This is nice, but it just allows you to replace some of the the Management Engine code. What we need to know in detail is what it's doing. There's probably a backdoor in there that hasn't been discovered yet.
Reverse-Engineering the Intel Management Engine
21–30 of 36 posts
Re: Reverse-Engineering the Intel Management Engine
#22Re: Reverse-Engineering the Intel Management Engine
#23Meanwhile I'm trying to find a way to remove the hard lock on CPU and RAM frequencies (extreme CPUs can't be overclocked, RAM is locked at 1333 MHz) :) Looks like it can be done through Management Engine, which has access to everything apparently. Only success so far is unlocking BCLK, but the overclock is small and unstable that way. Another roadblock was the read only lock, which can fortunately be bypassed on POST…
> extreme CPUs can't be overclocked You mean non-extreme? > unlocking BCLK, but the overclock is small and unstable that way On desktop Skylake, BCLK can get you to anywhere you want (I run an i5-6400 at 4.5GHz daily, over 4.7 for benchmarks). You're talking about laptops, right?
BCLK overclocking is heavily motherboard dependent, you need a very good external clock reference and in any case once you go over 3-5mhz you drop your PCIE rates from 3.0 to 2.0.
Intel's HEDT platform supports proper CPU strap overclocking withou adverse effects, but even then it's usually not recommended unless you are doing extreme OC and that's liquid nitro :)
Re: Reverse-Engineering the Intel Management Engine
#24Meanwhile I'm trying to find a way to remove the hard lock on CPU and RAM frequencies (extreme CPUs can't be overclocked, RAM is locked at 1333 MHz) :) Looks like it can be done through Management Engine, which has access to everything apparently. Only success so far is unlocking BCLK, but the overclock is small and unstable that way. Another roadblock was the read only lock, which can fortunately be bypassed on POST…
> extreme CPUs can't be overclocked You mean non-extreme? > unlocking BCLK, but the overclock is small and unstable that way On desktop Skylake, BCLK can get you to anywhere you want (I run an i5-6400 at 4.5GHz daily, over 4.7 for benchmarks). You're talking about laptops, right?
Laptop, and extreme CPU. HP and Dell block TPL/TRL adjustment even for XM processors, and HP took it even further with their 1333 MHz limit on RAM. I have 1600 MHz sticks that can run fine at 1866 and probably more (tried with Thaiphoon Burner), so that's really annoying. I don't want an Alienware to get that.
And BCLK allows for a 5MHz overclock, which is not much, anything more and the system crashes. Which is really strange, may have something to do with PCIE as Dogma said.
I just want to get everything out of my extreme processor and RAM.
Re: Reverse-Engineering the Intel Management Engine
#25Did the author notify Intel about the bug they found?
Even if it was exploitable, it's not like Intel can fix it as they have no mechanism to revoke the old version.
Sure, they could release a new version with the bug fixed, but the attacker doesn't have to use the new version, they can deliberately use the old flawed version in their modified version of the bios.
Re: Reverse-Engineering the Intel Management Engine
#26Did the author notify Intel about the bug they found?
Even if it was exploitable, it's not like Intel can fix it as they have no mechanism to revoke the old version.
Sure, they could release a new version with the bug fixed, but the attacker doesn't have to use the new version, they can deliberately use the old flawed version in their modified version of the bios.
Re: Reverse-Engineering the Intel Management Engine
#27This is nice, but it just allows you to replace some of the the Management Engine code. What we need to know in detail is what it's doing. There's probably a backdoor in there that hasn't been discovered yet.
On the other hand, if we get "our" code into the IME, we can really do interesting stuff. For example reading out data that one should not be read out? ;-)
Re: Reverse-Engineering the Intel Management Engine
#28Did the author notify Intel about the bug they found?
Respectfully, why would they? The goal here is to find exploits in ME and use them to make Intel chips more end-user friendly. When we were rooting Android devices we sat on a lot of exploits that we believed we could use to give end-users freedom. There were a handful that were bad enough to warrant disclosure [1], but we still offered them as ways for users to control their own devices with a few layers of obfuscat…
> When we were rooting Android devices we sat on a lot of exploits that we believed we could use to give end-users freedom.
I often think whether one should really help people who decide to buy locked-down Android devices.
Re: Reverse-Engineering the Intel Management Engine
#29Earlier quoted context omitted.
> extreme CPUs can't be overclocked You mean non-extreme? > unlocking BCLK, but the overclock is small and unstable that way On desktop Skylake, BCLK can get you to anywhere you want (I run an i5-6400 at 4.5GHz daily, over 4.7 for benchmarks). You're talking about laptops, right?
Laptop, and extreme CPU. HP and Dell block TPL/TRL adjustment even for XM processors, and HP took it even further with their 1333 MHz limit on RAM. I have 1600 MHz sticks that can run fine at 1866 and probably more (tried with Thaiphoon Burner), so that's really annoying. I don't want an Alienware to get that. And BCLK allows for a 5MHz overclock, which is not much, anything more and the system crashes. Which is real…
Isn't that a bad idea... laptops have significant thermal limitations, things start going wrong quickly when you push beyond those. I've not done any serious overclocking but most seem to stick to desktop and buy more capable cooling systems to make it sustainable.
Re: Reverse-Engineering the Intel Management Engine
#30Did the author notify Intel about the bug they found?
Even if it was exploitable, it's not like Intel can fix it as they have no mechanism to revoke the old version. Sure, they could release a new version with the bug fixed, but the attacker doesn't have to use the new version, they can deliberately use the old flawed version in their modified version of the bios.
Hopefully this is true. Though we really don't know what all the components in the Intel ME can do. They might be able to remotely update all chips so long as they have connected to a network that still exists. But I think (hope) this is unlikely and you are right.