unME11

(2017) You might be able to: https://www.csoonline.com/article/3220476/security/researche... https://github.com/ptresearch/unME11

I found some accompanying slides: https://www.troopers.de/downloads/troopers17/TR17_ME11_Stati... That said, please note that this is partially outdated information (even to the extent of warranting a mod edit even though it's so recent) - the parts that mention how some compressed modules are unreadable are now irrelevant. The URL for this article is /2017/04/ (April). More recently (July, three months later), this same group has somehow (??) managed to derive the Huffman compression tables for the previously-inaccessible modules: https://github.com/ptresearch/unME11 I haven't read anything that explicitly states this (on HN; I don't read anywhere else), but I get the impression this is the holy grail, or at least one of the major pieces of the puzzle. I found this random comment about actually using unME11: https://news.ycombinator.com/

It feels reassuring that you can actually get access and read the assembly of the IME now, thanks to https://github.com/ptresearch/unME11. For instance using the the Gigabrix-BSi5ha-6200 IME Firmware update archive: 1. Download and unzip the Gigabrix-BSi5ha-6200 IME update archive (http://download.gigabyte.us/FileList/BIOS/brix_bios_bsi5-h-a...). Use F5_BIOS/image.bin from that archive. 2. Start "python unME11.py image.bin" 3. The uncompressed modules are located in image/00004000.FTPR/* after that 4. You can i.e. load image/00004000.FTPR/kernel.mod in IDA using 80486 in 32bit real-mode or use "objdump -m i386 -b binary -D kernel.mod --adjust-vma=0x80000" with entry point being 0x80000 or "objdump -m i386 -b binary -D bup.mod --adjust-vma=0x2d000" with entry point being 0x2D04C