Qubes and Intel Management Engine

In the ifd (Intel Firmware Descriptor) region of the ROM you need to set a single bit, this will tell ME to shut down after the boot sequence is completed, this is the same as using me_cleaner with the -s option.

The offset of the HAP bit changes with every version of ME, but if you know the offset of the version you are using, you can just dump the ROM and use a hex editor to set the bit. Because the bit is in the ifd region and doesn’t change the BIOS or ME regions, it can be done with any bios firmware.

The Dasharo firmware has a feature in the bios menu that allows you to set the HAP bit, without have to worry about editing and flashing the firmware.

This is a good resource for ME info

4 Likes