Yegor Timoshenko | c2e4941 | 2018-10-07 01:58:27 +0000 | [diff] [blame] | 1 | #!/usr/bin/env python |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 2 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 3 | # me_cleaner - Tool for partial deblobbing of Intel ME/TXE firmware images |
| 4 | # Copyright (C) 2016-2018 Nicola Corna <nicola@corna.info> |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 5 | # |
| 6 | # This program is free software; you can redistribute it and/or modify |
| 7 | # it under the terms of the GNU General Public License as published by |
| 8 | # the Free Software Foundation; either version 3 of the License, or |
| 9 | # (at your option) any later version. |
| 10 | # |
| 11 | # This program is distributed in the hope that it will be useful, |
| 12 | # but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 13 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 14 | # GNU General Public License for more details. |
| 15 | # |
| 16 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 17 | from __future__ import division, print_function |
| 18 | |
| 19 | import argparse |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 20 | import binascii |
| 21 | import hashlib |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 22 | import itertools |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 23 | import shutil |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 24 | import sys |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 25 | from struct import pack, unpack |
| 26 | |
| 27 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 28 | min_ftpr_offset = 0x400 |
| 29 | spared_blocks = 4 |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 30 | unremovable_modules = ("ROMP", "BUP") |
| 31 | unremovable_modules_me11 = ("rbe", "kernel", "syslib", "bup") |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 32 | unremovable_partitions = ("FTPR",) |
| 33 | |
| 34 | pubkeys_md5 = { |
| 35 | "763e59ebe235e45a197a5b1a378dfa04": ("ME", ("6.x.x.x",)), |
| 36 | "3a98c847d609c253e145bd36512629cb": ("ME", ("6.0.50.x",)), |
| 37 | "0903fc25b0f6bed8c4ed724aca02124c": ("ME", ("7.x.x.x", "8.x.x.x")), |
| 38 | "2011ae6df87c40fba09e3f20459b1ce0": ("ME", ("9.0.x.x", "9.1.x.x")), |
| 39 | "e8427c5691cf8b56bc5cdd82746957ed": ("ME", ("9.5.x.x", "10.x.x.x")), |
| 40 | "986a78e481f185f7d54e4af06eb413f6": ("ME", ("11.x.x.x",)), |
| 41 | "bda0b6bb8ca0bf0cac55ac4c4d55e0f2": ("TXE", ("1.x.x.x",)), |
| 42 | "b726a2ab9cd59d4e62fe2bead7cf6997": ("TXE", ("1.x.x.x",)), |
| 43 | "0633d7f951a3e7968ae7460861be9cfb": ("TXE", ("2.x.x.x",)), |
| 44 | "1d0a36e9f5881540d8e4b382c6612ed8": ("TXE", ("3.x.x.x",)), |
| 45 | "be900fef868f770d266b1fc67e887e69": ("SPS", ("2.x.x.x",)), |
| 46 | "4622e3f2cb212a89c90a4de3336d88d2": ("SPS", ("3.x.x.x",)), |
| 47 | "31ef3d950eac99d18e187375c0764ca4": ("SPS", ("4.x.x.x",)) |
| 48 | } |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 49 | |
| 50 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 51 | class OutOfRegionException(Exception): |
| 52 | pass |
| 53 | |
| 54 | |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 55 | class RegionFile: |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 56 | def __init__(self, f, region_start, region_end): |
| 57 | self.f = f |
| 58 | self.region_start = region_start |
| 59 | self.region_end = region_end |
| 60 | |
| 61 | def read(self, n): |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 62 | if f.tell() + n <= self.region_end: |
| 63 | return self.f.read(n) |
| 64 | else: |
| 65 | raise OutOfRegionException() |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 66 | |
| 67 | def readinto(self, b): |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 68 | if f.tell() + len(b) <= self.region_end: |
| 69 | return self.f.readinto(b) |
| 70 | else: |
| 71 | raise OutOfRegionException() |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 72 | |
| 73 | def seek(self, offset): |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 74 | if self.region_start + offset <= self.region_end: |
| 75 | return self.f.seek(self.region_start + offset) |
| 76 | else: |
| 77 | raise OutOfRegionException() |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 78 | |
| 79 | def write_to(self, offset, data): |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 80 | if self.region_start + offset + len(data) <= self.region_end: |
| 81 | self.f.seek(self.region_start + offset) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 82 | return self.f.write(data) |
| 83 | else: |
| 84 | raise OutOfRegionException() |
| 85 | |
| 86 | def fill_range(self, start, end, fill): |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 87 | if self.region_start + end <= self.region_end: |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 88 | if start < end: |
| 89 | block = fill * 4096 |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 90 | self.f.seek(self.region_start + start) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 91 | self.f.writelines(itertools.repeat(block, |
| 92 | (end - start) // 4096)) |
| 93 | self.f.write(block[:(end - start) % 4096]) |
| 94 | else: |
| 95 | raise OutOfRegionException() |
| 96 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 97 | def fill_all(self, fill): |
| 98 | self.fill_range(0, self.region_end - self.region_start, fill) |
| 99 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 100 | def move_range(self, offset_from, size, offset_to, fill): |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 101 | if self.region_start + offset_from + size <= self.region_end and \ |
| 102 | self.region_start + offset_to + size <= self.region_end: |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 103 | for i in range(0, size, 4096): |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 104 | self.f.seek(self.region_start + offset_from + i, 0) |
| 105 | block = self.f.read(min(size - i, 4096)) |
