#!/usr/bin/python # me_cleaner - Tool for partial deblobbing of Intel ME/TXE firmware images # Copyright (C) 2016-2018 Nicola Corna # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # from __future__ import division, print_function import argparse import binascii import hashlib import itertools import shutil import sys from struct import pack, unpack min_ftpr_offset = 0x400 spared_blocks = 4 unremovable_modules = ("ROMP", "BUP") unremovable_modules_gen3 = ("rbe", "kernel", "syslib", "bup") unremovable_partitions = ("FTPR",) pubkeys_md5 = { "8431285d43b0f2a2f520d7cab3d34178": ("ME", ("2.0.x.x", "2.1.x.x", "2.2.x.x")), "4c00dd06c28119b5c1e5bb8eb6f30596": ("ME", ("2.5.x.x", "2.6.x.x")), "9c24077a7f7490967855e9c4c16c6b9e": ("ME", ("3.x.x.x",)), "bf41464be736f5520d80c67f6789020e": ("ME", ("4.x.x.x",)), "5c7169b7e7065323fb7b3b5657b4d57a": ("ME", ("5.x.x.x",)), "763e59ebe235e45a197a5b1a378dfa04": ("ME", ("6.x.x.x",)), "3a98c847d609c253e145bd36512629cb": ("ME", ("6.0.50.x",)), "0903fc25b0f6bed8c4ed724aca02124c": ("ME", ("7.x.x.x", "8.x.x.x")), "2011ae6df87c40fba09e3f20459b1ce0": ("ME", ("9.0.x.x", "9.1.x.x")), "e8427c5691cf8b56bc5cdd82746957ed": ("ME", ("9.5.x.x", "10.x.x.x")), "986a78e481f185f7d54e4af06eb413f6": ("ME", ("11.x.x.x",)), "bda0b6bb8ca0bf0cac55ac4c4d55e0f2": ("TXE", ("1.x.x.x",)), "b726a2ab9cd59d4e62fe2bead7cf6997": ("TXE", ("1.x.x.x",)), "0633d7f951a3e7968ae7460861be9cfb": ("TXE", ("2.x.x.x",)), "1d0a36e9f5881540d8e4b382c6612ed8": ("TXE", ("3.x.x.x",)), "be900fef868f770d266b1fc67e887e69": ("SPS", ("2.x.x.x",)), "4622e3f2cb212a89c90a4de3336d88d2": ("SPS", ("3.x.x.x",)), "31ef3d950eac99d18e187375c0764ca4": ("SPS", ("4.x.x.x",)) } class OutOfRegionException(Exception): pass class RegionFile: def __init__(self, f, region_start, region_end): self.f = f self.region_start = region_start self.region_end = region_end def read(self, n): if f.tell() + n <= self.region_end: return self.f.read(n) else: raise OutOfRegionException() def readinto(self, b): if f.tell() + len(b) <= self.region_end: return self.f.readinto(b) else: raise OutOfRegionException() def seek(self, offset): if self.region_start + offset <= self.region_end: return self.f.seek(self.region_start + offset) else: raise OutOfRegionException() def write_to(self, offset, data): if self.region_start + offset + len(data) <= self.region_end: self.f.seek(self.region_start + offset) return self.f.write(data) else: raise OutOfRegionException() def fill_range(self, start, end, fill): if self.region_start + end <= self.region_end: if start < end: block = fill * 4096 self.f.seek(self.region_start + start) self.f.writelines(itertools.repeat(block, (end - start) // 4096)) self.f.write(block[:(end - start) % 4096]) else: raise OutOfRegionException() def fill_all(self, fill): self.fill_range(0, self.region_end - self.region_start, fill) def move_range(self, offset_from, size, offset_to, fill): if self.region_start + offset_from + size <= self.region_end and \ self.region_start + offset_to + size <= self.region_end: for i in range(0, size, 4096): self.f.seek(self.region_start + offset_from + i, 0) block = self.f.read(min(size - i, 4096)) self.f.seek(self.region_start + offset_from + i, 0) self.f.write(fill * len(block)) self.f.seek(self.region_start + offset_to + i, 0) self.f.write(block) else: raise OutOfRegionException() def save(self, filename, size): if self.region_start + size <= self.region_end: self.f.seek(self.region_start) copyf = open(filename, "w+b") for i in range(0, size, 4096): copyf.write(self.f.read(min(size - i, 4096))) return copyf else: raise OutOfRegionException() def get_chunks_offsets(llut): chunk_count = unpack("> 4) & 7 print(" {:<16} ({:<7}, ".format(name, comp_str[comp_type]), end="") if comp_type == 0x00 or comp_type == 0x02: print("0x{:06x} - 0x{:06x} ): " .format(offset, offset + size), end="") if name in unremovable_modules: end_addr = max(end_addr, offset + size) print("NOT removed, essential") else: end = min(offset + size, me_end) f.fill_range(offset, end, b"\xff") print("removed") elif comp_type == 0x01: if not chunks_offsets: f.seek(offset) llut = f.read(4) if llut == b"LLUT": llut += f.read(0x3c) chunk_count = unpack(" removable_chunk[0]: end = min(removable_chunk[1], me_end) f.fill_range(removable_chunk[0], end, b"\xff") end_addr = max(end_addr, max(unremovable_huff_chunks, key=lambda x: x[1])[1]) return end_addr def check_partition_signature(f, offset): f.seek(offset) header = f.read(0x80) modulus = int(binascii.hexlify(f.read(0x100)[::-1]), 16) public_exponent = unpack("> 4) & 7 == 0x01: llut_start = unpack("> 25 modules.append((name, offset, comp_type)) modules.sort(key=lambda x: x[1]) for i in range(0, module_count): name = modules[i][0] offset = partition_offset + modules[i][1] end = partition_offset + modules[i + 1][1] removed = False if name.endswith(".man") or name.endswith(".met"): compression = "uncompressed" else: compression = comp_str[modules[i][2]] print(" {:<12} ({:<12}, 0x{:06x} - 0x{:06x}): " .format(name, compression, offset, end), end="") if name.endswith(".man"): print("NOT removed, partition manif.") elif name.endswith(".met"): print("NOT removed, module metadata") elif any(name.startswith(m) for m in unremovable_modules_gen3): print("NOT removed, essential") else: removed = True f.fill_range(offset, min(end, me_end), b"\xff") print("removed") if not removed: end_data = max(end_data, end) if relocate: new_offset = relocate_partition(f, me_end, 0x30, min_offset, []) end_data += new_offset - partition_offset partition_offset = new_offset return end_data, partition_offset def check_mn2_tag(f, offset, gen): f.seek(offset + 0x1c) tag = f.read(4) expected_tag = b"$MAN" if gen == 1 else b"$MN2" if tag != expected_tag: sys.exit("Wrong FTPR manifest tag ({}), this image may be corrupted" .format(tag)) def flreg_to_start_end(flreg): return (flreg & 0x7fff) << 12, (flreg >> 4 & 0x7fff000 | 0xfff) + 1 def start_end_to_flreg(start, end): return (start & 0x7fff000) >> 12 | ((end - 1) & 0x7fff000) << 4 if __name__ == "__main__": parser = argparse.ArgumentParser(description="Tool to remove as much code " "as possible from Intel ME/TXE firmware " "images") softdis = parser.add_mutually_exclusive_group() bw_list = parser.add_mutually_exclusive_group() parser.add_argument("-v", "--version", action="version", version="%(prog)s 1.2") parser.add_argument("file", help="ME/TXE image or full dump") parser.add_argument("-O", "--output", metavar='output_file', help="save " "the modified image in a separate file, instead of " "modifying the original file") softdis.add_argument("-S", "--soft-disable", help="in addition to the " "usual operations on the ME/TXE firmware, set the " "MeAltDisable bit or the HAP bit to ask Intel ME/TXE " "to disable itself after the hardware initialization " "(requires a full