Clean an older core 2 quad

orachas commented 5 years ago

I would like to run me_cleaner on an older HP (6000 pro sff) desktop running a Core 2 quad q9650 with a Q43 express chipset.

Running flashrom to extract the current bios fails (due to failed permission to read the ME?), but it tells me that I have an ICH10D with a Winbond flash chip "W25Q32.V." I only see one physical Winbond chip on this board, and it's not socketed (I don't see any socketed chips other than the CPU). Running mei-amt-check reports what I assume to be ME version 5.2.10.

I'm not afraid of bricking the board, because HP sells them reconditioned on ebay for $10.

I have the last HP BIOS from 2015 in a file called 7G2_0203.bin. I can generate an ifdtool dump which I'll attach, but me_cleaner reports "Unknown image" on it.

Are there any conversion tools that I can use on the OEM BIOS to create something that me_cleaner can patch? And can I convert this output back into something that the HP tools can write?

File 7G2_0203.bin is 4194304 bytes
FLMAP0:    0x04040001
  NR:      4
  FRBA:    0x40
  NC:      1
  FCBA:    0x10
FLMAP1:    0x0a100206
  ISL:     0x0a
  FPSBA:   0x100
  NM:      2
  FMBA:    0x60
FLMAP2:    0x00000120
  PSL:     0x0001
  FMSBA:   0x200
FLUMAP1:   0xffffffff
  Intel ME VSCC Table Length (VTL):        255
  Intel ME VSCC Table Base Address (VTBA): 0x000ff0

ME VSCC table:
  JID0:  0xffffffff
    SPI Componend Device ID 1:          0xff
    SPI Componend Device ID 0:          0xff
    SPI Componend Vendor ID:            0xff
  VSCC0: 0xffffffff
    Lower Erase Opcode:                 0xff
    Lower Write Enable on Write Status: 0x06
    Lower Write Status Required:        Yes
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    64KB
    Upper Erase Opcode:                 0xff
    Upper Write Enable on Write Status: 0x06
    Upper Write Status Required:        Yes
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    64KB
  JID1:  0xffffffff
    SPI Componend Device ID 1:          0xff
    SPI Componend Device ID 0:          0xff
    SPI Componend Vendor ID:            0xff
  VSCC1: 0xffffffff
    Lower Erase Opcode:                 0xff
    Lower Write Enable on Write Status: 0x06
    Lower Write Status Required:        Yes
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    64KB
    Upper Erase Opcode:                 0xff
    Upper Write Enable on Write Status: 0x06
    Upper Write Status Required:        Yes
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    64KB
  JID2:  0xffffffff
    SPI Componend Device ID 1:          0xff
    SPI Componend Device ID 0:          0xff
    SPI Componend Vendor ID:            0xff
  VSCC2: 0x0800ffff
    Lower Erase Opcode:                 0x08
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        No
    Lower Write Granularity:            1 bytes
    Lower Block / Sector Erase Size:    256 Byte
    Upper Erase Opcode:                 0xff
    Upper Write Enable on Write Status: 0x06
    Upper Write Status Required:        Yes
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    64KB
  JID3:  0x0053ffff
    SPI Componend Device ID 1:          0x53
    SPI Componend Device ID 0:          0xff
    SPI Componend Vendor ID:            0xff
  VSCC3: 0xffffffff
    Lower Erase Opcode:                 0xff
    Lower Write Enable on Write Status: 0x06
    Lower Write Status Required:        Yes
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    64KB
    Upper Erase Opcode:                 0xff
    Upper Write Enable on Write Status: 0x06
    Upper Write Status Required:        Yes
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    64KB
  JID4:  0xffffffff
    SPI Componend Device ID 1:          0xff
    SPI Componend Device ID 0:          0xff
    SPI Componend Vendor ID:            0xff
  VSCC4: 0x304810c3
    Lower Erase Opcode:                 0x30
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        Yes
    Lower Write Granularity:            1 bytes
    Lower Block / Sector Erase Size:    256 Byte
    Upper Erase Opcode:                 0x10
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        No
    Upper Write Granularity:            1 bytes
    Upper Block / Sector Erase Size:    64KB
  JID5:  0x10de103c
    SPI Componend Device ID 1:          0xde
    SPI Componend Device ID 0:          0x10
    SPI Componend Vendor ID:            0x3c
  VSCC5: 0x00008086
    Lower Erase Opcode:                 0x00
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        No
    Lower Write Granularity:            1 bytes
    Lower Block / Sector Erase Size:    256 Byte
    Upper Erase Opcode:                 0x80
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        No
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    8KB
  JID6:  0x00000d01
    SPI Componend Device ID 1:          0x00
    SPI Componend Device ID 0:          0x0d
    SPI Componend Vendor ID:            0x01
  VSCC6: 0xa7050000
    Lower Erase Opcode:                 0xa7
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        No
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    4KB
    Upper Erase Opcode:                 0x00
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        No
    Upper Write Granularity:            1 bytes
    Upper Block / Sector Erase Size:    256 Byte
  JID7:  0x0a003020
    SPI Componend Device ID 1:          0x00
    SPI Componend Device ID 0:          0x30
    SPI Componend Vendor ID:            0x20
  VSCC7: 0x8d070000
    Lower Erase Opcode:                 0x8d
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        No
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    64KB
    Upper Erase Opcode:                 0x00
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        No
    Upper Write Granularity:            1 bytes
    Upper Block / Sector Erase Size:    256 Byte

