About Intel Management Engine firmware

[virtualfred]

1 - ME firmware : infos and tools

Quick access :

1 - ME firmware : infos and tools
2 - Checking ME firmware

• A - Update ME FW with MEupdate
• B - Check ME FW with MEinfo
• C - Check ME FW functionality with MEManuf
• D - Check ME FW in BIOS file with FITC

3 - Extracting ME firmware

• A - Extracting ME firmware with FITC
• B - Extracting ME firmware with HxD editor

4 - Setting ME firmware

• A - ME FW settings for Z77/Z68/P68
• B - ME FW settings for X79
• C - ME FW settings for Z87
• D - Prepared ME FW files

5 - Replacing ME firmware in BIOS file


Do not confuse ME firmware and MEI driver, ME FW is part of the BIOS while MEI driver is installed on Windows and allows software to communicate with ME firmware in BIOS (as some overclocking and fan management software).

Fernando and Odiebugs have done a very good topic about ME firmware.

CodeRush also gave interesting infos in Hardforum.


BIOS consists of 3 to 5 regions (some BIOS don’t have Gbe and/or PDR region), ME firmware is an important part :

ME firmware contains different modules : AMT (Active Management Technology), ASF (Alert Standard Format), QST (Quiet System Technology) and TPM (Trusted Platform Module) for hardware remotely management… but it also contains chipset’s settings (clocks, frequencies,...) which affect important parameters as BCLK, RAM, Turbo Boost, fans speeds…


For further, here are some useful links (Intel chipset 6 and 7 series for P68/Z68/X79/Z77, Intel chipset 8 series for Z87) :
- HxD editor
- Flash Image Tool (FITC) for 6 and 7 series and FITC for 8 series (about 1.5MB)
- MEupdate 8.1.51.1471 for 6/7series and 9.0.30.1482 for 8 series (about 4MB)
- MEInfo for 6/7series and MEInfo for 8 series (about 0.8MB)
- MEManuf for 6/7 series and MEManuf for 8 series (about 1.5MB)
(Thanks to Pacman… and Google)

For greedy, here's full packages :
- Full Management Engine Tools 8.1.10.1286 for C600/6/7 series and Management Engine Tools 9.0.21.1462 for 8 series (with complete tools as MEinfo, MEManuf, FWupdate, Flash Image Tool and Flash Programming Tool, contains also ME and Gbe original binaries and old MEI drivers - about 120MB)
- and Intel System Tools user guides 7 series and 8 series (about 2MB)

[virtualfred]

2 - Checking ME firmware

A - Update ME FW with MEupdate (FWupdate)

First, even if it is irrelevant since the challenge is to insert the ME FW directly in the BIOS, I add here how to update under Windows with FWUpdLcl for those who have difficulty with the command prompt.

- you must have Intel Management Engine Interface drivers already installed :


- download MEupdate above
- extract MEupdate folder needed : Win folder for 32bits or Win64 for 64bits (on my desktop for this example)
- open command prompt as administrator, and go in your folder with :

cd C:\Users\VirtualFred\Desktop\Win64

- enter "flash" (flash.bat execute the command "FWUpdLcl64.exe -f ME_8.1.51.1471.bin") :

flash or FWUpdLcl64.exe -f ME_8.1.51.1471.bin

- when finished and according to CodeRush, a complete power off is required to restart ME.

If you flash BIOS with different ME version then current one, you need to use poweroff command after successful flashing to ensure ME restart. ME is powered with standby power line and doesn't restarts on normal reset, so you must use that command or remove power completely and wait for 30 secs to reset ME state. If they have same versions - normal reset is enough.

Also you can flash the same ME FW version (if you think it's corrupted) with the following command :

FWUpdLcl64.exe -ALLOWSV -f ME_8.1.51.1471.bin

B - Check ME FW with MEinfo

- download MEinfo above
- extract Meinfo folder needed : Win folder for 32bits or Win64 for 64bits (on my desktop for this example)
- open command prompt as administrator, and go in your folder with :

cd C:\Users\VirtualFred\Desktop\Win64

- enter command "meinfowin64" (64bits) or "meinfowin" (32bits) :

meinfowin64

FWupdate (FWUpdLcl) can also read ME FW version with the following command :

fwupdlcl64 -fwver

C - Check ME FW functionality with MEManuf

In another System Tools user guide, Intel explains MEManuf can validate ME FW functionality :

MEManuf validates ME functionality (verifies that all its components have been assembled together correctly) on the manufacturing line. The tool accomplishes this by invoking the test program embedded in the ME firmware. The test covers the following features: SMBus Interface, BIOS and BIOS/FW connectivity, C-Link (ME-ICH and ICH-Shilo), EC, iTPM, Wireless connectivity.

