search

corna / me_cleaner

Tool for partial deblobbing of Intel ME/TXE firmware images
GNU General Public License v3.0
4.49k stars 278 forks source link

HP ZBook 15 by any chance internally? Nothing works... #144

Open nagyrobi opened 6 years ago

nagyrobi commented 6 years ago

$ ./ifdtool -d L70_0137.bin File L70_0137.bin is 8388608 bytes Unknown descriptor version: 7

$./me_cleaner.py -O L70_013p.bin L70_0137.bin Unknown image

BIOS image is downloadable from https://support.hp.com/us-en/drivers/selfservice/hp-zbook-15-mobile-workstation/5387800 (select Windows at the operating system, it's listed between those drivers, the softpaq exe can be decompressed easily and the image file will be L70_0137.bin)

skochinsky commented 6 years ago

It seems this update does not contain the full flash image, but only the BIOS region. You will need to use an external flasher to dump the flash chip and clean that image before flashing it back.

nagyrobi commented 6 years ago

Thank you. That's not going to happen any time soon, but I intend to look into this too.

nagyrobi commented 6 years ago

01.38 Rev.A BIOS updated here too:

NOTE: Due to security changes, after this BIOS update is installed, previous versions cannot be reinstalled.

nagyrobi commented 6 years ago

@skochinsky, your words made me think maybe HP releases ME image separately. And indeed, if you look at the download page I linked previously, there's an item called "Intel Full Management Engine (ME) Firmware Component". If you decompress the .exe, you'll find a subdirectory "ME" with a file "ME9.1_5M_Production.bin" inside.

Running ME analyzer against it, it shows: -------[ ME Analyzer v1.38.1 r109 ]-------

File: ME9.1_5M_Production.bin (1/1)

Family: ME Version: 9.1.42.3002 Release: Production Type: Region, Stock SKU: 5MB SVN: 1 VCN: 15 PV: Yes Date: 2017-10-24 Size: 0x8D2000 Platform: LPT/WPT Latest: Yes

ifdtool doesn't recognize it: ./ifdtool -d ME9.1_5M_Production.bin File ME9.1_5M_Production.bin is 9248768 bytes No Flash Descriptor found in this image

me_cleaner does: ./me_cleaner.py -c ME9.1_5M_Production.bin ME/TXE image detected Found FPT header at 0x10 Found 28 partition(s) Found FTPR header: FTPR partition spans from 0x160000 to 0x210000 ME/TXE firmware version 9.1.42.3002 Checking the FTPR RSA signature... VALID

Patching it succeedes:

./me_cleaner.py -O ME9.1_5M_Production_patch.bin ME9.1_5M_Production.bin ME/TXE image detected Found FPT header at 0x10 Found 28 partition(s) Found FTPR header: FTPR partition spans from 0x160000 to 0x210000 ME/TXE firmware version 9.1.42.3002 Reading partitions list... PSVN (0x00000bc0 - 0x000000c00, 0x00000040 total bytes): removed FOVD (0x00000c00 - 0x000001000, 0x00000400 total bytes): removed MDES (0x00001000 - 0x000002000, 0x00001000 total bytes): removed FCRS (0x00002000 - 0x000003000, 0x00001000 total bytes): removed EFFS (0x00003000 - 0x0000df000, 0x000dc000 total bytes): removed BIAL (NVRAM partition, no data, 0x0000add3 total bytes): nothing to remove BIEL (NVRAM partition, no data, 0x00003522 total bytes): nothing to remove BIIS (NVRAM partition, no data, 0x00036000 total bytes): nothing to remove NVCL (NVRAM partition, no data, 0x000069c9 total bytes): nothing to remove NVCM (NVRAM partition, no data, 0x0000439b total bytes): nothing to remove NVCP (NVRAM partition, no data, 0x0000a3fe total bytes): nothing to remove NVHM (NVRAM partition, no data, 0x00000058 total bytes): nothing to remove NVJC (NVRAM partition, no data, 0x00003da0 total bytes): nothing to remove NVKR (NVRAM partition, no data, 0x00005fb4 total bytes): nothing to remove NVNF (NVRAM partition, no data, 0x0000175f total bytes): nothing to remove NVOS (NVRAM partition, no data, 0x0003a34d total bytes): nothing to remove NVSH (NVRAM partition, no data, 0x000022c0 total bytes): nothing to remove NVSM (NVRAM partition, no data, 0x00001de8 total bytes): nothing to remove NVTD (NVRAM partition, no data, 0x00001feb total bytes): nothing to remove NVUK (NVRAM partition, no data, 0x00008940 total bytes): nothing to remove PLDM (NVRAM partition, no data, 0x000043c5 total bytes): nothing to remove TMNN (NVRAM partition, no data, 0x000001a6 total bytes): nothing to remove GLUT (0x000df000 - 0x0000e8000, 0x00009000 total bytes): removed LOCL (0x000e8000 - 0x0000ec000, 0x00004000 total bytes): removed WCOD (0x000ec000 - 0x000160000, 0x00074000 total bytes): removed FTPR (0x00160000 - 0x000210000, 0x000b0000 total bytes): NOT removed NFTP (0x00210000 - 0x00048a000, 0x0027a000 total bytes): removed MDMV (0x0048a000 - 0x0004ca000, 0x00040000 total bytes): removed Removing partition entries in FPT... Removing EFFS presence flag... Correcting checksum (0xd9)... Reading FTPR modules list... UPDATE (LZMA , 0x1c6487 - 0x1c66b1): removed ROMP (Huffman, fragmented data ): NOT removed, essential BUP (Huffman, fragmented data ): NOT removed, essential KERNEL (Huffman, fragmented data ): removed POLICY (Huffman, fragmented data ): removed ClsPriv (LZMA , 0x1c66b1 - 0x1c6a8a): removed SESSMGR (LZMA , 0x1c6a8a - 0x1d2417): removed SESSMGR_PRIV (LZMA , 0x1d2417 - 0x1d7d07): removed HOSTCOMM (LZMA , 0x1d7d07 - 0x1e0039): removed TDT (LZMA , 0x1e0039 - 0x1e53fe): removed FPF (LZMA , 0x1e53fe - 0x1e6efd): removed The ME minimum size should be 1560576 bytes (0x17d000 bytes) Checking the FTPR RSA signature... VALID Done! Good luck!

Unfortunately the flasher utility doesn't accept it: C:\Install\me\sp82541-patch\FW64>FWUpdLcl64.exe -f ../ME/ME9.1_5M_Production.bin -allowsv -y

Intel (R) Firmware Update Utility Version: 9.1.42.3002 Copyright (C) 2007 - 2017, Intel Corporation. All rights reserved.

Communication Mode: MEI Checking firmware parameters...

Warning: Do not exit the process or power off the machine before the firmware up date process ends. Error 8771: Invalid File

I was able to update the ME image on the Zbook laptop from 9.1.41.3024 to 9.1.42.3002 (unmodified) using FWUpdLcl64.exe, but i was not able to do so with the patched image file. Info about the flasher tool:

C:\Install\me\sp82541-orig\FW64>FWUpdLcl64.exe

Intel (R) Firmware Update Utility Version: 9.1.42.3002 Copyright (C) 2007 - 2017, Intel Corporation. All rights reserved.

FWUpdLcl.exe [-H|?] [-VER] [-EXP] [-VERBOSE] [-F] [-Y] [-SAVE] [-FWVER] [-PARTID] [-ALLOWSV] [-FORCERESET] [-OEMID] [-PASS] [-GENERIC] [-HALTRCFG]

-H|? Displays help screen. -VER Displays version information. -EXP Displays example usage of this tool. -VERBOSE Display the debug information of the tool. -F File used for updating the FW. -Y Automatically answer Yes to prompts. -SAVE Save the current FW to an update image. -FWVER Display the FW Version of current FW or update image. -PARTID Provide specific Partition ID to perform partial update. -ALLOWSV Allows same version firmware updates. -FORCERESET Automatically Reboots system after update (if needed). -OEMID OEM ID needed to perform firmware update. -PASS MeBX password. Optional with the '-f' option. -GENERIC Perform the update through MEI without credentials. -HALTRCFG Halts remote configuration.

Unfortunately the kill switch cannot be applied either because:

./me_cleaner.py -s -O ME9.1_5M_Production_switch.bin ME9.1_5M_Production.bin ME/TXE image detected -d, -D, -M, -S and -s require a full dump

Is there any way to skip checking in FWUpdLcl64.exe? Or a prepared version of FWUpdLcl64.exe whick skips check of the image file?

skochinsky commented 6 years ago

The firmware update is done by the running ME itself, FWUpdLcl64 basically just sends the image over.

nagyrobi commented 6 years ago

I see. I get "Checking the FTPR RSA signature... VALID" - don't know why it rejects it...