Today I found >here< a link to an Intel ME tool, which may be interesting for Intel ME experts. The developer's name is Igor Skochinsky.

According to the developer's site (>LINK<) the me-tools resp. the related scripts are able to dump and to extract Intel ME Firmware images.
The following formats are supported by the tool:

1. Full SPI flash image with descriptor (signature 5A A5 F0 0F)
2. Full ME region image (signature '$FPT')
3. individual ME code partitions and update images (signature $MN2/$MAN)

Yeap, I am aware of this. Check this post of mine from November:

Making an UPD ME firmware image from an extracted ME Region

My idea was to try and send the "HMRFPO ENABLE" message to the ME co-processor and unlock it via software. However, this phython script was not properly working for both my Z77 and HM65 systems. Even if it did work, I'm not sure the message would have unlocked the descriptor because it may have to be sent during a specific system state right after booting or something. Without something to unlock the descriptor this dumper won't be useful. And if it is unlocked, FPT seems to be easier that running phython scripts either way.

Zitat von plutomaniac im Beitrag #2

---

Yeap, I am aware of this. Check this post of mine from November:
Making an UPD ME firmware image from an extracted ME Region

---

Zitat

---

My idea was to try and send the "HMRFPO ENABLE" message to the ME co-processor and unlock it via software. However, this phython script was not properly working for both my Z77 and HM65 systems.

---

Yes, this has been confirmed by our Forum member and expert CodeRush. This is what he wrote >here< about Igor Skochinsky's me-tools:

Zitat von CodeRush

---

This utilities are for tinkering with ME image, not for unlocking it.

---

No there is no need to merge. It's good that you made this thread, who knows what we can achieve with these tools in the future.

Well they may be for tinkering but if we can successfully send the HMRFPO message via me_util and it does not require any special system state (I think I read something relating to that in the extremely little info from Intel you can find regarding this message) then it would make everything extremely easier.

That user aler+ from mydigitallife is basically asking the same thing and unless I remember correctly and a special system state is required, I think it's possible. I'll mention @CodeRush here in case he can clarify on whether that is even remotely possible even though the same question was asked at mydigiallife. Either way, I'll be checking that other forum thread for his reply.

Oh I didn't know you worked for such a company (Intel, OEM etc). I'm sorry if I brought you in a difficult position.

So indeed, what I remembered as "system state" is End Of Post. Manufacturing mode is basically an unlocked descriptor so even if someone made a simple tool to execute that command it would't do anything in a properly distributed system with a locked flash descriptor. Thank you for the DXE driver tip, it might help some other tinkerer.