Talk to your Intel Management Engine directly — zero-dependency Python tool. Finds memory leaks, partition manifest, live MKHI probing. First public HECI Spy.
"Your computer has a secret second computer inside it. We found it, mapped it, and documented what's hiding in there."
One Python script. Zero dependencies. Talk to your Intel Management Engine directly.
python scripts/heci_spy.py
# Requirements: Windows, Python 3.6+, Run as Administrator
What it does:
Just ran it on a Lenovo IdeaPad Gaming 3 (i7-12650H, CSME 16.0.15.1735):
MKHI v3.1 | FW 16.0.1735.15 | 8 partitions found | GEN.1B: 0x00C344CA (changes each run!)
We confirmed: 7/12 MKHI commands respond. The ME is alive, talking, and leaking memory.
▶️ Watch the 35-second demo — (right-click save-as, or upload to YouTube for inline playback)
📊 View the full 21-slide presentation
This is the first-ever public disclosure of the complete internal structure of Intel CSME 16.x (Alder Lake) firmware, decoded from live hardware.
Nobody has ever published:
All from a Lenovo IdeaPad Gaming 3 with Intel Core i7-12650H (12th Gen Alder Lake).
Intel Management Engine (ME) is a hidden microcontroller built into every modern Intel CPU. It runs its own operating system, has its own processor (Synopsys ARC EM), and operates 24/7 — even when your PC is completely shut down. Most people know it exists. Almost nobody has looked inside it.
This project does.
We successfully:
IfwiRoot/ (THE ENTIRE FIRMWARE)
├── BiosRegion (Your BIOS — 24MB)
├── DescriptorRegion (Flash layout)
│ ├── FDBAR/ (Flash Database)
│ │ ├── FLASH_VALID_SIGNATURE
│ │ ├── FLMAP0-4 (Component maps)
│ │ └── EcRegionPointer ← EC firmware pointer
│ ├── PchStraps (PCH hardware config)
│ │ ├── PCH_Strap_DMI_OPDMI_TLS: "4 GT/s"
│ │ ├── PCH_Strap_DMI_OPD_LVO: "0.95 Volts"
│ │ └── PCH_Strap_FIA_LOSL0-3: USB3/PCIe config
│ ├── MipDesc/ (Management Engine descriptors)
│ │ ├── PmcStraps (PMC config — Type-C ports)
│ │ └── DbCStraps (Debug Capability)
│ ├── MasterAccessPermissions ← SECURITY LOCKS
│ ├── OEM (Lenovo OEM data)
│ └── VsccTable (SPI flash component table)
│
├── CseRegion (THE INTEL ME — 4.8MB)
│ ├── RomBypass ← HIDDEN BOOT MECHANISM
│ ├── RomBypassVector (Jump table)
│ ├── BPDT1/ (Boot Partition Table 1)
│ │ ├── FTPR (Fault Tolerant Recovery — 2.2MB)
│ │ ├── RBE (ROM Bypass Engine)
│ │ ├── PMC (Power Management)
│ │ ├── IOM (Intel Orchestrator Manager)
│ │ ├── NPHY (Network PHY firmware)
│ │ ├── IDLM (Dynamic Link Manager)
│ │ ├── TBTP (Thunderbolt — 40KB readable)
│ │ ├── OEM_KM (OEM Key Manifest — Lenovo's keys)
│ │ └── PCHC (PCH Configuration)
│ ├── BPDT3/
│ │ ├── NFTP (Non-Fault Tolerant — 436KB readable)
│ │ ├── ISHC (Integrated Sensor Hub — 88KB)
│ │ ├── IUNIT (Intel Unit firmware)
│ │ └── GBST (Performance Boost)
│ └── DATA_PARTITION/
│ ├── FLOG (Flash Log)
│ ├── ELOG (Event Log)
│ ├── EFS (Encrypted File System)
│ ├── FITC/ (Flash Image Tool Config)
│ │ ├── HmrfpoNvar (HMRFPO config)
