If only they would allow 7th gen Intel CPU's... sigh. M$ is so smart... like when they fail security in-house... lol

www.pcgamer.com/a-driver-containing-rootkit-malware-was-certified-by-microsoft/

Reminds me of how Intel CPU's include that secretive ME (Remote Management Engine) embedded 2nd micro-processor, whilst PC's designed for High Assurance Platform (government purposes) get the ability to turn the "security feature" off for... security reasons... ;)

lynx29If only they would allow 7th gen Intel CPU's... sigh. M$ is so smart... like when they fail security in-house... lol

www.pcgamer.com/a-driver-containing-rootkit-malware-was-certified-by-microsoft/

Fun fact, many of the 8th gen U-series cpus are supported and those are Kaby Lake R.
Meanwhile the 7900X from Q2 2017 is not supported while Xeon 8180 from Q3 is. Both of these being Skylake.
Microsoft literally drew a line in the sand at around mid 2017.

This is related to countries that don't allow certain "foreign" crypto technology or that are on lists that ban export of such technology to said countries.

ZubasaFun fact, many of the 8th gen U-series cpus are supported and those are Kaby Lake R.
Meanwhile the 7900X from Q2 2017 is not supported while Xeon 8180 from 3 is. Microsoft literally drew a line in the sand at around mid 2017.

Same as Ryzen 1000 not been support while 2000 series is, and it's the same cpus

BSim500Reminds me of how Intel CPU's include that secretive ME (Remote Management Engine) embedded 2nd micro-processor, whilst PC's designed for High Assurance Platform (government purposes) get the ability to turn the "security feature" off for... security reasons... ;)

Some consumer motherboards have an option to disable the M.E.
I know mine does and it is disabled.

ZubasaFun fact, many of the 8th gen U-series cpus are supported and those are Kaby Lake R.
Meanwhile the 7900X from Q2 2017 is not supported while Xeon 8180 from Q3 is. Both of these being Skylake.
Microsoft literally drew a line in the sand at around mid 2017.

well...not literally, but we get your point

m$ does it again, think they know whats best for everyone and forces you to buy into it.

Caring1Some consumer motherboards have an option to disable the M.E.
I know mine does and it is disabled.

BSim500Reminds me of how Intel CPU's include that secretive ME (Remote Management Engine) embedded 2nd micro-processor, whilst PC's designed for High Assurance Platform (government purposes) get the ability to turn the "security feature" off for... security reasons... ;)

HAP bit is literally present on every ME ever made. There just isn't neccesarily a bios menu option for it, but it can still be toggled.

It's also not a "second processor." It's your same processor, running code with above admin level priviledges.

....and there we go, this was inevitable. Of course the first official offering from Microsoft to the public will be full of false caveats and requirements to entice trick users into using a Microsoft account and giving Microsoft even more hardware authority over a system than they already have. The TPM 'requirement' is just stronger identification and control of your OS license and despite TPM having beneficial security uses for a user, its only real high-profile press coverage so far been (ab)use by OEMs taking advantage of the "trust" in TPM to push their own software/firmware without requiring user consent.

So many people are still using older systems that don't have TPM built in and Microsoft doesn't want to lose those users so W11 variants without the draconian requirements weren't just expected, they are practically guaranteed.

You may have to jump through some hoops to legally obtain these versions, just like you had to for the old LTSB licenses. However, the ole' Mary Celeste will still no doubt be a backup for people with ethics as shady as Microsoft's.

I can see this turning into a real shit show pretty quick..

I'm loving windows 11 !! On dev mode. Took less than 5 minutes today. So far ,so good.
Seamless upgrade from existing W/10 install . Way to go MS.

ozzyozzysecret.club/2021/06/28/windows11-tpms.html

I knew TPM was more bad than good and has been abused multiple times by OEMs in the past, but I didn't consider that it'll be used as DRM against you.... :\

R-T-BIt's also not a "second processor." It's your same processor, running code with above admin level priviledges.

