GNUBoot
/
coreboot-kgpe-d16
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

util/me_cleaner: Pull the latest changes from upstream 

Relevant changes (commit 2e8761e):
 * Add an option to truncate the ME image file
 * Add full support for Skylake (ME 11) and following, including
    modules removal, truncation informations and partition
    relocation
 * Add two options to generate a shrinked ME image file and the
    corresponding descriptor with a modified flash layout
 * Update README.md
 * Bug fixes

Also add a link to the usage guide in the Kconfig help.

Change-Id: I690c5d558139f64f38babf3c0988b53834ba8b37
Signed-off-by: Nicola Corna <nicola@corna.info>
Reviewed-on: https://review.coreboot.org/20915
Reviewed-by: Arthur Heymans <arthur@aheymans.xyz>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Philipp Deppenwiese <zaolin.daisuki@gmail.com>
This commit is contained in:
Nicola Corna 2017-08-08 21:24:49 +02:00 committed by Martin Roth
parent 4ff449272d
commit 98f30340cf
3 changed files with 378 additions and 153 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/southbridge/intel/common/firmware/Kconfig
View File

@ -93,6 +93,7 @@ config USE_ME_CLEANER
See the project's page
https://github.com/corna/me_cleaner
or the wiki
https://github.com/corna/me_cleaner/wiki/How-to-apply-me_cleaner
https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F
https://github.com/corna/me_cleaner/wiki/me_cleaner-status
for more info about this tool

58
util/me_cleaner/README.md
View File

@ -1,26 +1,44 @@
# ME cleaner
# me_cleaner
A cleaner for Intel ME/TXE images.
Intel ME is a coprocessor integrated in all post-2006 Intel boards, for which
this [Libreboot page](https://libreboot.org/faq.html#intelme) has an excellent
description. The main component of Intel ME is Intel AMT, and I suggest you to
read [this Wikipedia page](https://en.wikipedia.org/wiki/Intel_Active_Management_Technology)
for more information about it. In short, Intel ME is an irremovable environment
with an obscure signed proprietary firmware, with full network and memory
access, which poses a serious security threat.
Even when disabled from the BIOS settings, Intel ME is active: the only way to
be sure it is disabled is to remove its firmware from the flash chip.
This tools removes any unnecessary partition from an Intel ME/TXE firmware, reducing
its size and its ability to interact with the system.
It should work both with coreboot and with the factory firmware.
Before Nehalem (ME version 6, 2008/2009) the ME firmware could be removed
completely from the flash chip by setting a couple of bits inside the flash
descriptor, without the need to reverse-engineer the ME firmware.
Currently this tool:
* Scans the FPT (partition table) and checks that everything is correct
* Removes any partition entry (except for FTPR) from FPT
* Removes any partition except for the fundamental one (FTPR)
* Removes the EFFS presence flag
* Corrects the FPT checksum
* Removes any non-essential LZMA or Huffman compressed module from the FTPR partition (pre-Skylake only)
* Relocates the remaining parts of the FTPR partition to the top of the ME region (pre-Skylake only)
* Checks the validity of the RSA signature of the FTPR partition
Starting from Nehalem the Intel ME firmware can't be removed anymore: without a
valid firmware the PC shuts off forcefully after 30 minutes. This project is an
attempt to remove as much code as possible from such firmware without falling
into the 30 minutes recovery mode.
Don't forget to power cycle your PC after flashing the modified ME/TXE image
(power off and power on, not just reboot).
me_cleaner currently works on most architectures, see [me_cleaner status](https://github.com/corna/me_cleaner/wiki/me_cleaner-status) (or [its discussion](https://github.com/corna/me_cleaner/issues/3))
for more info about them. me_cleaner works also on the TXE and SPS firmware.
See the [current status](https://github.com/corna/me_cleaner/wiki/me_cleaner-status)
or [a more detailed description](https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F)
of me_cleaner.
If you want to understand how me_cleaner works, you can read the ["How does it work?" page](https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F).
Special thanks to Federico Amedeo Izzo for his help during the study of Intel ME.
If you want to apply me_cleaner on your platform I suggest you to read the
["How does it work?" page](https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F)
and then follow the guide ["How to apply me_cleaner"](https://github.com/corna/me_cleaner/wiki/How-to-apply-me_cleaner).
For pre-Skylake firmware (ME version < 11) this tool removes almost everything,
leaving only the two fundamental modules needed for the correct boot, ROMP and
BUP. The code size is reduced from 1.5 MB (non-AMT firmware) or 5 MB (AMT
firmware) to ~90 kB of compressed code.
Starting from Skylake (ME version >= 11) the ME subsystem and the firmware
structure have changed, requiring substantial changes in me_cleaner.
The fundamental modules required for the correct boot are now four (rbe, kernel,
syslib and bup) and the minimum code size is ~300 kB of compressed code (from
the 2 MB of the non-AMT firmware and the 7 MB of the AMT one).
This project is based on the work of the community; in particular I thank Igor
Skochinsky, for the core information about Intel ME and its firmware structure,
and Federico Amedeo Izzo, for its help during the study of Intel ME.

374
util/me_cleaner/me_cleaner.py
View File

@ -25,14 +25,15 @@ from struct import pack, unpack
min_ftpr_offset = 0x400
spared_blocks = 4
unremovable_modules = ("BUP", "ROMP")
unremovable_modules = ("ROMP", "BUP")
unremovable_modules_me11 = ("rbe", "kernel", "syslib", "bup")
class OutOfRegionException(Exception):
pass
class regionFile:
class RegionFile:
def __init__(self, f, region_start, region_end):
self.f = f
self.region_start = region_start
@ -81,6 +82,13 @@ class regionFile:
else:
raise OutOfRegionException()
def save(self, filename, size):
self.f.seek(self.region_start)
copyf = open(filename, "w+b")
for i in range(0, size, 4096):
copyf.write(self.f.read(4096 if size - i >= 4096 else size - i))
return copyf
def get_chunks_offsets(llut, me_start):
chunk_count = unpack("<I", llut[0x04:0x08])[0]
@ -109,7 +117,7 @@ def get_chunks_offsets(llut, me_start):
def remove_modules(f, mod_headers, ftpr_offset, me_end):
comp_str = ("Uncomp.", "Huffman", "LZMA")
comp_str = ("uncomp.", "Huffman", "LZMA")
unremovable_huff_chunks = []
chunks_offsets = []
base = 0
@ -211,6 +219,15 @@ def check_partition_signature(f, offset):
return "{:#x}".format(decrypted_sig).endswith(sha256.hexdigest()) # FIXME
def print_check_partition_signature(f, offset):
if check_partition_signature(f, offset):
print("VALID")
else:
print("INVALID!!")
sys.exit("The FTPR partition signature is not valid. Is the input "
"ME/TXE image valid?")
def relocate_partition(f, me_start, me_end, partition_header_offset,
new_offset, mod_headers):
@ -226,7 +243,7 @@ def relocate_partition(f, me_start, me_end, partition_header_offset,
llut_start = unpack("<I", mod_header[0x38:0x3C])[0] + old_offset
break
if llut_start != 0:
if mod_headers and llut_start != 0:
# Bytes 0x9:0xb of the LLUT (bytes 0x1:0x3 of the AddrBase) are added
# to the SpiBase (bytes 0xc:0x10 of the LLUT) to compute the final
# start of the LLUT. Since AddrBase is not modifiable, we can act only
@ -239,13 +256,15 @@ def relocate_partition(f, me_start, me_end, partition_header_offset,
new_offset = ((new_offset + 0x1f) // 0x20) * 0x20
offset_diff = new_offset - old_offset
print("Relocating {} to {:#x} - {:#x}..."
.format(name, new_offset, new_offset + partition_size))
print("Relocating {} from {:#x} - {:#x} to {:#x} - {:#x}..."
.format(name, old_offset, old_offset + partition_size,
new_offset, new_offset + partition_size))
print(" Adjusting FPT entry...")
f.write_to(partition_header_offset + 0x8,
pack("<I", new_offset - me_start))
if mod_headers:
if llut_start != 0:
f.seek(llut_start)
if f.read(4) == b"LLUT":
@ -284,53 +303,211 @@ def relocate_partition(f, me_start, me_end, partition_header_offset,
return new_offset
def check_and_remove_modules(f, me_start, me_end, offset, min_offset,
relocate, keep_modules):
f.seek(offset + 0x20)
num_modules = unpack("<I", f.read(4))[0]
f.seek(offset + 0x290)
data = f.read(0x84)
module_header_size = 0
if data[0x0:0x4] == b"$MME":
if data[0x60:0x64] == b"$MME" or num_modules == 1:
module_header_size = 0x60
elif data[0x80:0x84] == b"$MME":
module_header_size = 0x80
if module_header_size != 0:
f.seek(offset + 0x290)
mod_headers = [f.read(module_header_size)
for i in range(0, num_modules)]
if all(hdr.startswith(b"$MME") for hdr in mod_headers):
if args.keep_modules:
end_addr = offset + ftpr_lenght
else:
end_addr = remove_modules(f, mod_headers,
offset, me_end)
if args.relocate:
new_offset = relocate_partition(f, me_start, me_end,
me_start + 0x30,
min_offset + me_start,
mod_headers)
end_addr += new_offset - offset
offset = new_offset
return end_addr, offset
else:
print("Found less modules than expected in the FTPR "
"partition; skipping modules removal")
else:
print("Can't find the module header size; skipping "
"modules removal")
return -1, offset
def check_and_remove_modules_me11(f, me_start, me_end, partition_offset,
partition_lenght, min_offset, relocate,
keep_modules):
comp_str = ("LZMA/uncomp.", "Huffman")
if keep_modules:
end_data = partition_offset + partition_lenght
else:
end_data = 0
f.seek(partition_offset + 0x4)
module_count = unpack("<I", f.read(4))[0]
modules = []
modules.append(("end", partition_lenght, 0))
f.seek(partition_offset + 0x10)
for i in range(0, module_count):
data = f.read(0x18)
name = data[0x0:0xc].rstrip(b"\x00").decode("ascii")
offset_block = unpack("<I", data[0xc:0x10])[0]
offset = offset_block & 0x01ffffff
comp_type = (offset_block & 0x02000000) >> 25
modules.append((name, offset, comp_type))
modules.sort(key=lambda x: x[1])
for i in range(0, module_count):
name = modules[i][0]
offset = partition_offset + modules[i][1]
end = partition_offset + modules[i + 1][1]
removed = False
if name.endswith(".man") or name.endswith(".met"):
compression = "uncompressed"
else:
compression = comp_str[modules[i][2]]
sys.stdout.write(" {:<12} ({:<12}, 0x{:06x} - 0x{:06x}): "
.format(name, compression, offset, end))
if name.endswith(".man"):
print("NOT removed, partition manif.")
elif name.endswith(".met"):
print("NOT removed, module metadata")
elif any(name.startswith(m) for m in unremovable_modules_me11):
print("NOT removed, essential")
else:
removed = True
f.fill_range(offset, min(end, me_end), b"\xff")
print("removed")
if not removed:
end_data = max(end_data, end)
if relocate:
new_offset = relocate_partition(f, me_start, me_end, me_start + 0x30,
min_offset + me_start, [])
end_data += new_offset - partition_offset
partition_offset = new_offset
return end_data, partition_offset
def check_mn2_tag(f, offset):
f.seek(offset + 0x1c)
tag = f.read(4)
if tag != b"$MN2":
sys.exit("Wrong FTPR manifest tag ({}), this image may be corrupted"
.format(tag))
def flreg_to_start_end(flreg):
return (flreg & 0x7fff) << 12, (flreg >> 4 & 0x7fff000 | 0xfff) + 1
def start_end_to_flreg(start, end):
return (start & 0x7fff000) >> 12 | ((end - 1) & 0x7fff000) << 4
if __name__ == "__main__":
parser = argparse.ArgumentParser(description="Tool to remove as much code "
"as possible from Intel ME/TXE firmwares")
"as possible from Intel ME/TXE firmware "
"images")
parser.add_argument("file", help="ME/TXE image or full dump")
parser.add_argument("-O", "--output", help="save the modified image in a "
"separate file, instead of modifying the original "
"file")
parser.add_argument("-r", "--relocate", help="relocate the FTPR partition "
"to the top of the ME region", action="store_true")
"to the top of the ME region to save even more space",
action="store_true")
parser.add_argument("-k", "--keep-modules", help="don't remove the FTPR "
"modules, even when possible", action="store_true")
parser.add_argument("-d", "--descriptor", help="remove the ME/TXE "
"Read/Write permissions to the other regions on the "
"flash from the Intel Flash Descriptor (requires a "
"full dump)", action="store_true")
parser.add_argument("-t", "--truncate", help="truncate the empty part of "
"the firmware (requires a separated ME/TXE image or "
"--extract-me)", action="store_true")
parser.add_argument("-c", "--check", help="verify the integrity of the "
"fundamental parts of the firmware and exit",
action="store_true")
parser.add_argument("-D", "--extract-descriptor", help="extract the "
"flash descriptor from a full dump; when used with "
"--truncate save a descriptor with adjusted regions "
"start and end")
parser.add_argument("-M", "--extract-me", help="extract the ME firmware "
"from a full dump; when used with --truncate save a "
"truncated ME/TXE image")
args = parser.parse_args()
if args.check:
if args.relocate:
sys.exit("-c and -r can't be used together")
elif args.truncate:
sys.exit("-c and -t can't be used together")
f = open(args.file, "rb" if args.check or args.output else "r+b")
f.seek(0x10)
magic = f.read(4)
if magic == b"$FPT":
print("ME/TXE image detected")
me_start = 0
f.seek(0, 2)
me_end = f.tell()
if args.descriptor:
sys.exit("-d requires a full dump")
if args.extract_descriptor:
sys.exit("-D requires a full dump")
if args.extract_me:
sys.exit("-M requires a full dump")
me_start = 0
f.seek(0, 2)
me_end = f.tell()
elif magic == b"\x5a\xa5\xf0\x0f":
print("Full image detected")
if args.truncate and not args.extract_me:
sys.exit("-t requires a separated ME/TXE image (or --extract-me)")
f.seek(0x14)
flmap0, flmap1 = unpack("<II", f.read(8))
nr = flmap0 >> 24 & 0x7
frba = flmap0 >> 12 & 0xff0
fmba = (flmap1 & 0xff) << 4
if nr >= 2:
f.seek(frba)
flreg0, flreg1, flreg2 = unpack("<III", f.read(12))
fd_start = (flreg0 & 0x1fff) << 12
fd_end = flreg0 >> 4 & 0x1fff000 | 0xfff + 1
me_start = (flreg2 & 0x1fff) << 12
me_end = flreg2 >> 4 & 0x1fff000 | 0xfff + 1
flreg = unpack("<III", f.read(12))
fd_start, fd_end = flreg_to_start_end(flreg[0])
bios_start, bios_end = flreg_to_start_end(flreg[1])
me_start, me_end = flreg_to_start_end(flreg[2])
if me_start >= me_end:
sys.exit("The ME/TXE region in this image has been disabled")
@ -341,9 +518,6 @@ if __name__ == "__main__":
print("The ME/TXE region goes from {:#x} to {:#x}"
.format(me_start, me_end))
else:
sys.exit("This image does not contains a ME/TXE firmware NR = {})"
.format(nr))
else:
sys.exit("Unknown image")
@ -378,8 +552,28 @@ if __name__ == "__main__":
if f.read(4) == b"$CPD":
me11 = True
num_entries = unpack("<I", f.read(4))[0]
ftpr_mn2_offset = 0x10 + num_entries * 0x18
f.seek(ftpr_offset + 0x10)
ftpr_mn2_offset = -1
for i in range(0, num_entries):
data = f.read(0x18)
name = data[0x0:0xc].rstrip(b"\x00").decode("ascii")
offset = unpack("<I", data[0xc:0xf] + b"\x00")[0]
if name == "FTPR.man":
ftpr_mn2_offset = offset
break
if ftpr_mn2_offset >= 0:
check_mn2_tag(f, ftpr_offset + ftpr_mn2_offset)
print("Found FTPR manifest at {:#x}"
.format(ftpr_offset + ftpr_mn2_offset))
else:
sys.exit("Can't find the manifest of the FTPR partition")
else:
check_mn2_tag(f, ftpr_offset)
me11 = False
ftpr_mn2_offset = 0
@ -394,7 +588,10 @@ if __name__ == "__main__":
shutil.copy(args.file, args.output)
f = open(args.output, "r+b")
mef = regionFile(f, me_start, me_end)
mef = RegionFile(f, me_start, me_end)
if args.descriptor or args.extract_descriptor:
fdf = RegionFile(f, fd_start, fd_end)
print("Removing extra partitions...")
mef.fill_range(me_start + 0x30, ftpr_offset, b"\xff")
@ -410,18 +607,15 @@ if __name__ == "__main__":
flags &= ~(0x00000001)
mef.write_to(me_start + 0x24, pack("<I", flags))
if args.descriptor:
print("Removing ME/TXE R/W access to the other flash regions...")
fdf = regionFile(f, fd_start, fd_end)
fdf.write_to(fmba + 0x4, pack("<I", 0x04040000))
if me11:
mef.seek(me_start + 0x10)
header = bytearray(mef.read(0x20))
header[0x0b] = 0x00
else:
mef.seek(me_start)
header = bytearray(mef.read(0x30))
checksum = (0x100 - (sum(header) - header[0x1b]) & 0xff) & 0xff
header[0x1b] = 0x00
checksum = (0x100 - sum(header) & 0xff) & 0xff
print("Correcting checksum (0x{:02x})...".format(checksum))
# The checksum is just the two's complement of the sum of the first
@ -430,45 +624,20 @@ if __name__ == "__main__":
# must be always 0x00.
mef.write_to(me_start + 0x1b, pack("B", checksum))
if not me11:
print("Reading FTPR modules list...")
mef.seek(ftpr_offset + 0x1c)
tag = mef.read(4)
if tag == b"$MN2":
mef.seek(ftpr_offset + 0x20)
num_modules = unpack("<I", mef.read(4))[0]
mef.seek(ftpr_offset + 0x290)
data = mef.read(0x84)
module_header_size = 0
if data[0x0:0x4] == b"$MME":
if data[0x60:0x64] == b"$MME" or num_modules == 1:
module_header_size = 0x60
elif data[0x80:0x84] == b"$MME":
module_header_size = 0x80
if module_header_size != 0:
mef.seek(ftpr_offset + 0x290)
mod_headers = [mef.read(module_header_size)
for i in range(0, num_modules)]
if all(hdr.startswith(b"$MME") for hdr in mod_headers):
if args.keep_modules:
end_addr = ftpr_offset + ftpr_lenght
if me11:
end_addr, ftpr_offset = \
check_and_remove_modules_me11(mef, me_start, me_end,
ftpr_offset, ftpr_lenght,
min_ftpr_offset, args.relocate,
args.keep_modules)
else:
end_addr = remove_modules(mef, mod_headers,
ftpr_offset, me_end)
if args.relocate:
new_ftpr_offset = relocate_partition(mef,
me_start, me_end,
me_start + 0x30,
min_ftpr_offset + me_start,
mod_headers)
end_addr += new_ftpr_offset - ftpr_offset
ftpr_offset = new_ftpr_offset
end_addr, ftpr_offset = \
check_and_remove_modules(mef, me_start, me_end, ftpr_offset,
min_ftpr_offset, args.relocate,
args.keep_modules)
if end_addr > 0:
end_addr = (end_addr // 0x1000 + 1) * 0x1000
end_addr += spared_blocks * 0x1000
@ -477,29 +646,66 @@ if __name__ == "__main__":
if me_start > 0:
print("The ME region can be reduced up to:\n"
" {:08x}:{:08x} me"
.format(me_start, end_addr - 1))
else:
print("Found less modules than expected in the FTPR "
"partition; skipping modules removal")
else:
print("Can't find the module header size; skipping "
"modules removal")
else:
print("Wrong FTPR partition tag ({}); skipping modules removal"
.format(tag))
else:
print("Modules removal in ME v11 or greater is not yet supported")
" {:08x}:{:08x} me".format(me_start, end_addr - 1))
elif args.truncate:
print("Truncating file at {:#x}...".format(end_addr))
f.truncate(end_addr)
sys.stdout.write("Checking FTPR RSA signature... ")
if check_partition_signature(f, ftpr_offset + ftpr_mn2_offset):
print("VALID")
if args.descriptor:
print("Removing ME/TXE R/W access to the other flash regions...")
fdf.write_to(fmba + 0x4, pack("<I", 0x04040000))
if args.extract_descriptor:
if args.truncate:
print("Extracting the descriptor to \"{}\"..."
.format(args.extract_descriptor))
fdf_copy = fdf.save(args.extract_descriptor, fd_end - fd_start)
if bios_start == me_end:
print("Modifying the regions of the extracted descriptor...")
print(" {:08x}:{:08x} me --> {:08x}:{:08x} me"
.format(me_start, me_end - 1, me_start, end_addr - 1))
print(" {:08x}:{:08x} bios --> {:08x}:{:08x} bios"
.format(bios_start, bios_end - 1, end_addr, bios_end - 1))
flreg1 = start_end_to_flreg(end_addr, bios_end)
flreg2 = start_end_to_flreg(me_start, end_addr)
fdf_copy.seek(frba + 0x4)
fdf_copy.write(pack("<II", flreg1, flreg2))
else:
print("INVALID!!")
sys.exit("The FTPR partition signature is not valid. Is the input "
"ME/TXE image valid?")
print("\nWARNING:\n The start address of the BIOS region "
"isn't equal to the end address of the ME\n region: if "
"you want to recover the space from the ME region you "
"have to\n manually modify the descriptor.\n")
fdf_copy.close()
else:
print("Extracting the descriptor to \"{}\"..."
.format(args.extract_descriptor))
fdf.save(args.extract_descriptor, fd_end - fd_start).close()
if args.extract_me:
if args.truncate:
print("Extracting and truncating the ME image to \"{}\"..."
.format(args.extract_me))
mef_copy = mef.save(args.extract_me, end_addr - me_start)
else:
print("Extracting the ME image to \"{}\"..."
.format(args.extract_me))
mef_copy = mef.save(args.extract_me, me_end - me_start)
sys.stdout.write("Checking the FTPR RSA signature of the extracted ME "
"image... ")
print_check_partition_signature(mef_copy, ftpr_offset +
ftpr_mn2_offset - me_start)
mef_copy.close()
sys.stdout.write("Checking the FTPR RSA signature... ")
print_check_partition_signature(f, ftpr_offset + ftpr_mn2_offset)
f.close()
if not args.check:
print("Done! Good luck!")