Skip to content

Commit ced3b46

Browse files
cornacorna
committed
Set the HAP bit (ME >= 11) or the AltMeDisable bit (ME < 11)
Positive Technologies discovered the presence of an undocumented HAP bit in the PCHSTRP0 field of the descriptor which, when set to 1, disables completely Intel ME just after the initialization. This is confirmed both by an analysis of the status of Intel ME after the setting of the bit and by reverse engineering the BUP module. More information in their blog post: http://blog.ptsecurity.com/2017/08/disabling-intel-me.html Moreover Igor Skochinsky discovered a bit in the PCHSTRP10, which achieves more or less the same result as the HAP bit for ME < 11. With this commit one of these bits is set to 1: instead of halting due to corrupted modules, Intel ME now halts before trying to load them, possibly leading to a cleaner shutoff of the ME subsystem.
1 parent 5ffeaff commit ced3b46

1 file changed

Lines changed: 17 additions & 1 deletion

File tree

‎me_cleaner.py‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -501,6 +501,7 @@ def start_end_to_flreg(start, end):
501501
flmap0, flmap1 = unpack("<II", f.read(8))
502502
frba = flmap0 >> 12 & 0xff0
503503
fmba = (flmap1 & 0xff) << 4
504+
fpsba = flmap1 >> 12 & 0xff0
504505

505506
f.seek(frba)
506507
flreg = unpack("<III", f.read(12))
@@ -590,7 +591,7 @@ def start_end_to_flreg(start, end):
590591

591592
mef = RegionFile(f, me_start, me_end)
592593

593-
if args.descriptor or args.extract_descriptor:
594+
if me_start > 0:
594595
fdf = RegionFile(f, fd_start, fd_end)
595596

596597
print("Removing extra partitions...")
@@ -651,6 +652,21 @@ def start_end_to_flreg(start, end):
651652
print("Truncating file at {:#x}...".format(end_addr))
652653
f.truncate(end_addr)
653654

655+
if me_start > 0:
656+
if me11:
657+
print("Setting the HAP bit in PCHSTRP0 to disable Intel ME...")
658+
fdf.seek(fpsba)
659+
pchstrp0 = unpack("<I", fdf.read(4))[0]
660+
pchstrp0 |= (1 << 16)
661+
fdf.write_to(fpsba, pack("<I", pchstrp0))
662+
else:
663+
print("Setting the AltMeDisable bit in PCHSTRP10 to disable "
664+
"Intel ME...")
665+
fdf.seek(fpsba + 0x28)
666+
pchstrp10 = unpack("<I", fdf.read(4))[0]
667+
pchstrp10 |= (1 << 7)
668+
fdf.write_to(fpsba + 0x28, pack("<I", pchstrp10))
669+
654670
if args.descriptor:
655671
print("Removing ME/TXE R/W access to the other flash regions...")
656672
fdf.write_to(fmba + 0x4, pack("<I", 0x04040000))

0 commit comments

Comments
 (0)