一个逆向工程项目,记录了从一台 Alder Lake 笔记本实机提取的 Intel CSME 16.x 固件内部结构,并提供了一个零依赖的 Python 脚本通过 HECI 直接查询 ME。

Stars

6

7 天增长

暂无数据

Fork 数

1

开放 Issue

0

开源协议

暂无数据

最近更新

2026-07-30

AI 仓库情报摘要
FR-AI / ANALYSIS

为什么值得关注

该项目公开了 Intel ME/CSME 16.x 此前少有记录的内部细节,包括固件分区映射、证书链、模块清单和内存泄漏发现,同时发布了任何人都能运行的 HECI Spy 脚本。

适合谁使用

  • 硬件安全研究人员
  • 固件逆向工程师
  • BIOS/UEFI 开发者
  • 关注 Intel ME 的隐私与安全爱好者

典型使用场景

  • 学习 Intel ME 架构和 CSME 16.x 内部结构
  • 在 Windows 主机上审计或监控 ME 通信
  • 固件取证与证书链分析
  • 用真实案例进行硬件安全教学

项目优势

  • 提供 heci_spy.py——零依赖 Python 脚本,可通过 HECI/MKHI 查询实机 ME
  • 详细记录了 IFWI 文件系统、内部模块、证书和安全功能映射
  • 基于真实硬件的实证研究,并明确记录了设备与固件版本
  • 包含修复后的 MEAnalyzer 支持和多个分析脚本,便于复现

使用前须知

  • heci_spy.py 仅支持 Windows,需要 Python 3.6+ 并以管理员身份运行
  • 所有发现来自单一联想笔记本和 CSME 16.0.15.1735 固件版本
  • “世界首创”声明为项目自述,未经独立验证
  • 硬件安全锁阻止修改或禁用,限制了实际可操作空间

README 快速开始

Intel ME Firmware Reverse Engineering — Live CSME 16.x Analysis

"Your computer has a secret second computer inside it. We found it, mapped it, and documented what's hiding in there."

🔥 TRY IT YOURSELF — HECI SPY 🔥

One Python script. Zero dependencies. Talk to your Intel Management Engine directly.

python scripts/heci_spy.py
# Requirements: Windows, Python 3.6+, Run as Administrator

What it does:

  • Auto-detects your Intel HECI/MEI device
  • Connects to the ME via MKHI protocol
  • Queries firmware version, partition manifest, and hidden values
  • Finds the memory leak — GEN.1B returns a different value every run
  • Saves a shareable report with full raw hex log

Just ran it on a Lenovo IdeaPad Gaming 3 (i7-12650H, CSME 16.0.15.1735):

MKHI v3.1 | FW 16.0.1735.15 | 8 partitions found | GEN.1B: 0x00C344CA (changes each run!)

We confirmed: 7/12 MKHI commands respond. The ME is alive, talking, and leaking memory.

▶️ Watch the 35-second demo(right-click save-as, or upload to YouTube for inline playback)

📊 View the full 21-slide presentation


🏆 WORLD-FIRST CLAIM

This is the first-ever public disclosure of the complete internal structure of Intel CSME 16.x (Alder Lake) firmware, decoded from live hardware.

Nobody has ever published:

  1. The complete IFWI filesystem map — 80 internal paths of CSME 16.x
  2. The exact hardware configuration — JSON config blocks showing laptop wiring
  3. The full X.509 certificate trust chain — 13 certificates decoded
  4. The ROM Bypass boot mechanism — how ME boots before your BIOS
  5. The ME capability map — 11 access domains from firmware evidence
  6. 28 security structures mapped from live firmware
  7. ~2.9MB of readable firmware from a live Intel CSME 16.x system

All from a Lenovo IdeaPad Gaming 3 with Intel Core i7-12650H (12th Gen Alder Lake).

TL;DR

Intel Management Engine (ME) is a hidden microcontroller built into every modern Intel CPU. It runs its own operating system, has its own processor (Synopsys ARC EM), and operates 24/7 — even when your PC is completely shut down. Most people know it exists. Almost nobody has looked inside it.

**This project

项目描述

Talk to your Intel Management Engine directly — zero-dependency Python tool. Finds memory leaks, partition manifest, live MKHI probing. First public HECI Spy.

相关仓库与替代方案

根据分类、Topic 和编程语言匹配的相似项目。

lopopolo
精选
lopopolo GitHub avatar

harness-engineering

Harness Engineering is a methodology for improving coding agent outputs by carefully crafting the environment around them—providing curated context, tools, and executable constraints that encode an organization’s nonfunctional requirements and cumulative lessons.

AI 与机器学习AI 智能体
2,390
slvDev
精选
slvDev GitHub avatar

esp32-ai

A 28.9 million parameter language model runs on an $8 ESP32-S3 microcontroller entirely on-device, generating simple stories at about 9.5 tokens per second.

AI 与机器学习大语言模型
1,960
littledivy
精选
littledivy GitHub avatar

mimic

mimic captures traffic from any iOS or web app and automatically generates a Python client library that lets you call the app's API like a regular library.

AI 与机器学习
1,482