UEFI firmware image viewer and editor

This Intel Management partition contains boot code for the Integrated Sensors Hub (ISH) and is digitally signed by the OEM.

This Intel Management partition contains various OEM-provided public keys for signing data.

This Intel Management partition provides ARC firmware for the Power Management Controller (PMC).

This Intel Management partition provides a flash log that contains error and warning messages generated by ME modules, the data written here is a subset of the data output to the Tracehub.

This Intel Management partition is used to request the reset of Private RTC (PRTC) which store some ME runtime data. It is probably only used during firmware update. Only the first DWORD #1 (offset 4) has meaning. If it is 0x55555555 then the RBE module zeroes the PRTC during platform startup.

This Intel Management partition stores ROM Boot Extensions (CSE-RBE) and is digitally signed by Intel.

This Intel Management high volume manufacturing partition is used by manufacturers to override the default SKU configuration (features of Q/H/Z chip versions) burned in fuses for a particular Platform Controller Hub (PCH). It is a new feature of CSME 12 firmware for CannonPoint chipsets.

This Intel Management block partition stores an OEM unlock token used to unlock debugging for the ME or Integrated Sensor Hub (ISH). This token is cryptographically signed by either the Intel private key or by an OEM private key, granting a level of access depending on which key was used. GREEN access is the default, when no UTOK is present and only allows TraceHub tracing and debug of the host CPU. ORANGE unlock allows debug of the Intel Sensor Hub, and RED unlock allows debugging the ME but will clear secrets from its memory before doing so.

This Intel Management partition is a code Non-Fault Tolerant Partition and provides additional code to the BUP. It is digitally signed by Intel.

This Intel Management partition stores a file system that contains ME-related data stored between runs. The low-level MFS implementation does not support file names or sizes. Files are identified by numbers.

This Intel Management encrypted block partition is used for “warm” start (like hibernate restoration) and is integrity protected with HMAC. It is unique for each platform (PCH-chip) and each boot.

This Intel Management partition is a Fault Tolerant Partition (FTP) code partition. Digitally signed processes of the correct type are started from this module, much like autorun. It is digitally signed by Intel.

This optional Intel Management partition stores the previous SVN (Secure Version Number) value and is used to calculate “previous security keys”. It must be impossible to install ME firmware with previous SVN without direct writing SPI Flash with chip programmer. Updates to the SVN causes alteration of related security keys. Having access to both “previous” and “current” keys allows migration of the MFS file system from old to new keys.