dump)", action="store_true") softdis.add_argument("-s", "--soft-disable-only", help="instead of the " "usual operations on the ME/TXE firmware, just set " "the MeAltDisable bit or the HAP bit to ask Intel " "ME/TXE to disable itself after the hardware " "initialization (requires a full dump)", action="store_true") parser.add_argument("-r", "--relocate", help="relocate the FTPR partition " "to the top of the ME region to save even more space", action="store_true") parser.add_argument("-t", "--truncate", help="truncate the empty part of " "the firmware (requires a separated ME/TXE image or " "--extract-me)", action="store_true") parser.add_argument("-k", "--keep-modules", help="don't remove the FTPR " "modules, even when possible", action="store_true") bw_list.add_argument("-w", "--whitelist", metavar="whitelist", help="Comma separated list of additional partitions " "to keep in the final image. This can be used to " "specify the MFS partition for example, which stores " "PCIe and clock settings.") bw_list.add_argument("-b", "--blacklist", metavar="blacklist", help="Comma separated list of partitions to remove " "from the image. This option overrides the default " "removal list.") parser.add_argument("-d", "--descriptor", help="remove the ME/TXE " "Read/Write permissions to the other regions on the " "flash from the Intel Flash Descriptor (requires a " "full dump)", action="store_true") parser.add_argument("-D", "--extract-descriptor", metavar='output_descriptor', help="extract the flash " "descriptor from a full dump; when used with " "--truncate save a descriptor with adjusted regions " "start and end") parser.add_argument("-M", "--extract-me", metavar='output_me_image', help="extract the ME firmware from a full dump; when " "used with --truncate save a truncated ME/TXE image") parser.add_argument("-c", "--check", help="verify the integrity of the " "fundamental parts of the firmware and exit", action="store_true") args = parser.parse_args() if args.check and (args.soft_disable_only or args.soft_disable or args.relocate or args.descriptor or args.truncate or args.output): sys.exit("-c can't be used with -S, -s, -r, -d, -t or -O") if args.soft_disable_only and (args.relocate or args.truncate): sys.exit("-s can't be used with -r or -t") if (args.whitelist or args.blacklist) and args.relocate: sys.exit("Relocation is not yet supported with custom whitelist or " "blacklist") gen = None f = open(args.file, "rb" if args.check or args.output else "r+b") magic0 = f.read(4) f.seek(0x10) magic10 = f.read(4) if b"$FPT" in {magic0, magic10}: print("ME/TXE image detected") if args.descriptor or args.extract_descriptor or args.extract_me or \ args.soft_disable or args.soft_disable_only: sys.exit("-d, -D, -M, -S and -s require a full dump") f.seek(0, 2) me_start = 0 me_end = f.tell() mef = RegionFile(f, me_start, me_end) elif b"\x5a\xa5\xf0\x0f" in {magic0, magic10}: print("Full image detected") f.seek(0x4 if magic0 == b"\x5a\xa5\xf0\x0f" else 0x14) flmap0, flmap1, flmap2 = unpack("> 12 & 0xff0 fmba = (flmap1 & 0xff) << 4 # Generation 1 fisba = flmap1 >> 12 & 0xff0 fmsba = (flmap2 & 0xff) << 4 # Generation 2-3 fpsba = fisba f.seek(frba) flreg = unpack("= me_end: print("The ME region in this image has already been disabled") else: mef = RegionFile(f, me_start, me_end) if magic0 == b"\x5a\xa5\xf0\x0f": gen = 1 else: sys.exit("Unknown image") if me_start < me_end: mef.seek(0) if