| 106 | self.f.seek(self.region_start + offset_from + i, 0) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 107 | self.f.write(fill * len(block)) |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 108 | self.f.seek(self.region_start + offset_to + i, 0) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 109 | self.f.write(block) |
| 110 | else: |
| 111 | raise OutOfRegionException() |
| 112 | |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 113 | def save(self, filename, size): |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 114 | if self.region_start + size <= self.region_end: |
| 115 | self.f.seek(self.region_start) |
| 116 | copyf = open(filename, "w+b") |
| 117 | for i in range(0, size, 4096): |
| 118 | copyf.write(self.f.read(min(size - i, 4096))) |
| 119 | return copyf |
| 120 | else: |
| 121 | raise OutOfRegionException() |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 122 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 123 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 124 | def get_chunks_offsets(llut): |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 125 | chunk_count = unpack("<I", llut[0x04:0x08])[0] |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 126 | huffman_stream_end = sum(unpack("<II", llut[0x10:0x18])) |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 127 | nonzero_offsets = [huffman_stream_end] |
| 128 | offsets = [] |
| 129 | |
| 130 | for i in range(0, chunk_count): |
| 131 | chunk = llut[0x40 + i * 4:0x44 + i * 4] |
| 132 | offset = 0 |
| 133 | |
| 134 | if chunk[3] != 0x80: |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 135 | offset = unpack("<I", chunk[0:3] + b"\x00")[0] |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 136 | |
| 137 | offsets.append([offset, 0]) |
| 138 | if offset != 0: |
| 139 | nonzero_offsets.append(offset) |
| 140 | |
| 141 | nonzero_offsets.sort() |
| 142 | |
| 143 | for i in offsets: |
| 144 | if i[0] != 0: |
| 145 | i[1] = nonzero_offsets[nonzero_offsets.index(i[0]) + 1] |
| 146 | |
| 147 | return offsets |
| 148 | |
| 149 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 150 | def remove_modules(f, mod_headers, ftpr_offset, me_end): |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 151 | comp_str = ("uncomp.", "Huffman", "LZMA") |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 152 | unremovable_huff_chunks = [] |
| 153 | chunks_offsets = [] |
| 154 | base = 0 |
| 155 | chunk_size = 0 |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 156 | end_addr = 0 |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 157 | |
| 158 | for mod_header in mod_headers: |
| 159 | name = mod_header[0x04:0x14].rstrip(b"\x00").decode("ascii") |
| 160 | offset = unpack("<I", mod_header[0x38:0x3C])[0] + ftpr_offset |
| 161 | size = unpack("<I", mod_header[0x40:0x44])[0] |
| 162 | flags = unpack("<I", mod_header[0x50:0x54])[0] |
| 163 | comp_type = (flags >> 4) & 7 |
| 164 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 165 | print(" {:<16} ({:<7}, ".format(name, comp_str[comp_type]), end="") |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 166 | |
| 167 | if comp_type == 0x00 or comp_type == 0x02: |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 168 | print("0x{:06x} - 0x{:06x} ): " |
| 169 | .format(offset, offset + size), end="") |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 170 | |
| 171 | if name in unremovable_modules: |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 172 | end_addr = max(end_addr, offset + size) |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 173 | print("NOT removed, essential") |
| 174 | else: |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 175 | end = min(offset + size, me_end) |
| 176 | f.fill_range(offset, end, b"\xff") |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 177 | print("removed") |
| 178 | |
| 179 | elif comp_type == 0x01: |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 180 | if not chunks_offsets: |
| 181 | f.seek(offset) |
| 182 | llut = f.read(4) |
| 183 | if llut == b"LLUT": |
| 184 | llut += f.read(0x3c) |
| 185 | |
| 186 | chunk_count = unpack("<I", llut[0x4:0x8])[0] |
| 187 | base = unpack("<I", llut[0x8:0xc])[0] + 0x10000000 |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 188 | chunk_size = unpack("<I", llut[0x30:0x34])[0] |
| 189 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 190 | llut += f.read(chunk_count * 4) |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 191 | chunks_offsets = get_chunks_offsets(llut) |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 192 | else: |
| 193 | sys.exit("Huffman modules found, but LLUT is not present") |
| 194 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 195 | module_base = unpack("<I", mod_header[0x34:0x38])[0] |
| 196 | module_size = unpack("<I", mod_header[0x3c:0x40])[0] |
| 197 | first_chunk_num = (module_base - base) // chunk_size |
| 198 | last_chunk_num = first_chunk_num + module_size // chunk_size |
| 199 | huff_size = 0 |
| 200 | |
| 201 | for chunk in chunks_offsets[first_chunk_num:last_chunk_num + 1]: |
| 202 | huff_size += chunk[1] - chunk[0] |
| 203 | |
| 204 | print("fragmented data, {:<9}): " |
| 205 | .format("~" + str(int(round(huff_size / 1024))) + " KiB"), |
| 206 | end="") |
| 207 | |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 208 | if name in unremovable_modules: |
| 209 | print("NOT removed, essential") |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 210 | |
| 211 | unremovable_huff_chunks += \ |
| 212 | [x for x in chunks_offsets[first_chunk_num: |
| 213 | last_chunk_num + 1] if x[0] != 0] |
| 214 | else: |
| 215 | print("removed") |
| 216 | |
| 217 | else: |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 218 | print("0x{:06x} - 0x{:06x}): unknown compression, skipping" |
| 219 | .format(offset, offset + size), end="") |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 220 | |
| 221 | if chunks_offsets: |
