires.

@larryth
Copy link

larryth commented Oct 14, 2021

Hello,

Working on:

  • CoffeLake S
  • Intel Pentium G5420
  • Asus PRIME H310M-A R2.0
  • OEM bios / Intel Me 11.8.77.3664
  • tested only with -s flag since ifdtool doesn't recognize the chipset, and report not writable regions
  • External flashing (soic-8 clip adapter required) + Raspberry Pi 1 at spispeed=10000

After flashing software-disable bit, pci device disapeared and intel_csme_version_detection_tool report missing ME

Thanks for your work and best regards

@JannF
Copy link

JannF commented Nov 5, 2021

Working on:

Broadwell
Intel Core  i7-5600U
Lenovo ThinkPad X250
latest OEM BIOS / Intel ME for this model at this date
only -s flag works, -S seems to break thermal management, BIOS complains about an UEFI ME form not being available but boots just fine
External flashing (soic-8 clip adapter required) + 3.3V fixed CH341A and flashrom

@ghost ghost mentioned this issue Nov 7, 2021
@RefinedAnarchy
Copy link

RefinedAnarchy commented Nov 13, 2021

  • Kaby Lake R
  • i5-8350U
  • Thinkpad T480
  • OEM (1.40)
  • s (-S and no flags refuse to boot)

@yanovich
Copy link

yanovich commented Nov 19, 2021

#3 (comment)

Then deleted the Dxe file, MeRecoveryDxe, GUID: F1FCD66F-8966-441E-909C-77F211AB9C3E
@Koenigseggs-and-Crypto, how did you find which file to delete?

@yanovich
Copy link

yanovich commented Nov 20, 2021

  • Bay Trail TXE 1.1.0.1089
  • Intel Celeron J1900
  • Pegatron nettop
  • OEM BIOS
  • extrenal flashing with RPi 4B, Pomona clip and a ALVC164245
  • -s (blank screen on -S)

Notes:

  • One of three devices apparently has a bug in TXE, it cannot be disabled.
  • Check voltage of the flash chip!! Mine is 1.8V, RPi 4B has 3.3V GPIO, so I had to wire a TI ALVC164245 in between.

@redfawks
Copy link

redfawks commented Dec 29, 2021

Working on:

  • Intel Core i7-4600M
  • Haswell
  • ThinkPad T540p
  • OEM BIOS (v2.39)
  • -S
  • 43612a6

Setup was according to this guide with Arch Linux ARM running on a RPi 3 Model B using one of those cheap black SOIC-8 clips.

I'll get a bit more into the details because I couldn't find any information about disabling the ME via me_cleaner on a T540p, so I'd like to document my findings here.
During the process I ran into a pitfall. The T540p comes with two Macronix chips for the BIOS, a MX25L6473E (8MB) and a MX25L3273E (4MB). The first one is the one with the ME image on it so this one has to get flashed.
When trying to backup the original content of it I got inconsistent reads, the checksums never matched. flashrom reported the correct chip model only and exactly every 3rd probe, indicating this to be a logical problem rather than a physical one (crosstalk, insufficient shielding, wires too long, etc.).
Long story short: This post on the coreboot mailing list is what fixed the problem. After driving CS / Pin 1 of the opposite chip high (3.3V, connected to pin 1 of the RPi-GPIO) and leaving all of the other pins unconnected it stopped interfering and the reads were consistent from there on. No need to power the mainboard via Wake-on-Lan / applying AC as others on the web with a similar problem had suggested.

me_cleaner worked like a charm on the first try using the "-S" flag, soft-disabling the ME by setting the HAP-Bit and removing the modules (I haven't tried without "-S" / not setting the HAP bit). As of now (4 days later), everything is working absolutely flawless. Not a single error message or warning popped up, no shutdowns/reboots after 30 minutes of uptime, ethernet and all other devices are working fine. The ME disappeared from the PCI bus and intelmetool shows the same output as in #3 (comment) now.
In case I'll encounter a problem I'll report back.

Thanks to Jörg Albert for posting his fix, Sakaki for creating the detailed how-to and Nicola Corna & contributors for providing me_cleaner and all the research about the IME black box! Some great work you did there.

@Serphentas
Copy link

Serphentas commented Jan 30, 2022

CPU architecture: Sandy Bridge
CPU model: i7 2635QM
Laptop/motherboard: MacBook Pro 15" Mid-2011
OEM BIOS or coreboot: Apple OEM
If you used the -s/-S flag in me_cleaner: -S and -d

Bad news, you have a `HM65 Express Chipset LPC Controller` so you have ME hardware on board and you can't control or disable it, continuing...

MEI found: [8086:1c3a] 6 Series/C200 Series Chipset Family MEI Controller #1

ME Status   : 0x20191
ME Status 2 : 0x100a0000

ME: FW Partition Table      : OK
ME: Bringup Loader Failure  : NO
ME: Firmware Init Complete  : NO
ME: Manufacturing Mode      : YES
ME: Boot Options Present    : NO
ME: Update In Progress      : NO
ME: Current Working State   : Initializing
ME: Current Operation State : Bring up
ME: Current Operation Mode  : Debug
ME: Error Code              : No Error
ME: Progress Phase          : BUP Phase
ME: Power Management Event  : Clean Moff->Mx wake
ME: Progress Phase State    : Check to see if straps say ME DISABLED

@ghost
Copy link

ghost commented Jan 31, 2022

Working on:

  • Intel Core i5-4690
  • Haswell
  • EVGA Z97 FTW
  • OEM BIOS
  • -S flag, haven't bothered trying -s

ezpz, get latest firmware from EVGA download center, run me_cleaner on 1E977204.bin, and copy the modified firmware to a flash drive.

