search

corna / me_cleaner

Tool for partial deblobbing of Intel ME/TXE firmware images
GNU General Public License v3.0
4.47k stars 278 forks source link

T430 SPI Dump - "Unknown Image" #35

Open n4ru opened 7 years ago

n4ru commented 7 years ago

me_cleaner seems to not like my fresh images pulled from my T430. v2.72 of BIOS, pulled with flashrom.

n4ru commented 7 years ago

Same issue seems to occur when pulled with software through Windows (12MB filesize)

ghost commented 7 years ago

@n4ru Can you run ifdtool -d on the dump and post the output?

The BIOS should be located in the 4MB binary file and other regions in the 8MB binary file. Note that both the flash descriptor and ME are locked, so you will need an external programmer in the end.

Try to dump both of them, and then concatenate them:

cutamar commented 5 years ago

Same problem on a T430, @n4ru could you solve it?

@Thiblizz here is my output (for the 4MB dump):

File bios1.bin is 4194304 bytes
ICH Revision: 100 series Sunrise Point
FLMAP0:    0x5ec0940f
  NR:      6
  FRBA:    0xc00
  NC:      1
  FCBA:    0xf0
FLMAP1:    0x5ec032c3
  ISL:     0x5e
  FPSBA:   0xc00
  NM:      2
  FMBA:    0xc30
FLMAP2:    0x026856c3
  PSL:     0x6856
  FMSBA:   0xc30
FLUMAP1:   0xced7002c
  Intel ME VSCC Table Length (VTL):        0
  Intel ME VSCC Table Base Address (VTBA): 0x0002c0

ME VSCC table:

OEM Section:
00: cc d4 32 e6 86 d4 e5 33 97 19 93 25 68 fa 0c 7b
10: c6 2f ba 95 0c 33 61 17 f8 bd 74 04 a0 39 1e 9d
20: a1 7b e9 fe 56 38 52 4c 06 56 5f 7a 0c 44 87 d9
30: 15 c5 e4 c9 e7 0c 63 94 84 56 df 1c ee bc fe 37

Found Region Section
FLREG0:    0x66f1a3c3
  Flash Region 0 (Flash Descriptor): 023c3000 - 066f1fff 
FLREG1:    0xb9767f31
  Flash Region 1 (BIOS): 07f31000 - 03976fff (unused)
FLREG2:    0xb533caf2
  Flash Region 2 (Intel ME): 04af2000 - 03533fff (unused)
FLREG3:    0x2a09d666
  Flash Region 3 (GbE): 05666000 - 02a09fff (unused)
FLREG4:    0xd1d277d6
  Flash Region 4 (Platform Data): 077d6000 - 051d2fff (unused)
FLREG5:    0xdf29c170
  Flash Region 5 (Reserved): 04170000 - 05f29fff 
FLREG6:    0x73cfb98f
  Flash Region 6 (Reserved): 0398f000 - 073cffff 
FLREG7:    0xfa4489f4
  Flash Region 7 (Reserved): 009f4000 - 07a44fff 
FLREG8:    0xc384dce4
  Flash Region 8 (EC): 05ce4000 - 04384fff (unused)

Found Component Section
FLCOMP     0xbc48970a
  Dual Output Fast Read Support:       not supported
  Read ID/Read Status Clock Frequency: unknown<7>MHz
  Write/Erase Clock Frequency:         30MHz
  Fast Read Clock Frequency:           48MHz
  Fast Read Support:                   not supported
  Read Clock Frequency:                30MHz
  Component 2 Density:                 512KB
  Component 1 Density:                 unknown<a>MB
FLILL      0x48be0cba
  Invalid Instruction 3: 0x48
  Invalid Instruction 2: 0xbe
  Invalid Instruction 1: 0x0c
  Invalid Instruction 0: 0xba
FLPB       0x8dce9f91
  Flash Partition Boundary Address: 0xf91000