| 222 | removable_huff_chunks = [] |
| 223 | |
| 224 | for chunk in chunks_offsets: |
| 225 | if all(not(unremovable_chk[0] <= chunk[0] < unremovable_chk[1] or |
| 226 | unremovable_chk[0] < chunk[1] <= unremovable_chk[1]) |
| 227 | for unremovable_chk in unremovable_huff_chunks): |
| 228 | removable_huff_chunks.append(chunk) |
| 229 | |
| 230 | for removable_chunk in removable_huff_chunks: |
| 231 | if removable_chunk[1] > removable_chunk[0]: |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 232 | end = min(removable_chunk[1], me_end) |
| 233 | f.fill_range(removable_chunk[0], end, b"\xff") |
| 234 | |
| 235 | end_addr = max(end_addr, |
| 236 | max(unremovable_huff_chunks, key=lambda x: x[1])[1]) |
| 237 | |
| 238 | return end_addr |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 239 | |
| 240 | |
| 241 | def check_partition_signature(f, offset): |
| 242 | f.seek(offset) |
| 243 | header = f.read(0x80) |
| 244 | modulus = int(binascii.hexlify(f.read(0x100)[::-1]), 16) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 245 | public_exponent = unpack("<I", f.read(4))[0] |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 246 | signature = int(binascii.hexlify(f.read(0x100)[::-1]), 16) |
| 247 | |
| 248 | header_len = unpack("<I", header[0x4:0x8])[0] * 4 |
| 249 | manifest_len = unpack("<I", header[0x18:0x1c])[0] * 4 |
| 250 | f.seek(offset + header_len) |
| 251 | |
| 252 | sha256 = hashlib.sha256() |
| 253 | sha256.update(header) |
| 254 | sha256.update(f.read(manifest_len - header_len)) |
| 255 | |
| 256 | decrypted_sig = pow(signature, public_exponent, modulus) |
| 257 | |
| 258 | return "{:#x}".format(decrypted_sig).endswith(sha256.hexdigest()) # FIXME |
| 259 | |
| 260 | |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 261 | def print_check_partition_signature(f, offset): |
| 262 | if check_partition_signature(f, offset): |
| 263 | print("VALID") |
| 264 | else: |
| 265 | print("INVALID!!") |
| 266 | sys.exit("The FTPR partition signature is not valid. Is the input " |
| 267 | "ME/TXE image valid?") |
| 268 | |
| 269 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 270 | def relocate_partition(f, me_end, partition_header_offset, |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 271 | new_offset, mod_headers): |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 272 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 273 | f.seek(partition_header_offset) |
| 274 | name = f.read(4).rstrip(b"\x00").decode("ascii") |
| 275 | f.seek(partition_header_offset + 0x8) |
| 276 | old_offset, partition_size = unpack("<II", f.read(0x8)) |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 277 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 278 | llut_start = 0 |
| 279 | for mod_header in mod_headers: |
| 280 | if (unpack("<I", mod_header[0x50:0x54])[0] >> 4) & 7 == 0x01: |
| 281 | llut_start = unpack("<I", mod_header[0x38:0x3C])[0] + old_offset |
| 282 | break |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 283 | |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 284 | if mod_headers and llut_start != 0: |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 285 | # Bytes 0x9:0xb of the LLUT (bytes 0x1:0x3 of the AddrBase) are added |
| 286 | # to the SpiBase (bytes 0xc:0x10 of the LLUT) to compute the final |
| 287 | # start of the LLUT. Since AddrBase is not modifiable, we can act only |
| 288 | # on SpiBase and here we compute the minimum allowed new_offset. |
| 289 | f.seek(llut_start + 0x9) |
| 290 | lut_start_corr = unpack("<H", f.read(2))[0] |
| 291 | new_offset = max(new_offset, |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 292 | lut_start_corr - llut_start - 0x40 + old_offset) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 293 | new_offset = ((new_offset + 0x1f) // 0x20) * 0x20 |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 294 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 295 | offset_diff = new_offset - old_offset |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 296 | print("Relocating {} from {:#x} - {:#x} to {:#x} - {:#x}..." |
| 297 | .format(name, old_offset, old_offset + partition_size, |
| 298 | new_offset, new_offset + partition_size)) |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 299 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 300 | print(" Adjusting FPT entry...") |
| 301 | f.write_to(partition_header_offset + 0x8, |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 302 | pack("<I", new_offset)) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 303 | |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 304 | if mod_headers: |
| 305 | if llut_start != 0: |
| 306 | f.seek(llut_start) |
| 307 | if f.read(4) == b"LLUT": |
| 308 | print(" Adjusting LUT start offset...") |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 309 | lut_offset = llut_start + offset_diff + 0x40 - lut_start_corr |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 310 | f.write_to(llut_start + 0x0c, pack("<I", lut_offset)) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 311 | |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 312 | print(" Adjusting Huffman start offset...") |
| 313 | f.seek(llut_start + 0x14) |
| 314 | old_huff_offset = unpack("<I", f.read(4))[0] |
| 315 | f.write_to(llut_start + 0x14, |
| 316 | pack("<I", old_huff_offset + offset_diff)) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 317 | |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 318 | print(" Adjusting chunks offsets...") |
| 319 | f.seek(llut_start + 0x4) |
| 320 | chunk_count = unpack("<I", f.read(4))[0] |
| 321 | f.seek(llut_start + 0x40) |
| 322 | chunks = bytearray(chunk_count * 4) |
| 323 | f.readinto(chunks) |
| 324 | for i in range(0, chunk_count * 4, 4): |
| 325 | if chunks[i + 3] != 0x80: |
| 326 | chunks[i:i + 3] = \ |
| 327 | pack("<I", unpack("<I", chunks[i:i + 3] + |
| 328 | b"\x00")[0] + offset_diff)[0:3] |
