Skip to content

Commit 009fff4

Browse files
pal1000pal1000
committed
Initial release.
0 parents  commit 009fff4

3 files changed

Lines changed: 83 additions & 0 deletions

File tree

‎FWUpdate.bat‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
@echo off
2+
3+
:: BatchGotAdmin
4+
:-------------------------------------
5+
REM --> Check for permissions
6+
IF "%PROCESSOR_ARCHITECTURE%" EQU "amd64" (
7+
>nul 2>&1 "%SYSTEMROOT%\SysWOW64\cacls.exe" "%SYSTEMROOT%\SysWOW64\config\system"
8+
) ELSE (
9+
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"
10+
)
11+
12+
REM --> If error flag set, we do not have admin.
13+
if '%errorlevel%' NEQ '0' (
14+
echo Requesting administrative privileges...
15+
goto UACPrompt
16+
) else ( goto gotAdmin )
17+
18+
:UACPrompt
19+
echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
20+
set params = %*:"=""
21+
echo UAC.ShellExecute "cmd.exe", "/c ""%~s0"" %params%", "", "runas", 1 >> "%temp%\getadmin.vbs"
22+
23+
"%temp%\getadmin.vbs"
24+
del "%temp%\getadmin.vbs"
25+
exit /B
26+
27+
:gotAdmin
28+
pushd "%CD%"
29+
CD /D "%~dp0"
30+
:--------------------------------------
31+
set fwupdate=FWUpdLcl
32+
if %PROCESSOR_ARCHITECTURE%==AMD64 set fwupdate=%fwupdate%64
33+
set fwupdate=%fwupdate%.exe
34+
35+
echo Easy launcher for Intel ME Firmware update tool (FWUpdate)
36+
echo ----------------------------------------------------------
37+
set /p firmwarefilename=Enter firmware filename:
38+
set firmwarefilename="%firmwarefilename%"
39+
echo.
40+
if NOT EXIST %fwupdate% set fwupdate=%fwupdate:64=%
41+
if NOT EXIST %fwupdate% echo FWUpdate tool is missing.
42+
if NOT EXIST %fwupdate% GOTO exit
43+
%fwupdate% -f %firmwarefilename%
44+
:exit
45+
pause
46+
exit

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2017 pal1000
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎readme.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
### Easy launcher for Intel ME Firmware update tool
2+
This script slightly reduces the complexity of the task of updating Intel Management Engine firmware or related AMT/TXE/SPS when the manufacturer of the system fails to update it with security patches like [NTEL-SA-00086](https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr).
3+
### Step by step patching of Intel ME vulnerabilities (standard)
4+
- Check if you are vulnerable by running NTEL-SA-00086 assessment tool available for download on the link above. If you are, take note of your Intel ME/AMT/TXE/SPS firmware version reported by the tool and continue with next step. This is needed in case you get to the advanced phase.
5+
- Check if your motherboard manufacturer provides firmware/BIOS update if your system is custom-build or the manufacturer of your system (OEM) otherwise (ex: Dell, Lenovo, Acer, Asus, LG, etc). If no firmware / BIOS update is available, mostly on aging systems, the next steps in the advanced section will help you patch it without OEM or motherboard manufacturer assistance.
6+
### Step by step patching of Intel ME vulnerabilities (advanced)
7+
To patch the Intel ME firmware we need 4 pieces of software:
8+
- Up-to-date Intel MEI or SOL driver. Depends on your system. Look in Device Manager - System devices. Corporate users that actively use ME features need to install/update both driver and software. MEI/SOL drivers and software are available at [win-raid forums](https://www.win-raid.com/t596f39-Intel-Management-Engine-Drivers-Firmware-amp-System-Tools.html)
9+
- This script. It makes the firmware update easy, requiring a simple double-click. No Run As Admin is required, elevation request via UAC is done automatically. On execution this script only asks for the firmware filename. Usually a .bin filename. Note that if you copy-paste the firmware filename you need to manually add the extension too.
10+
- The updated firmware. Here the ME firmware version reported by Intel vulnerability assessment tool comes into play. From that version we must extract its branch. It is usually the first 2 numbers from the version string. Some ME firmware branches have multiple variants. You have to identify the correct one for your system. Again Intel vulnerability scanner can help with that as well. A detailed step-by step process along with the firmware catalog is available at win-raid forums.
11+
- The firmware update tool for your ME firmware branch is also available at win-raid forums.
12+
13+
This script and firmware update tool must be on the same folder. To ease things up the firmware filename should be placed there too.
14+
15+
16+
On corporate environment the ME keys should also be renewed see the win-raid forum thread from above.

0 commit comments

Comments
 (0)