Found PCH Strap Section
PCHSTRP0:  0x66f1a3c3
PCHSTRP1:  0xb9767f31
PCHSTRP2:  0xb533caf2
PCHSTRP3:  0x2a09d666
PCHSTRP4:  0xd1d277d6
PCHSTRP5:  0xdf29c170
PCHSTRP6:  0x73cfb98f
PCHSTRP7:  0xfa4489f4
PCHSTRP8:  0xc384dce4
PCHSTRP9:  0x463b1300
PCHSTRP10: 0x52158d16
PCHSTRP11: 0x51230c37
PCHSTRP12: 0xf1b75d09
PCHSTRP13: 0x8bf2d9f3
PCHSTRP14: 0x07d7b9b5
PCHSTRP15: 0xcd4db80c
PCHSTRP16: 0x6d1738a6
PCHSTRP17: 0xa404214c
HAP bit is set

Found Master Section
FLMSTR1:   0xf1b75d09 (Host CPU/BIOS)
  EC Region Write Access:            enabled
  Platform Data Region Write Access: enabled
  GbE Region Write Access:           enabled
  Intel ME Region Write Access:      disabled
  Host CPU/BIOS Region Write Access: enabled
  Flash Descriptor Write Access:     enabled
  EC Region Read Access:             enabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       enabled
  Host CPU/BIOS Region Read Access:  disabled
  Flash Descriptor Read Access:      enabled
FLMSTR2:   0x8bf2d9f3 (Intel ME)
  EC Region Write Access:            disabled
  Platform Data Region Write Access: enabled
  GbE Region Write Access:           enabled
  Intel ME Region Write Access:      enabled
  Host CPU/BIOS Region Write Access: enabled
  Flash Descriptor Write Access:     enabled
  EC Region Read Access:             disabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       disabled
  Host CPU/BIOS Region Read Access:  disabled
  Flash Descriptor Read Access:      enabled
FLMSTR3:   0x07d7b9b5 (GbE)
  EC Region Write Access:            disabled
  Platform Data Region Write Access: enabled
  GbE Region Write Access:           enabled
  Intel ME Region Write Access:      enabled
  Host CPU/BIOS Region Write Access: disabled
  Flash Descriptor Write Access:     enabled
  EC Region Read Access:             enabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       disabled
  Host CPU/BIOS Region Read Access:  disabled
  Flash Descriptor Read Access:      enabled
FLMSTR5:   0x6d1738a6 (EC)
  EC Region Write Access:            disabled
  Platform Data Region Write Access: enabled
  GbE Region Write Access:           disabled
  Intel ME Region Write Access:      disabled
  Host CPU/BIOS Region Write Access: disabled
  Flash Descriptor Write Access:     enabled
  EC Region Read Access:             enabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       disabled
  Host CPU/BIOS Region Read Access:  disabled
  Flash Descriptor Read Access:      disabled
Found Processor Strap Section
????:      0xf1b75d09
????:      0x8bf2d9f3
????:      0x07d7b9b5
????:      0xcd4db80c
????:      0x6d1738a6
????:      0xa404214c
????:      0x1d231487
????:      0x729b475d
kaybarkbark commented 1 year ago

Same issue here. I extracted these with an external SPI flasher, with the chips physically desoldered from the board. Both chips were read twice and md5sum'd to ensure the read was good.

ICH Revision: Unknown PCH
FLMAP0:    0x5ec0940f
  NR:      6
  FRBA:    0xc00
  NC:      1
  FCBA:    0xf0
FLMAP1:    0x5ec032c3
  ISL:     0x5e
  FPSBA:   0xc00
  NM:      2
  FMBA:    0xc30
FLMAP2:    0x026856c3
  PSL:     0x6856
  FMSBA:   0xc30
FLUMAP1:   0xa983d896
  Intel ME VSCC Table Length (VTL):        216
  Intel ME VSCC Table Base Address (VTBA): 0x000960