| 329 | f.write_to(llut_start + 0x40, chunks) |
| 330 | else: |
| 331 | sys.exit("Huffman modules present but no LLUT found!") |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 332 | else: |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 333 | print(" No Huffman modules found") |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 334 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 335 | print(" Moving data...") |
| 336 | partition_size = min(partition_size, me_end - old_offset) |
| 337 | f.move_range(old_offset, partition_size, new_offset, b"\xff") |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 338 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 339 | return new_offset |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 340 | |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 341 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 342 | def check_and_remove_modules(f, me_end, offset, min_offset, |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 343 | relocate, keep_modules): |
| 344 | |
| 345 | f.seek(offset + 0x20) |
| 346 | num_modules = unpack("<I", f.read(4))[0] |
| 347 | f.seek(offset + 0x290) |
| 348 | data = f.read(0x84) |
| 349 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 350 | mod_header_size = 0 |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 351 | if data[0x0:0x4] == b"$MME": |
| 352 | if data[0x60:0x64] == b"$MME" or num_modules == 1: |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 353 | mod_header_size = 0x60 |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 354 | elif data[0x80:0x84] == b"$MME": |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 355 | mod_header_size = 0x80 |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 356 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 357 | if mod_header_size != 0: |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 358 | f.seek(offset + 0x290) |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 359 | data = f.read(mod_header_size * num_modules) |
| 360 | mod_headers = [data[i * mod_header_size:(i + 1) * mod_header_size] |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 361 | for i in range(0, num_modules)] |
| 362 | |
| 363 | if all(hdr.startswith(b"$MME") for hdr in mod_headers): |
| 364 | if args.keep_modules: |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 365 | end_addr = offset + ftpr_length |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 366 | else: |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 367 | end_addr = remove_modules(f, mod_headers, offset, me_end) |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 368 | |
| 369 | if args.relocate: |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 370 | new_offset = relocate_partition(f, me_end, 0x30, min_offset, |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 371 | mod_headers) |
| 372 | end_addr += new_offset - offset |
| 373 | offset = new_offset |
| 374 | |
| 375 | return end_addr, offset |
| 376 | |
| 377 | else: |
| 378 | print("Found less modules than expected in the FTPR " |
| 379 | "partition; skipping modules removal") |
| 380 | else: |
| 381 | print("Can't find the module header size; skipping " |
| 382 | "modules removal") |
| 383 | |
| 384 | return -1, offset |
| 385 | |
| 386 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 387 | def check_and_remove_modules_me11(f, me_end, partition_offset, |
| 388 | partition_length, min_offset, relocate, |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 389 | keep_modules): |
| 390 | |
| 391 | comp_str = ("LZMA/uncomp.", "Huffman") |
| 392 | |
| 393 | if keep_modules: |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 394 | end_data = partition_offset + partition_length |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 395 | else: |
| 396 | end_data = 0 |
| 397 | |
| 398 | f.seek(partition_offset + 0x4) |
| 399 | module_count = unpack("<I", f.read(4))[0] |
| 400 | |
| 401 | modules = [] |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 402 | modules.append(("end", partition_length, 0)) |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 403 | |
| 404 | f.seek(partition_offset + 0x10) |
| 405 | for i in range(0, module_count): |
| 406 | data = f.read(0x18) |
| 407 | name = data[0x0:0xc].rstrip(b"\x00").decode("ascii") |
| 408 | offset_block = unpack("<I", data[0xc:0x10])[0] |
| 409 | offset = offset_block & 0x01ffffff |
| 410 | comp_type = (offset_block & 0x02000000) >> 25 |
| 411 | |
| 412 | modules.append((name, offset, comp_type)) |
| 413 | |
| 414 | modules.sort(key=lambda x: x[1]) |
| 415 | |
| 416 | for i in range(0, module_count): |
| 417 | name = modules[i][0] |
| 418 | offset = partition_offset + modules[i][1] |
| 419 | end = partition_offset + modules[i + 1][1] |
| 420 | removed = False |
| 421 | |
| 422 | if name.endswith(".man") or name.endswith(".met"): |
| 423 | compression = "uncompressed" |
| 424 | else: |
| 425 | compression = comp_str[modules[i][2]] |
| 426 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 427 | print(" {:<12} ({:<12}, 0x{:06x} - 0x{:06x}): " |
| 428 | .format(name, compression, offset, end), end="") |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 429 | |
| 430 | if name.endswith(".man"): |
| 431 | print("NOT removed, partition manif.") |
| 432 | elif name.endswith(".met"): |
| 433 | print("NOT removed, module metadata") |
| 434 | elif any(name.startswith(m) for m in unremovable_modules_me11): |
| 435 | print("NOT removed, essential") |
| 436 | else: |
| 437 | removed = True |
| 438 | f.fill_range(offset, min(end, me_end), b"\xff") |
| 439 | print("removed") |
| 440 | |
| 441 | if not removed: |
| 442 | end_data = max(end_data, end) |
| 443 | |
| 444 | if relocate: |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 445 | new_offset = relocate_partition(f, me_end, 0x30, min_offset, []) |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 446 | end_data += new_offset - partition_offset |