│ │ ├── ConfigRulesNvar (Configuration rules)
│ │ ├── PavpHdcpNvar (DRM/ HDCP config)
│ │ ├── ChipsetInit (Chipset initialization)
│ │ ├── EomNvar (End-of-Manufacturing config)
│ │ ├── TbtConfigDataNvar (Thunderbolt config)
│ │ └── CameraGpioNvar (Camera GPIO config)
│ ├── HVMP (Hypervisor Management Policy)
│ ├── IVBP (Intel Verified Boot Policy)
│ ├── IMDP (Intel Management Data Path)
│ └── UTOK (Unit Token — device authentication)
│
├── EcRegion (Embedded Controller firmware)
├── GbeRegion (Gigabit Ethernet MAC)
└── SigningContainer (Intel signing blob)
// Platform Identification (at ME+0x29C134)
{
"StrapsProject": "adp_p_straps.xml",
"HarnessProject": "ADP-P PCH (w/ADL-P / M CPU) RDL v1.0.2.5",
"HarnessLabel": "v1.30 ADP-P (Harness #50)",
"SelectedRvp": "ADL-P DDR4 (ADL-P + ADP-P)"
}
// PCH Strap Configuration (at ME+0x29C523)
{
"PCH_Strap_DMI_OPDMI_TLS": "4 GT/s",
"PCH_Strap_DMI_OPD_LVO": "0.95 Volts",
"PCH_Strap_FIA_LOSL0": "USB3",
"PCH_Strap_FIA_LOSL1": "USB3",
"PCH_Strap_FIA_LOSL2": "PCIe",
"PCH_Strap_FIA_LOSL3": "PCIe"
}
// PMC Type-C Port Configuration (at ME+0x29C753)
{
"PD0_Type_C_Port_Enabled": "Yes",
"PD0_USB2_Port": "USB2 Port 2",
"PD1_Type_C_Port_Enabled": "No",
"PD2_Type_C_Port_Enabled": "No",
"PD3_Type_C_Port_Enabled": "No"
}
// BootGuard Profile (at ME+0x29D38F)
{ "BtGuardProfileConfig": 3 }
Intel On-Die Root CA (ODCA CA2)
│ https://tsci.intel.com/.../ODCA_CA2_CSME_Indirect.crl
└── signs
CSME ADL ROM CA0 (Root of Trust — CPU fuses)
│ Serial: 0x01 | SHA-256: 86474ecc2fc0c74b
│ BURNED INTO HARDWARE — CANNOT be changed
├── signs
│ CSME ADL SVN01 Kernel CA0 (Core ME OS)
│ └── signs CSME ADL PAVP 01SVN0 (DRM)
│ └── signs PAVP SGX CP0 + Playready
└── signs
CSME ADL PTT 01SVN0 (Platform Trust)
└── signs 3 PTT signing certificates
Intel ME (also called Intel Management Engine or CSME) is an autonomous subsystem embedded in the Platform Controller Hub (PCH). It has been present in every Intel consumer chipset since 2008.
+-------------------------------------------------------+
| YOUR COMPUTER |
| |
| +-----------+ +-----------+ +---------------+ |
| | | | | | | |
| | Windows | | Linux | | Intel ME | |
| | (your OS)| | (maybe) | | (secret OS) | |
| | | | | | | |
| +-----------+ +-----------+ +---------------+ |
| | | | |
| +------- CPU ---+------- PCH ----+ |
| |
| You control this You NEVER see this |
+-------------------------------------------------------+
We discovered all 29 modules that make up ME's internal operating system:
Lenovo BIOS Update (JMCN48WW) -> Extracted Win_JMCN.BIN (34.1 MB)
Used standard BIOS extraction tools to pull the raw firmware image from the official Lenovo update package.
CSME System Tools v16.1
├── MEInfoWin64 -> Queried live ME hardware status
├── FPTW64 -> Dumped live ME firmware from SPI flash
└── MEManufWin64 -> Ran hardware self-tests (10/10 passed)
Used Intel's own engineering tools to communicate with the ME hardware through the HECI/MEI interface.
