platomav / meanalyzer

Intel Engine & Graphics Firmware Analysis Tool

ME Analyzer

Intel Engine & Graphics Firmware Analysis Tool

ME Analyzer News Feed

ME Analyzer Discussion Topic

Intel Engine/Graphics/Independent Firmware Introduction

Intel Engine/Graphics/Independent Firmware Repositories

A. About ME Analyzer

ME Analyzer is a tool which parses Intel Engine, Intel Graphics and their Independent firmware from the following families:

• (Converged Security) Management Engine - CS(ME)
  • ME 2-10
  • CSME 11-15
• (Converged Security) Trusted Execution Engine - (CS)TXE
  • TXE 0-2
  • CSTXE 3-4
• (Converged Security) Server Platform Services - (CS)SPS
  • SPS 1-3
  • CSSPS 4-5 (BA, HA, ME, PU)
• Graphics System Controller - GSC
  • GSC 100 (DG1)
• Power Management Controller - PMC
  • PMC APL-MCC
• Platform Controller Hub Configuration - PCHC
  • PCHC ICP-MCC
• USB Type C Physical - PHY
  • PHY ICP-TGP
• Graphics Option ROM - OROM
  • OROM DG1

It can be used by end-users who are looking for all relevant firmware information such as Family, Version, Release, Type, Date, SKU, Platform, Size, Health Status etc. ME Analyzer is also a powerful Engine / Graphics / Independent firmware research analysis tool with multiple structures which allow, among others, full parsing and unpacking of Converged Security Engine (CSE) & Graphics System Controller (GSC) Code and File Systems such as:

• Flash Partition Table - FPT
• Boot Partition Descriptor Table - BPDT/IFWI
• CSE Layout Table - LT
• CSE File Table - FTBL/EFST
• CSE Virtual File System - VFS
• GSC OROM-PCIR - VBT/EFI

Moreover, with the help of its extensive databases, ME Analyzer is capable of uniquely identifying and categorizing all supported Engine / Graphics / Independent firmware as well as check for any firmware which have not been stored at the equivalent, community supported, Firmware Repositories yet.

A1. ME Analyzer Features

• Supports Engine/Graphics firmware Families ME 2-15, TXE 0-4, SPS 1-5 and GSC 100
• Supports CSE/GSC Independent (IUP) firmware Families PMC, PCHC, PHY and OROM/VBT
• Detection of Firmware Details (Family, Version, SKU, Date, Platform etc)
• Detection of Firmware Release (Production, Pre-Production, ROM-Bypass etc)
• Detection of Firmware Type (Region, Extracted, Update etc)
• Detection of Firmware Security/Update Version Numbers (SVN, VCN etc)
• Detection of Power Management Controller (PMC) Independent firmware info
• Detection of PCH Configuration (PCHC) Independent firmware info
• Detection of USB Type C Physical (PHY) Independent firmware info
• Detection of Graphics Option ROM (OROM) Independent firmware info
• Ability to fully unpack all supported CSE, GSC and/or IUP firmware
• Ability to validate Engine/Graphics/IUP RSA Signature and Checksums
• Advanced detection & validation of Engine/Graphics/IUP firmware Size
• Ability to detect & analyze Integrated Firmware Images (IFWI/BPDT)
• Ability to analyze multiple files by drag & drop or by input path
• Ability to detect & categorize any firmware which require attention
• Ability to automatically scan for newer ME Analyzer & Database releases
• Reports firmware which are not found at the Engine/Graphics/IUP Repositories
• Reports new, unknown, problematic, incomplete etc Engine/Graphics/IUP firmware
• Features command line parameters to enhance functionality & assist research
• Features user friendly messages & proper handling of unexpected code errors
• Shows colored text to signify the importance of notes, warnings & errors
• Open Source project under BSD permissive license, comment assisted code

A2. Engine Firmware Repository Database

ME Analyzer allows end-users and/or researchers to quickly analyze and/or report new firmware versions without the use of special Intel tools (FIT/FITC, FWUpdate) or Hex Editors. To do that effectively, a database had to be built. The Intel Engine/Graphics/Independent Firmware Repositories is a collection of every (CS)ME, (CS)TXE, (CS)SPS, GSC, PMC, PCHC, PHY & OROM firmware we have found. Its existence is very important for ME Analyzer as it allows us to continue doing research, find new types of firmware, compare same major version releases for similarities etc. Bundled with ME Analyzer is a file called MEA.dat which is required for the program to run. It includes entries for all Engine / Graphics / Independent firmware that are available to us. This accommodates primarily two actions: a) Detect each firmware's Family via unique identifier keys and b) Help find new Engine firmware sooner by reporting them at the Intel Engine/Graphics/Independent Firmware Repositories thread.

