Intel ME Firmware Reverse Engineering — Live CSME 16.x Analysis
"Your computer has a secret second computer inside it. We found it, mapped it, and documented what's hiding in there."
🔥 TRY IT YOURSELF — HECI SPY 🔥
One Python script. Zero dependencies. Talk to your Intel Management Engine directly.
python scripts/heci_spy.py
# Requirements: Windows, Python 3.6+, Run as Administrator
What it does:
- Auto-detects your Intel HECI/MEI device
- Connects to the ME via MKHI protocol
- Queries firmware version, partition manifest, and hidden values
- Finds the memory leak — GEN.1B returns a different value every run
- Saves a shareable report with full raw hex log
Just ran it on a Lenovo IdeaPad Gaming 3 (i7-12650H, CSME 16.0.15.1735):
MKHI v3.1 | FW 16.0.1735.15 | 8 partitions found | GEN.1B: 0x00C344CA (changes each run!)
We confirmed: 7/12 MKHI commands respond. The ME is alive, talking, and leaking memory.
▶️ Watch the 35-second demo — (right-click save-as, or upload to YouTube for inline playback)
📊 View the full 21-slide presentation
🏆 WORLD-FIRST CLAIM
This is the first-ever public disclosure of the complete internal structure of Intel CSME 16.x (Alder Lake) firmware, decoded from live hardware.
Nobody has ever published:
- The complete IFWI filesystem map — 80 internal paths of CSME 16.x
- The exact hardware configuration — JSON config blocks showing laptop wiring
- The full X.509 certificate trust chain — 13 certificates decoded
- The ROM Bypass boot mechanism — how ME boots before your BIOS
- The ME capability map — 11 access domains from firmware evidence
- 28 security structures mapped from live firmware
- ~2.9MB of readable firmware from a live Intel CSME 16.x system
All from a Lenovo IdeaPad Gaming 3 with Intel Core i7-12650H (12th Gen Alder Lake).
TL;DR
Intel Management Engine (ME) is a hidden microcontroller built into every modern Intel CPU. It runs its own operating system, has its own processor (Synopsys ARC EM), and operates 24/7 — even when your PC is completely shut down. Most people know it exists. Almost nobody has looked inside it.
**This project