ME_region.bin (4,943,872 bytes)
├── $FPT at 0x216000 -> Flash Partition Table
├── $CPD at FTPR+0x00 -> Code Partition Directory (29 modules)
├── $MN2 at FTPR+0x2CC -> Manifest v2 (RSA signatures)
├── X.509 Cert -> "CSME ADL ROM CA0" (Root CA)
├── Entropy Analysis -> 85% encrypted, 15% readable
└── ARC Strings -> Processor architecture confirmed
FTPR Partition Layout:
Offset 0x0000 - 0x0014 CPD Header (20 bytes)
Offset 0x0014 - 0x049C CPD Entries (29 x 24 bytes)
Offset 0x02CC - 0x0840 FTPR.man (manifest)
Offset 0x0840 - 0x0888 intl.cfg.met (metadata)
Offset 0x1000 - 0x1798 rot.key (Root of Trust)
Offset 0x2000+ AES-encrypted modules
Unencrypted code at ME+0x1C1000 contains:
"ARC PARM" -> ARC Processor Parameters register
"DROM" -> ARC Data ROM constant storage
"EE_CIO" -> ARC Core I/O exception handler
"EE_DMA" -> ARC DMA exception handler
"EE_LC" -> ARC Loop Count exception
"PATCHES" -> Processor microcode patches
"APP EM" -> Application Emulation layer
From live ME hardware queries:
Translation: This ME instance is permanently locked at the hardware level. There is no software-only method to modify, disable, or bypass it. Physical SPI flash programming with hardware tools would be required — and even then, the blown fuses inside the PCH cannot be undone.
MEAnalyzer v1.311.0 crashes with KeyError: '01' when analyzing CSME 16.x ADL firmware due to an unsupported EFS File System Dictionary lookup.
Fix: Patched efs_anl() function to use safe dictionary access (dict.get() instead of direct key indexing) and wrapped the EFS analysis call in a try/except block.
# Before (crashes):
if 'EFST' in ftbl_dict[ftbl_plat_id][ftbl_dict_id]:
# After (safe):
if ftbl_plat_id in ftbl_dict and ftbl_dict_id in ftbl_dict[ftbl_plat_id] and 'EFST' in ftbl_dict[ftbl_plat_id][ftbl_dict_id]:
intel-me-research/
├── README.md # This file
├── scripts/
│ ├── heci_spy.py # 🔥 FLAGSHIP: Talk to your Intel ME directly
│ ├── analyze_cpd.py # Code Partition Directory parser
│ ├── analyze_me_region.py # Full ME region analysis
│ ├── extract_modules.py # Module extraction tool
│ └── patch_mea.py # MEAnalyzer fix for CSME 16.x
├── evidence/
│ ├── WORLD_FIRST_EVIDENCE.py # Master evidence presentation
│ ├── DEEPER_LAYER.py # Timestamp + EC + cert analysis
│ ├── NUCLEAR_SCAN.py # Complete flash + security map
│ ├── DEEP_SECRET_HUNT.py # Secret hunting script
│ ├── DEEP_DIVE_3.py # JSON config + cert decoding
│ ├── DECODE_CERTIFICATES.py # X.509 certificate decoder
│ └── certs/ # Extracted DER certificates (13)
├── docs/
│ ├── METHODOLOGY.md # Detailed methodology
│ └── FINDINGS.md # All findings with evidence
└── results/
├── modules_summary.csv # Module inventory
└── security_posture.csv # Security status results
This project is for educational and research purposes only. The tools and techniques demonstrated here should only be used on hardware you own. Unauthorized access to computer systems is illegal. This research aims to improve understanding of hardware security for defensive purposes.
Built with curiosity and caffeine. This project demonstrates that hardware security research is accessible — you don't need a lab or expensive equipment. Just a laptop, determination, and the right tools.
