Forum - RE: Intel Trusted Execution Engine: Drivers, Firmware & System Tools

Win-Raid Forum (Drivers - Firmware - Modding) � Special Topics � Intel Management Engine � Intel (Converged Security) Trusted Execution Engine: Drivers, Firmware and Tools

Page 12 of 17 � Page 1 ... 7 8 9 10 11 12 13 14 15 16 17 Page �

Topic settings

Print view

Jump to forum

General & Forum related Topics News / Announcements Forum-related Questions & Suggestions Off Topic Important Drivers (AHCI/RAID, NVMe, USB etc.) General: Storage Drivers (AHCI/RAID, NVMe and USB) Specific: Intel AHCI/RAID Drivers Specific: NVIDIA nForce Chipset Drivers (incl. AHCI/RAID) Specific: NVMe Drivers Other Drivers System Performance RAID Performance AHCI/NVMe Performance Solid State Drives BIOS Modding BIOS Modding Guides and Problems BIOS modules (PCI ROM, EFI and others) BIOS Modding Requests Reports: BIOS Modding Results Offers: Already modded special BIOSes Special Topics Intel Management Engine CPU Microcodes NVMe Support for old Systems Other Tools (not BIOS modding related) Interesting PC Hardware & Software OS related Topics Windows 11 Windows 8-10/Server 2012-2019 Windows 7/Vista/Server 2008 Windows XP/2000/Server 2003 DOS/Windows 3.X/9X/ME - Retro Gaming Other Operating Systems

#166 | RE: Intel Trusted Execution Engine: Drivers, Firmware & System Tools datum

Mon Mar 12, 2018 8:16 am

Thanks, I have backed up the firmware, can anyone help create an updated version?
https://nofile.io/f/d3dn2feEZ0T/backup.bin

reply

#167 | RE: Intel Trusted Execution Engine: Drivers, Firmware & System Tools datum

Mon Mar 12, 2018 6:03 pm

@zyo

Your image is OEM signed. However, I have made an attempt to update the CSTXE firmware using a new method. I cannot guarantee that it will work but I think it will. So if you decide to test this, I suggest to make sure that you can recover via a programmer.

plutomaniac has attached files to this post

backup_fix.rar

reply

#168 | RE: Intel Trusted Execution Engine: Drivers, Firmware & System Tools datum

Mon Mar 12, 2018 7:58 pm

Thanks, I dont really have a programmer to recover in case this goes bad. I recall seeing someone at techtablets flashing a Jumper Ezbook 3 pro bios onto a Yepo 737A laptop I wonder if it's OEM signed how they can do that without bricking...

reply

#169 | RE: Intel Trusted Execution Engine: Drivers, Firmware & System Tools datum

Mon Mar 12, 2018 8:55 pm

From the two SPI images I've seen, the RSA Keys are different. The real question is whether these OEMs actually closed Manufacturing Mode at their factory in order to commit the RSA Public Key Hash at the Chipset hardware (FPF). Run "TXEInfo -verbose" and show me the results.

reply

#170 | RE: Intel Trusted Execution Engine: Drivers, Firmware & System Tools datum

Tue Mar 13, 2018 8:14 am

Intel(R) TXEInfo Version: 3.1.50.2222
Copyright(C) 2005 - 2017, Intel Corporation. All rights reserved.

FW Status Register1: 0x80000255
FW Status Register2: 0x39850000
FW Status Register3: 0x30B50608
FW Status Register4: 0x00080000
FW Status Register5: 0x00000000
FW Status Register6: 0x00000000

CurrentState: Normal
ManufacturingMode: Enabled
FlashPartition: Valid
OperationalState: CM0 with UMA
InitComplete: Complete
BUPLoadState: Success
ErrorCode: No Error
ModeOfOperation: Normal
SPI Flash Log: Not Present
Phase: BringUp
TXE File System Corrupted: No
PhaseStatus: UNKNOWN
FPF and TXE Config Status: Not committed
FW Capabilities value is 0x31109040
Feature enablement is 0x31109040
Platform type is 0x73FF0321
Intel(R) TXE code versions:

Table Type 0 ( 0x 00 ) found, size of 0 (0x 00 ) bytes
BIOS Version YEPOM10x.8.WP313R.NHNAUHL01
Vendor ID 8086
PCH Version B
FW Version 3.0.13.1144
Security Version (SVN) 0
Number of IFWI Modules 4
IFWI Module Name/Version
FTPR.man Version: 3.0.13.1144
PMCP.man Version: 0.1.0.0
SMIP.man Version: 11822.0.0.0
IUNP.man Version: 0.0.0.0

FW Capabilities 0x31109040

Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
Service Advertisement & Discovery - NOT PRESENT
Intel(R) Platform Trust Technology - PRESENT/ENABLED
Persistent RTC and Memory - PRESENT/ENABLED

Re-key needed False
Last TXE reset reason Power up
BIOS Config Lock Enabled
Get flash master region access status...done
Host Read Access to TXE Enabled
Host Write Access to TXE Enabled
Get EC region access status...done
Host Read Access to EC Disabled
Host Write Access to EC Disabled
Protected Range Register Base #0 0x0
Protected Range Register Limit #0 0x0
Protected Range Register Base #1 0x0
Protected Range Register Limit #1 0x0
Protected Range Register Base #2 0x0
Protected Range Register Limit #2 0x0
Protected Range Register Base #3 0x0
Protected Range Register Limit #3 0x0
Protected Range Register Base #4 0x0
Protected Range Register Limit #4 0x0
SPI Flash ID 1 C86017
SPI Flash ID 2 Not Available
BIOS boot State Post Boot
Capability Licensing Service Enabled
OEM Tag 0x00000000
Slot 1 Board Manufacturer 0x00000000
Slot 2 System Assembler 0x00000000
Slot 3 Reserved 0x00000000
EPID Group ID 0x11E4
Keybox Not Provisioned
Crypto HW Support Enabled
Replay Protection Not Supported
Replay Protection Bind Counter 0
Storage Device Type SPI
Replay Protection Bind Status Pre-bind
Replay Protection Rebind Not Supported
Replay Protection Max Rebind 0
Intel(R) PTT Supported Yes
Intel(R) PTT initial power-up state Enabled
PAVP Supported Yes
Integrated Sensor Hub Initial Power State Disabled
End of Manufacturing Enable No
Post Manufacturing NVAR Config Enabled No
Protect BIOS Environment Enabled
CPU Debugging Disabled
BSP Initialization Disabled
Measured Boot Enabled
Verified Boot Enabled
OEM Public Key Hash FPF Not set
OEM Public Key Hash UEP 340383FBD2D92AC6451D2E6AB412B5A5FCC9B476BC496A86845F77F20DAA9C76
OEM Public Key Hash TXE FW 340383FBD2D92AC6451D2E6AB412B5A5FCC9B476BC496A86845F77F20DAA9C76

FPF UEP TXE FW
--- --- ------
Boot Guard Profile Not set 2 - VM 2 - VM
Key Manifest ID Not set 0x1 0x1
PTT Not set Enabled Enabled
UFS Boot Source Not set Disabled Disabled
EMMC Boot Source Not set Disabled Disabled
SPI Boot Source Not set Enabled Enabled
LED Indication Enabled Disabled Disabled
DnX Not set Disabled Disabled
OEM ID Not set 0x0 0x0
OEM Platform ID Not set 0x0 0x0
SOC Config Lock Not set Not set Not set
RPMB Bind Counter 0x0 0x0 0x0
RPMB Migration Done Not set Not set Not set
Persistent PRTC Backup Power Exists Exists Exists
Allow OEM Signing of DAL Applets No No No
EK Revoke State Not Revoked Not Revoked Not Revoked

reply

#171 | RE: Intel Trusted Execution Engine: Drivers, Firmware & System Tools datum

Tue Mar 13, 2018 8:15 am

Looks like FPF is not set?

reply

#172 | RE: Intel Trusted Execution Engine: Drivers, Firmware & System Tools datum

Tue Mar 13, 2018 3:40 pm (Last edited: Tue Mar 13, 2018 3:43 pm)

Yeap, as you can see:

ManufacturingMode: Enabled
FPF and TXE Config Status: Not committed
Host Read Access to TXE Enabled
Host Write Access to TXE Enabled
End of Manufacturing Enable No
OEM Public Key Hash FPF Not set
(all FPF are Not set)

All of the above indicate that, although the SPI/BIOS image is signed, the signature was never hardware(FPF)-committed by the OEM. So you can do whatever you want, even commit to FPF yourself with your own key or whatever (why though?). You can thus follow the Engine CleanUp Guide and at step 7, just remove the OEM Public Key Hash to disable Signing. The platform should accept that change because the FPF are not committed. At the above fixed SPI I attached, I've updated the CSTXE firmware to the latest 3.1.50.2238 as well the APL CPU Microcode for Spectre Variant 2 mitigation.

I'd like to emphasize that the above portray my own understanding of the situation. Although, to my knowledge, nothing should be capable of blocking the update, the risk of flashing is always on the modder.

reply

#173 | RE: Intel Trusted Execution Engine: Drivers, Firmware & System Tools datum

Tue Mar 13, 2018 8:47 pm

Thanks for the explanation much appreciated, I will try flashing the bios tonight.

Just to clarify, is there anything I need to do prior to flashing? Do I just need to load the firmware onto a USB drive and flash it using afuefix /p /b in EFI shell

reply

#174 | RE: Intel Trusted Execution Engine: Drivers, Firmware & System Tools datum

Tue Mar 13, 2018 9:15 pm (Last edited: Tue Mar 13, 2018 9:16 pm)

Yes, you can flash it via AFU. After flashing, you may need to remove all power (AC + Battery, RTC is ok) for 1 minute or so and in the meantime, press the power button 1-2 times as well. The system should boot. If not, try to a few things like discussed here. Once it's up, run Flash Programming Tool with command "fptw -greset" for good measure and after the system reboot, everything should be updated and operational.

reply

#175 | RE: Intel Trusted Execution Engine: Drivers, Firmware & System Tools datum

Wed Mar 14, 2018 8:04 am

That worked, the SA-00086 as well as Spectre are patched. Meltdown still remains, I thought the Microcode update would have addressed that?

reply

#176 | RE: Intel Trusted Execution Engine: Drivers, Firmware & System Tools datum

Wed Mar 14, 2018 2:09 pm

Only Spectre Variant 2 requires a microcode fix. Meltdown, Spectre Variant 1 and Spectre Variant 2 rely on OS-based fixes.

reply

#177 | RE: Intel Trusted Execution Engine: Drivers, Firmware & System Tools datum

Thu Mar 15, 2018 6:04 pm (Last edited: Thu Mar 15, 2018 6:06 pm)

Intel CSTXE 4 Firmware v4.0.0.1245

Intel CSTXE 3.1 Firmware v3.1.50.2238

Intel CSTXE 3.2 Firmware v3.2.10.1129

Note: Added instructions on how you can update the CSTXE 3 & 4 firmware-based platforms (CSTXE 3 - 4 Updating).

reply

#178 | RE: Intel Trusted Execution Engine: Drivers, Firmware & System Tools datum

Fri Apr 13, 2018 9:39 pm

Intel CSTXE System Tools v4 r1

reply

#179 | RE: Intel Trusted Execution Engine: Drivers, Firmware & System Tools datum

Tue May 01, 2018 2:58 pm (Last edited: Tue May 01, 2018 3:09 pm)

Hi, plutomaniac. Can you take a look at this BIOS: Teclast F7 rom. It's not OEM signed and can be fixed against intel SA-00086 and 88 or not?
ME Analyzer told me, that there is OEM RSA Signature, but in previous case this signature was not a problem.

Smartpol has attached images to this post

TeclastF7.jpg

reply

#180 | RE: Intel Trusted Execution Engine: Drivers, Firmware & System Tools datum

Tue May 01, 2018 3:13 pm

It is signed as can be seen in MEA. Follow the Engine CleanUp Guide.

reply

Intel ME fw Downgrade MSI gf63 thin 10sc � � 2233-HECI error during MEBx execution

Page 12 of 17 � Page 1 ... 7 8 9 10 11 12 13 14 15 16 17 Page �

Please enter a reason for warning.