Intel ME: Flash File System Explained

on YouTube ↗53m

" summary

Explains the ME 11.x on-flash layout with precise constants: 8 KB pages, every 12th page is a system page, 64-byte payload chunks, 120/122 chunks per page, two-byte CRC and a 52‑byte integrity trailer. Provides extraction tools (GitHub project to split images and a vendor FIT resource) and counts: up to 2056 file slots, SVN versions up to 3, and typical flash erase lifetimes. Key finding: a GEN partition allows deriving non-Intel keys so protected files can be decrypted and an ME-stored remote-access password was recovered.

AI-written summary · about

" chapters (24)

1. 0:00Intro
2. 3:24black hat ME Position in Computer System
3. 5:18black hat MFS Partition Layout
4. 6:19black hat Flash Memory Characteristics
5. 7:55black hat Flash File System Design Goals
6. 9:14black hat Recommended Materials
7. 11:06black hat MFS Pagination
8. 14:11black hat Page Chunks Single Chunk (66 bytes)
9. 15:15black hat System Pages
10. 17:35black hat Data Pages
11. 18:31black hat Data Area Reconstruction
12. 19:10black hat System Area Reconstruction
13. 22:18black hat Data Extraction from Files
14. 24:34black hat MFS Templates from fit.exe
15. 26:41black hat Special Files
16. 30:18black hat intel.cfg (fitc.cfg) Structure
17. 32:51black hat intel.cfg Partial Dump
18. 33:40black hat MFS Directory
19. 36:46black hat Integrity, Encryption, Anti-Replay
20. 39:57black hat FS Security Keys
21. 43:09black hat Crypto Engine / Usage Practices
22. 45:54black hat Key Derivation and Usage
23. 49:52black hat File System Types in VFS
24. 51:35black hat Black Hat Sound Bytes

" related talks

• 47mHow To Dump, Parse, And Analyze i.MX Flash Memory ChipsDamien Cauquil · HITBSecConf 2019 Amsterdam
• 01h 13mIs there an EFI monster inside your apple?Pedro Vilaça · CODE BLUE 2015
• 53mBehind the Scenes of Intel Security and Manageability EngineShai Hasarfaty, Yanai Moyal · Black Hat USA 2019
• 49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded ControllerAlex Matrosov, Alexandre Gazet · Black Hat USA 2019
• 23mMeltdown: Reading Kernel Memory from User SpaceMoritz Lipp · USENIX Security '18
• 36mFrom Raw To Refined: The Evolution of Raw Flash Support in LinuxMiquèl Raynal · Open Source Summit Europe 2025
• 45mReverse Engineering Flash Memory for Fun and BenefitMatt Oh · Black Hat USA 2014
• 35mAn Insight into the Advanced XIP Filesystem (AXFS)Aaditya Kumar · Embedded Linux Conference 2013