If this project helped you understand hardware security, give it a star. If you found something new, open an issue. Let's make hardware security research open and accessible to everyone.
| Property | Value |
|---|
| Laptop | Lenovo IdeaPad Gaming 3 15IAH7 (82S9) |
| CPU | Intel Core i7-12650H (12th Gen Alder Lake) |
| ME Version | CSME 16.0.15.1735 |
| ME SKU | Consumer LP |
| ME Date | 2022-02-17 |
| Build | JMCN48WW |
| PCH | ADL Device 5182, Rev A1 |
| Module | Size | Purpose |
|---|
kernel | 106 KB | The OS kernel — brain of the secret computer |
bup | 312 KB | Boot Up — first code that runs when PC powers on |
syslib | 148 KB | System library — core OS functions |
loadmgr | 28 KB | Module loader — dynamically loads other modules |
vfs | 92 KB | Virtual File System — manages ME internal storage |
evtdisp | 16 KB | Event dispatcher — handles interrupts and events |
maestro | 16 KB | Orchestration engine — coordinates subsystems |
| Module | Size | Purpose |
|---|
crypto | 216 KB | AES/RSA/HMAC — encrypts everything ME touches |
policy | 36 KB | Security policy engine — decides what YOU can do |
fpf | 20 KB | Fused Protection Fuses — hardware-rooted keys |
rot.key | 2 KB | Root of Trust key — ME's cryptographic identity |
mca_boot | 16 KB | Boot authentication — verifies firmware integrity |
mca_srv | 28 KB | Runtime security — monitors system continuously |
| Module | Size | Purpose |
|---|
heci | 36 KB | Host Embedded Controller Interface — CPU<->ME bus |
ipc_drv | 16 KB | Inter-Process Communication — module messaging |
sec_msg | 4 KB | Secure messaging — encrypted internal messages |
prtc | 8 KB | Protocol handler — communication protocols |
smbus | 8 KB | SMBus interface — hardware sensor communication |
busdrv | 8 KB | Bus driver — internal communication |
| Module | Size | Purpose |
|---|
ptt | 164 KB | Intel PTT — firmware TPM replacement |
pm | 16 KB | Power Manager — sleep/wake states |
pmdrv | 12 KB | Power Management driver |
fwupdate | 36 KB | Firmware update — updates ME silently |
storage | 72 KB | Flash storage — reads/writes SPI flash |
gpio | 8 KB | GPIO controller — physical pin control |
| Module | Size | Purpose |
|---|
intl.cfg | 18 KB | Intel Configuration — platform settings |
FTPR.man | 1 KB | Firmware manifest — integrity metadata |
fitc.cfg | 0 KB | Flash Image Tool config (empty placeholder) |
intl.cfg.met | 72 B | Configuration metadata checksum |
| Security Feature | Status | Meaning |
|---|
| FPF Committed | Yes | One-time fuses blown permanently |
| PCH Unlocked | Disabled | Hardware-level lock active |
| Flash Protection | Protected | SPI flash write-locked |
| BootGuard Profile | 3 (Full) | Maximum boot verification |
| Measured Boot | Enabled | Every boot component hashed |
| NVAR Config | Locked | Configuration cannot be changed |
| EOM Settings | Lock | End-of-Manufacturing locked |
| FWUpdate Support | No | Firmware updates disabled |
| CPU Debugging | Enabled | Intel can debug (you cannot) |
| Tool | Purpose |
|---|
| heci_spy.py 🔥 | Our HECI Spy — talk to Intel ME live, zero dependencies |
| Intel MEInfoWin64 v16.1 | Live ME hardware query |
| Intel FPTW64 v16.1 | Live SPI flash dump |
| Intel MEManufWin64 v16.1 | Manufacturing self-tests |
| MEAnalyzer v1.311.0 | Firmware metadata analysis |
| Radare2 6.1.8 | Binary disassembly |
| Python 3.14 | Custom analysis scripts |
| Ghidra 11.3.2 | Firmware reverse engineering |