ME VSCC table:
  JID0:  0x55cba035
    SPI Component Vendor ID:            0x35
    SPI Component Device ID 0:          0xa0
    SPI Component Device ID 1:          0xcb
  VSCC0: 0x2add61f4
    Lower Erase Opcode:                 0x2a
    Lower Write Enable on Write Status: 0x06
    Lower Write Status Required:        Yes
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    4KB
    Upper Erase Opcode:                 0x61
    Upper Write Enable on Write Status: 0x06
    Upper Write Status Required:        No
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    256 Byte
  JID1:  0x6d3c6ffc
    SPI Component Vendor ID:            0xfc
    SPI Component Device ID 0:          0x6f
    SPI Component Device ID 1:          0x3c
  VSCC1: 0xe9f8cb60
    Lower Erase Opcode:                 0xe9
    Lower Write Enable on Write Status: 0x06
    Lower Write Status Required:        Yes
    Lower Write Granularity:            1 bytes
    Lower Block / Sector Erase Size:    256 Byte
    Upper Erase Opcode:                 0xcb
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        No
    Upper Write Granularity:            1 bytes
    Upper Block / Sector Erase Size:    256 Byte
  JID2:  0x9a7035b3
    SPI Component Vendor ID:            0xb3
    SPI Component Device ID 0:          0x35
    SPI Component Device ID 1:          0x70
  VSCC2: 0x423a4e35
    Lower Erase Opcode:                 0x42
    Lower Write Enable on Write Status: 0x06
    Lower Write Status Required:        Yes
    Lower Write Granularity:            1 bytes
    Lower Block / Sector Erase Size:    8KB
    Upper Erase Opcode:                 0x4e
    Upper Write Enable on Write Status: 0x06
    Upper Write Status Required:        No
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    4KB
  JID3:  0x8e5c8f96
    SPI Component Vendor ID:            0x96
    SPI Component Device ID 0:          0x8f
    SPI Component Device ID 1:          0x5c
  VSCC3: 0x9284e731
    Lower Erase Opcode:                 0x92
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        No
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    256 Byte
    Upper Erase Opcode:                 0xe7
    Upper Write Enable on Write Status: 0x06
    Upper Write Status Required:        No
    Upper Write Granularity:            1 bytes
    Upper Block / Sector Erase Size:    4KB
  JID4:  0xe66a9196
    SPI Component Vendor ID:            0x96
    SPI Component Device ID 0:          0x91
    SPI Component Device ID 1:          0x6a
  VSCC4: 0xa68abe35
    Lower Erase Opcode:                 0xa6
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        Yes
    Lower Write Granularity:            1 bytes
    Lower Block / Sector Erase Size:    8KB
    Upper Erase Opcode:                 0xbe
    Upper Write Enable on Write Status: 0x06
    Upper Write Status Required:        No
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    4KB
  JID5:  0xfb3b1a80
    SPI Component Vendor ID:            0x80
    SPI Component Device ID 0:          0x1a
    SPI Component Device ID 1:          0x3b
  VSCC5: 0xf54600ce
    Lower Erase Opcode:                 0xf5
    Lower Write Enable on Write Status: 0x50
    Lower Write Status Required:        No
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    8KB
    Upper Erase Opcode:                 0x00
    Upper Write Enable on Write Status: 0x50
    Upper Write Status Required:        Yes
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    8KB
  JID6:  0x7d70feeb
    SPI Component Vendor ID:            0xeb
    SPI Component Device ID 0:          0xfe
    SPI Component Device ID 1:          0x70
  VSCC6: 0xbe5f8811
    Lower Erase Opcode:                 0xbe
    Lower Write Enable on Write Status: 0x06
    Lower Write Status Required:        Yes
    Lower Write Granularity:            64 bytes
    Lower Block / Sector Erase Size:    64KB
    Upper Erase Opcode:                 0x88
    Upper Write Enable on Write Status: 0x06
    Upper Write Status Required:        No
    Upper Write Granularity:            1 bytes
    Upper Block / Sector Erase Size:    4KB
  JID7:  0x59bcd185
    SPI Component Vendor ID:            0x85
    SPI Component Device ID 0:          0xd1
    SPI Component Device ID 1:          0xbc
  VSCC7: 0x7d921ffd
    Lower Erase Opcode:                 0x7d
    Lower Write Enable on Write Status: 0x06
    Lower Write Status Required:        No
    Lower Write Granularity:            1 bytes
    Lower Block / Sector Erase Size:    8KB
    Upper Erase Opcode:                 0x1f
    Upper Write Enable on Write Status: 0x06
    Upper Write Status Required:        Yes
    Upper Write Granularity:            64 bytes
    Upper Block / Sector Erase Size:    4KB