| 447 | partition_offset = new_offset |
| 448 | |
| 449 | return end_data, partition_offset |
| 450 | |
| 451 | |
| 452 | def check_mn2_tag(f, offset): |
| 453 | f.seek(offset + 0x1c) |
| 454 | tag = f.read(4) |
| 455 | if tag != b"$MN2": |
| 456 | sys.exit("Wrong FTPR manifest tag ({}), this image may be corrupted" |
| 457 | .format(tag)) |
| 458 | |
| 459 | |
| 460 | def flreg_to_start_end(flreg): |
| 461 | return (flreg & 0x7fff) << 12, (flreg >> 4 & 0x7fff000 | 0xfff) + 1 |
| 462 | |
| 463 | |
| 464 | def start_end_to_flreg(start, end): |
| 465 | return (start & 0x7fff000) >> 12 | ((end - 1) & 0x7fff000) << 4 |
| 466 | |
| 467 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 468 | if __name__ == "__main__": |
| 469 | parser = argparse.ArgumentParser(description="Tool to remove as much code " |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 470 | "as possible from Intel ME/TXE firmware " |
| 471 | "images") |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 472 | softdis = parser.add_mutually_exclusive_group() |
| 473 | bw_list = parser.add_mutually_exclusive_group() |
| 474 | |
| 475 | parser.add_argument("-v", "--version", action="version", |
| 476 | version="%(prog)s 1.2") |
| 477 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 478 | parser.add_argument("file", help="ME/TXE image or full dump") |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 479 | parser.add_argument("-O", "--output", metavar='output_file', help="save " |
| 480 | "the modified image in a separate file, instead of " |
| 481 | "modifying the original file") |
| 482 | softdis.add_argument("-S", "--soft-disable", help="in addition to the " |
| 483 | "usual operations on the ME/TXE firmware, set the " |
| 484 | "MeAltDisable bit or the HAP bit to ask Intel ME/TXE " |
| 485 | "to disable itself after the hardware initialization " |
| 486 | "(requires a full dump)", action="store_true") |
| 487 | softdis.add_argument("-s", "--soft-disable-only", help="instead of the " |
| 488 | "usual operations on the ME/TXE firmware, just set " |
| 489 | "the MeAltDisable bit or the HAP bit to ask Intel " |
| 490 | "ME/TXE to disable itself after the hardware " |
| 491 | "initialization (requires a full dump)", |
| 492 | action="store_true") |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 493 | parser.add_argument("-r", "--relocate", help="relocate the FTPR partition " |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 494 | "to the top of the ME region to save even more space", |
| 495 | action="store_true") |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 496 | parser.add_argument("-t", "--truncate", help="truncate the empty part of " |
| 497 | "the firmware (requires a separated ME/TXE image or " |
| 498 | "--extract-me)", action="store_true") |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 499 | parser.add_argument("-k", "--keep-modules", help="don't remove the FTPR " |
| 500 | "modules, even when possible", action="store_true") |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 501 | bw_list.add_argument("-w", "--whitelist", metavar="whitelist", |
| 502 | help="Comma separated list of additional partitions " |
| 503 | "to keep in the final image. This can be used to " |
| 504 | "specify the MFS partition for example, which stores " |
| 505 | "PCIe and clock settings.") |
| 506 | bw_list.add_argument("-b", "--blacklist", metavar="blacklist", |
| 507 | help="Comma separated list of partitions to remove " |
| 508 | "from the image. This option overrides the default " |
| 509 | "removal list.") |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 510 | parser.add_argument("-d", "--descriptor", help="remove the ME/TXE " |
| 511 | "Read/Write permissions to the other regions on the " |
| 512 | "flash from the Intel Flash Descriptor (requires a " |
| 513 | "full dump)", action="store_true") |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 514 | parser.add_argument("-D", "--extract-descriptor", |
| 515 | metavar='output_descriptor', help="extract the flash " |
| 516 | "descriptor from a full dump; when used with " |
| 517 | "--truncate save a descriptor with adjusted regions " |
| 518 | "start and end") |
| 519 | parser.add_argument("-M", "--extract-me", metavar='output_me_image', |
| 520 | help="extract the ME firmware from a full dump; when " |
| 521 | "used with --truncate save a truncated ME/TXE image") |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 522 | parser.add_argument("-c", "--check", help="verify the integrity of the " |
| 523 | "fundamental parts of the firmware and exit", |
| 524 | action="store_true") |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 525 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 526 | args = parser.parse_args() |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 527 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 528 | if args.check and (args.soft_disable_only or args.soft_disable or |
| 529 | args.relocate or args.descriptor or args.truncate or args.output): |
| 530 | sys.exit("-c can't be used with -S, -s, -r, -d, -t or -O") |
| 531 | |
| 532 | if args.soft_disable_only and (args.relocate or args.truncate): |
| 533 | sys.exit("-s can't be used with -r or -t") |
| 534 | |
| 535 | if (args.whitelist or args.blacklist) and args.relocate: |
| 536 | sys.exit("Relocation is not yet supported with custom whitelist or " |
| 537 | "blacklist") |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 538 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 539 | f = open(args.file, "rb" if args.check or args.output else "r+b") |
| 540 | f.seek(0x10) |
| 541 | magic = f.read(4) |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 542 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 543 | if magic == b"$FPT": |
| 544 | print("ME/TXE image detected") |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 545 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 546 | if args.descriptor or args.extract_descriptor or args.extract_me or \ |