It is a second processor. It always has been. It lives in the chipset and since Skylake is also a x86.
From Wikipedia:

The Intel Management Engine (ME), also known as the Intel Manageability Engine,[1][2] is an autonomous subsystem that has been incorporated in virtually all of Intel's processor chipsets since 2008.[1][3][4] It is located in the Platform Controller Hub of modern Intel motherboards.

ncrsIt is a second processor. It always has been. It lives in the chipset and since Skylake is also a x86.
From Wikipedia:

It used to be a seperate arc core on the chipset but it hasn't been since X58, when it both became x86, minix based, and on your general cpu. Keep in mind, I'm one of the chief researchers in the effort to disable the Intel ME in firmware, so I know a lot more than wikipedia.

R-T-BIt used to be a seperate arc core on the chipset but it hasn't been since X58, when it both became x86, minix based, and on your general cpu. Keep in mind, I'm one of the chief researchers in the effort to disable the Intel ME in firmware, so I know a lot more than wikipedia.

And yet what you wrote is wrong, because ME was never located on the CPU itself. Obviously Intel themselves are wrong about where they put it:


Also how come AMT is functional with the CPU not in the socket? :)

ncrsAlso how come AMT is functional with the CPU not in the socket?

AMT is a vPro technology which does feature a chipset coprocessor. It is somewhat seperate from the core Intel ME suite but interacts with it fully. And interestingly, all modern chipsets do have this coprocessor, but it is off by default in consumer SKUs. You can toggle it on with some hackery to the image but I don't really desire out of band management.

I know what Intel says but I've been through the minix binaries and it's quite clear where the core ME binaries (as well as the watchdog) run.

Intel also claimed for years the HAP bit was non-existant. They aren't beyond telling what is in generous terms, a simplified version of the truth.

Fun fact while we are at it: their RAID solution is run on your primary cpu, too.

R-T-BAMT is a vPro technology which does feature a chipset coprocessor. It is somewhat seperate from the core Intel ME suite but interacts with it fully. And interestingly, all modern chipsets do have this coprocessor, but it is off by default in consumer SKUs. You can toggle it on with some hackery to the image but I don't really desire out of band management.

I know what Intel says but I've been through the minix binaries and it's quite clear where the core ME binaries (as well as the watchdog) run.

Intel also claimed for years the HAP bit was non-existant. They aren't beyond telling what is in generous terms, a simplified version of the truth.

Fun fact while we are at it: their RAID solution is run on your primary cpu, too.

You are aware that what you wrote has no sources other than: trust me bro.
You claim to be a researcher, why haven't you edited the wikipedia article citing your published papers yet? What you wrote directly contradicts it, and Intel's documentation. This is a genuine question, not mockery.

ncrsYou are aware that what you wrote has no sources other than: trust me bro.

Yes. I no longer work on this (am employed elsewhere now) but people on this forum remember my work and successes. The threads are still here too, most recently ASrock boards pretty sure.

Feel free to look up my modified images. And if you still don't buy it, tough but not much I can do. I was a researcher who made images, not papers, so nothing to find. But my username is known amognst just about every ME researcher out there, FWIW.

As for why I haven't corrected wikipedia, probably because they'd have to start paying me. I'm a very busy man now.

I don't mean this rude. You are correct to be skeptical. I am just unsure what more I can provide, sorry. Good on you not taking things at face value though. I mean that honestly.

R-T-BYes. I no longer work on this (am employed elsewhere now) but people on this forum remember my work and successes. The threads are still here too, most recently ASrock boards pretty sure.

Feel free to look up my modified images. And if you still don't buy it, tough but not much I can do. I was a researcher who made images, not papers, so nothing to find. But my username is known amognst just about every ME researcher out there, FWIW.

As for why I haven't corrected wikipedia, probably because they'd have to start paying me. I'm a very busy man now.

I don't mean this rude. You are correct to be skeptical. I am just unsure what more I can provide, sorry. Good on you not taking things at face value though. I mean that honestly.

