Forum - RE: ME Analyzer Intel Engine Firmware Analysis Tool Discussion

#256 | RE: ME Analyzer Intel Engine Firmware Analysis Tool Discussion datum

Sat Jan 13, 2018 7:30 pm (Last edited: Sat Jan 13, 2018 7:31 pm)

ME Analyzer v1.42.0 r110

v1.42.0

Added full support for CSME 12.0 firmware
Added CSE Extensions 0x11, 0x16 and 0x14 R2
Added CSE Layout Table (LT) v1.6 & v1.7 support
Added Flash Partition Table ($FPT) v2.1 support
Added Boot Partition Descriptor Table (BPDT) v2-3 support
Added $FPT, BPDT & CSE LT partition overlap detection
Added CSE $FPT, BPDT & CSE Layout Table unpacking
Added CSE Partition Instance ID unpacking display
Added CSE partition OEM/FIT customization detection
Added CSE partition Hash & Size validation in all cases
Added CSE partition out-of-bounds Module detection
Added CSE UTFL structure at UTOK/STKN unpacking
Added CSE Layout Table entries info display (-dfpt)
Added ME 8-10 $FPT Partition Instance ID display
Improved CSE Extensions 0x3, 0xE, 0xF, 0x10 & 0x14 R1
Improved $FPT and BPDT entries info display (-dfpt)
Improved $CPD Entry Counter for end offset detection
Fixed CSE unpacking metadata text filename collision
Fixed false positive BPDT S-BPDT & CSE_BUP detection
Fixed wrong Manifest detection at Intel SPS capsules
Fixed wrong CSE firmware analysis messages position

r110

CSME 11.21.50.1429_COR_H_B0-S0_PRD_RGN
CSME 11.11.50.1436_CON_H_D0_PRD_RGN
CSME 11.8.50.3425_SLM_H_D0_PRD_EXTR
CSME 11.8.50.3425_SLM_LP_C0_NPDM_PRD_EXTR
CSME 11.6.12.1201_CON_H_D0_PRD_EXTR
ME 7.1.92.3273_5MB_PRD_UPD
TXE 1.1.5.2162_1.375MB_IT_PRD_EXTR

reply

#257 | RE: ME Analyzer Intel Engine Firmware Analysis Tool Discussion datum

Thu Mar 15, 2018 5:22 pm

thinks you help me for my works good job

reply

#258 | RE: ME Analyzer Intel Engine Firmware Analysis Tool Discussion datum

Wed Aug 15, 2018 6:36 am

What does this error mean, I've never seen before. I assumed this BIOS maybe didn't contain ME, since board has two roms and other larger dump did contain ME, but I ran this one through anyway to check and it just looks like BIOS without ME

I dropped the file in FIT too, errors there and would not open. Other larger BIOS no problem for MC Extractor or FIT. So I assume there is NO ME in this file, but wanted to ask here due to the "Found" but error and it seems like maybe there is some hidden ME and it's corrupted or something possibly?
BIOS is here - https://mega.nz/#!UGgHwQBT!lZ3mN-MIZke4H...r-ugMbg_5k38N4I
Thanks!

Please don't send PM's for help on BIOS edits, I can't help with BIOS in PM's. Please make a thread and I will try to help as soon as I can - thanks!
If you appreciate my efforts and are willing to donate to help improve my hardware, gift cards work for me (Amazn, NuEgg, eBa) - send me a PM
I view the forum like this, please bump your thread 1x every 24-48 hours if no reply

reply

#259 | RE: ME Analyzer Intel Engine Firmware Analysis Tool Discussion datum

Wed Aug 15, 2018 3:00 pm

This is not really MCE related but rather MEA. It means that a FD was detected with (CS)ME region offset/size but the region is not present. This usually indicates that something went wrong during dumping or similar.

reply

#260 | RE: ME Analyzer Intel Engine Firmware Analysis Tool Discussion datum

Thu Aug 16, 2018 7:29 am

Sorry man, I was sleep-posting I think, thought I put this into the MEA thread. This boards BIOS are made that way I think, both BIOS are fine as he's overwritten them with modified and programmed back the originals.
I think one BIOS just never has ME and the other always does, but it concerned me that is detected ME but unidentifiable. Dump is OK though, so it's not corrupted dump.

Please don't send PM's for help on BIOS edits, I can't help with BIOS in PM's. Please make a thread and I will try to help as soon as I can - thanks!
If you appreciate my efforts and are willing to donate to help improve my hardware, gift cards work for me (Amazn, NuEgg, eBa) - send me a PM
I view the forum like this, please bump your thread 1x every 24-48 hours if no reply

reply

#261 | RE: ME Analyzer Intel Engine Firmware Analysis Tool Discussion datum

Thu Aug 16, 2018 2:54 pm

No problem @Lost_N_BIOS, I moved these posts and tagged you to see the new location. That image is not proper. The FD does not start at 0x0 and it lacks the mentioned regions. That's an either incomplete or bad dump. It makes no sense for a system to have two BIOS chips, unless they are used for recovery (Dual BIOS) or one continues after the other (8MB + 4MB = 12MB for example). In the latter case, the first SPI usually holds the FD + Engine and the 2nd the BIOS or whatever did not fit at the first 8MB one. Getting two dumps with two FD and the 2nd not even being at 0x0 makes no sense.

reply

#262 | RE: ME Analyzer Intel Engine Firmware Analysis Tool Discussion datum

Thu Aug 16, 2018 5:20 pm

It's from an HP 800G2 AIO system, that has two BIOS on the board. It may be for recovery, or other reason I am not sure? I've never used one of those systems, so I can't explain it, but that's how it's setup. I've only seen like you mentioned, on an Asus corporate B75, one chip had FD+ME and the other full BIOS.
I was confused about it too, and thought maybe one was partial dump at first too, but he's already tested other BIOS I sent him, and then reflashed those back to the chips and it's working fine again. At first, he only sent me BIOS from one, since he could only dump one before his programmer arrived, and that was no good trying mod that way.