| 547 | args.soft_disable or args.soft_disable_only: |
| 548 | sys.exit("-d, -D, -M, -S and -s require a full dump") |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 549 | |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 550 | f.seek(0, 2) |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 551 | me_start = 0 |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 552 | me_end = f.tell() |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 553 | mef = RegionFile(f, me_start, me_end) |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 554 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 555 | elif magic == b"\x5a\xa5\xf0\x0f": |
| 556 | print("Full image detected") |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 557 | |
| 558 | if args.truncate and not args.extract_me: |
| 559 | sys.exit("-t requires a separated ME/TXE image (or --extract-me)") |
| 560 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 561 | f.seek(0x14) |
| 562 | flmap0, flmap1 = unpack("<II", f.read(8)) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 563 | frba = flmap0 >> 12 & 0xff0 |
| 564 | fmba = (flmap1 & 0xff) << 4 |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 565 | fpsba = flmap1 >> 12 & 0xff0 |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 566 | |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 567 | f.seek(frba) |
| 568 | flreg = unpack("<III", f.read(12)) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 569 | |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 570 | fd_start, fd_end = flreg_to_start_end(flreg[0]) |
| 571 | bios_start, bios_end = flreg_to_start_end(flreg[1]) |
| 572 | me_start, me_end = flreg_to_start_end(flreg[2]) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 573 | |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 574 | if me_start >= me_end: |
| 575 | sys.exit("The ME/TXE region in this image has been disabled") |
| 576 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 577 | mef = RegionFile(f, me_start, me_end) |
| 578 | |
| 579 | mef.seek(0x10) |
| 580 | if mef.read(4) != b"$FPT": |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 581 | sys.exit("The ME/TXE region is corrupted or missing") |
| 582 | |
| 583 | print("The ME/TXE region goes from {:#x} to {:#x}" |
| 584 | .format(me_start, me_end)) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 585 | else: |
| 586 | sys.exit("Unknown image") |
| 587 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 588 | end_addr = me_end |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 589 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 590 | print("Found FPT header at {:#x}".format(mef.region_start + 0x10)) |
| 591 | |
| 592 | mef.seek(0x14) |
| 593 | entries = unpack("<I", mef.read(4))[0] |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 594 | print("Found {} partition(s)".format(entries)) |
| 595 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 596 | mef.seek(0x30) |
| 597 | partitions = mef.read(entries * 0x20) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 598 | |
| 599 | ftpr_header = b"" |
| 600 | |
| 601 | for i in range(entries): |
| 602 | if partitions[i * 0x20:(i * 0x20) + 4] == b"FTPR": |
| 603 | ftpr_header = partitions[i * 0x20:(i + 1) * 0x20] |
| 604 | break |
| 605 | |
| 606 | if ftpr_header == b"": |
| 607 | sys.exit("FTPR header not found, this image doesn't seem to be valid") |
| 608 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 609 | ftpr_offset, ftpr_length = unpack("<II", ftpr_header[0x08:0x10]) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 610 | print("Found FTPR header: FTPR partition spans from {:#x} to {:#x}" |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 611 | .format(ftpr_offset, ftpr_offset + ftpr_length)) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 612 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 613 | mef.seek(ftpr_offset) |
| 614 | if mef.read(4) == b"$CPD": |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 615 | me11 = True |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 616 | num_entries = unpack("<I", mef.read(4))[0] |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 617 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 618 | mef.seek(ftpr_offset + 0x10) |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 619 | ftpr_mn2_offset = -1 |
| 620 | |
| 621 | for i in range(0, num_entries): |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 622 | data = mef.read(0x18) |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 623 | name = data[0x0:0xc].rstrip(b"\x00").decode("ascii") |
| 624 | offset = unpack("<I", data[0xc:0xf] + b"\x00")[0] |
| 625 | |
| 626 | if name == "FTPR.man": |
| 627 | ftpr_mn2_offset = offset |
| 628 | break |
| 629 | |
| 630 | if ftpr_mn2_offset >= 0: |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 631 | check_mn2_tag(mef, ftpr_offset + ftpr_mn2_offset) |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 632 | print("Found FTPR manifest at {:#x}" |
| 633 | .format(ftpr_offset + ftpr_mn2_offset)) |
| 634 | else: |
| 635 | sys.exit("Can't find the manifest of the FTPR partition") |
| 636 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 637 | else: |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 638 | check_mn2_tag(mef, ftpr_offset) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 639 | me11 = False |
| 640 | ftpr_mn2_offset = 0 |
| 641 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 642 | mef.seek(ftpr_offset + ftpr_mn2_offset + 0x24) |
| 643 | version = unpack("<HHHH", mef.read(0x08)) |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 644 | print("ME/TXE firmware version {}" |
| 645 | .format('.'.join(str(i) for i in version))) |
| 646 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 647 | mef.seek(ftpr_offset + ftpr_mn2_offset + 0x80) |