Reboot into bios setup, then flip dual bios switch on the motherboard. Go to Save & Exit, and update firmware from USB at the bottom. Select your modified firmware to flash.

If something goes wrong after flashing, flip dual bios switch back to its original position, so you can get back to a working state, and maybe figure out what went wrong later.

@ghost
Copy link

ghost commented Feb 18, 2022

Works on the following configurations:


  • Intel Core i7-6700k (Skylake)
  • ASUS Maximus VIII Hero
  • BIOS 3801
  • -S flag, but required some extra manipulation
  • Flashed externally with Raspberry Pi and breadboard

Write-up here: https://brhiggins.com/posts/me-cleaner-maximus-viii-hero/


  • Intel Core i7-6700k (Skylake)
  • ASUS Prime Z270-A
  • BIOS 1302
  • -S flag
  • Flashed externally with SOIC8 clip and CH341A programmer

First few cold boots hung for some reason (required holding down power to turn off, and 'warm' reboot), but has been fine since with no boot issues.


  • Intel Core i7-6700k (Skylake)
  • ASUS Prime Z270i
  • BIOS 1010 / 1205
  • -S flag
  • Flashed externally with SOIC8 clip and CH341A programmer

BIOS shows ME version 0.0.0.0, sudo intelmetool -b returns Can't find ME PCI device, and the ME does not appear in the PCI devices.

I initially applied me_cleaner with BIOS version 1010, and then later updated to 1205. The update to 1205 did not appear to re-introduce the ME, validated with me_cleaner after dumping the chip again.


  • Intel Core i5-8250U (Kaby Lake R)
  • Lenovo ThinkPad T480
  • BIOS 1.39
    - -S flag
  • -s flag
  • Flashed externally with SOIC8 clip and CH341A programmer

I initially used -S but switched to -s after repeated crashes that would freeze the entire system. Using -s instead seems to have cleared up this problem.

Write-up here: https://brhiggins.com/posts/me-cleaner-thinkpad-t480/

Lid close detection possibly broken. It is not working on my Linux install right now, but I rarely use suspend-on-close so I don't know whether this started after applying me_cleaner, or at some other point. Not tested with Windows.

@czeej
Copy link

czeej commented Apr 19, 2022

  • Haswell / Lynxpoint SOC
  • Intel i5 4300u
  • Lenovo T440 (not s or p)
  • me_cleaner.py -S -w FCRS,EFFS
  • OEM bios cannot get coreboot built will need to find way around boot guard and re-claim lost space.
  • External Programmer

no issues found yet. will try modding bios a bit and see what happens.

@oood
Copy link

oood commented May 8, 2022

Working on:

  • Intel NUC8i3BEH / NUC8i5BEH / NUC8i7BEH

  • i3-8109U / i5-8259U/ i7-8559U

  • Coffee Lake-U

  • ME-Firmware 12.0.81.1753

I wrote a complete guide to explain how to set up the HAP bit on an Intel NUC.

@Yannik 's reply here is also a great reference, thanks.

@marwenius
Copy link

marwenius commented Jul 18, 2022

Working on:

  • Kaby Lake R
  • i7-8650U
  • Lenovo ThinkPad T480
  • OEM BIOS (v1.44)
  • -s flag

The whole thing took a total of 7 minutes (extract, me_clean and flash).

@Fabio82
Copy link

Fabio82 commented Aug 2, 2022

Working on:

  • Intel(R) Core(TM) i5-8250U CPU @ 1.60GHz
    
  • Intel Kaby Lake R 8th generation
    
  • Lenovo ThinkPad T480
    
  • OEM BIOS
    
  • -S flag
    

No problem so far

@AzimsTech
Copy link

AzimsTech commented Aug 6, 2022

  • CPU architecture: Haswell
  • CPU model: E3-1220 v3
  • Laptop/motherboard: MSI H81M-P33
  • OEM BIOS or coreboot?: OEM v1.9
  • If you used the -s/-S flag in me_cleaner: With -s flag (Alt Disable Mode)

Instructions here

Screenshot 2022-08-06 145729

@marwenius
Copy link

marwenius commented Aug 8, 2022

Working on:

  • Ivy Bridge
  • i5-3337U
  • ThinkPad Twist S230u
  • OEM BIOS (v1.81)
  • no flag (-S flag: can't enter BIOS settings)
[Bad news, you have a HM77 Express Chipset LPC Controller so you have ME hardware on board and you can't control or disable it, continuing...

[MEI found: [8086:1e3a] 7 Series/C216 Chipset Family MEI Controller #1

ME Status   : 0x1e003052
ME Status 2 : 0x1032015a

ME: FW Partition Table      : OK
ME: Bringup Loader Failure  : NO
ME: Firmware Init Complete  : NO
ME: Manufacturing Mode      : YES
ME: Boot Options Present    : NO
ME: Update In Progress      : NO
ME: Current Working State   : Recovery
ME: Current Operation State : M0 with UMA
ME: Current Operation Mode  : Normal
ME: Error Code              : Image Failure
ME: Progress Phase          : BUP Phase
ME: Power Management Event  : Clean Moff->Mx wake
ME: Progress Phase State    : M0 kernel load

ME: Extend SHA-256: 5d04e0f80a19368d72a9d630f04f4dc209702341d32c93a75a76d3309bf07c39

ME: has a broken implementation on your board with this firmware
ME: failed to become ready
ME: failed to become ready
ME: GET FW VERSION message failed

@lyneez
Copy link

lyneez commented Aug 9, 2022

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests