TR17 - Intel ME The Way of the Static Analysis

### Overview At Troopers 2017, Dmitry Sklyarov from Positive Technologies presented research conducted alongside colleagues Maxim Goryachy and Mark Ermolov on reverse engineering Intel Management Engine (ME) version 11. Historically running on ARC processors (and SPARC for mobile Atom platforms), Intel ME transitioned in version 11 (Skylake and later) to an x86 architecture. Positioned within the chipset with out-of-band network access, arbitrary DMA to host RAM, and operation during sleep or power-off states, ME 11 represents a deeply privileged and largely undocumented component. The researchers examined the architecture, firmware formats, metadata structures, and ROM bypass mechanisms using static analysis.

### Key Topics - **Architecture and Evolution:** Shift from ARC/SPARC to an x86-based core in ME 11, TXE 3, and Server Platform Services (SPS) 4, alongside the emergence of the Convergent Security Engine (CSE) moniker. - **Firmware Structure & Partitioning:** Organization of SPI flash containing the Flash Partition Table (FPT), Code Partition Directory (CPD), partition manifests, and module metadata. - **Uncovering Undocumented Formats:** Extraction of embedded XML resource schemas from vendor utilities (MEU and FIT) using binwalk, revealing the layout of tag-length-value (TLV) extension records. - **Integrity and Cryptography:** Multi-layered verification chain relying on SHA-256 and 2048-bit RSA signatures checked against public key hashes stored in on-die ROM. - **Compression and OS Findings:** Hardware-assisted Huffman compression barring analysis of key ME modules, the lack of Huffman compression in TXE, and string evidence showing ME 11 is based on the Minix operating system.

### Technical Details Sklyarov explained that modules like the kernel, `rbe`, `bup`, and `amt` in ME 11 are compressed using hardware Huffman tables tailored to x86 byte frequencies, which remain unknown and unpublished. However, inspecting the Manifest Extension Utility (`meu`) and Flash Image Tool (`fit`) with `binwalk` exposed embedded Qt resources (`qresource`) holding uncompressed XML schemas. These schemas revealed the definitions for TLV metadata records within manifests and modules: - **System Information & Initialization:** Specifies UMA size (~32 MB carve-out from host DRAM inaccessible even to SMM) and boot scripts determining when specific modules execute. - **Process Manifests:** Contains load base addresses, entry points, thread stacks, scheduling policies, user/group IDs, and a bitmask of permitted system calls. - **MMIO Ranges & Privileges:** Details how user-mode (Ring 3) processes access hardware via selector 7 in the LDT, cross-referenced with entries in device drivers like `bus_drv`. - **Special File Producers:** Maps Unix-like device paths (e.g., `/dev/crypto_gkey`) with user/group permissions to identify which process handles specific endpoints.

The speaker also analyzed seven rare firmware images exhibiting a "ROM bypass" mechanism. Designed to patch hardware ROM flaws by jumping execution directly to flash-resident initialization routines, these images revealed early execution flow: initializing hardware, maintaining an internal 12-character name-value dictionary, calling hardware cryptographic accelerators for HMAC/AES key derivation, and loading early libraries (`syslib`/`csyslib`) prior to kernel execution.

### Takeaways While cryptographic verification (RSA-2048 anchored to eight ROM hashes) prevents unauthorized firmware modifications, static analysis provides substantial visibility into ME 11's architecture. TXE 3 firmware provides an accessible starting point because its modules are not compressed with Huffman tables. Furthermore, string analysis in the `VFS` module confirmed that ME 11's operating system environment is based on Minix rather than ThreadX. The researchers highlighted that recovering hardware Huffman tables remains the primary roadblock to fully auditing critical ME modules.