A3. Supported Engine Firmware Families/Versions

(CS)ME	(CS)TXE	(CS)SPS	GSC	PMC	PCHC	PHY	OROM
2	0	1	100	APL	ICP	ICP	DG1
3	1	2	-	BXT	LKF	LKF	-
4	2	3	-	GLK	JSP	CMP	-
5	3	4 (BA, HA, PU)	-	CNP	CMP	TGP	-
6	4	5 (ME)	-	ICP	TGP	DG1	-
7	-	-	-	LKF	MCC	-	-
8	-	-	-	JSP	-	-	-
9	-	-	-	CMP	-	-	-
10	-	-	-	TGP	-	-	-
11	-	-	-	MCC	-	-	-
12	-	-	-	DG1	-	-	-
13 (0, 30, 50)	-	-	-	-	-	-	-
14 (0, 1, 5)	-	-	-	-	-	-	-
15 (0, 40)	-	-	-	-	-	-	-

Any Intel Engine/Graphics/Independent family and/or version which is not listed above, is not supported. There are no plans to add support for other Intel Engine/Graphics/Independent firmware at this point.

B. How to use ME Analyzer

There are two ways to use ME Analyzer, MEA script & command prompt. The MEA script allows you to input or drag & drop one or more firmware and analyze them one by one or recursively scan entire directories. To manually use ME Analyzer, a command prompt can be used with -skip as parameter.

B1. ME Analyzer Script

To use ME Analyzer, select one or multiple files and input or Drag & Drop them to its script. You can also input certain optional parameters either by running MEA directly or by first dropping one or more files to it. Keep in mind that, due to operating system limitations, there is a limit on how many files can be dropped at once. If the latter is a problem, you can always use the -mass parameter to recursively scan entire directories, as explained below.

B2. ME Analyzer Parameters

There are various parameters which enhance or modify the default behavior of ME Analyzer:

• -? : Displays help & usage screen
• -skip : Skips welcome & options screen
• -exit : Skips Press enter to exit prompt
• -mass : Scans all files of a given directory
• -pdb : Writes unique input file DB name to file
• -dbn : Renames input file based on unique DB name
• -duc : Disables automatic check for MEA & DB updates
• -dcm : Disables automatic input file copy on messages
• -out : Defines output directory for all MEA operations
• -dfpt : Shows FPT, BPDT, OROM & CSE/GSC Layout Table info
• -unp86 : Unpacks all supported CSE, GSC and/or IUP firmware
• -bug86 : Enables pause on error during CSE/GSC/IUP unpacking
• -ver86 : Enables verbose output during CSE/GSC/IUP unpacking
• -html : Writes parsable HTML info files during MEA operation
• -json : Writes parsable JSON info files during MEA operation

B3. ME Analyzer Flow Control

During operation, ME Analyzer may encounter issues that can trigger Notes, Warnings and/or Errors. Notes (yellow/green color) provide useful information about a characteristic of this particular firmware. Warnings (purple color) notify the user of possible problems that can cause system instability. Errors (red color) are shown when something unexpected or problematic is encountered.

C. Download ME Analyzer

ME Analyzer consists of four files: the script (MEA.py) and its databases (MEA.dat, Huffman.dat & FileTable.dat). Download the latest version from the Releases tab, title should start with "ME Analyzer vX.Y.Z". You may need to scroll down a bit if there are DB releases at the top. The latter can be used to update the outdated DB which was bundled with the latest "ME Analyzer vX.Y.Z" release, title should start with "DB rXY".

C1. Compatibility

ME Analyzer should work at all Windows, Linux or macOS operating systems which have Python >= 3.7 support.

C2. Prerequisites

To run ME Analyzer, you need to install Python >= 3.7, followed by these 3rd party Python modules:

• colorama
• crccheck
• pltable

pip3 install colorama crccheck pltable

D. Pictures

Note: Some pictures may be outdated and depict older ME Analyzer versions/features.

meanalyzer's Issues

Installation Complete But when i open then nothing showing

When i open MEA then Popup cmd and automatically closed without showing anything.

eror how to fix

version 2.70 same eror how to fix master. this image eror link https://postimg.cc/PPQbjRS6

Where can you download 16.1.25.2128_COR_H_A_PRD_EXTR-Y?

I can't seem to find this firmware anywhere. Where do you get them from?

Exception during parsing of Intel ARC EEPROM dumps

I have three firmware images from various Intel ARC GPUs that have been dumped directly from the card, as such they contain the entire image, not just the oprom section. When running this through MEA, unpacking fails due to the field DelayedAuthMode in the UTFL header containing the value 255.

