intel flash programming tool for me 11.0

As a developer working with Intel's Management Engine (ME), I recently had to port an existing exploit from Transactional Execute (TXE) to ME 11.x. In this article, I'll share my experience and provide some key insights on how to successfully execute the exploit.

Firstly, it's essential to understand that the shared memory context structure is located at offset 0x18 in the syslib context, which contains a pointer to shared memory descriptors at offset 0x28. The number of valid shared memory descriptors can be found at offset 0x2C. If the ME crashes instead of booting completely, it becomes unbootable.

To overcome this issue, you need to enable the Hypervisor Assisted Partition (HAP) bit. This will prevent the ME from creating a home partition in the Master File System (MFS), which could cause the exploit to stop working.

Another critical aspect is ensuring that there is no file index 8 in the MFS partition. If present, it can cause the exploit to malfunction. To mitigate this, you should check if the MFS partition has a file in index 8 and take necessary measures to rectify the issue.

To activate DCI using the CPU straps in the Intel Flash Descriptor (IFD), follow the recommended procedure. Additionally, make sure that the '/home/mca/eom' file in the MFS's fitc.cfg file contains one byte with a value of 0x00.

When reading files from the MFS partition, the MFS read function uses a temporary buffer of 1024 bytes and can read multiple chunks (up to 16) at once if they are sequential. The MFS partition itself uses chunks of 64 bytes each.

I initially attempted to use the systracer method but found it challenging due to limited control over bits in the return address. I had no choice but to explore the exploit explained in the BlackHat Europe 2017 presentation, which used memcpy. Fortunately, I had already started porting this approach to ME 11.x.

Now that we have a better understanding of the existing TXE exploit, it's essential to port it to ME 11.x. If you haven't read Part 1: Understanding PT's TXE PoC, please do so before proceeding with this article.

In conclusion, exploiting Intel's Management Engine (ME) requires careful consideration of various factors, including HAP bit enablement, file indexing in the MFS partition, and DCI activation using CPU straps. By following these guidelines and leveraging existing exploits, developers can successfully execute their attacks on ME 11.x.

Intel flash programming tool for me 11.0