Unlocking FD or/and ME section provides a better overview of some common methods. Some desktop motherboards have a physical jumper that could be tagged as 'Service Mode', 'FD/Flash/Security Override', 'FD Unlock', 'ME/TXE/SPS Unlock', 'ME/TXE/SPS Service', 'Manufacturing Mode' or similar, making full flash memory access facilitated, but laptops do not have such jumpers and rely on something simulated, such as a pin on Intel High Definition Audio codecs to enable a servicing mode.

Intel platform development guides for OEMs often mention 'Flash Descriptor Security Override' or 'Intel ME Debug Mode' ('Service Mode' on Dell hardware), that could be enabled via different ways depending on the manufacturer. Intel also have some security override methods in its platforms specifications for OEMs. firmware rootkits), however it's possible to disable write protection using various servicing modes often provided by manufacturers. Usually most of those regions are not available for write for security reasons (e.g. The information stored in the Flash Descriptor can only be written during the manufacturing process as its read/write permissions must be set to Read Only when the computer leaves the manufacturing floor.įlash Descriptor contains AltMeDisable or High Assurance Platform (HAP) bits that disable Intel MEĪll these regions combined is a full flash memory available directly from OS.

The maximum size of the Flash Descriptor is 4 KBytes. The descriptor is on the SPI flash itself and is not in memory mapped space like PCH programming registers. The Descriptor data structure describes the layout of the flash as well as defining configuration parameters for the PCH. The Flash Descriptor is a data structure that is programmed on the SPI flash part. Winbond W25Q64FV) in a same way as using external programmers, providing the ability to read and write the following flash parts: Asserting HDA_SDO HIGH on Intel High Definition Audio chips ( >= 6 chipset series )įPT is able to access the flash memory chips (e.g.Determining whether the Intel Boot Guard is enabled.

Neutralizing Intel ME via internal flashing with Intel FPT

Intel flash programming tool download