All information is provided for educational purposes only. Follow these instructions at your own risk. Neither the authors nor their employer are responsible for any direct or consequential damage or loss arising from any person or organization acting or failing to act on the basis of information contained in this page.
Introduction
Required Software
Generating the Payload
Generating the Unlock Token
Preparing the SPI Flash Image
Integrating Files Into the Firmware Image
Disabling OEM Signing
Building the Firmware Image
BringUP Main CPU
Writing the Image to SPI Flash
Preparing the USB Debug Cable
Patching OpenIPC Configuration Files
Decrypting OpenIPC Configuration Files
Adding LMT Core to the Configuration
Setting the IPC_PATH Environment Variable
Performing an Initial Check of JTAG Operability
Show CPU ME Thread
Halting Cores
ME Debugging: Quick Start
Reading Arbitrary Memory
Reading ROM
Why TXE?
Tested Platforms List
Authors
License
Vulnerability INTEL-SA-00086 allows to activate JTAG for Intel Management Engine core. We developed our JTAG PoC for the Gigabyte Brix GP-BPCE-3350C platform. Although we recommend that would-be researchers use the same platform, other manufacturers' platforms with the Intel Apollo Lake chipset should support the PoC as well (for TXE version 3.0.1.1107).
Because the Gigabyte Brix GP-BPCE-3350C is no longer widely commercially available, these instructions have been updated to instead target the AAEON UP Squared SKU UPS-APLX7-A20-0864 (Intel Atom® x7-E3950). If you purchase this board, make sure to also get the power supply, serial adapter, and any USB-to-serial adapter. Additionally, the UP Squared only needs a basic USB debug cable to perform DCI debugging. The USB debug cable should be connected to the port where the yellow USB cable is shown here.
Vulnerability INTEL-SA-00086 involves a buffer overflow when handling a file stored on MFS (the internal ME file system). The full file path is /home/bup/ct. You will need to integrate a vulnerability-exploiting version of this file into the ME firmware by using Intel Flash Image Tool (FIT), one of the Intel System Tools provided by Intel to OEMs of hardware based on Intel PCH chipsets.
The Intel ME (TXE, SPS) System Tools utilities are not intended for end users—so you cannot find them on the official Intel website. However, some OEMs publish them as part of software updates together with device drivers. So, for integrating our PoC you need "CSTXE System Tools v3", which can be found here.
You need to install Intel System Studio for performing JTAG debugging. In our original experiments, we used Intel System Studio 2018. These instructions have been updated for Intel System Studio 2020 which can be obtained from here.
The PoC targets Intel TXE firmware version 3.0.1.1107. The "CSTXE 3.0" image repository at Win-Raid forums contains the necessary TXE firmware version.
All our scripts are written on Python. We recommend using Python 2.7 Also the scripts require pycrypto packet. To install pycrypto, run the following command:
pip install pycrypto
While the purpose of this guide is to enable JTAG debugging in the ME via an exploit, it is a good practice to first sanity check and make sure you can perform normal JTAG debugging of the UP Squared board via DCI. AAEON no longer ships their BIOSes with DCI enabled, as they stated on their forums that this led to instability. (And older versions of the BIOS before v5.0 that had DCI enabled will no longer work with newer hardware, due to a DRAM vendor hardware change.) Therefore, to enable DCI JTAG on the UP Squared, you must perform 3 steps:
- Perform the binary patching described by Satoshi Tanda here (although it should say to use UEFITool 0.28 not 2.8).
- Enable DCI through the BIOS configuration menu by pressing F7 at boot, entering the default UP password (upassw0rd), from the Main menu, going down to "CRB Setup" -> "CSB Chipset" -> "South Cluster Configuration" -> "Miscellaneous Configuration" -> "DCI Enable (HDCIEN)" and setting it to enabled. Then exit the BIOS setup menu, save the configuration change, and reboot the system.
- Open "C:\IntelSWTools\system_studio_2020\system_debugger_2020\target_indicator\bin\TargetIndicator.exe" and confirm that when you have that system plugged in to the UP Squared via the debug cable, that there is displayed a blue indicator that DCI is possible such as the below:
You can then launch ":\Program Files (x86)\IntelSWTools\sw_dev_tools\system_debugger_2020\system_debug_legacy\xdb.bat", connect to the target, and break into it, and single step to confirm you have baseline debugging capabilities.
(You can also follow the blog series by Alan Sguigna here on how to build the Debug-build of the open source code for this platform, which will be DCI-debuggable from the reset vector. However, note that due to a hardware change for DRAM, this built-from-source code will no longer fully boot on new hardware - it will instead hang at boot time as noted here. Intel TianoCore maintainers have refused to fix this.)