What location did you see an FD in there? I didn't check, because I didn't see it at the usual spot. I've ran into a few BIOS like that recently, maybe all from HP too, so maybe it's some new crap they do, I hate working on their BIOS nothing is labeled half the time or more (All numbers instead of module names)

Please don't send PM's for help on BIOS edits, I can't help with BIOS in PM's. Please make a thread and I will try to help as soon as I can - thanks!
If you appreciate my efforts and are willing to donate to help improve my hardware, gift cards work for me (Amazn, NuEgg, eBa) - send me a PM
I view the forum like this, please bump your thread 1x every 24-48 hours if no reply

reply

#263 | RE: ME Analyzer Intel Engine Firmware Analysis Tool Discussion datum

Fri Aug 17, 2018 1:49 am (Last edited: Fri Aug 17, 2018 2:00 am)

The FD has a specific signature tag, as explained at the FD Guide. In this case, it starts at 0x2000. From 0x2000, the GbE starts at + 0x1000 (from 0x0) = 0x3000 (valid firmware), ME at + 0x3000 (from 0x0) = 0x5000 (non valid, other OEM data, MEA error) and BIOS at + 0x700000 (from 0x0) = 0x702000 (valid firmware). The FD starts always at 0x0 and of course the ME region cannot be filled with irrelevant OEM data. That clearly indicates that this 2nd SPI chip is used for some sort of special HP feature/method, maybe recovery or backup or other reason. So, you only need to make any changes to the proper primary 16MB SPI chip.

reply

#264 | RE: ME Analyzer Intel Engine Firmware Analysis Tool Discussion datum

Fri Aug 17, 2018 12:45 pm (Last edited: Fri Aug 17, 2018 12:47 pm)

Wow, OK, thank you very much for all the info, I need to start absorbing some of these smaller details!
I will pass this along to the board owner!

Please don't send PM's for help on BIOS edits, I can't help with BIOS in PM's. Please make a thread and I will try to help as soon as I can - thanks!
If you appreciate my efforts and are willing to donate to help improve my hardware, gift cards work for me (Amazn, NuEgg, eBa) - send me a PM
I view the forum like this, please bump your thread 1x every 24-48 hours if no reply

reply

#265 | RE: ME Analyzer Intel Engine Firmware Analysis Tool Discussion datum

Tue Sep 25, 2018 5:12 am

thank

reply

#266 | RE: ME Analyzer Intel Engine Firmware Analysis Tool Discussion datum

Tue Dec 04, 2018 6:21 pm

can't identify this bios
https://www.asus.com/Motherboards/E3-PRO.../HelpDesk_BIOS/

╔══════════════════════════════════════════╗
║ ME Analyzer v1.70.2 r142 ║
╚══════════════════════════════════════════╝

╔═══════════════════════════════════════════════════════╗
║ E3-PRO-GAMING-V5-ASUS-2606.bin (1/2) ║
╟───────────────────────────────────┬───────────────────╢
║ Firmware Family │ CSE SPS ║
╟───────────────────────────────────┼───────────────────╢
║ Firmware Version │ 04.01.04.054 ║
╟───────────────────────────────────┼───────────────────╢
║ Firmware Release │ Production ║
╟───────────────────────────────────┼───────────────────╢
║ Firmware Type │ Region ║
╟───────────────────────────────────┼───────────────────╢
║ Firmware SKU │ 2 ║
╟───────────────────────────────────┼───────────────────╢
║ Security Version Number │ 3 ║
╟───────────────────────────────────┼───────────────────╢
║ Version Control Number │ 0 ║
╟───────────────────────────────────┼───────────────────╢
║ Production Version │ No ║
╟───────────────────────────────────┼───────────────────╢
║ OEM Unlock Token │ No ║
╟───────────────────────────────────┼───────────────────╢
║ Firmware Date │ 2017-09-25 ║
╟───────────────────────────────────┼───────────────────╢
║ File System State │ Configured ║
╟───────────────────────────────────┼───────────────────╢
║ Firmware Size │ 0x2F9000 ║
╟───────────────────────────────────┼───────────────────╢
║ Flash Image Tool │ 04.01.04.054 ║
╟───────────────────────────────────┼───────────────────╢
║ Chipset Support │ Unknown ║
╚═══════════════════════════════════╧═══════════════════╝

reply

#267 | RE: ME Analyzer Intel Engine Firmware Analysis Tool Discussion datum

Tue Dec 04, 2018 7:50 pm (Last edited: Tue Dec 04, 2018 7:52 pm)

Platform is undefined (bug/problem by Asus mistake, I think), rom can't be opened in SPS FITc 4 either due to this chipset issue (Image configuration not found - PCH/platform + File System Undefined).

Please don't send PM's for help on BIOS edits, I can't help with BIOS in PM's. Please make a thread and I will try to help as soon as I can - thanks!
If you appreciate my efforts and are willing to donate to help improve my hardware, gift cards work for me (Amazn, NuEgg, eBa) - send me a PM
I view the forum like this, please bump your thread 1x every 24-48 hours if no reply