6 ms·

I one purchased a Coffee Lake SFF PC from eBay from a fleet reseller, and I discovered a "ME DISABLED" sticker on the chassis when I received it. Sure enough,

by dannyw 2y ago

I one purchased a Coffee Lake SFF PC from eBay from a fleet reseller, and I discovered a "ME DISABLED" sticker on the chassis when I received it. Sure enough, every single software tool, or the BIOS/UEFI itself suggests ME is disabled, or does not exist at all. 'Features' requiring ME like Intel SGX appear as not supported. I'm not sure how exactly they did it, and/or if there are any other modifications made to the system, but digging further is beyond my skill level. My theory, with no evidence, is that this is an ex-govt (security/defense?) PC that somehow got sold.

neilv 2y ago
IIRC, there was a non-publicly-known switch to turn off IME, for government purposes, which became publicly-known. There have also been efforts to delete just part of IME from the flash. A couple links: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner https://doc.coreboot.org/northbridge/intel/sandybridge/me_cleaner.html https://doc.coreboot.org/northbridge/intel/sandybridge/me_cl... On X200-era systems, however, you can remove IME entirely from the flash, which is what I did. I put only Coreboot and GRUB2 on the flash, but you can add SeaBIOS to that, if you want more PC BIOS facilities and options available. (So I stockpiled a few backup units of the X200, before they disappeared from the market, or the available units got too beaten up or expensive.)
- vel0city 2y ago
  I seen to recall having some Thinkpads which had a firmware setting that would irrecoverably break the management engine. It had a lot of scary warnings about disabling it, and likewise features like SGX wouldn't work properly from what I could tell. I think they were T460S'es, but I could be misremembering.
  - divingdragon 2y ago
    There is an official way to completely disable and remove Computrace (which I did on my T480), but I don't remember anything that allowed removing ME.
deleted 2y ago
[deleted]

by dannyw 2y ago

neilv 2y ago

IIRC, there was a non-publicly-known switch to turn off IME, for government purposes, which became publicly-known. There have also been efforts to delete just part of IME from the flash. A couple links: https://github.com/corna/me_cleaner https://github.com/corna/me_cleaner https://doc.coreboot.org/northbridge/intel/sandybridge/me_cleaner.html https://doc.coreboot.org/northbridge/intel/sandybridge/me_cl... On X200-era systems, however, you can remove IME entirely from the flash, which is what I did. I put only Coreboot and GRUB2 on the flash, but you can add SeaBIOS to that, if you want more PC BIOS facilities and options available. (So I stockpiled a few backup units of the X200, before they disappeared from the market, or the available units got too beaten up or expensive.)

vel0city 2y ago
I seen to recall having some Thinkpads which had a firmware setting that would irrecoverably break the management engine. It had a lot of scary warnings about disabling it, and likewise features like SGX wouldn't work properly from what I could tell. I think they were T460S'es, but I could be misremembering.
- divingdragon 2y ago
  There is an official way to completely disable and remove Computrace (which I did on my T480), but I don't remember anything that allowed removing ME.

deleted 2y ago

[deleted]