Alright, I understand. I'm just surprised that nobody from the ME research community wanted to fix the publicly available misinformation on the wikipedia page. Like... literally nobody? There must be tons of PhD students interested in this, willing to score easy points and having the civic duty to fix this.

(But you're not too busy to reply to my posts on this forum tho ;) )

ncrsBut you're not too busy to reply to my posts on this forum tho

Never. TPU is half the reason I have my current job. Besides, it's far too hot to work today:


Wikipedia isn't honestly a haven for firmware researchers. You may try win-raid.com forums. I think plutomaniac could help you. You could also look into if the author of me_cleaner is still about, he may remember my work. May not, too. Hard to say we didn't talk much (probably why his user handle is escaping now)

ncrsThere must be tons of PhD

Nope. I think only one of us finished college. Firmware stuff is reverse engineering galore and colleges don't like to touch it. Too many grey areas.

EDIT: It appears I forgot about this hackaday article on my work on the Taichi boards... something maybe?

hackaday.com/2020/06/16/disable-intels-backdoor-on-modern-hardware/

R-T-BNever. TPU is half the reason I have my current job. Besides, it's far too hot to work today:


Wikipedia isn't honestly a haven for firmware researchers. You may try win-raid.com forums. I think plutomaniac could help you. You could also look into if the author of me_cleaner is still about, he may remember my work. May not, too. Hard to say we didn't talk much (probably why his user handle is escaping now)


Nope. I think only one of us finished college. Firmware stuff is reverse engineering galore and colleges don't like to touch it. Too many grey areas.

All the materials I can find for Blackhat, USENIX point to ME being in the chipset. Even Intel presented that on Blackhat 2019. Maybe the reason you thought Minix runs on the CPU is the fact that it actually runs on a modified i486 embedded into the chipset since Skylake?
Why would Intel lie about this on the biggest security-focused conference?

ncrsMaybe the reason you thought Minix runs on the CPU is the fact that it actually runs on a modified i486 embedded into the chipset since Skylake?

Actually, that is possible admitedly because the Minux binaries are single threaded. But they also are x64, and I guess the core contention I have is that I find it unlikely they could stuff that in the chipset without a thermal envelope that is unacceptably large. Maybe atom is way better than the old day, I am not really as up to date on architectures as I once was.

Also, spectre style exploits work on protected enclaves, suggesting what is running them indeed is an out of order cpu, at least. Are atoms out of order? I thought they weren't.

I guess I'll back off a little and admit this: anything is possible but I don't find it likely.

ncrsWhy would Intel lie about this on the biggest security-focused conference?

My only guess is if they are lying, they don't see it as lying. The firmware itself lives in the bios chip which connects directly to the PCH. Maybe they consider that when they say the ME "lives" there. But it's just speculation.

R-T-BActually, that is possible admitedly because the Minux binaries are single threaded. But they also are x64, and I guess the core contention I have is that I find it unlikely they could stuff that in the chipset without a thermal envelope that is unacceptably large. Maybe atom is way better than the old day, I am not really as up to date on architectures as I once was.

Also, spectre style exploits work on protected enclaves, suggesting what is running them indeed is an out of order cpu, at least. Are atoms out of order? I thought they weren't.

I guess I'll back off a little and admit this: anything is possible but I don't find it likely.


My only guess is if they are lying, they don't see it as lying. The firmware itself lives in the bios chip which connects directly to the PCH. Maybe they consider that when they say the ME "lives" there. But it's just speculation.

The presentation I linked shows very clearly that the chipset hosts ME.
The x64 parts of the Minix firmware could be explained by slide 9 which shows that during bring-up, more specifically DRAM init, there is a part of ME running on the host CPU called ACM. But even after the host OS is started, ME services keep living on the embedded i486.

Security enclaves, as in SGX? That indeed does live in the CPU, as in the code runs there (the SDK and public info confirms this), but is managed by ME from the chipset. I am not aware of any speculative execution exploit that managed to break into the ME part. If you are I'd appreciate some links or even keywords.

Edit: the entire presentation is very technical, I'll have to watch the recording of it later on, but I'm surprised Intel shared this much publicly.