| 648 | pubkey_md5 = hashlib.md5(mef.read(0x104)).hexdigest() |
| 649 | |
| 650 | if pubkey_md5 in pubkeys_md5: |
| 651 | variant, pubkey_versions = pubkeys_md5[pubkey_md5] |
| 652 | print("Public key match: Intel {}, firmware versions {}" |
| 653 | .format(variant, ", ".join(pubkey_versions))) |
| 654 | else: |
| 655 | if version[0] >= 6: |
| 656 | variant = "ME" |
| 657 | else: |
| 658 | variant = "TXE" |
| 659 | print("WARNING Unknown public key {}\n" |
| 660 | " Assuming Intel {}\n" |
| 661 | " Please report this warning to the project's maintainer!" |
| 662 | .format(pubkey_md5, variant)) |
| 663 | |
| 664 | if not args.check and args.output: |
| 665 | f.close() |
| 666 | shutil.copy(args.file, args.output) |
| 667 | f = open(args.output, "r+b") |
| 668 | |
| 669 | mef = RegionFile(f, me_start, me_end) |
| 670 | |
| 671 | if me_start > 0: |
| 672 | fdf = RegionFile(f, fd_start, fd_end) |
| 673 | |
| 674 | if me11: |
| 675 | fdf.seek(fpsba) |
| 676 | pchstrp0 = unpack("<I", fdf.read(4))[0] |
| 677 | print("The HAP bit is " + |
| 678 | ("SET" if pchstrp0 & 1 << 16 else "NOT SET")) |
| 679 | else: |
| 680 | fdf.seek(fpsba + 0x28) |
| 681 | pchstrp10 = unpack("<I", fdf.read(4))[0] |
| 682 | print("The AltMeDisable bit is " + |
| 683 | ("SET" if pchstrp10 & 1 << 7 else "NOT SET")) |
| 684 | |
| 685 | # ME 6 Ignition: wipe everything |
| 686 | me6_ignition = False |
| 687 | if not args.check and not args.soft_disable_only and \ |
| 688 | variant == "ME" and version[0] == 6: |
| 689 | mef.seek(ftpr_offset + 0x20) |
| 690 | num_modules = unpack("<I", mef.read(4))[0] |
| 691 | mef.seek(ftpr_offset + 0x290 + (num_modules + 1) * 0x60) |
| 692 | data = mef.read(0xc) |
| 693 | |
| 694 | if data[0x0:0x4] == b"$SKU" and data[0x8:0xc] == b"\x00\x00\x00\x00": |
| 695 | print("ME 6 Ignition firmware detected, removing everything...") |
| 696 | mef.fill_all(b"\xff") |
| 697 | me6_ignition = True |
| 698 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 699 | if not args.check: |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 700 | if not args.soft_disable_only and not me6_ignition: |
| 701 | print("Reading partitions list...") |
| 702 | unremovable_part_fpt = b"" |
| 703 | extra_part_end = 0 |
| 704 | whitelist = [] |
| 705 | blacklist = [] |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 706 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 707 | whitelist += unremovable_partitions |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 708 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 709 | if args.blacklist: |
| 710 | blacklist = args.blacklist.split(",") |
| 711 | elif args.whitelist: |
| 712 | whitelist += args.whitelist.split(",") |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 713 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 714 | for i in range(entries): |
| 715 | partition = partitions[i * 0x20:(i + 1) * 0x20] |
| 716 | flags = unpack("<I", partition[0x1c:0x20])[0] |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 717 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 718 | try: |
| 719 | part_name = \ |
| 720 | partition[0x0:0x4].rstrip(b"\x00").decode("ascii") |
| 721 | except UnicodeDecodeError: |
| 722 | part_name = "????" |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 723 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 724 | part_start, part_length = unpack("<II", partition[0x08:0x10]) |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 725 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 726 | # ME 6: the last partition has 0xffffffff as size |
| 727 | if variant == "ME" and version[0] == 6 and \ |
| 728 | i == entries - 1 and part_length == 0xffffffff: |
| 729 | part_length = me_end - me_start - part_start |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 730 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 731 | part_end = part_start + part_length |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 732 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 733 | if flags & 0x7f == 2: |
| 734 | print(" {:<4} ({:^24}, 0x{:08x} total bytes): nothing to " |
| 735 | "remove" |
| 736 | .format(part_name, "NVRAM partition, no data", |
| 737 | part_length)) |
| 738 | elif part_start == 0 or part_length == 0 or part_end > me_end: |
| 739 | print(" {:<4} ({:^24}, 0x{:08x} total bytes): nothing to " |
| 740 | "remove" |
| 741 | .format(part_name, "no data here", part_length)) |
| 742 | else: |
| 743 | print(" {:<4} (0x{:08x} - 0x{:09x}, 0x{:08x} total bytes): " |
| 744 | .format(part_name, part_start, part_end, part_length), |
| 745 | end="") |
| 746 | if part_name in whitelist or (blacklist and |
| 747 | part_name not in blacklist): |
| 748 | unremovable_part_fpt += partition |
| 749 | if part_name != "FTPR": |
| 750 | extra_part_end = max(extra_part_end, part_end) |
| 751 | print("NOT removed") |
| 752 | else: |
| 753 | mef.fill_range(part_start, part_end, b"\xff") |
| 754 | print("removed") |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 755 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 756 | print("Removing partition entries in FPT...") |
| 757 | mef.write_to(0x30, unremovable_part_fpt) |
| 758 | mef.write_to(0x14, |
| 759 | pack("<I", len(unremovable_part_fpt) // 0x20)) |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 760 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 761 | mef.fill_range(0x30 + len(unremovable_part_fpt), |
| 762 | 0x30 + len(partitions), b"\xff") |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 763 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 764 | if (not blacklist and "EFFS" not in whitelist) or \ |
| 765 | "EFFS" in blacklist: |
| 766 | print("Removing EFFS presence flag...") |
| 767 | mef.seek(0x24) |
| 768 | flags = unpack("<I", mef.read(4))[0] |
| 769 | flags &= ~(0x00000001) |
| 770 | mef.write_to(0x24, pack("<I", flags)) |
| 771 | |
| 772 | if me11: |
| 773 | mef.seek(0x10) |