I have attached the full firmware dump that produces this error.
Uploading Intel-A770LE.bin.gz…

MEAnalizer not working on W10

Just installed python and downloaded the files. Ran mea.py through powershell on the folder where I threw the files. It opens another window then it closes inmediately. I just read the previous issue but no more info was provided to know how him got it to work.
edit:
just running it from cmd throws this

Cannot decompose MTL ME binary

Dear partner,

I cannot decompose MTL ME binary with latest MEA I can get from this repository.
Please share if there's plan for supporting MTL ME?

Feat. req. Option to disable net connection on startup

subj

Error when unpacking with current head

I've got the following. If this is relevant I'm launching mea.py via a symlink from different path, it doesn't cause problem in other operations however with the 'out' is my output prefix I see it doubled

Error: ME Analyzer v1.304.5 crashed, please report the following:

Traceback (most recent call last):
  File "/Users/CUT/MEA.py", line 13012, in <module>
    cse_unpack(variant, fpt_part_all, bpdt_part_all, file_end, fpt_start if rgn_exist else -1, fpt_chk_fail, cse_lt_chk_fail,
  File "/Users/CUT/MEA.py", line 5808, in cse_unpack
    rbe_pm_met_valid = mod_anl(cpd_offset_e, cpd_mod_attr_e, cpd_ext_attr_e, fw_name, ext_print, ext_phval, ext_dnx_val, ext_iunit_val,
  File "/Users/CUT/MEA.py", line 7017, in mod_anl
    with open(gmf_cert_path, 'wb') as gmf_cert : gmf_cert.write(gmf_blob_info[3][0])
FileNotFoundError: [Errno 2] No such file or directory: 'out/out/Unpacked_CUT_SPI.bin/RBEP 0001 [0x104000]/GMF_Certificate.crt'

Latest Firmware status missing

How to add is an issue with Status of ME firmware. I have older exe file with this function.

Installation Complete But when i open then nothing showing

Crash in mfs_print from utf-8 decode?

╔══════════════════════════════════════╗
║          MFS Volume Header           ║
╟────────────────────────┬─────────────╢
║       Signature        │   724F6201  ║
╟────────────────────────┼─────────────╢
║       Unknown 0        │     0x01    ║
╟────────────────────────┼─────────────╢
║       Unknown 1        │   0x000000  ║
╟────────────────────────┼─────────────╢
║      Volume Size       │   0xD6C80   ║
╟────────────────────────┼─────────────╢
║   File Record Count    │     1024    ║
╚════════════════════════╧═════════════╝

    MFS System Volume Size is VALID

    Analyzing MFS Low Level File 2 (Anti-Replay) ...

    Analyzing MFS Low Level File 3 (Anti-Replay) ...

    Analyzing MFS Low Level File 5 (Quota Storage) ...

    Analyzing MFS Low Level File 7 (OEM Configuration) ...

Error: ME Analyzer crashed, please report the following:

Traceback (most recent call last):
  File "MEA.py", line 10160, in <module>
    cse_unpack(variant, fpt_part_all, bpdt_part_all, file_end, fpt_start if rgn_exist else -1, fpt_chk_fail, cse_lt_chk_fail)
  File "MEA.py", line 4694, in cse_unpack
    mfs_parsed_idx,intel_cfg_hash_mfs,mfs_info,pch_init_final,vol_ftbl_id,config_rec_size = mfs_anl(os.path.join(mod_f_path[:-4], ''), part_start, part_end, variant) # Parse MFS
  File "MEA.py", line 6572, in mfs_anl
    pch_init_info = mfs_cfg_anl(mfs_file[0], mfs_file[1], rec_folder, root_folder, config_rec_size, pch_init_info, vol_ftbl_id) # Parse MFS Config Records
  File "MEA.py", line 6812, in mfs_cfg_anl
    rec_hdr_pt = rec_hdr.mfs_print() # MFS Configuration Record PrettyTable Object
  File "MEA.py", line 1128, in mfs_print
    pt.add_row(['Name', self.FileName.decode('utf-8')])
UnicodeDecodeError: 'utf-8' codec can't decode byte 0x9d in position 0: invalid start byte

This image comes directly from the flash chip of the system, I also have a pristine image that's supposed to be there and they don't match, one can see that some sections on the actual chip are relocated or omitted (the pristine image can be processed by MEAnalyzer just fine).

When looking at produced results, the entry for AFSP is not really there in the pristine image, though I am not sure if it matters or not.

Images are available if that's helpful.

