search

ptresearch / IntelTXE-PoC

Intel Management Engine JTAG Proof of Concept
505 stars 106 forks source link

I'm having issues reproducing the PoC #11

Closed amatus closed 5 years ago

amatus commented 5 years ago

I followed the README.md and produced a flash image, wrote it to the flash chip of a Gigabyte Brix GP-BPCE-3350C rev 1.1, and powered it on. However no DCI USB device appeared and the Brix seems to immediately turn off. What else can I try?

I flashed back to the original image and followed instructions here (https://gist.github.com/eiselekd/d235b52a1615c79d3c6b3912731ab9b2) to enable DCI to test that my datapro debug cable worked and was able to get DCI working that way. So I know the rest of my setup works.

amatus commented 5 years ago

If I use me_exp_bxtp.py from before commit 34af403e3ff0f0378d08f052c170388851131279 I can see the DCI USB device. Thanks to @kakaroto for helping me figure this out.

kakaroto commented 5 years ago

I was going to file an issue about that. I don't have an issue with that commit not seeing the DCI USB device. I do connect to it and able to list the ipc.devicelist but within 5 seconds it says power is off, then power on (infinite reboot loop) which makes it unusable. I haven't yet investigated the issue, it might be that it's because the infinite loop rop was removed but not re-added at the end of the new rops?

h0t commented 5 years ago

I followed the README.md and produced a flash image, wrote it to the flash chip of a Gigabyte Brix GP-BPCE-3350C rev 1.1, and powered it on. However no DCI USB device appeared and the Brix seems to immediately turn off. What else can I try?

I flashed back to the original image and followed instructions here (https://gist.github.com/eiselekd/d235b52a1615c79d3c6b3912731ab9b2) to enable DCI to test that my datapro debug cable worked and was able to get DCI working that way. So I know the rest of my setup works.

Hi @amatus! Thank you for your interest to our work! This platform behavior is similar to the fact that you didn't activate the HAP mode (see: https://github.com/ptresearch/IntelTXE-PoC#bringup-main-cpu). I've checked ct file and it is working on my platform. You need to activate HAP before the first startup, as result you need to rebuild your image and set HAP bit manually!

Iocontrol commented 5 years ago 
I have an issue in reading the poc ,how can I get 0x00016e1a and syslib_ctx_start in me_exp_bxtp.py
data += struct.pack("<L", 0x00016e1a) 
data += struct.pack("<L", STACK_BASE - BUFFER_OFFSET + init_trace_len)
data_tail = struct.pack("<LLLLL", 0, syslib_ctx_start,**  0, 0x03000300, STACK_BASE-4)
h0t commented 5 years ago 
I have an issue in reading the poc ,how can I get 0x00016e1a and syslib_ctx_start in me_exp_bxtp.py
data += struct.pack("<L", 0x00016e1a) 
data += struct.pack("<L", STACK_BASE - BUFFER_OFFSET + init_trace_len)
data_tail = struct.pack("<LLLLL", 0, syslib_ctx_start,**  0, 0x03000300, STACK_BASE-4)

Please create a new issue and describe in more detail what you want.