William reviews Plato’s ME Analyzer tool

November 6, 2018 ~ hucktech ~ Leave a comment

William has a review of ME Analyzer:

https://www.basicinputoutput.com/2018/11/intel-me-resourcesme-analyzer.html

AMI BIOS Guard Extractor: Parses AMI BIOS Guard (a.k.a. PFAT) images and extracts a proper SPI/BIOS image

October 30, 2018 ~ hucktech ~ Leave a comment

I have written a new utility called AMI BIOS Guard Extractor. It parses AMI BIOS Guard (a.k.a. PFAT) images and extracts a proper SPI/BIOS image. You can find it at my Various BIOS Utilities for Modding/Research repository. https://t.co/u3mJLQmK0S pic.twitter.com/sGAXFkTBYo

— Plato Mavropoulos (@platomaniac) October 13, 2018

Parses AMI BIOS Guard (a.k.a. PFAT) images and extracts a proper SPI/BIOS image. You can either Drag & Drop or manually enter the full path of a folder containing AMI PFAT images.

https://github.com/platomav/BIOSUtilities#ami-bios-guard-extractor

ME Analyzer v1.70.0 released

October 12, 2018 ~ hucktech ~ Leave a comment

ME Analyzer v1.70.0 adds full parsing & unpacking of all Intel CSE ME/TXE/SPS File Systems (MFS/AFS) based on the amazing initial research by @_Dmit. MEA can now show the FS state and log all low-level details. General CSE firmware analysis also improved. https://t.co/Snttp8fULE pic.twitter.com/txmx6Pyl2d

— Plato Mavropoulos (@platomaniac) October 11, 2018

ME Analyzer v1.70.0 adds full parsing & unpacking of all Intel CSE ME/TXE/SPS File Systems (MFS/AFS) based on the amazing initial research by @_Dmit. MEA can now show the FS state and log all low-level details. General CSE firmware analysis also improved.

https://github.com/platomav/MEAnalyzer

ME Analyzer 1.48.0 released

April 6, 2018 ~ hucktech ~ Leave a comment

ME Analyzer v1.48.0 is out with CSME 12 "FWUpdate" (FWU) region Type detection. CSME 12 firmware support should now be fully implemented. https://t.co/Snttp8fULE pic.twitter.com/MAHQ9wvCWo

— Plato Mavropoulos (@platomaniac) April 5, 2018

It seems that Intel CSME 11.8.50.3460 fixes some CVEs which are still set to Reserved: CVE-2018-3627, CVE-2018-3628, CVE-2018-3629, & CVE-2018-3632. They should't be that important though based on the +2 firmware VCN increase.

— Plato Mavropoulos (@platomaniac) April 4, 2018

https://github.com/platomav/MEAnalyzer

ME Analyzer 1.42.0 released

January 14, 2018 ~ hucktech ~ Leave a comment

ME Analyzer v1.42.0 is out! Quite a big update. Added support for CSME 12.0, CSE Layout Table (LT) v1.6 – v1.7, BPDT v2 – v3, FPT v2.1 & CSE Extensions 17, 22 & 20 R2. Improved CSE Ext 3, 14, 15, 16 & 20 R1. Added CSE unpacking of CSE LT, BPDT, FPT, UTOK UTFL & Instance ID info. pic.twitter.com/xNlW7GLGEt

— Plato Mavropoulos (@platomaniac) January 13, 2018

Added FPT, BPDT & CSE LT partition overlap check. Also CSE partition Size, Hash, OEM/FIT config & Out of Bounds module detection. Improved CPD entry count and ME 8+ FPT & BPDT entry display (-dfpt). Fixed bugs at CSE unpacking, S-BPDT & Manifest detection. https://t.co/Snttp8fULE pic.twitter.com/i4O0shtBs0

— Plato Mavropoulos (@platomaniac) January 13, 2018

https://github.com/platomav/MEAnalyzer

ME Analyzer 1.33.0 released (and microcode document revised)

November 14, 2017 ~ hucktech ~ Leave a comment

Plato updates ME Analyzer, and an Intel microcode document!

I updated my "Intel Microcode Extra Undocumented Header" paper with everything new since April such as HeaderType, Flags, Unknown1, UpdateRevision, Unknown9, RSA Block and more! Also new MC Extractor v1.11.0 with usage pics & better docs. https://t.co/Be4Jv3Md1q pic.twitter.com/NSQY00qzzB

— Plato Mavropoulos (@platomaniac) November 13, 2017

ME Analyzer v1.33.0 adds CSTXE 3.1 & 3.3 support & fixes BPDT parsing. It seems that a lot of MEA users (thank you 😍) don't know its advanced capabilities outside of basic info display. Thus, I've also improved the ReadMe and added cool feature pictures. https://t.co/Snttp8fULE pic.twitter.com/iQ6C6QWerI

— Plato Mavropoulos (@platomaniac) November 11, 2017

https://github.com/platomav/MEAnalyzer

https://github.com/platomav/MCExtractor/wiki/Intel-Microcode-Extra-Undocumented-Header

MEAnalyzer v1.32.0 released

October 25, 2017 ~ hucktech ~ Leave a comment

ME Analyzer v1.32.0 supports new CSME & more CSE Extensions with various error detection https://t.co/Snttp8fULE

— Plato Mavropoulos (@platomaniac) October 24, 2017

v1.32.0 includes:
Added support for CSME 11.8, 11.11 & 11.21 firmware
Added support for CSME 12 SPI FD Region structures
Added CSE Extension 22 for proper CSME 12 parsing
Added CSE Extension 14 Mod for proper DNX parsing
Added CSE Extension 5 Mod for proper Process parsing
Added CSE Extension data overflow error detection
Added CSE Extension data division error detection
Added CSE Extension data total size error detection
Improved CSE Extensions 1, 13 with CSME 12 support
Improved CSE Extension structure Revision detection
Fixed CSE unpacking crash at Key modules/regions
Fixed issues at unknown CSE Extension detection
Fixed wrong CSME 11 FIT PCH-H Z370 SKU detection

https://github.com/platomav/MEAnalyzer

MEAnalyzer 1.18.0 released

September 3, 2017 ~ hucktech ~ Leave a comment

ME Analyzer v1.18.0 adds IFWI support & unpacking, BPDT parsing & region display, ME 12.0 CNP support & other fixes https://t.co/Snttp8fULE pic.twitter.com/qWEHOiMIPZ

— Plato Mavropoulos (@platomaniac) September 1, 2017

https://github.com/platomav/MEAnalyzer

ME Analyzer 1.16.3 released

July 17, 2017 ~ hucktech ~ Leave a comment

MEA v1.16.3 greatly improves Engine x86 (ME 11, TXE 3, SPS 4) firmware unpacking. Thank you for the feedback so far. https://t.co/Snttp8fULE pic.twitter.com/F7bJ7lu34r

— Plato Mavropoulos (@platomaniac) July 16, 2017

ME Analyzer Features:
Supports all Engine firmware generations (ME 1 – 11, TXE 1 – 3 & SPS 1 – 4)
Supports all types of file images (Engine Regions, SPI/BIOS images etc)
Detection of Family, Version, SKU, Date, Revision, Platform etc info
Detection of Production, Pre-Production, ROM-Bypass, MERecovery etc Releases
Detection of Region (Stock/clean or Extracted/dirty), Update etc Types
Detection of Security Version Number (SVN), Version Control Number (VCN) & PV
Detection of firmware’s Flash Image Tool platform configuration for ME 11 & up
Detection of Intel SPI Flash Descriptor region’s Access Permissions
Detection of whether the imported Engine firmware is updated
Detection of unusual Engine firmware (Corrupted, Compressed, OEM etc)
Detection of multiple Engine regions in input file, number only
Detection of special Engine firmware BIOS GUIDs via UEFIFind
Detection of unique mobile Apple Macintosh Engine firmware SKUs
Advanced detection & validation of Engine region’s firmware Size
Ability to analyze multiple files by drag & drop or by input path
Ability to unpack all Engine x86 firmware (ME >= 11, TXE >= 3, SPS >= 4)
Ability to detect & categorize firmware which require attention
Ability to validate Engine region’s $FPT checksums & entries counter
Ability to detect various important firmware problems and corruptions
Supports SoniX/LS_29’s UBU, Lordkag’s UEFIStrip & CodeRush’s UEFIFind
Reports all firmware which are not found at the Engine Repository Database
Reports any new, unknown, problematic, incomplete etc Engine firmware images
Features command line parameters to enhance functionality & assist research
Features user friendly messages & proper handling of unexpected code errors
Shows colored text to signify the importance of notes, warnings & errors
Open Source project licensed under GNU GPL v3, comment assisted code

https://github.com/platomav/MEAnalyzer/commits/master
https://github.com/platomav/MEAnalyzer

ME Analyzer 1.16.0 released

July 13, 2017 ~ hucktech ~ Leave a comment

MEA v1.16.0 can now unpack all Engine x86 firmware (-unp86) like @IgorSkochinsky me_unpack. Also RSA Sig validation. https://t.co/Snttp8fULE pic.twitter.com/AEQx64U67t

— Plato Mavropoulos (@platomaniac) July 11, 2017

https://github.com/platomav/MEAnalyzer

https://github.com/IllegalArgument/Huffman11

ME Analyzer 1.11.1 released

May 9, 2017May 9, 2017 ~ hucktech ~ Leave a comment

ME Analyzer v1.11.1 (better ME 11.7 KBL-R support, better ME x86 Huffman module split) https://t.co/Snttp8fULE

— Plato Mavropoulos (@platomaniac) May 1, 2017

ME Analyzer is a tool which can show various details about Intel Engine Firmware (Management Engine, Trusted Execution Engine, Service Platform Services) images. It can be used to identify whether the firmware is updated, healthy, what Release, Type, SKU it is etc.[…]

https://github.com/platomav/MEAnalyzer

http://www.win-raid.com/t596f39-Intel-Management-Engine-Drivers-Firmware-amp-System-Tools.html#msg10191

http://www.win-raid.com/t840f39-ME-Analyzer-Intel-Engine-Firmware-Analysis-Tool.html#msg14803

Current state of fixed firmware found for INTEL-SA-00075/CVE-2017-5689 vulnerability. https://t.co/05xaxpZeTS pic.twitter.com/6hiKgXzUbY

— Plato Mavropoulos (@platomaniac) May 7, 2017

ME Analyzer switches from closed-source to open-source

August 22, 2016 ~ hucktech ~ Leave a comment

ME Analyzer is now on GitHub and licensed under GPLv3.
Thanks to plutomaniac for it and for it's ME binaries DB.https://t.co/Bflyyryxff

— Nikolaj Schlej (@NikolajSchlej) August 21, 2016

Great news, the tool “ME Analyzer” — for analyzing the Intel Management Engine (ME) — has switched from closed-source freeware to open source!!

ME Analyzer is now on GitHub and licensed under GPLv3.
Thanks to plutomaniac for it and for it's ME binaries DB.https://t.co/Bflyyryxff

— Nikolaj Schlej (@NikolajSchlej) August 21, 2016

Plutomaniac’s ME Analyzer

Ha,ha Initial plan was to be called "AnalyzeMe", managed to resist the temptation 😛

— Plato Mavropoulos (@platomaniac) August 21, 2016