OEM Section:
00: 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 31 39
10: 38 32 2c 32 30 31 35 20 48 65 77 6c 65 74 74 2d
20: 50 61 63 6b 61 72 64 20 44 65 76 65 6c 6f 70 6d
30: 65 6e 74 20 43 6f 6d 70 61 6e 79 20 4c 2e 50 2e

Found Region Section
FLREG0:    0x00000000
  Flash Region 0 (Flash Descriptor): 00000000 - 00000fff 
FLREG1:    0x03ff0260
  Flash Region 1 (BIOS): 00260000 - 003fffff 
FLREG2:    0x025f000b
  Flash Region 2 (Intel ME): 0000b000 - 0025ffff 
FLREG3:    0x00020001
  Flash Region 3 (GbE): 00001000 - 00002fff 
FLREG4:    0x000a0003
  Flash Region 4 (Platform Data): 00003000 - 0000afff 

Found Component Section
FLCOMP     0x00300003
  Dual Output Fast Read Support:       not supported
  Read ID/Read Status Clock Frequency: 20MHz
  Write/Erase Clock Frequency:         20MHz
  Fast Read Clock Frequency:           33MHz
  Fast Read Support:                   supported
  Read Clock Frequency:                20MHz
  Component 2 Density:                 512KB
  Component 1 Density:                 4MB
FLILL      0x00000000
  Invalid Instruction 3: 0x00
  Invalid Instruction 2: 0x00
  Invalid Instruction 1: 0x00
  Invalid Instruction 0: 0x00
FLPB       0x00000000
  Flash Partition Boundary Address: 0x000000

Found PCH Strap Section
PCHSTRP0:  0x10194e08
PCHSTRP1:  0x0022810f
PCHSTRP2:  0x6165696d
PCHSTRP3:  0x00000000
PCHSTRP4:  0x00000000
PCHSTRP5:  0x00000000
PCHSTRP6:  0x00000000
PCHSTRP7:  0x00000000
PCHSTRP8:  0x00000000
PCHSTRP9:  0x00000030
PCHSTRP10: 0xffffffff
PCHSTRP11: 0xffffffff
PCHSTRP12: 0xffffffff
PCHSTRP13: 0xffffffff
PCHSTRP14: 0xffffffff
PCHSTRP15: 0xffffffff
PCHSTRP16: 0xffffffff
PCHSTRP17: 0xffffffff

Found Master Section
FLMSTR1:   0x1f1f0000 (Host CPU/BIOS)
  Platform Data Region Write Access: enabled
  GbE Region Write Access:           enabled
  Intel ME Region Write Access:      enabled
  Host CPU/BIOS Region Write Access: enabled
  Flash Descriptor Write Access:     enabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       enabled
  Host CPU/BIOS Region Read Access:  enabled
  Flash Descriptor Read Access:      enabled
  Requester ID:                      0x0000