| 774 | header = bytearray(mef.read(0x20)) |
| 775 | header[0x0b] = 0x00 |
| 776 | else: |
| 777 | mef.seek(0) |
| 778 | header = bytearray(mef.read(0x30)) |
| 779 | header[0x1b] = 0x00 |
| 780 | checksum = (0x100 - sum(header) & 0xff) & 0xff |
| 781 | |
| 782 | print("Correcting checksum (0x{:02x})...".format(checksum)) |
| 783 | # The checksum is just the two's complement of the sum of the first |
| 784 | # 0x30 bytes in ME < 11 or bytes 0x10:0x30 in ME >= 11 (except for |
| 785 | # 0x1b, the checksum itself). In other words, the sum of those |
| 786 | # bytes must be always 0x00. |
| 787 | mef.write_to(0x1b, pack("B", checksum)) |
| 788 | |
| 789 | print("Reading FTPR modules list...") |
| 790 | if me11: |
| 791 | end_addr, ftpr_offset = \ |
| 792 | check_and_remove_modules_me11(mef, me_end, |
| 793 | ftpr_offset, ftpr_length, |
| 794 | min_ftpr_offset, |
| 795 | args.relocate, |
| 796 | args.keep_modules) |
| 797 | else: |
| 798 | end_addr, ftpr_offset = \ |
| 799 | check_and_remove_modules(mef, me_end, ftpr_offset, |
| 800 | min_ftpr_offset, args.relocate, |
| 801 | args.keep_modules) |
| 802 | |
| 803 | if end_addr > 0: |
| 804 | end_addr = max(end_addr, extra_part_end) |
| 805 | end_addr = (end_addr // 0x1000 + 1) * 0x1000 |
| 806 | end_addr += spared_blocks * 0x1000 |
| 807 | |
| 808 | print("The ME minimum size should be {0} bytes " |
| 809 | "({0:#x} bytes)".format(end_addr)) |
| 810 | |
| 811 | if me_start > 0: |
| 812 | print("The ME region can be reduced up to:\n" |
| 813 | " {:08x}:{:08x} me" |
| 814 | .format(me_start, me_start + end_addr - 1)) |
| 815 | elif args.truncate: |
| 816 | print("Truncating file at {:#x}...".format(end_addr)) |
| 817 | f.truncate(end_addr) |
| 818 | |
| 819 | if args.soft_disable or args.soft_disable_only: |
| 820 | if me11: |
| 821 | print("Setting the HAP bit in PCHSTRP0 to disable Intel ME...") |
| 822 | pchstrp0 |= (1 << 16) |
| 823 | fdf.write_to(fpsba, pack("<I", pchstrp0)) |
| 824 | else: |
| 825 | print("Setting the AltMeDisable bit in PCHSTRP10 to disable " |
| 826 | "Intel ME...") |
| 827 | pchstrp10 |= (1 << 7) |
| 828 | fdf.write_to(fpsba + 0x28, pack("<I", pchstrp10)) |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 829 | |
| 830 | if args.descriptor: |
| 831 | print("Removing ME/TXE R/W access to the other flash regions...") |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 832 | if me11: |
| 833 | flmstr2 = 0x00400500 |
| 834 | else: |
| 835 | fdf.seek(fmba + 0x4) |
| 836 | flmstr2 = (unpack("<I", fdf.read(4))[0] | 0x04040000) & 0x0404ffff |
| 837 | |
| 838 | fdf.write_to(fmba + 0x4, pack("<I", flmstr2)) |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 839 | |
| 840 | if args.extract_descriptor: |
| 841 | if args.truncate: |
| 842 | print("Extracting the descriptor to \"{}\"..." |
| 843 | .format(args.extract_descriptor)) |
| 844 | fdf_copy = fdf.save(args.extract_descriptor, fd_end - fd_start) |
| 845 | |
| 846 | if bios_start == me_end: |
| 847 | print("Modifying the regions of the extracted descriptor...") |
| 848 | print(" {:08x}:{:08x} me --> {:08x}:{:08x} me" |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 849 | .format(me_start, me_end - 1, |
| 850 | me_start, me_start + end_addr - 1)) |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 851 | print(" {:08x}:{:08x} bios --> {:08x}:{:08x} bios" |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 852 | .format(bios_start, bios_end - 1, |
| 853 | me_start + end_addr, bios_end - 1)) |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 854 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 855 | flreg1 = start_end_to_flreg(me_start + end_addr, bios_end) |
| 856 | flreg2 = start_end_to_flreg(me_start, me_start + end_addr) |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 857 | |
| 858 | fdf_copy.seek(frba + 0x4) |
| 859 | fdf_copy.write(pack("<II", flreg1, flreg2)) |
| 860 | else: |
| 861 | print("\nWARNING:\n The start address of the BIOS region " |
| 862 | "isn't equal to the end address of the ME\n region: if " |
| 863 | "you want to recover the space from the ME region you " |
| 864 | "have to\n manually modify the descriptor.\n") |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 865 | else: |
| 866 | print("Extracting the descriptor to \"{}\"..." |
| 867 | .format(args.extract_descriptor)) |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 868 | fdf_copy = fdf.save(args.extract_descriptor, fd_end - fd_start) |
| 869 | |
| 870 | fdf_copy.close() |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 871 | |
| 872 | if args.extract_me: |
| 873 | if args.truncate: |
| 874 | print("Extracting and truncating the ME image to \"{}\"..." |
| 875 | .format(args.extract_me)) |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 876 | mef_copy = mef.save(args.extract_me, end_addr) |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 877 | else: |
| 878 | print("Extracting the ME image to \"{}\"..." |
| 879 | .format(args.extract_me)) |
| 880 | mef_copy = mef.save(args.extract_me, me_end - me_start) |
| 881 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 882 | if not me6_ignition: |
| 883 | print("Checking the FTPR RSA signature of the extracted ME " |
| 884 | "image... ", end="") |
| 885 | print_check_partition_signature(mef_copy, |
| 886 | ftpr_offset + ftpr_mn2_offset) |
Nicola Corna | 98f3034 | 2017-08-08 21:24:49 +0200 | [diff] [blame] | 887 | mef_copy.close() |
| 888 | |
Nicola Corna | 8882ac5 | 2018-03-31 16:25:03 +0200 | [diff] [blame] | 889 | if not me6_ignition: |
| 890 | print("Checking the FTPR RSA signature... ", end="") |
| 891 | print_check_partition_signature(mef, ftpr_offset + ftpr_mn2_offset) |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 892 | |
Nicola Corna | e38f859 | 2017-02-22 10:16:32 +0100 | [diff] [blame] | 893 | f.close() |
| 894 | |
| 895 | if not args.check: |
Nicola Corna | 9bcc002 | 2017-01-23 15:28:24 +0100 | [diff] [blame] | 896 | print("Done! Good luck!") |