Inspect and deblob the management firmware that ships below your operating system. intel_ma strips and neuters the Intel ME/TXE/CSME, inspects the AMD PSP, and audits the vendor locks (Boot Guard, BIOS Guard, Secure Boot) on a flash image.

Disabling the Intel Management Engine is making management absent. Hence the name.

A library (src/lib.rs) with a thin CLI (src/main.rs).

Supported:

• Image detection: ME/TXE region images and full SPI dumps (Intel Flash Descriptor)
• $FPT partition table parsing; FTPR/CODE location; IFWI $CPD discovery
• Generations 1-7: ME 6 Ignition, ME 6-10 (AltMeDisable), CSME 11-16 (HAP), plus TXE and SPS variants
• Partition removal with white/blacklist, FPT checksum repair, EFFS flag clear
• Module removal: gen2 ($MME, LLUT/Huffman) and gen3 ($CPD)
• FTPR relocation (-r) and truncation (-t)
• HAP / AltMeDisable / meDisable soft-disable (-S / -s)
• Descriptor hardening: drop ME R/W to other regions (-d)
• Descriptor / ME extraction (-D / -M)
• FTPR RSA signature verification (2048-bit modpow + SHA-256)
• FIT parsing (microcode, ACMs) with Boot Guard detection - warns before you flash an unsigned image onto a Boot-Guard-enforced board
• locks - one-shot inventory of every vendor lock: Boot Guard, BIOS Guard (AMI PFAT), Secure Boot key material, and the FLMSTR descriptor access matrix (flags when the ME can write your BIOS region)
• AMD PSP - parse the Embedded Firmware Structure / FET and the $PSP/$BHD directories (bootloader, public key, SMU, ABL, APCB/APOB, ...). The PSP is on-die and fuse-enforced, so this side is inspect-only
• BIOS region (bios) - walk UEFI firmware volumes and FFS files, listing modules; decompresses EFI/Tiano and LZMA sections via the efi-compress crate. Detects legacy PCI option ROMs (video BIOS) and can extract them with --extract-roms <dir>
• GbE region (gbe) - the Intel LAN NVM: MAC address, per-bank checksum and the active bank, and the LAN controller model (I217/I218/I219, 82577/82579). Accepts a full dump or a bare flashregion_3_gbe.bin
• Live probe (mei, Linux only) - query the ME on the running machine with no image and no root: the HECI PCI function, /dev/mei0, and the kernel's dev_state / running fw_ver / fw_status from sysfs. macOS/FreeBSD build fine and report "unsupported"

For a full walkthrough - detecting the ME on Linux, dumping the flash, auditing locks, and neutering the engine end-to-end - see docs/USAGE.md.

# Inspect an image
intel_ma info  firmware.bin

# Verify integrity (FTPR RSA signature, layout)
intel_ma check firmware.bin

# Parse the FIT - list microcode/ACMs and detect Boot Guard before flashing
intel_ma fit firmware.bin

# Inventory every vendor lock: Boot Guard, BIOS Guard, Secure Boot, descriptor
intel_ma locks firmware.bin

# Inspect AMD PSP firmware (FET, directories, entries)
intel_ma amd firmware.bin

# Walk the BIOS region: UEFI volumes, modules (decompresses EFI/Tiano + LZMA)
intel_ma bios firmware.bin

# Extract any PCI option ROMs / video BIOS to a directory
intel_ma bios firmware.bin --extract-roms ./roms

# Read the GbE region: MAC, LAN controller, NVM banks
intel_ma gbe firmware.bin

# Probe the ME on THIS running machine (Linux only, no image, no root)
intel_ma mei

# Strip and neuter the ME. Writes in place unless -O is given.
intel_ma clean firmware.bin -O cleaned.bin

# Full deblob: strip + relocate + HAP soft-disable + descriptor hardening
intel_ma clean dump.bin -S -r -d -O cleaned.bin

# Keep an extra partition (e.g. MFS), then truncate an ME-only image
intel_ma clean me.bin -w MFS -t -O me_small.bin

Grab a prebuilt binary from the releases page, or install from crates.io:

cargo install intel_ma

Runs on x86_64 Linux and FreeBSD/amd64.

let mut buf = std::fs::read("firmware.bin")?;
let info = intel_ma::analyze(&buf)?;          // read-only analysis
let report = intel_ma::clean(&mut buf, &intel_ma::Options {
    soft_disable: true,
    ..Default::default()
})?;

For research, right-to-repair and firmware-liberation work on hardware you own. Flashing a bad image can brick a board - keep a known-good dump and a hardware programmer (CH347 / FlashcatUSB / external SPI) on hand.

Builds on the research and reference implementations of me_cleaner (Intel ME) and PSPTool (AMD PSP), both GPL-3.

And a thank-you to the coreboot team and community, whose work to replace proprietary firmware is what makes management absent in the first place.

Thanks to Andrew S. Tanenbaum, author of MINIX: the OS that Intel stole to build the Intel ME.

MINIX 3 runs on the Management Engine's core inside billions of machines - quietly the most widely deployed operating system in the known universe. The real MINIX 3 runs thousands of NetBSD packages (Doom included); the build Intel embedded is stripped to a blind, screenless core with no userland - it could run Doom, but Intel gave it nothing to draw on. The OS was never the prisoner. Intel built the cell. Its author was never asked, never credited, and never even informed; he found out from the news, and wrote Intel an open letter about it.

GPL-3.0-or-later.