mef.read(4) == b"$FPT": fpt_offset = 0 else: mef.seek(0x10) if mef.read(4) == b"$FPT": fpt_offset = 0x10 else: if me_start > 0: sys.exit("The ME/TXE region is valid but the firmware is " "corrupted or missing") else: sys.exit("Unknown error") if gen == 1: end_addr = 0 else: end_addr = me_end if me_start < me_end: print("Found FPT header at {:#x}".format(mef.region_start + fpt_offset)) mef.seek(fpt_offset + 0x4) entries = unpack("= 0: check_mn2_tag(mef, ftpr_offset + ftpr_mn2_offset, gen) print("Found FTPR manifest at {:#x}" .format(ftpr_offset + ftpr_mn2_offset)) else: sys.exit("Can't find the manifest of the FTPR partition") else: check_mn2_tag(mef, ftpr_offset, gen) ftpr_mn2_offset = 0 if not gen: gen = 2 mef.seek(ftpr_offset + ftpr_mn2_offset + 0x24) version = unpack("= 6: variant = "ME" else: variant = "TXE" print("WARNING Unknown public key {}\n" " Assuming Intel {}\n" " Please report this warning to the project's " "maintainer!" .format(pubkey_md5, variant)) if not args.check and args.output: f.close() shutil.copy(args.file, args.output) f = open(args.output, "r+b") if me_start < me_end: mef = RegionFile(f, me_start, me_end) if me_start > 0: fdf = RegionFile(f, fd_start, fd_end) if gen == 1: for (ba, name) in ((fisba, "ICHSTRP0"), (fmsba, "MCHSTRP0")): fdf.seek(ba) strp = unpack(" me_end: print(" {:<4} ({:^24}, 0x{:08x} total bytes): nothing to " "remove" .format(part_name, "no data here", part_length)) else: print(" {:<4} (0x{:08x} - 0x{:09x}, 0x{:08x} total bytes): " .format(part_name, part_start, part_end, part_length), end="") if part_name in whitelist or (blacklist and part_name not in blacklist): unremovable_part_fpt += partition if part_name != "FTPR": extra_part_end = max(extra_part_end, part_end) print("NOT removed") else: mef.fill_range(part_start, part_end, b"\xff") print("removed") print("Removing partition entries in FPT...") mef.write_to(0x30, unremovable_part_fpt) mef.write_to(0x14, pack("= 11 (except for # 0x1b, the checksum itself). In other words, the sum of those # bytes must be always 0x00. mef.write_to(0x1b, pack("B", checksum)) print("Reading FTPR modules list...") if gen == 3: end_addr, ftpr_offset = \ check_and_remove_modules_gen3(mef, me_end, ftpr_offset, ftpr_length, min_ftpr_offset, args.relocate, args.keep_modules) else: end_addr, ftpr_offset = \ check_and_remove_modules(mef, me_end, ftpr_offset, min_ftpr_offset, args.relocate, args.keep_modules) if end_addr > 0: end_addr = max(end_addr, extra_part_end) end_addr = (end_addr // 0x1000 + 1) * 0x1000 end_addr += spared_blocks * 0x1000 print("The ME minimum size should be {0} bytes " "({0:#x} bytes)".format(end_addr)) if me_start > 0: print("The ME region can be reduced up to:\n" " {:08x}:{:08x} me" .format(me_start, me_start + end_addr - 1)) elif args.truncate: print("Truncating file at {:#x}...".format(end_addr)) f.truncate(end_addr) if args.soft_disable or args.soft_disable_only: if gen == 3: print("Setting the HAP bit in PCHSTRP0 to disable Intel ME...") pchstrp0 |= (1 << 16) fdf.write_to(fpsba, pack(" {:08x}:{:08x} me" .format(me_start, me_end - 1, me_start, me_start + end_addr - 1)) print(" {:08x}:{:08x} bios --> {:08x}:{:08x} bios" .format(bios_start, bios_end - 1, me_start + end_addr, bios_end - 1)) flreg1 = start_end_to_flreg(me_start + end_addr, bios_end) if gen != 1: flreg2 = start_end_to_flreg(me_start, me_start + end_addr) fdf_copy.seek(frba + 0x4) fdf_copy.write(pack("