FLMSTR2:   0x1c1f0000 (Intel ME)
  Platform Data Region Write Access: enabled
  GbE Region Write Access:           enabled
  Intel ME Region Write Access:      enabled
  Host CPU/BIOS Region Write Access: disabled
  Flash Descriptor Write Access:     disabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       enabled
  Host CPU/BIOS Region Read Access:  enabled
  Flash Descriptor Read Access:      enabled
  Requester ID:                      0x0000

FLMSTR3:   0x081f0218 (GbE)
  Platform Data Region Write Access: disabled
  GbE Region Write Access:           enabled
  Intel ME Region Write Access:      disabled
  Host CPU/BIOS Region Write Access: disabled
  Flash Descriptor Write Access:     disabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       enabled
  Host CPU/BIOS Region Read Access:  enabled
  Flash Descriptor Read Access:      enabled
  Requester ID:                      0x0218

Found Processor Strap Section
????:      0xffffff7e
????:      0xffffffff
????:      0xffffffff
????:      0xffffffff
????:      0xffffffff
????:      0xffffffff
????:      0xffffffff
????:      0xffffffff

persmule commented 5 years ago

Check https://github.com/corna/me_cleaner/issues/227 for reference.

orachas commented 5 years ago

Thanks, I will try Libreboot's ich9deblob tools for this board instead.

corna commented 5 years ago

This morning I've added support for ICH9 and older, no need to use ich9deblob. Try to pull the latest changes in me_cleaner and run it again on your image.

orachas commented 5 years ago

Ok, here is the log of what I did:

$ wget https://raw.githubusercontent.com/corna/me_cleaner/master/me_cleaner.py
--2018-10-07 12:22:59--  https://raw.githubusercontent.com/corna/me_cleaner/master/me_cleaner.py
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 151.101.184.133
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|151.101.184.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 37482 (37K) [text/plain]
Saving to: ‘me_cleaner.py’

me_cleaner.py       100%[===================>]  36.60K  --.-KB/s    in 0.02s

2018-10-07 12:22:59 (1.68 MB/s) - ‘me_cleaner.py’ saved [37482/37482]

$ chmod 755 me_cleaner.py

$ ./me_cleaner.py -c 7G2_0203.bin
Full image detected
Found FPT header at 0xb010
Found 14 partition(s)
Found FTPR header: FTPR partition spans from 0xd2000 to 0x162000
ME/TXE firmware version 5.2.10.1023 (generation 1)
Public key match: Intel ME, firmware versions 5.x.x.x
The meDisable bit in ICHSTRP0 is NOT SET
The meDisable bit in MCHSTRP0 is NOT SET

$ ./me_cleaner.py -S -O nome_6000pro.bin 7G2_0203.bin
Full image detected
Found FPT header at 0xb010
Found 14 partition(s)
Found FTPR header: FTPR partition spans from 0xd2000 to 0x162000
ME/TXE firmware version 5.2.10.1023 (generation 1)
Public key match: Intel ME, firmware versions 5.x.x.x
The meDisable bit in ICHSTRP0 is NOT SET, setting it now...
The meDisable bit in MCHSTRP0 is NOT SET, setting it now...
Disabling the ME region...
Wiping the ME region...
Done! Good luck!

I have three options to burn this...

The Windows 7 flash tool, which I am running in Windows 10.
A FlashBin.exe tool in a "DOS Flash" directory included with the above Win7 set.
A flash update option in the BIOS that supposedly reads from USB.

Which should I try first?

...maybe I'll just give the BIOS version a whirl.

orachas commented 5 years ago

I have flashed this image successfully within the HP BIOS, powered down, and cleanly rebooted.