[green@fatbox2 MEAnalyzer]$ ls Unpacked_elk-19.36.2.1.bin
'BPDT [4].bin'              'PDRP 0000 [0x001000]'
'BPDT [4].txt'              'PDRP 0000 [0x001000].txt'
'FTPR 0000 [0x120000]'      'PMCP 0001 [0x110000]'
'FTPR 0000 [0x120000].bin'  'PMCP 0001 [0x110000].bin'
'FTPR 0000 [0x120000].txt'  'PMCP 0001 [0x110000].txt'
'IBBP 0000 [0x18C000]'      'RBEP 0000 [0x105000]'
'IBBP 0000 [0x18C000].bin'  'RBEP 0000 [0x105000].bin'
'IBBP 0000 [0x18C000].txt'  'RBEP 0000 [0x105000].txt'
'ISHC 0001 [0x1CD000]'      'S-BPDT 0000 [0x800200].bin'
'ISHC 0001 [0x1CD000].bin'  'S-BPDT 0001 [0x1CC000].bin'
'ISHC 0001 [0x1CD000].txt'  'SMIP 0000 [0x101000]'
'IUNP 0001 [0x310000]'      'SMIP 0000 [0x101000].bin'
'IUNP 0001 [0x310000].bin'  'SMIP 0000 [0x101000].txt'
'IUNP 0001 [0x310000].txt'  'UCOD 0000 [0x183000]'
'NFTP 0000 [0x20D000]'      'UCOD 0000 [0x183000].bin'
'NFTP 0000 [0x20D000].bin'  'UCOD 0000 [0x183000].txt'
'NFTP 0000 [0x20D000].txt'  'UEP 0000 [0x100210].bin'
'OBBP 0000 [0x801000]'      'UEPB 0000 [0x100200].bin'
'OBBP 0000 [0x801000].bin'  'UTOK 0000 [0x1CA000].bin'
'OBBP 0000 [0x801000].txt'
[green@fatbox2 MEAnalyzer]$ ls Unpacked_rom2.bin/
'AFSP 0000 [0xF0A000]'      'FPT [0xF00000].bin'
'AFSP 0000 [0xF0A000].bin'  'FPT [0xF00000].txt'
[green@fatbox2 MEAnalyzer]$ ls Unpacked_rom2.bin/AFSP\ 0000\ \[0xF0A000\]
'002 Anti-Replay'  '003 Anti-Replay'  '005 Quota Storage'

error

Forum Thread to report CSE SPS firmware updates

I have found a unknown CSE SPS version in the BIOS version 1.1a (X11SDV9.517) for the Supermicro X11SDV-4C-TP8F mainboard (download is https://www.supermicro.com/about/policies/disclaimer.cfm?SoftwareItemID=7720).

As there are only pinned/linked forum threads for CSME and TXE updates (at least there is no link for SPS updates in README.md) I hereby post this data in a GitHub issue (maybe you want to create a pinned/linked forum thread for SPS updates, too):

╔══════════════════════════════════════════╗
║         ME Analyzer v1.85.1 r163         ║
╚══════════════════════════════════════════╝

╔════════════════════════════════════════╗
║           X11SDV9.517 (1/1)            ║
╟─────────────────────────┬──────────────╢
║          Family         │   CSE SPS    ║
╟─────────────────────────┼──────────────╢
║         Version         │ 04.00.04.097 ║
╟─────────────────────────┼──────────────╢
║         Release         │  Production  ║
╟─────────────────────────┼──────────────╢
║           Type          │    Region    ║
╟─────────────────────────┼──────────────╢
║           SKU           │      3       ║
╟─────────────────────────┼──────────────╢
║         Chipset         │  LBG-H B,A   ║
╟─────────────────────────┼──────────────╢
║ Security Version Number │      3       ║
╟─────────────────────────┼──────────────╢
║  Version Control Number │      0       ║
╟─────────────────────────┼──────────────╢
║    Production Version   │     Yes      ║
╟─────────────────────────┼──────────────╢
║    OEM RSA Signature    │      No      ║
╟─────────────────────────┼──────────────╢
║     OEM Unlock Token    │      No      ║
╟─────────────────────────┼──────────────╢
║           Date          │  2019-02-02  ║
╟─────────────────────────┼──────────────╢
║    File System State    │  Configured  ║
╟─────────────────────────┼──────────────╢
║           Size          │   0x37E000   ║
╟─────────────────────────┼──────────────╢
║     Flash Image Tool    │ 04.00.04.097 ║
╟─────────────────────────┼──────────────╢
║     Chipset Support     │  Bakerville  ║
╚═════════════════════════╧══════════════╝

Note: This CSE SPS firmware was not found at the database, please report it!

[UPDATE]: This version 04.00.04.097 seems to be the fix for CVE-2019-0089 as the version before this (04.00.04.086) is listed in https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html like the following:

CVEID: CVE-2019-0089 [...] Description: Improper data sanitization vulnerability in subsystem in Intel(R) SPS before versions [...] and SPS_SoC-X_04.00.04.086.0 may allow a privileged user to potentially enable escalation of privilege via local access.