OEM Section:
00: 0f 71 fb ad b2 c7 5f a3 9b 00 3a e2 b5 86 f9 7f
10: 9f 8f 53 8c 02 c7 a9 b1 e0 fe 11 23 5c 46 10 cb
20: d1 84 26 dc fc b0 4a 0b e0 6a 12 39 62 21 32 c6
30: a2 9b c4 4b 38 25 3e 7f 5e a6 2d d9 e2 5c 51 30

Found Region Section

Found Component Section
FLCOMP     0xf0acbddb
  Dual Output Fast Read Support:       supported
  Read ID/Read Status Clock Frequency: 17MHz
  Write/Erase Clock Frequency:         20MHz
  Fast Read Clock Frequency:           unknown<5>MHz
  Fast Read Support:                   not supported
  Read Clock Frequency:                17MHz
  Component 2 Density:                 4MB
  Component 1 Density:                 4MB
FLILL      0xa2a0a4a9
  Invalid Instruction 3: 0xa2
  Invalid Instruction 2: 0xa0
  Invalid Instruction 1: 0xa4
  Invalid Instruction 0: 0xa9
FLPB       0xefb129e8
  Flash Partition Boundary Address: 0x9e8000

Found PCH Strap Section
PCHSTRP0  : 0xedf03bf2
PCHSTRP1  : 0x564fb98a
PCHSTRP2  : 0x573654e2
PCHSTRP3  : 0x451e93da
PCHSTRP4  : 0xb23944a5
PCHSTRP5  : 0xc20a08bc
PCHSTRP6  : 0x76962d54
PCHSTRP7  : 0xf5a54d9e
PCHSTRP8  : 0xe96454af
PCHSTRP9  : 0x6edc4f86
PCHSTRP10 : 0x7647fe12
PCHSTRP11 : 0xb69b5eeb
PCHSTRP12 : 0x26d4e8e8
PCHSTRP13 : 0x80f07b42
PCHSTRP14 : 0x1ffef245
PCHSTRP15 : 0x92e5d610
PCHSTRP16 : 0x83418bff
PCHSTRP17 : 0xce50a2ce
PCHSTRP18 : 0xade9c56e
PCHSTRP19 : 0xac708860
PCHSTRP20 : 0x05cbe4de
PCHSTRP21 : 0xb8ee06c7
PCHSTRP22 : 0x2d10b3df
PCHSTRP23 : 0x6427d5a8
PCHSTRP24 : 0x8db908e3
PCHSTRP25 : 0x759473e9
PCHSTRP26 : 0x793f3032
PCHSTRP27 : 0x7711104f
PCHSTRP28 : 0xb30d22e5
PCHSTRP29 : 0x6275b416
PCHSTRP30 : 0xb7899183
PCHSTRP31 : 0xd59e8f12
PCHSTRP32 : 0x348b1fa4
PCHSTRP33 : 0xd12e7bef
PCHSTRP34 : 0x932f4ec8
PCHSTRP35 : 0x93d41b1c
PCHSTRP36 : 0xbe311aa6
PCHSTRP37 : 0xd12e328f
PCHSTRP38 : 0xf8532f22
PCHSTRP39 : 0x8962f238
PCHSTRP40 : 0xcf624398
PCHSTRP41 : 0x993c869b
PCHSTRP42 : 0x4cd9a273
PCHSTRP43 : 0xfd004bba
PCHSTRP44 : 0xccc2e5d1
PCHSTRP45 : 0xc6a53e7f
PCHSTRP46 : 0x8103d576
PCHSTRP47 : 0x9f53de06
PCHSTRP48 : 0xacde504c
PCHSTRP49 : 0xf6718907
PCHSTRP50 : 0x36c65c9f
PCHSTRP51 : 0x10ef4ec7
PCHSTRP52 : 0xde1a8726
PCHSTRP53 : 0x25e8319c
PCHSTRP54 : 0xc5d1a3c1
PCHSTRP55 : 0x904b1beb
PCHSTRP56 : 0x4cf8a1d5
PCHSTRP57 : 0x785e1844
PCHSTRP58 : 0x5142640c
PCHSTRP59 : 0x4b022573
PCHSTRP60 : 0xe2b7ae5c
PCHSTRP61 : 0xaf1d717a
PCHSTRP62 : 0x6cb26d01
PCHSTRP63 : 0x003e1f65
PCHSTRP64 : 0x4c0ddba3
PCHSTRP65 : 0x071ab03a
PCHSTRP66 : 0x6fdf35e3
PCHSTRP67 : 0xf24dd2ed
PCHSTRP68 : 0x8b4303e8
PCHSTRP69 : 0xe9e84f1e
PCHSTRP70 : 0x65684d00
PCHSTRP71 : 0xb3ccb167
PCHSTRP72 : 0x81ce837c
PCHSTRP73 : 0x355c87c1
PCHSTRP74 : 0x1d789845
PCHSTRP75 : 0xd3c6e172
PCHSTRP76 : 0xa7360f7d
PCHSTRP77 : 0xb5b01999
PCHSTRP78 : 0x350d3e6b
PCHSTRP79 : 0x0634b66a
PCHSTRP80 : 0xa06366e6
PCHSTRP81 : 0x1188596b
PCHSTRP82 : 0xaff8fddc
PCHSTRP83 : 0xc84b08a7
PCHSTRP84 : 0x431196d9
PCHSTRP85 : 0xfaf1cb5c
PCHSTRP86 : 0x9df360d6
PCHSTRP87 : 0x7fd369a6
PCHSTRP88 : 0x1a080042
PCHSTRP89 : 0xf13e4186
PCHSTRP90 : 0x1cef9d03
PCHSTRP91 : 0x03b7bdeb
PCHSTRP92 : 0x31147fc4
PCHSTRP93 : 0x3d370af0
AltMeDisable bit is not set

