[FIRMWARE] Intel ME (H470/Z490)

[L-Sakata]

Hi everyone,

- Intel ME Consumer Firmware :
snip
Hardware requirements : Motherboards with Intel Z490 chipset.

Hey there.

I've been going round and round with support, for over a week, about the IntelME update at https://rog.asus.com/motherboards/ro...helpdesk_bios/

Version 14.0.45.1389V2.1
2020/10/29 4.93 MBytes
MEUpdateTool
Intel has identified security issue that could potentially place impacted platform at risk.
Use ME Update tool to update your ME.
*We suggest you update ME Driver to the latest Version 14.0.45.1389V2.1 simultaneously.
Please download the file and check the MD5 code first.
MD5: a326d4ad928cc054d970924b50e7b6d6

MD5 matched up, unzipped the archive, and see a bunch of crap that doesn't even appear to have a bin file to flash, but figure maybe I'm out of touch. Run the MEUpdateTool.exe and at first it just crashes without error. Figured out the system was blocking the DLL files included. Turns out these weren't packaged quite right, but... MD5 matches, its from official site, I must really be out of touch. Unblock the DLLs, and re-run the MEUpdateTool. This time is crashes anyways, and presents two errors, the first of which is ASIO.sys missing, then another that I can't recall.

So I'm looking at your package, and it actually looks like a firmware update! I do note the date is a bit older, and I'm not seeing a v2.1 bit on the tail. Not sure if it matters, but figure there had to be a reason they uploaded it on 2020/10/29, so was wondering a couple of things:

First, if you check this stuff, and I'm not just being dumb, maybe you have a bit more influence, or the correct channel, to get them to update the official package? Nothing against you, but I'm a bit suspicious of stuff hosted on some free file sharing service, or an unofficial channel in general. You also don't have a hash to check against in your post, so there's absolutely no telling if what you uploaded has been tampered with by the time I get it.

Second, if the official package is correct, do you happen to have any idea what AsIO.sys is, where it can be obtained? I'm wondering if I'm missing a critical driver somewhere, and support... I'm not sure if they're even reading the support ticket, or understand what I'm saying, either due to language barrier, or because I'm dealing with the B-team lvl1 support people still. They're asking for BIOS screenshots, to see what version of ME I have, which I already know to be old (and have several active CVEs affecting it) which is why I was downloading the update program to begin with! FFS!

Third, I noted in the official download that they recommend some driver be downloaded, that appears to be a ghost. Don't see any other ME packages with a 'driver', nor am I aware that one is required? Intel itself doesn't appear to have released a 'driver' for ME since 8th gen CPUs (https://downloadcenter.intel.com/pro...agement-Engine). Also, this kind of update, if needed or existing, should already be in the package to update firmware anyhow?!

Thanks for taking your time to read this. Hopefully I communicated clearly -- I'm a bit frustrated (with ASUS, not you), but hope that hasn't made me seem like a jerk.

[geneo]

Yeah that package from Asus was a hot mess, though I did manage to flash it, no thanks to Asus. This came a little late for me but thanks again for supplying these MoKiChU!

[L-Sakata]

So I just got off the phone with an ASUS rep. While it didn't seem that he had the tech chops to know how to look at the zip file and get it sorted, he did keep me doing nothing else long enough to look at things myself. While going through the phone call, I sent OPs file over to virustotal, which came up clean, downloaded it, and checked out the folder structure, and the batch file OP has in there. Checked against the official file and... it would appear some doofus packaged the wrong folder to start.

BTW, OP - interesting take on how to check for admin. This might interest you. It's way longer, but a bit more elegant. It self-elevates. Scroll down to the code block: https://stackoverflow.com/questions/...-administrator

So anyhow, it would appear that ASUS's Intel ME update package does have the BIN file already in it, inside the .\FW folder. They just have the switches for the updater in the batch file wrong... looks like someone started to try and make something elegant and gave up after 2 lines :P

So if you're a bit squirrely about installing packages from a sharing site like I am, you can edit the batch file to replace this line:

.\FWUpdLcl64.exe -FWVER ME.bin >> version_file

with this one:

FWUpdLcl64.exe -F ME.bin

You can run the OP's original command as well, but be forewarned - it will reboot without confirmation whatsoever once done! I'm also unsure why OP used the "Allow same version" switch, but imagine they had a reason.

FWUpdLcl64.exe -FORCERESET -ALLOWSV -F ME.bin

Also, it would appear that as of this post, the file OP uploaded is perfectly fine. I downloaded and validated the hashes of the files:

CertUtil -hashfile .\FWUpdLcl64.exe
SHA1 hash of .\FWUpdLcl64.exe:
e354a30c74ca6c9d7cfb81e21041315825242bb3
CertUtil: -hashfile command completed successfully.

CertUtil -hashfile .\14.0.45.1389.bin
SHA1 hash of .\14.0.45.1389.bin:
6b310680926e74fdc9e3fa1fc29134a1e5cde0e3
CertUtil: -hashfile command completed successfully.

