search

merge / skulls

pre-built coreboot images and documentation on how to flash them for Thinkpad Laptops
GNU General Public License v3.0
677 stars 65 forks source link

Why no trimming nor deletion and relocation of free space for ME? #192

Open tlaurion opened 3 years ago

tlaurion commented 3 years ago

Skulls script ${ME_CLEANER_PATH} -d -S -O "${TEMP_DIR}"/work.rom "${TEMP_DIR}"/test1.rom

As opposed to python ~/me_cleaner/me_cleaner.py -r -t -d -S -O clean_flash.bin down.rom.new --extract-me extracted_me.rom

This confused people, a lot.

-r, --relocate        relocate the FTPR partition to the top of the ME
                        region to save even more space
-t, --truncate        truncate the empty part of the firmware (requires a
                        separated ME/TXE image or --extract-me)
-d, --descriptor      remove the ME/TXE Read/Write permissions to the other
                        regions on the flash from the Intel Flash Descriptor
                        (requires a full dump)
-S, --soft-disable    in addition to the usual operations on the ME/TXE
                        firmware, set the MeAltDisable bit or the HAP bit to
                        ask Intel ME/TXE to disable itself after the hardware
                        initialization (requires a full dump)

Where 1vyrain:

How is Intel ME disabled?

Intel ME is disabled through the software Advanced Menu in the BIOS. There are three known ways of disabling Intel ME. Advanced Menu is one of them. The other way is by completely stripping non-essential ME components out of the image itself, or using the AltMeDisable Bit. The Advanced Menu disable is closer to the latter, which doesn’t strip any of ME but just turns it “off”.