A reverse-engineering project that documents the internal structure of Intel CSME 16.x firmware from a live Alder Lake laptop, and provides a zero-dependency Python script to query the ME via HECI.

Stars

6

7-day growth

No data

Forks

1

Open issues

0

License

No data

Last updated

2026-07-30

AI repository intelligence
FR-AI / ANALYSIS

Why it is worth attention

It publishes rarely documented details about Intel ME/CSME 16.x internals, including firmware maps, certificate chains, module inventories, and a working memory-leak finding, while also releasing a simple HECI spy script that anyone can run.

Who it is for

  • Hardware security researchers
  • Firmware reverse engineers
  • BIOS/UEFI developers
  • Privacy and security enthusiasts investigating Intel ME

Use cases

  • Learning about Intel ME architecture and CSME 16.x internals
  • Auditing or monitoring ME communication from a Windows host
  • Firmware forensics and certificate-chain analysis
  • Teaching hardware security with real-world evidence

Strengths

  • Provides heci_spy.py, a zero-dependency Python script that queries live ME via HECI/MKHI
  • Detailed maps of the IFWI filesystem, internal modules, certificates, and security posture
  • Based on hands-on evidence from real hardware with exact device and firmware versions documented
  • Includes patched MEAnalyzer support and multiple analysis scripts for reproducibility

Considerations

  • heci_spy.py requires Windows, Python 3.6+, and Administrator privileges
  • All findings come from a single Lenovo laptop with one CSME 16.0.15.1735 firmware version
  • World-first claims are self-reported and not independently verified
  • Hardware security locks prevent modification or disabling, limiting practical experimentation

README quick start

Intel ME Firmware Reverse Engineering — Live CSME 16.x Analysis

"Your computer has a secret second computer inside it. We found it, mapped it, and documented what's hiding in there."

🔥 TRY IT YOURSELF — HECI SPY 🔥

One Python script. Zero dependencies. Talk to your Intel Management Engine directly.

python scripts/heci_spy.py
# Requirements: Windows, Python 3.6+, Run as Administrator

What it does:

  • Auto-detects your Intel HECI/MEI device
  • Connects to the ME via MKHI protocol
  • Queries firmware version, partition manifest, and hidden values
  • Finds the memory leak — GEN.1B returns a different value every run
  • Saves a shareable report with full raw hex log

Just ran it on a Lenovo IdeaPad Gaming 3 (i7-12650H, CSME 16.0.15.1735):

MKHI v3.1 | FW 16.0.1735.15 | 8 partitions found | GEN.1B: 0x00C344CA (changes each run!)

We confirmed: 7/12 MKHI commands respond. The ME is alive, talking, and leaking memory.

▶️ Watch the 35-second demo(right-click save-as, or upload to YouTube for inline playback)

📊 View the full 21-slide presentation


🏆 WORLD-FIRST CLAIM

This is the first-ever public disclosure of the complete internal structure of Intel CSME 16.x (Alder Lake) firmware, decoded from live hardware.

Nobody has ever published:

  1. The complete IFWI filesystem map — 80 internal paths of CSME 16.x
  2. The exact hardware configuration — JSON config blocks showing laptop wiring
  3. The full X.509 certificate trust chain — 13 certificates decoded
  4. The ROM Bypass boot mechanism — how ME boots before your BIOS
  5. The ME capability map — 11 access domains from firmware evidence
  6. 28 security structures mapped from live firmware
  7. ~2.9MB of readable firmware from a live Intel CSME 16.x system

All from a Lenovo IdeaPad Gaming 3 with Intel Core i7-12650H (12th Gen Alder Lake).

TL;DR

Intel Management Engine (ME) is a hidden microcontroller built into every modern Intel CPU. It runs its own operating system, has its own processor (Synopsys ARC EM), and operates 24/7 — even when your PC is completely shut down. Most people know it exists. Almost nobody has looked inside it.

**This project

Description

Talk to your Intel Management Engine directly — zero-dependency Python tool. Finds memory leaks, partition manifest, live MKHI probing. First public HECI Spy.

Related repositories

Similar projects matched by category, topics, and programming language.

lopopolo
Featured
lopopolo GitHub avatar

harness-engineering

Harness Engineering is a methodology for improving coding agent outputs by carefully crafting the environment around them—providing curated context, tools, and executable constraints that encode an organization’s nonfunctional requirements and cumulative lessons.

AI & Machine LearningAI Agents
2,390
slvDev
Featured
slvDev GitHub avatar

esp32-ai

A 28.9 million parameter language model runs on an $8 ESP32-S3 microcontroller entirely on-device, generating simple stories at about 9.5 tokens per second.

AI & Machine LearningLarge Language Models
1,960
littledivy
Featured
littledivy GitHub avatar

mimic

mimic captures traffic from any iOS or web app and automatically generates a Python client library that lets you call the app's API like a regular library.

AI & Machine Learning
1,482