- download MEManuf above
- extract MEManuf folder needed : Windows folder for 32bits or Windows64 for 64bits (on my desktop for this example)
- open command prompt as administrator, and go in your folder with :

cd C:\Users\VirtualFred\Desktop\Windows64

- enter command "memanufwin64" (or "memanufwin64 -verbose" for details) :

memanufwin64

D - Check ME FW in BIOS file with FITC

With FITC you can check which version of ME firmware is in a BIOS file, so no need to have the motherboard with this BIOS installed :
- download Flash Image Tool above
- run fitc.exe
- just drag and drop BIOS file within FITC
- ME firmware version is easily showed :


Unfortunately, it doesn't works with certain brand (Asus…), BIOS is not recognized so we have to extract ME FW before being able to read version it in FITC…

... to open Asus Cap file in FITC, you can use "fd44cpr" from FTK package.
"fd44cpr filename.rom filename.rom" have to enter filename twice,
then the Cap header is removed and works with FITC.
The Cap header can also easily be removed manually in a Hexeditor, tested with Asrock also.
It has worked with the Z87 BIOSes i've tried.

[virtualfred]

3 - Extracting ME firmware

Extracting ME firmware from a BIOS file can be useful to check ME version of an unrecognized BIOS, or to extract a new ME FW to use it later in other BIOS.

A - Extracting ME firmware with FITC

When you drag and drop a BIOS file within FITC, it automatically create a folder with all BIOS region decomposed :


But this BIN also contains chipset's setting that match, we'll see later we have to change settings before inserting in another BIOS…

B - Extracting ME firmware with HxD editor

(Thanks to Amurtigress who shows me the way)

- open your BIOS file with HxD editor (drag and drop works)
- Find "krid", ME region always start just before by "20 20 80 0F 40",
- place your cursor in front of "20 20 80…", then menu "select a bloc", check "length" and enter "17D000" (which is ME region length)


- right click and "Copy", open a new empty tab, and "paste write" (HxD advertise you the file size will change, hit OK)


- "save as" and give an appropriate name to your extracted ME FW.

Example :
Asus P8Z77-V BIOS 2104 is unrecognized by FITC (locked ?)… but after extraction of ME firmware with HxD, we can read ME FW version :

[virtualfred]

4 - Setting ME firmware

And now the most laborious part…

I want to emphasize that we are now entering a deep modification of BIOS, before playing with the insertion of ME FW in the BIOS you need to master BIOS flashing and usage of Dual-BIOS to be able to revert back if necessary. (BIOS flashing thread)


ME firmware is not a read only as a ROM or microcode. When comparing many ME files with HxD editor : original ME firmware (generic production/preproduction file provides in MEupdate), ME region extracted from original BIOS file and from BIOS chip with @BIOS or Q-Flash : all files are different ! While ROM and µcode stay unchanged in BIOS, using FWUpdLcl update ME FW parts while keeping previous settings, of course I could be wrong but I suspect that data is written in the ME region during the first boot after BIOS flash.
This means ME firmware can’t be pasted “as it is” in BIOS file, that’s why it must be prepared to match with chipset platform and manufacturer BIOS settings before being included in BIOS.
To match the settings of the new ME FW with the target BIOS, I extract two identical FITC to open and compare the original BIOS with the ME FW build. The principle is the same for different chipset, but for example Z87 has a lot more settings.

A - ME FW settings for Z77 (same for Z68/P68)

So we need to work with 2 FITC opened side by side… a wide screen is useful ! (but for the forum's width I put both FITC one above the other)
- open first FIT and drag and drop within original BIOS
- open a second FIT and drag and drop ME FW to adjust… but in this FITC for building of new ME FW, go under Descriptor Region/Descriptor Map to set Number of flash to 0, it will be necessary to build a file that contains only the ME FW :


- as with original BIOS, in new ME FW we set SKU to the matched platform : Intel 7 Series Chipset and Intel Z77 - Desktop (6 Series and Z68 Desktop for Z68/P68)


- then develop ME region/Configuration to check each of the original BIOS settings and apply them to the new ME FW… but for example there is some impact between different fields : in Power Packages we have to set Power Pkg 2 Supported to "false" to be able to disable M3 Power Rails Availability in ME sub-settings :


… then we can return to ME to set M3 Power Rails to False :


- continue with all settings, Manageability Application can't be open because it's not for Z77 chipset… be care in ME Debug Event Service, double-click on Event Filters and check Group 1 (must be 0x00000001) and Group 76 (0x000000FE) :


- under FCIM/BTM Specific ICC Registers, we have to copy/paste each settings, for example changing 0x00011A33 to 0X00011A34 change settings below :


- generally, the adjustable settings are yellow ... but not always, so take the time to check them all ! Continue with all settings… it is a long job, but much shorter than Z87 !


- and when all is done, check 2 or 3 times that everything is perfect !
- hit the build button (or menu Build/Build image F5), you obtain your prepared ME FW named outimage.bin (size 1524kB), you can rename it with appropriate name for further usage (thereafter for my example I name it ME_8.1.51.1471_Z77.bin)

B - ME FW settings for X79

Same job with few differences…
- when opening many X79's original BIOS, FITC returns error with SKU non recognized (but we will not have this error with the modified BIOS with our prepared ME FW), you have to set it as Intel C600 Series Chipset, I don't see any difference between Intel Patsburg A, B/J, D, T and X79. Example with G1assassin2 F12u SKU error :


- the rest is identical except FCIM / BTM whose header can't be changed, we must change the sub-parameters individually :

C - ME FW settings for Z87

Good news with the Z87 chipset : the first settings are almost identical to the ME FW default... Now the bad news: the last settings under Integrated Clock Controller are very likely to be particularly tedious, especially in Hardware Register : it's fast but under ICC Profile 0 and ICC Profile 1 there are more than 500 lines to check !
Be brave, I always check 2 or 3 times !


Most settings to change are yellow but not always, so be meticulous !

D - Prepared ME FW files

You can save some time by using my ME FW prepared, but I still advise you to check because there may be some small differences for some BIOS :

- ME_8.1.51.1471_Z68-P67
- ME_8.1.51.1471_X79
- ME_8.1.51.1471_Z77
- ME_9.0.30.1482_Z87

[virtualfred]

5 - Replacing ME firmware in BIOS file

And here is the end of the story : we have only to replace the original ME region of BIOS with our ME FW prepared.


- drag and drop original BIOS and prepared ME FW within HxD editor, go to ME FW tab, select all (CTRL+A) and copy (CTRL+C) :


- go to BIOS tab, find ME FW beginning searching for "krid", put your cursor before the first "20" :


- select ME region (length of 17D000) :


- and paste write new ME FW over selected ME region (ME region turns to red)… and save :


HxD editor automatically creates a backup BIOS ending by .bak… you can check your modified BIOS in FITC :


You checked every settings 3, 4 or 5 times ? Well done ! Now flash your BIOS !

[profJim]

Excellent initial post!!
These thread will probably be stickied sooner rather than later.
I think that you carried the reserved thread count too 2 far.

[RootWyrm]

Nice thread, fred! (Rhyme unintentional.)

Any chance you've also got the manuals for the straps and tables?

I may have to find the time to do a write up on the PCH Straps and MAS; technically MAS\GbE is where changes to ethernet are supposed to be made including firmware update (\GbE Region). On the plus side, I can now confirm that Gigabyte did in fact, completely screw the pooch on the F4 release BIOS. Set ME to Workstation from HED and failed to use correct SKU (chipset identifier.)

[virtualfred]

Excellent initial post!!
These thread will probably be stickied sooner rather than later.
I think that you carried the reserved thread count too 2 far.

Thanks, yes I did in doubt, now deleted, but I know it is possible to insert posts later if necessary.

Nice thread, fred! (Rhyme unintentional.)
Any chance you've also got the manuals for the straps and tables?
I may have to find the time to do a write up on the PCH Straps and MAS; technically MAS\GbE is where changes to ethernet are supposed to be made including firmware update (\GbE Region). On the plus side, I can now confirm that Gigabyte did in fact, completely screw the pooch on the F4 release BIOS. Set ME to Workstation from HED and failed to use correct SKU (chipset identifier.)

Nice rhyme . I gave links for all guides i have, i played with copy/paste with PCH Straps for LAN issue in G1.assassin2 F12t... but yet i haven't any other tool working with other region...

[vailr]

So: generally speaking, what ME firmware changes did Intel incorporate, comparing between the Z77 & Z87 chipsets?
Also: why Z87's ME firmware can't be applied to the Z77 machine's bios.
Lack of space, or exactly what reason? Was the bios ROM storage capacity changed with the Z87, or?

[virtualfred]

About Z77 vs Z87, Google will help you better than me... I do not have the knowledge necessary to answer you specifically.
I'm sure put a FW ME 9 in Z77 BIOS would result in infinite boot loops, many clock settings and frequencies are different... i'm not mad enough to try it
ME FW 8 & 9 have the same size, Z77's BIOS are 8MB while Z87's BIOS are 16MB.