{"id":13440065,"url":"https://github.com/corna/me_cleaner","last_synced_at":"2025-10-06T01:06:47.899Z","repository":{"id":41490378,"uuid":"73701496","full_name":"corna/me_cleaner","owner":"corna","description":"Tool for partial deblobbing of Intel ME/TXE firmware images","archived":false,"fork":false,"pushed_at":"2024-05-28T18:44:47.000Z","size":124,"stargazers_count":4662,"open_issues_count":237,"forks_count":285,"subscribers_count":186,"default_branch":"master","last_synced_at":"2025-05-21T17:03:30.265Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/corna.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-11-14T12:14:34.000Z","updated_at":"2025-05-21T16:44:30.000Z","dependencies_parsed_at":"2024-09-30T18:20:25.223Z","dependency_job_id":null,"html_url":"https://github.com/corna/me_cleaner","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/corna/me_cleaner","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corna%2Fme_cleaner","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corna%2Fme_cleaner/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corna%2Fme_cleaner/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corna%2Fme_cleaner/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/corna","download_url":"https://codeload.github.com/corna/me_cleaner/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/corna%2Fme_cleaner/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278542947,"owners_count":26004101,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-05T02:00:06.059Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-31T03:01:19.499Z","updated_at":"2025-10-06T01:06:47.879Z","avatar_url":"https://github.com/corna.png","language":"Python","readme":"# me\\_cleaner [![Donation](https://img.shields.io/badge/Donate-PayPal-green.svg)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick\u0026hosted_button_id=B5HCXCLZVCVZ8)\n\n_me\\_cleaner_ is a Python script able to modify an Intel ME firmware image with\nthe final purpose of reducing its ability to interact with the system.\n\n## Intel ME\n\nIntel ME is a co-processor integrated in all post-2006 Intel boards, which is\nthe base hardware for many Intel features like Intel AMT, Intel Boot Guard,\nIntel PAVP and many others. To provide such features, it requires full access to\nthe system, including memory (through DMA) and network access (transparent to\nthe user).\n\nUnlike many other firmware components, the Intel ME firmware can't be neither\ndisabled nor reimplemented, as it is tightly integrated in the boot process and\nit is signed.\n\nThis poses an issue both to the free firmware implementations like [coreboot](\nhttps://www.coreboot.org/), which are forced to rely on a proprietary, obscure\nand always-on blob, and to the privacy-aware users, who are reasonably worried\nabout such firmware, running on the lowest privilege ring on x86.\n\n## What can be done\n\nBefore Nehalem (ME version 6, 2008/2009) the ME firmware could be removed\ncompletely from the flash chip by setting a couple of bits inside the flash\ndescriptor, effectively disabling it.\n\nStarting from Nehalem the Intel ME firmware can't be removed anymore: without a\nvalid firmware the PC shuts off forcefully after 30 minutes, probably as an\nattempt to enforce the Intel Anti-Theft policies.\n\nHowever, while Intel ME can't be turned off completely, it is still possible to\nmodify its firmware up to a point where Intel ME is active only during the boot\nprocess, effectively disabling it during the normal operation, which is what\n_me\\_cleaner_ tries to accomplish.\n\n## Platform support\n\n_me\\_cleaner_ currently works on [most of the Intel platforms](\nhttps://github.com/corna/me_cleaner/wiki/me_cleaner-status); while this doesn't\nmean it works on all the boards (due to the different firmware implementations),\nit has been proven quite reliable on a great number of them.\n\n## Usage\n\n_me\\_cleaner_ should handle all the steps necessary to the modification of an\nIntel ME firmware with the command:\n\n      $ python me_cleaner.py -S -O modified_image.bin original_dump.bin\n\nHowever, obtaining the original firmware and flashing back the modified one is\nusually not trivial, as the Intel ME firmware region is often non-writable from\nthe OS (and it's not a safe option anyways), requiring the use of an external\nSPI programmer.\n\n## Results\n\nFor generation 1 (before Nehalem, ME version \u003c= 5) this tool removes the whole\nME firmware and disables it completely.\n\nFor generation 2 (Nehalem-Broadwell, ME version between 6 and 10) this tool\nremoves almost everything, leaving only the two fundamental modules needed for\nthe correct boot, `ROMP` and `BUP`. The firmware size is reduced from 1.5 MB\n(non-AMT firmware) or 5 MB (AMT firmware) to ~90 kB.\n\nFor generation 3 (from Skylake onwards, ME version \u003e= 11) the ME subsystem and\nthe firmware structure have changed, requiring substantial changes\nin _me\\_cleaner_. The fundamental modules required for the correct boot are now\nfour (`rbe`,  `kernel`, `syslib` and `bup`) and the minimum firmware size is\n~300 kB (from the 2 MB of the non-AMT firmware and the 7 MB of the AMT one).\n\nOn some boards the OEM firmware fails to boot without a valid Intel ME firmware;\nin the other cases the system should work with minor inconveniences (like longer\nboot times or warning messages) or without issues at all.\n\nObviously, the features provided by Intel ME won't be functional anymore after\nthe modifications.\n\n## Documentation\n\nThe detailed documentation about the working of _me\\_cleaner_ can be found on\nthe page [\"How does it work?\" page](\nhttps://github.com/corna/me_cleaner/wiki/How-does-it-work%3F).\n\nVarious guides and tutorials are available on the Internet, however a good\nstarting point is the [\"How to apply me_cleaner\" guide](\nhttps://github.com/corna/me_cleaner/wiki/How-to-apply-me_cleaner).\n\n","funding_links":["https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick\u0026hosted_button_id=B5HCXCLZVCVZ8"],"categories":["Python","Archs"],"sub_categories":["CTFs tools"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcorna%2Fme_cleaner","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcorna%2Fme_cleaner","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcorna%2Fme_cleaner/lists"}