1# me\_cleaner 2 3_me\_cleaner_ is a Python script able to modify an Intel ME firmware image with 4the final purpose of reducing its ability to interact with the system. 5 6## Intel ME 7 8Intel ME is a co-processor integrated in all post-2006 Intel boards, which is 9the base hardware for many Intel features like Intel AMT, Intel Boot Guard, 10Intel PAVP and many others. To provide such features, it requires full access to 11the system, including memory (through DMA) and network access (transparent to 12the user). 13 14Unlike many other firmware components, the Intel ME firmware can't be neither 15disabled nor reimplemented, as it is tightly integrated in the boot process and 16it is signed. 17 18This poses an issue both to the free firmware implementations like [coreboot]( 19https://www.coreboot.org/), which are forced to rely on a proprietary, obscure 20and always-on blob, and to the privacy-aware users, who are reasonably worried 21about such firmware, running on the lowest privilege ring on x86. 22 23## What can be done 24 25Before Nehalem (ME version 6, 2008/2009) the ME firmware could be removed 26completely from the flash chip by setting a couple of bits inside the flash 27descriptor, effectively disabling it. 28 29Starting from Nehalem the Intel ME firmware can't be removed anymore: without a 30valid firmware the PC shuts off forcefully after 30 minutes, probably as an 31attempt to enforce the Intel Anti-Theft policies. 32 33However, while Intel ME can't be turned off completely, it is still possible to 34modify its firmware up to a point where Intel ME is active only during the boot 35process, effectively disabling it during the normal operation, which is what 36_me\_cleaner_ tries to accomplish. 37 38## Platform support 39 40_me\_cleaner_ currently works on [most of the Intel platforms]( 41https://github.com/corna/me_cleaner/wiki/me_cleaner-status); while this doesn't 42mean it works on all the boards (due to the different firmware implementations), 43it has been proven quite reliable on a great number of them. 44 45## Usage 46 47_me\_cleaner_ should handle all the steps necessary to the modification of an 48Intel ME firmware with the command: 49 50 $ python me_cleaner.py -S -O modified_image.bin original_dump.bin 51 52However, obtaining the original firmware and flashing back the modified one is 53usually not trivial, as the Intel ME firmware region is often non-writable from 54the OS (and it's not a safe option anyways), requiring the use of an external 55SPI programmer. 56 57## Results 58 59For pre-Skylake firmware (ME version < 11) this tool removes almost everything, 60leaving only the two fundamental modules needed for the correct boot, `ROMP` and 61`BUP`. The code size is reduced from 1.5 MB (non-AMT firmware) or 5 MB (AMT 62firmware) to ~90 kB of compressed code. 63 64Starting from Skylake (ME version >= 11) the ME subsystem and the firmware 65structure have changed, requiring substantial changes in _me\_cleaner_. 66The fundamental modules required for the correct boot are now four (`rbe`, 67`kernel`, `syslib` and `bup`) and the minimum code size is ~300 kB of compressed 68code (from the 2 MB of the non-AMT firmware and the 7 MB of the AMT one). 69 70On some boards the OEM firmware fails to boot without a valid Intel ME firmware; 71in the other cases the system should work with minor inconveniences (like longer 72boot times or warning messages) or without issues at all. 73 74Obviously, the features provided by Intel ME won't be functional anymore after 75the modifications. 76 77## Documentation 78 79The detailed documentation about the working of _me\_cleaner_ can be found on 80the page ["How does it work?" page]( 81https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F). 82 83Various guides and tutorials are available on the Internet, however a good 84starting point is the ["How to apply me_cleaner" guide]( 85https://github.com/corna/me_cleaner/wiki/How-to-apply-me_cleaner). 86