Run the script me_exp_bxtp.py:
me_exp_bxtp.py -f <file_name>
The script generates the necessary data and exports it to the specified file (indicate either the full file path or, within the current directory, simply a name, ct.bin by default). This file will be used later by FIT.
Run the script utock_gen.py:
utock_gen.py -f <file_name>
The script generates the necessary data and exports it to the specified file (indicate either the full file path or, within the current directory, simply a name, utok.bin by default). This file will be used later by FIT.
To integrate the ct.bin and utok.bin files, run the FIT utility (fit.exe) obtained from CSTXE System Tools v3. First use it to open your UP Squared BIOS image that has been DCI enabled (e.g. "UPA1AM61_DCI_Enabled.bin")
FIT extracts different sections of the overall SPI image (SPI descriptor, UEFI/BIOS firmware, Intel ME firmware, and Unlock Token) when the image is opened and saves them in the folder "image_name"/Decomp in the same local directory as FIT.
After doing this, save the configuration XML (e.g. to "UPA1AM61_DCI_Enabled.xml") and exit fit.exe.
In order to downgrade the Intel TXE firmware to the vulnerable version 3.0.1.1107, we need to replace the file /Decomp/TXE Region.bin, with the file "3.0.1.1107_B_PRD_RGN.bin". This should be done by renaming the original file to "TXE Region.bin.orig" and then naming "3.0.1.1107_B_PRD_RGN.bin" to "TXE Region.bin".
Re-open fit.exe and re-load your configuration from your saved XML file. If you replaced the file on the filesystem correctly, in the "Intel(R) TXE Binary File" on the Flash Layout tab you should see the version displayed as 3.0.1.1107 instead of whatever it originally came with:
Now we need to indicate in FIT the files we generated for /home/bup/ct (ct.bin) and Unlock Token (utok.bin). On the Debug tab in FIT, you can specify the Trace Hub Binary and Unlock Token to integrate into the firmware. These should be the files that we generated already.
There will be an OEM Public key hash under the Platform Protection tab. Remove it by entering 32 zeros:
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Select Build Settings
By default it will look like the following:
Update it change the outimage.bin to the same name as your input file. Also set the "Enable Boot Guard warning message at build time" to No,
and "Verify manifest signing keys against the OEM Key Manifest" to No. It should then look like the following:
Build the image by selecting Build Image in the Build menu.
If everything has been done correctly up to this point, the build process should be successful and FIT outputs something like the following console message:
You have to activate HAP mode for this exploit to work. Bit index 0 of the byte at the offset +0x102 should be manually set to 1 via a hex editor in the output file that was built by fit.exe:
At the end of the process you should have a file similar to the example file provided here, although that is for UP BIOS version 5.2, and the preceeding instructions are for version 6.1.
To write the image to SPI flash, we highly recommend using an SPI programmer (such as the Dediprog SF600Plus).
Be sure to back up the original firmware so you can restore from it if something goes wrong!
You will need a USB 3.0 debug cable to connect to the platform. Either buy one specially made for the purpose or hack together your own from a USB 3.0 AM–AM cable by isolating the D+, D-, and Vcc contacts.
Intel develops and provides users with two software packages that can be used for JTAG debugging of platforms and the main CPU: DAL (DFx Abstraction Layer) and OpenIPC. Both DAL and OpenIPC are part of Intel System Studio. After installation of Intel System Studio 2020, OpenIPC appears in the following directory:
Windows
C:\IntelSWTools\system_studio_2020\tools\OpenIPC_1.2035.4868.100
The OpenIPC configuration is encrypted and does not support the TXE core. So decrypt the configuration and add a TXE description to it.
To decrypt the configuration files, extract the key from the StructuredData library (StructuredData_x64.dll) in OpenIPC/Bin using the IDA Pro script openipc_key_extract.py. If the script does not work, you can simply open the file in IDA Pro, and search for the string "Logging.xml" and then get the 16 bytes after that after the next alignment. (There will be 4 extra bytes, and then 4 zeros after the 16 bytes you care about.) Pass the key (in our case, F820AD4F6CC2E9EE050C43DEBF631F59) to the script config_decryptor.py with path to the OpenIPC directory.
config_decryptor.py –k F820AD4F6CC2E9EE050C43DEBF631F59 –p C:\IntelSWTools\system_studio_2020\tools\OpenIPC_1.2035.4868.100
The supplied version of OpenIPC does not have the necessary information about the TXE core. So we need to apply a patch (patch.diff) to the decrypted OpenIPC configuration files. Here's how to do it:
patch -p2 < patch.diff
After decryption and patching, set the IPC_PATH environment variable to the new OpenIPC directory so that ipccli uses the modified OpenIPC version. For instance:
Windows
set IPC_PATH=C:\IntelSWTools\system_studio_2020\tools\OpenIPC_1.2035.4868.100\Bin
The activator blocks subsequent loading by keeping the BUP process in a loop after JTAG is activated. After launch, the platform will not show any signs of life (the monitor does not turn on, keyboard indicators do not light up, and no BIOS POST sound is played). So you will need to check via DCI debugging that the platform has gotten "stuck" in the BUP module.