How can I verify that the ME is disabled? I still see the output below:

# ./mei-amt-check
AMT present: true
AMT provisioning state: being provisioned
Flash:      5.2.10
Netstack:   5.2.10
AMTApps:    5.2.10
AMT:        5.2.10
Sku:        18462
VendorID:   8086
Build Number:       1023
Recovery Version:   5.2.10
Recovery Build Num: 1023
Legacy Mode:        False

Assuming that I've successfully wiped my flash, I might write this procedure up.

p.s. There is an option "CTRL+P=MEBx" on my BIOS splash screen - this function no longer works, but goes immediately to GRUB. It used to present an ME admin page asking for a password.

orachas commented 5 years ago

I have applied this to a few similar machines with no difficulty, and it seems to work well.

After removing all power from these systems for some time, the mei-amt-check utility is no longer able to find an active ME. It does seem that the ARC CPU is able to survive a short loss of power, maintaining the running ME instance across a reboot. I am guessing that ten minutes with no power is sufficient to reset it.

Am I correct in guessing that this is the last Intel architecture that is not vulnerable to SA-00086 after ME removal?

Jolex12 commented 5 years ago

Can you please send me 7G2_0203.bin ?

orachas commented 5 years ago

Can you please send me 7G2_0203.bin ?

Below is the processed BIOS file that you requested. I'm assuming that you know how to undo the base64 encoding and xz compression. Please do check the signature.

Hewlett-Packard HP Compaq 6000 Pro SFF PC/3048h, BIOS 786G2 v02.03 10/19/2015 dbcbd10f057a39c617937a1a80c74e08dc83cde5d80952ae482c740d188bd5a4 7G2_0204.bin 7G2_0204.bin.xz.base64.txt

I also have a processed BIOS for the HP dc7800p SFF, attached below.

26d4854102d6f2383aa33e72ff64905d62ec23e9322708f3b75b11e7901f8b21 7F1_0136.bin 7F1_0136.bin.xz.base64.txt

Hope they work as well for you as they did for me.

Jolex12 commented 5 years ago

I'm really sorry to bored you,but can you please send me 7G2_0204.bin.xz.base64.txt in bin file. I don't now how change it to bin file. Greeting from Bosnia ! :)

суб, 1. дец 2018. у 16:33 orachas notifications@github.com је написао/ла:

Can you please send me 7G2_0203.bin ?

Below is the processed BIOS file that you requested. I'm assuming that you know how to undo the base64 encoding and xz compression. Please do check the signature.

Hewlett-Packard HP Compaq 6000 Pro SFF PC/3048h, BIOS 786G2 v02.03 10/19/2015 dbcbd10f057a39c617937a1a80c74e08dc83cde5d80952ae482c740d188bd5a4 7G2_0204.bin 7G2_0204.bin.xz.base64.txt https://github.com/corna/me_cleaner/files/2635988/7G2_0204.bin.xz.base64.txt

I also have a processed BIOS for the HP dc7800p SFF, attached below.

26d4854102d6f2383aa33e72ff64905d62ec23e9322708f3b75b11e7901f8b21 7F1_0136.bin 7F1_0136.bin.xz.base64.txt https://github.com/corna/me_cleaner/files/2635992/7F1_0136.bin.xz.base64.txt

Hope they work as well for you as they did for me.

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/corna/me_cleaner/issues/233#issuecomment-443434484, or mute the thread https://github.com/notifications/unsubscribe-auth/ArZlEV76KryyulMrx2zT0s8lXNCfiXX8ks5u0qFVgaJpZM4XL6lB .

orachas commented 5 years ago

I'm really sorry to bored you,but can you please send me 7G2_0204.bin.xz.base64.txt in bin file. I don't now how change it to bin file. Greeting from Bosnia ! :) суб, 1. дец 2018 .

If you don't know how to work with common archive formats, then are you sure that you want to run a custom BIOS?

In any case, the above .txt file can be decoded and uncompressed on Windows with the latest copy of busybox for win32 (which you should easily be able to find).

This command will generate the .bin file:

busybox64 base64 -d 7G2_0204.bin.xz.base64.txt | busybox64 xz -cd > 7G2_0204.bin

This command will print the sha256 signature:

busybox64 sha256sum 7G2_0204.bin

It must match this perfectly:

dbcbd10f057a39c617937a1a80c74e08dc83cde5d80952ae482c740d188bd5a4 7G2_0204.bin

corna / me_cleaner

Clean an older core 2 quad #233