Best regards,
Werner

increased functionality

Please add compatibility for SPS v3 (now limited to SPS>=4). SPS 3 is used for platforms Haswell-E (Wellsburg) and is still very much in use today

csme 16.0.15.1545 ( unsupported intel engine error)

Kindly please update for ver csme 16

AttributeError: module 'prettytable' has no attribute 'BOX_CHARS'

Envirinment:
OS: Linux
Python: 3.7.0
python-colorama: 0.3.9
python-prettytable: 0.7.2
MEAnalyzer: 7e4f078

$ meanalyzer
Traceback (most recent call last):
  File "/usr/bin/meanalyzer", line 5085, in <module>
    mea_hdr(db_rev)
  File "/usr/bin/meanalyzer", line 4660, in mea_hdr
    hdr_pt = ext_table([], False, 1)
  File "/usr/bin/meanalyzer", line 4633, in ext_table
    if not param.cli_redirect : pt.set_style(prettytable.BOX_CHARS)
AttributeError: module 'prettytable' has no attribute 'BOX_CHARS'

Syntax error in /Users/username/MEA.py Mac OS

Error on command, cannot continue :(

pyinstaller --noupx --onefile MEA.py

137 INFO: PyInstaller: 5.3
137 INFO: Python: 3.10.6
150 INFO: Platform: macOS-10.15.7-x86_64-i386-64bit
154 INFO: wrote /Users/username/MEA.spec
158 INFO: UPX is not available.
160 INFO: Extending PYTHONPATH with paths
['/Users/dannydegalicia']
402 INFO: checking Analysis
402 INFO: Building Analysis because Analysis-00.toc is non existent
402 INFO: Initializing module dependency graph...
405 INFO: Caching module graph hooks...
415 INFO: Analyzing base_library.zip ...
5123 INFO: Processing pre-find module path hook distutils from '/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/PyInstaller/hooks/pre_find_module_path/hook-distutils.py'.
5165 INFO: distutils: retargeting to non-venv dir '/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10'
6821 INFO: Caching module dependency graph...
6977 INFO: running Analysis Analysis-00.toc
6990 INFO: Analyzing /Users/username/MEA.py

Syntax error in /Users/username/MEA.py
File "/Users/username/MEA.py", line 67
<title>MEAnalyzer/MEA.py at master · platomav/MEAnalyzer · GitHub</title>
^
SyntaxError: invalid character '·' (U+00B7)

Download blocked by Google

Traffic Scan has detected a threat. Access to a webpage has been denied.github-production-release-asset-2e65be.s3.amazonaws.com/66204703/4abb4100-583c-11eb-87d7-289f4cc5f4a3?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20210122%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20210122T070333Z&X-Amz-Expires=300&X-Amz-Signature=b3e23bc8d85a08a6fa3ff4bf6d5aa54117d0aae740cf52a55a2dfb5b5c7be1ad&X-Amz-SignedHeaders=host&actor_id=68005677&key_id=0&repo_id=66204703&response-content-disposition=attachment%3B%20filename%3DME_Analyzer_v1.185.0_r227.rar&response-content-type=application%2Foctet-stream contains malware of type Gen:Variant.Mikey.118245

This is from antivirus

[not an issue per se] ME FPT Header parser: I am in quest for v21 sample

Sir,
did You have a sample of such beast (bios)?

Feature requrest: don't exit after the analysis is complete and instead ask the user if they want to analyze another file

Hello, first - I've been using this tool for a long time now and it's fantastic!
To the feature request, the title says it all.

Good luck with further development and thank you!

Error: MEA.dat file is missing!

I get this error after pointing MEA to my .rom file.

Using Manjaro Linux, ME Analyzer v1.82.3, Python 3.7.3.
Let me know if you need additional info.

Thanks in advance.

Why VirusTotal flags MEAnalyzer?

File Info:

ME_Analyzer_v1.148.4_r209.rar 04fcbb08704ddd66b8518032f2e1db9596d14025b4b8afb95e33aff929deeac5

https://github.com/platomav/MEAnalyzer/releases/download/v1.148.4-r209/ME_Analyzer_v1.148.4_r209.rar

https://www.virustotal.com/gui/file/04fcbb08704ddd66b8518032f2e1db9596d14025b4b8afb95e33aff929deeac5/detection

Is this false positive or what?

PS: Chrome also blocks the download as dangerous file.