Like DAL, the OpenIPC library includes a command-line interface (CLI), written in Python and provided as a library for Python as part of Intel System Studio, which can be installed on the system with the help of pip. The installation package for ipccli is at the following path: Windows
C:\IntelSWTools\system_studio_2020\system_debugger_2020\debugger\ipccli\ipccli-1.2035.1920.100-py2.py3-none-any.whl
To install ipccli, run the following console command:
pip install ipccli-1.2035.1920.100-py2.py3-none-any.whl
Once installed, ipccli is available within the runtime of the corresponding Python version (the one from which pip was invoked). To get started with OpenIPC, run the following commands in the Python console from an Administrator command prompt:
import ipccli
ipc = ipccli.baseaccess()
The mechanism for connecting to the target platform via DCI launches, resulting in the following console output:
When no connection is established—for example, if the platform is not powered on or is not physically connected via DCI—messages will resemble the following:
If DCI connection is successful, make sure that the PERSONALITY register of the DFX_AGGRAGATOR device equals 3. The PERSONALITY register has an IR (Instruction Register) code of 0x54. To read it, run the following commands:
dfx_agg = ipc.devs.mdu_dfx_agg_tap0
ipc.irdrscan(dfx_agg, 0x54, 32)
Here is what the result of that command should look like:
The ipccli utility comes with rather detailed HTML documentation, which can be found in a folder of the ipccli Python package:
<Python Dir>\Lib\site-packages\ipccli\html\Index.html
If the previous steps have been performed correctly, when a connection to the platform is made via ipccli, the TXE core is accessible via CSE Tap and ipccli allows accessing it by applying the following ipccli path:
ipc.devs.cse_c0.threads[0]
But since the PoC blocks loading of the platform until the main CPU is initialized, its cores are inaccessible via JTAG and the ME core can be accessed via the following command:
ipc.threads[0]
To halt ME processor instructions, run the following command:
me = ipc.devs.cse_c0.threads[0]
me.halt()
To halt CPU processor instructions, run the following command:
core = ipc.threads[0]
core.halt()
The console displays the logical address of the instruction at which the halt was made.
OpenIPC allows reading memory after the halt, for example:
ipc.threads[0].mem("0xf0080004P", 4)
You can specify a logical address (sel:offset), linear address (L modifier), or physical address (P modifier).
The ME system agent (MISA) allows getting the initial physical address of the ROM region, which includes the ME reset vector. You can get the ROM address via the Hunit ROM Memory Base (HROMMB) register at offset 0xe20 MISA MMIO (0xf0000000P):
ROM always resides from ROMBASE to 0xffffffff To copy the ROM to a file, run the following command:
ipc.threads[0].memsave("<file path>", "0xfffe0000p", 0x20001)
It is important to specify the size as 0x20001, as opposed to 0x20000 (otherwise OpenIPC runs into issues due to problems with 64-bit access, which is not possible for the 32-bit ME core). The last byte of the file can be thrown out, since it is not part of the ROM.
The platform gives more opportunities for debugging without a special Intel CCA-SVT adapter and allows debugging the earliest stages of the TXE core via an ordinary USB debug cable.
Intel ME: The Way of the Static Analysis
Intel ME: Flash File System Explained
How to Hack a Turned-Off Computer or Running Unsigned Code in Intel Management Engine
Inside Intel Management Engine
Disabling Intel ME 11 via undocumented mode
- Gigabyte Mini-PC Barebone (BRIX) GB-BPCE-3350C (rev:1.1, 1.2)
- Beelink M1
- MinisForum N33 Mini PC - 2021
- UP Squared Intel Atom® x7-E3950 SKU UPS-APLX7-A20-0864 - 2022
- UP 4000 Intel Atom® x7-E3950 SKU UP-APL03X7F-A10-0464 - 2022
Mark Ermolov (@_markel___)
Maxim Goryachy (@h0t_max)
Xeno Kovah (@XenoKovah)
Mark Ermolov (@_markel___)
Maxim Goryachy (@h0t_max)
Dmitry Sklyarov (@_Dmit)
Copyright (c) 2018 Mark Ermolov, Maxim Goryachy at Positive Technologies
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.