Found Master Section
FLMSTR1:   0x26d4e8e8 (Host CPU/BIOS)
  Platform Data Region Write Access: disabled
  GbE Region Write Access:           disabled
  Intel ME Region Write Access:      enabled
  Host CPU/BIOS Region Write Access: enabled
  Flash Descriptor Write Access:     disabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            disabled
  Intel ME Region Read Access:       enabled
  Host CPU/BIOS Region Read Access:  disabled
  Flash Descriptor Read Access:      disabled
  Requester ID:                      0xe8e8

FLMSTR2:   0x80f07b42 (Intel ME)
  Platform Data Region Write Access: disabled
  GbE Region Write Access:           disabled
  Intel ME Region Write Access:      disabled
  Host CPU/BIOS Region Write Access: disabled
  Flash Descriptor Write Access:     disabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            disabled
  Intel ME Region Read Access:       disabled
  Host CPU/BIOS Region Read Access:  disabled
  Flash Descriptor Read Access:      disabled
  Requester ID:                      0x7b42

FLMSTR3:   0x1ffef245 (GbE)
  Platform Data Region Write Access: enabled
  GbE Region Write Access:           enabled
  Intel ME Region Write Access:      enabled
  Host CPU/BIOS Region Write Access: enabled
  Flash Descriptor Write Access:     enabled
  Platform Data Region Read Access:  enabled
  GbE Region Read Access:            enabled
  Intel ME Region Read Access:       enabled
  Host CPU/BIOS Region Read Access:  enabled
  Flash Descriptor Read Access:      disabled
  Requester ID:                      0xf245

Found Processor Strap Section
????:      0x26d4e8e8
????:      0x80f07b42
????:      0x1ffef245
????:      0x92e5d610
????:      0x83418bff
????:      0xce50a2ce
????:      0xade9c56e
????:      0xac708860