CertUtil -hashfile .\FWUpdLcl64.exe
SHA1 hash of .\FWUpdLcl64.exe:
e354a30c74ca6c9d7cfb81e21041315825242bb3
CertUtil: -hashfile command completed successfully.

certutil.exe -hashfile .\ME.bin
SHA1 hash of .\ME.bin:
6b310680926e74fdc9e3fa1fc29134a1e5cde0e3
CertUtil: -hashfile command completed successfully.

ASUS should hire OP. If they can afford them...

[L-Sakata]

Hey @MoKiChU
Since your update BIN is the *exact same* as the one they have in official package, figured I'd ask you about something odd I noticed while testing, to get you an updated script -- I'm not sure if it's a BIOS issue, or ME issue:

PS D:\Users\sakata\Downloads\Intel_ME_v14.0.45.1389> .\FWUpdLcl64.exe -save ME-FW-backup.bin
Intel (R) Firmware Update Utility Version: 14.0.45.1389
Copyright (C) 2005 - 2020, Intel Corporation. All rights reserved.


Error 357: Restore Point Image was requested, but it is not allowed because CSE is in Recovery Mode.

Error 329: Restore Point Image Failure. Reboot may be required.
PS D:\Users\liath\Downloads\ME_Intel_v14.0.45.1389>

I'm hoping that the Intel FW updater tool is just being weird, or there is something simple to fix.

Any ideas?

[edit] Here you go, if you're interested - I updated the install script.

https://gist.github.com/Sakata-MC/7e...c99d2d28b17b8d

Probably a little overkill, but it makes some parts easier to deal with.
-Automatically requests elevation if it is not started with elevation.
-Can just edit the 5th line when putting out a new update.
-Does a backup of the current FW *before* going ham.... or attempts to, I get the above error, but I'd already updated FW and BIOS.
-Handles errors a bit more gracefully. Also shuts down a little better than the -forcereset option does.
-Has a little bit of C.Y.A. -- just in case.

[toouur]

I have the same error
Error 23: Communication error between application and Intel(R) ME module.
Error 329: Restore Point Image Failure. Reboot may be required.

[L-Sakata]

I have the same error
Error 23: Communication error between application and Intel(R) ME module.
Error 329: Restore Point Image Failure. Reboot may be required.

Could you provide a little more info? Does it not back up before you installed ME firmware, or after?
Also, what BIOS are you running? Did you run the backup command on your own or save my version of the script and run it? And with official firmware image, or the (should be identical) version from here?
I forgot to mention that myself; I'm running 0901. 0807 before. Not sure if any of the firmware versions could be backed up; I learned there was a backup function while writing the script update and testing it...
@OP: hoping you'll see this and say least be able to allay my fears of corrupt firmware.

[toouur]

Could you provide a little more info? Does it not back up before you installed ME firmware, or after?
Also, what BIOS are you running? Did you run the backup command on your own or save my version of the script and run it? And with official firmware image, or the (should be identical) version from here?
I forgot to mention that myself; I'm running 0901. 0807 before. Not sure if any of the firmware versions could be backed up; I learned there was a backup function while writing the script update and testing it...
@OP: hoping you'll see this and say least be able to allay my fears of corrupt firmware.

Didn't backup before (I believe because of the same communication error)
I ran with 0901 (I am 1002 now)
I used your script
I tried both

I uninstalled me completely from device manager and the drivers reinstalled successfully but I just can't update further (neither driver nor firmware)

ps. I do not think my me firmware is corrupted or smth like that

[DirtyShady]

Hi MoKiChU

I found a new firmware :

Intel Management Engine (ME) Firmware Version 14.0.47.1482 (S-H)

here :

https://www.station-drivers.com/inde...d=4690&lang=fr

It's possible you update your auto install ?

Thanks

[hsm06]

Hi MoKiChU

I found a new firmware :

Intel Management Engine (ME) Firmware Version 14.0.47.1482 (S-H)

here :

https://www.station-drivers.com/inde...d=4690&lang=fr

It's possible you update your auto install ?

Thanks

This is "Corporate" 5M Version .
As far as I think this is for OEM hosts (such as HP/DELL).

Perhaps the latest version available is v14.0.46.1431 (Intel CSME 14.0 Consumer PCH-H A Firmware v14.0.46.1431)
source: https://www.win-raid.com/t596f39-Int...tem-Tools.html

In MSI MEG Z490 GODLIK, I saw that the beta bios(7C70v161) has 14.1 me fw .

[DirtyShady]

This is "Corporate" 5M Version .
As far as I think this is for OEM hosts (such as HP/DELL).

Perhaps the latest version available is v14.0.46.1431 (Intel CSME 14.0 Consumer PCH-H A Firmware v14.0.46.1431)
source: https://www.win-raid.com/t596f39-Int...tem-Tools.html

In MSI MEG Z490 GODLIK, I saw that the beta bios(7C70v161) has 14.1 me fw .

Ok no problem,

I have an MSI MPG Z490 Gaming Edge Wifi, no new beta bios yet...