Intel ME (Manageability engine) 6.x Huffman algorithm
Starting at version 6 the "firmware" for the Intel manageability engine uses a custom compression scheme. As explained in various publications by Igor Skochinsky. The details of the compression scheme however remained unknown until now. A lot of it though is only confirmed for ME 6.x and incomplete.scheme details:
- basic huffman, prefix free codes translate one to one into plain text
- different dictionaries for each major version(6.x, 7.x,...)
- dictionaries are not present in firmware
- there are two dictionaries for each version, a data and a code compression dictionary
- canonical tree
- large trees, about 1700 entries
- compression rate appears to be pretty poor
- dictionary entries are between 7 and 19 bits long (ME>6.x the lower limit is 8bit)
- the entries translate into 1 to 15 bytes.
- often multiple ways to encode plaintext, the shortest possibility is used.
Getting 6.x firmwares:
- 6.2 : msi.com->support->qm57->im-qm57->bios -> 9882_114.zip - 6.1 : supermicro.com -> support -> downloads -> c7sim-q -> Get Bios -> C7SIMQ1.C02.zip - 6.0 : foxconnchannel.com -> support -> downloads -> keyword=Q57M -> bios file -> 997F1P03.zip
Dumping compressed bits:dumper.c
Note this code is intentionally buggy and limited, base your work directly on Igor Skochinsky's code and research.
Extracting:data code
These dictionaries are incomplete, and inaccurate. I estimate at least 95% of the entries are correct. More verification and expansion is needed. These extracters will halt when encountering the first unknown dictionary entry. Indispensable help by Igor Skochinsky, phcoder, ...
Feel free to send me corrections and additions.
--bla