• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Disabling Intel ME

leSLIe

leSLIe

Fully [H]
Joined
Oct 18, 2004
Messages
17,398
Has anyone disable Intel ME in their CPU?
I'm not talking about not installing the Intel ME windows drivers, but disabling the actual option in the hardware.
If so, share your experiences
 
leSLIe said:
Has anyone disable Intel ME in their CPU?
I'm not talking about not installing the Intel ME windows drivers, but disabling the actual option in the hardware.
If so, share your experiences
Click to expand...
Not personal experience, but you can buy laptops with custom BIOS, or open source BIOS like Coreboot, and IME fully disabled. There are laptop vendors out there specialized in doing this.
Have not seen much of that going on desktops, though.
 
Yes. It's possible without having it that way forever (why that's better gets explained), flashing / modifying your firmware.
Let's keep it short.

How? Reverse engineer FPTW64.exe (specifically the "-disableme" argument) for your CSME Version.
It boils down to one MKHI message: group 0xFF, command 0x10.
Send it from Windows → rejected. fpt gives you 219.

Why? End-of-POST (EOP).
Near the end of boot, the firmware hands the ME its EOP message. After EOP the ME stops accepting the a whole class of "bring up" commands. From Windows you're way past EOP -> too late. The command's fine, the timing's wrong.

Fix? Win the TPL Race.
Intel ME sends EOP from TPL_CALLBACK (0x08). I register mine at the higher TPL_NOTIFY (0x10), so it runs first. That gap is the whole race win.

Now what?
Write a UEFI Driver to hook high TPL, at ReadyToBoot (latest stage before EOP gets sent) hit HECI1 with 0xFF/0x10 equals ME (and your audio*) disabled.

Have fun.
https://github.com/sch-247/management-engine/

1783011886440.png
 
sch1 said:
Yes. It's possible without having it that way forever (why that's better gets explained), flashing / modifying your firmware.
Let's keep it short.

How? Reverse engineer FPTW64.exe (specifically the "-disableme" argument) for your CSME Version.
It boils down to one MKHI message: group 0xFF, command 0x10.
Send it from Windows → rejected. fpt gives you 219.

Why? End-of-POST (EOP).
Near the end of boot, the firmware hands the ME its EOP message. After EOP the ME stops accepting the a whole class of "bring up" commands. From Windows you're way past EOP -> too late. The command's fine, the timing's wrong.

Fix? Win the TPL Race.
Intel ME sends EOP from TPL_CALLBACK (0x08). I register mine at the higher TPL_NOTIFY (0x10), so it runs first. That gap is the whole race win.

Now what?
Write a UEFI Driver to hook high TPL, at ReadyToBoot (latest stage before EOP gets sent) hit HECI1 with 0xFF/0x10 equals ME (and your audio*) disabled.

Have fun.
https://github.com/sch-247/management-engine/

View attachment 812702
Click to expand...
Its nice
but it only works explicitly for Comet Lake + CSME 14.1.

Intel is making it even harder to disable ME, some functionality moved into the PMC (Power Management Controller), and full disable often breaks more things or is less effective.
I don't like this ME backdoor, but it looks like we can't avoid this...
 
leSLIe said:
Its nice
but it only works explicitly for Comet Lake + CSME 14.1.

Intel is making it even harder to disable ME, some functionality moved into the PMC (Power Management Controller), and full disable often breaks more things or is less effective.
I don't like this ME backdoor, but it looks like we can't avoid this...
Click to expand...
not sure if it only explicitly works on comet lake and idk you can call this a backdoor its a legitimate implementation by intel. other than that i believe this method should universally work for any / most csme version(s) why shouldnt it?
do you mind telling me your csme version?
 
Isn't there a BIOS setting? I think there is on my Gigabyte board. I might be thinking of AMT? I'll have a look in a little.
 
sch1 said:
k you can call this a backdoor its a legitimate implementation by intel.
Click to expand...
It's a legitimate backdoor by Intel 😁
a cpu inside a cpu with ring 0 access, that you can't control. Put there due to a direct order by the NSA.
Yeah, this will not be used for good, in fact i reckon this backdoor will be used in the upcoming computer "covid" that has been planned for some time.
 
You must log in or register to reply here.
Back
Top