Compile with PyInstaller error

PyInstaller: 3.3.1
Python: 3.9.2
Platform: Windows-10

Error
File "C:\Users\User1\AppData\Local\Programs\Python\Python39\lib\site-packages\PyInstaller\building\utils.py", line 632, in strip_paths_in_code
return code_func(co.co_argcount, co.co_kwonlyargcount, co.co_nlocals, co.co_stacksize,
TypeError: an integer is required (got type bytes)

Not in database 11.6.27.3264

-------[ ME Analyzer v1.11.1 ]-------
            Database r85

File:     116273264.bin

Family:   ME
Version:  11.6.27.3264
Release:  Production
Type:     Region, Stock
SKU:      Corporate H
Rev:      D0
VCN:      192
PV:       Yes
Date:     09/04/2017
Size:     0x702000
Platform: SPT/KBP
Latest:   No

Note: This firmware was not found at the database, please report it!

http://www.station-drivers.com/index.php?option=com_remository&Itemid=352&func=startdown&id=2829&lang=fr

Linux Please

No windows here.

Json output missing data...

Tested version: MEAnalyzer-1.304.4-r338

   "Platform Controller Hub Configuration": [
        "Entry 0000",
        "Entry 0001",
        "Entry 0002",
        "Entry 0003",
        "Entry 0004",
        "Entry 0005",
        "Entry 0006",
        "Entry 0007",
        "Entry 0008",
        "Entry 0009",
        "Entry 0010",
        "Entry 0011",
        "Entry 0012",
        "Entry 0013"

Intel ME Version 11.6.29.3287

Will it be updated to work with 11.6.29.3287? I ask because the last update already shows 11.7.x.

Thanks

How to download anything on github ?

Please explain to me how to download compiled projects here on github ?
I never find a link to already compiled projects. All i find is source code.
I cant compile it my self because i dont know what programs i need to do it but it seems to me that this is all there is.

This project description says i can download it by going to releases and provide a link, but when i follow that link, all i see is source code.
This is driving me nuts. For years i avoid github because there is no obvious way to download compiled windows executable.

Easier to parse output version

Hi,

I'm pondering using your project on the LVFS (https://fwupd.org/lvfs/) to analyse the ME firmware that's being uploaded by vendors such as HP, Lenovo and Dell. MEAnalyser is by far superior to the other alternatives I've researched, although I do have some concerns:

• I can't use anything without updates via pip on the production server, so https://github.com/platomav/PTable/archive/boxchar.zip is a no-go.

• I need to be able to parse the output, preferably as JSON or XML, but even a plain Key: Value format would be fine too.

• Suppose without the fancy tables, colorama becomes unnecessary too.

I'm using this command like at the moment: python3 ./MEA.py ../me_cleaner/X1-ME-firmware.bin -skip -redir -- but I'm perfect willing to write code and submit a PR for the above requests if you're receptive to the idea. The easiest way would be to create a MEA_cli.py that imports all the things in MEA.py and then outputs as the existing tool does now and a MEA_json.py that outputs all the info as a big JSON blob. I'd be fine if MEA_json.py lived in the LVFS, and I could just import things from MEA.py directly.

Anyway, comments welcome. I didn't want to start work if the idea if you were not happy with the idea. Thanks.

api-ms-win-core-path-l1-1-0.dll is missing in win7

When I use the latest ME analyzer v1.253.0 r262,it always prompt that "api-ms-win-core-path-l1-1-0.dll is missing", and the older one has no such problem (such as "ME analyzer_ Analyzer_ v1.206.4" ),What's the matter?

Feature request: print additional firmware info + standalone analyze of IOM(P), TBT(P)

Currently, MEA lists information on CSME,PMC,PCHC,NPHY (at least on TGL, different for other platforms). IOM and TBT fw would be nice to have, too. Both are already decoded with -unp86

Being able to analyze TBT(P), IOM(P) standalone (MEA.py ) like the other images/binaries/partitions would be awesome, too! :-)

btw. what about adding these images to the firmware repo?

new realase not work

Hallo master am used win7 pro x64 but eror (The program cant start because api-ms-win-core-patch-l1-1-0.dll is missing) in opened me analizer v1.260.0 r68, please help.Thanks for all

Is there a guide to run on Ubuntu 20.04 for non python devs?

Character encoding error. Tried on Windows 7 x64

SyntaxError: Non-ASCII character '\xc2' in file MEA.py on line 233, but no encod
ing declared; see http://python.org/dev/peps/pep-0263/ for details

Failed to anlayze SPSv5.x

File: https://ufile.io/sekaul4l

Reproducible steps:

1. Patch it under Ubuntu 20.04:

index be1edd1..1c01e88
--- a/MEA.py
+++ b/MEA.py
@@ -9480,7 +9479,7 @@ def mea_exit(code) :
 # Input Colorama Workaround (Windows, Python 3.5+)
 # https://github.com/tartley/colorama/issues/103#issuecomment-629816451
 def input_col(message) :
-       print(message, end = '')
+       print(message, end == '')
        input()
 
 # Calculate MD5 hash of data

python3 MEA.py -skip -dfpt | less

Error: ME Analyzer v1.204.0 crashed, please report the following:

Traceback (most recent call last):
  File "MEA.py", line 10521, in <module>
    elif sys_os.startswith('linux') or sys_os == 'darwin' : sys.stdout.write('\x1b]2;' + mea_title + '\x07')
  File "/usr/lib/python3/dist-packages/colorama/ansitowin32.py", line 41, in write
    self.__convertor.write(text)
  File "/usr/lib/python3/dist-packages/colorama/ansitowin32.py", line 162, in write
    self.write_and_convert(text)
  File "/usr/lib/python3/dist-packages/colorama/ansitowin32.py", line 184, in write_and_convert
    text = self.convert_osc(text)
  File "/usr/lib/python3/dist-packages/colorama/ansitowin32.py", line 256, in convert_osc
    winterm.set_title(params[1])
AttributeError: 'NoneType' object has no attribute 'set_title'

#python3 MEA.py -skip -dfpt

............
........
....
Error: Detected MFS Low Level File 364 which has not been parsed!

Error: Detected MFS Low Level File 365 which has not been parsed!

Error: Detected MFS Low Level File 366 which has not been parsed!

Error: Detected MFS Low Level File 367 which has not been parsed!

Error: Detected CSE Extension 0x16 with wrong Partition Hash at OPR > FTPR.man!

Error: ME Analyzer crashed

Hi!
Windows 10 Pro 64. Python Python 3.7.3 . I decomress new Dell Latitude bios 3570. After -mass option, choose path , then Enter , some file checked, then stop with that mistake.

Error: ME Analyzer crashed, please report the following:
Traceback (most recent call last):
File "MEA.py", line 8775, in
oem_config,oem_signed,cpd_mn2_info,ext_iunit_val = ext_anl(reading, '$MN2', start_man_match, file_end, [variant, major, minor, hotfix, build], None) # Get CSE Attributes
File "MEA.py", line 4946, in ext_anl
if mod_data == b'\xFF' * mod_size or cpd_entry_offset >= file_end : mod_empty = 1 # Determine if Module is Empty/Missing
OverflowError: cannot fit 'int' into an index-sized integer

Exit status is 0 when no ME detected

This is how you can reproduce:

$ python3 ./MEA.py Changelog.txt -skip -redir
+------------------------------------------+
|         ME Analyzer v1.85.0 r162         |
+------------------------------------------+

+---------------------+
| Changelog.txt (1/1) |
+---------------------+

File does not contain Intel Engine firmware

$ echo $?
0

Error with option -unp86 on Windows python with [fix]

The error with unpacked folder filenames with new option -unp86

Error: MEA just crashed, please report the following:

Traceback (most recent call last):
  File "D:\Pliki\Drivery\BIOSy\MEAnalyzer170\MEA.py", line 7325, in <module>
    cse_unpack(variant, fpt_part_all, bpdt_part_all, file_end, fpt_start if rgn_exist else -1, fpt_chk_fail)
  File "D:\Pliki\Drivery\BIOSy\MEAnalyzer170\MEA.py", line 3260, in cse_unpack
    os.mkdir(os.path.join(mea_dir, fw_name, ''))
FileExistsError: [WinError 183] Cannot create a file when that file already exists: 'd:\\pliki\\drivery\\biosy\\meanalyzer170\\A40_DUMP\\'

My fix:

def cse_unpack(variant, fpt_part_all, bpdt_part_all, file_end, fpt_start, fpt_chk_fail) :
	print()
	fpt_hdr_0_print = None
	cpd_match_ranges = []
	len_fpt_part_all = len(fpt_part_all)
	len_bpdt_part_all = len(bpdt_part_all)
	ansi_escape = re.compile(r'\x1b[^m]*m') # Generate ANSI Color and Font Escape Character Sequences
	
	# Create main Firmware Extraction Directory
	fw_name = os.path.basename(file_in)
	if os.path.isdir(os.path.join(mea_dir, fw_name, '')) : shutil.rmtree(os.path.join(mea_dir, fw_name, ''))
	fw_name = fw_name.__add__('_UNP86') // this create folder with other name than file @cooltronicyoutube 
	os.mkdir(os.path.join(mea_dir, fw_name, ''))

Error Loading File with 256 electrodes

Me Analyzer Not Working In Windows 10 Pro 64x

I've installed all the python file and MEAnalyzer successfully, But when i'm try to open MEA.py A prompt open and close in just few milliseconds, after that nothing happened

AttributeError: 'NoneType' object has no attribute 'reconfigure' during compilation

Hello, I am trying to compile the MEA.py file into MEA.exe using Python 3.12.1 + auto_py_to_exe GUI method, however, all of the time I get the same error when trying to run the compiled MEA.exe:

Traceback (most recent call last):
File "MEA.py", line 25, in
sys.stdout.reconfigure(encoding='utf-8') # Fix Windows Unicode console redirection
^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'reconfigure'

Python version is 3.12.1 (64-bit), OS is Windows 11 Home. I have tested on a number of different Python versions (3.8.x - 3.12.x), no changes. Could you please check what may cause the compiled file to throw such an error? When I run MEA.py script directly via python.exe it opens fine with no errors.

please add Intel CSME 11.8 Consumer PCH-LP C Firmware v11.8.79.3722

I need ME analyzer support files and the intel me firmware v11.8.79.3722, So please upload it soon.

add dg1 fw

╔═══════════════════════════════════════════╗
║ ME Analyzer v1.172.3 r216 ║
╚═══════════════════════════════════════════╝

╔═══════════════════════════════════════════════╗
║ dg1_gfx_fwupdate.bin (1/1) ║
╟───────────────────────────────┬───────────────╢
║ Family │ GSC ║
╟───────────────────────────────┼───────────────╢
║ Version │ 100.0.0.1162 ║
╟───────────────────────────────┼───────────────╢
║ Release │ Production ║
╟───────────────────────────────┼───────────────╢
║ Type │ Extracted ║
╟───────────────────────────────┼───────────────╢
║ SKU │ Slim LP ║
╟───────────────────────────────┼───────────────╢
║ Chipset │ Unknown ║
╟───────────────────────────────┼───────────────╢
║ TCB Security Version Number │ 1 ║
╟───────────────────────────────┼───────────────╢
║ ARB Security Version Number │ 1 ║
╟───────────────────────────────┼───────────────╢
║ Version Control Number │ 2 ║
╟───────────────────────────────┼───────────────╢
║ Production Ready │ Yes ║
╟───────────────────────────────┼───────────────╢
║ OEM Configuration │ No ║
╟───────────────────────────────┼───────────────╢
║ Date │ 2020-08-16 ║
╟───────────────────────────────┼───────────────╢
║ File System State │ Unconfigured ║
╟───────────────────────────────┼───────────────╢
║ Size │ 0x201000 ║
╟───────────────────────────────┼───────────────╢
║ Flash Image Tool │ 100.0.0.1162 ║
╟───────────────────────────────┼───────────────╢
║ Chipset Support │ DG1 ║
╟───────────────────────────────┼───────────────╢
║ Latest │ Yes ║
╚═══════════════════════════════╧═══════════════╝
╔════════════════════════════════════════════╗
║ Power Management Controller ║
╟─────────────────────────────┬──────────────╢
║ Family │ PMC ║
╟─────────────────────────────┼──────────────╢
║ Version │ 10.0.00.1024 ║
╟─────────────────────────────┼──────────────╢
║ Release │ Production ║
╟─────────────────────────────┼──────────────╢
║ Type │ Independent ║
╟─────────────────────────────┼──────────────╢
║ Chipset SKU │ Unknown ║
╟─────────────────────────────┼──────────────╢
║ Chipset Stepping │ Unknown ║
╟─────────────────────────────┼──────────────╢
║ TCB Security Version Number │ 0 ║
╟─────────────────────────────┼──────────────╢
║ ARB Security Version Number │ 0 ║
╟─────────────────────────────┼──────────────╢
║ Version Control Number │ 1 ║
╟─────────────────────────────┼──────────────╢
║ Production Ready │ Yes ║
╟─────────────────────────────┼──────────────╢
║ Date │ 2020-08-20 ║
╟─────────────────────────────┼──────────────╢
║ Size │ 0x3000 ║
╟─────────────────────────────┼──────────────╢
║ Manifest Extension Utility │ 100.0.0.9000 ║
╟─────────────────────────────┼──────────────╢
║ Chipset Support │ DG1 ║
╚═════════════════════════════╧══════════════╝

Warning: Could not find any File System FTBL/EFST Platform, assuming 01!

Warning: Could not find any File System FTBL/EFST Dictionary, assuming 0A!

Warning: Incompatible PMC DG1 firmware detected!

Note: This PMC DG1 firmware was not found at the database, please report it!

Note: This GSC firmware was not found at the database, please report it!
fulldriver.cab
fw:cab\fw\dg1_gfx_fwupdate.bin

Csme 18,19,20

Did you come across csme 18 ?

take yellow error and cannot use for analise firmware mei

I take an message yellow when i install pyinstaller and cannot use for create mea.exe

Extract and replace ME Configuration

Hi!

Will it be possible in the future to extract and/or replace the configuration area inside the me firmware? At the moment this can only be done by Intel FIT. Idea is to extract the configuration and inject the configuration into a new me image.

me analyzer drag drop not working

plz help
me analyzer drag drop not working