amt-setupbin-0.1.0.js

Go to the documentation of this file.

/** 
* @description Intel(R) AMT Setup.bin Parser
* @author Ylian Saint-Hilaire
* @version v0.1.0
*/
 
// Intel(R) AMT Setup.bin GUID's
var AmtSetupBinSetupGuids = [
    "\xb5\x16\xfb\x71\x87\xcb\xf9\x4a\xb4\x41\xca\x7b\x38\x35\x78\xf9", // Version 1
    "\x96\xb2\x81\x58\xcf\x6b\x72\x4c\x8b\x91\xa1\x5e\x51\x2e\x99\xc4", // Version 2
    "\xa7\xf7\xf6\xc6\x89\xc4\xf6\x47\x93\xed\xe2\xe5\x02\x0d\xa5\x1d", // Version 3
    "\xaa\xa9\x34\x52\xe1\x29\xa9\x44\x8d\x4d\x08\x1c\x07\xb9\x63\x53"  // Version 4
];
 
// Notes about version 2 of setup.bin:
//   - Default "admin" must be followed by a new MEBx password
//   - ME_VARIABLE_IDENTIFIER_MANAGEABILITY_FEATURE_SELECTION may not appear after any CM settings
//   - CM_VARIABLE_IDENTIFIER_USER_DEFINED_CERT_ADD must be preceded by setting CM_VARIABLE_IDENTIFIER_USER_DEFINED_CERTS_CONFIG to (TODO!)
 
// General notes:
//   - Setup.bin should always start with "CurrentMEBx Pwd", "newMebx Pwd", "manageability selection" (if present).
 
// Intel(R) AMT variable identifiers
// Type: 0 = Binar Stringy, 1 = Char, 2 = Short, 3 = Int
var AmtSetupBinVarIds =
{
    1: {
        1:  [0, "Current MEBx Password"],
        2:  [0, "New MEBx Password"],
        3:  [1, "Manageability Feature Selection"],
        4:  [1, "Firmware Local Update",                   // 0 = Disabled, 1 = Enabled, 2 = Password Protected
            { 0: "Disabled", 1: "Enabled", 2: "Password Protected" }],
        5:  [1, "Firmware Update Qualifier",               // 0 = Always, 1 = Never, 2 = Restricted
            { 0: "Always", 1: "Never", 2: "Restricted" }],
        6:  [0, "Power Package"]                           // GUID Length (16 bytes), Intel AMT version 2.1, 3 and 4
    },
    2: {
        1:  [0, "Provisioning Preshared Key ID (PID)"],
        2:  [0, "Provisioning Preshared Key (PPS)"],
        3:  [0, "PKI DNS Suffix"],                         // 255 bytes max length
        4:  [0, "Configuration Server FQDN"],              // 255 bytes max length
        5:  [1, "Remote Configuration Enabled (RCFG)",     // 0 = Off, 1 = On
            { 0: "Off", 1: "On" }],
        6:  [1, "Pre-Installed Certificates Enabled",      // 0 = Off, 1 = On
            { 0: "Off", 1: "On" }],
        7:  [1, "User Defined Certificate Configuration",  // 0 = Disabled, 1 = Enabled, 2 = Delete
            { 0: "Disabled", 1: "Enabled", 2: "Delete" }],
        8:  [0, "User Defined Certificate Addition"],      // 1 byte hash algo, 20 to 48 bytes hash, 1 byte name length, up to 32 bytes friendly name, 1 = SHA1 (20 bytes), 2 = SHA256 (32 bytes), 3 = SHA384 (48 bytes). Algo 2 & 3 are for version 3 and up.
        10: [1, "SOL/IDER Redirection Configuration"],
        11: [0, "Hostname"],                               // 63 bytes max length
        12: [0, "Domain Name"],                            // 255 bytes max length
        13: [0, "DHCP"],
        14: [1, "Secure Firmware Update (SFWU)",           // 0 = Disabled, 1 = Enabled
            { 0: "Disabled", 1: "Enabled" }],
        15: [0, "ITO"],
        16: [1, "Provisioning Mode (PM)",                  // 1 = Enterprise, 2 = Small Buisness (SMB)
            { 0: "Enterprise", 1: "Small Buisness"}],
        17: [0, "Provisioning Server Address"],
        18: [2, "Provision Server Port Number (PSPO)"],
        19: [0, "Static PV4 Parameters"],
        20: [0, "VLAN"],
        21: [0, "PASS Policy Flag"],
        22: [0, "IPv6"],                                   // Length is 204 bytes old format, 84 bytes new format, Version 3+ only
        23: [1, "Shared/Dedicated FQDN",                   // 0 = Dedicated, 1 = Shared. This option is valid only if configuring the hostname as well
            { 0: "Dedicated", 1: "Shared" }],
        24: [1, "Dynamic DNS Update",                      // 0 = Disabled, 1 = Enabled
            { 0: "Disabled", 1: "Enabled" }],
        25: [1, "Remote Desktop (KVM) State",              // 0 = Disabled, 1 = Enabled
            { 0: "Disabled", 1: "Enabled" }],
        26: [1, "Opt-in User Consent Option",              // 0 = Disabled, 1 = KVM, 0xFF = ALL
            { 0 : "Disabled", 1 : "KVM", 255 : "All" }],
        27: [1, "Opt-in Remote IT Consent Policy",         // 0 = Disabled, 1 = Enabled. Allows user consent to be configured remotely.
            { 0 : "Disabled", 1 : "Enabled"} ],
        28: [1, "ME Provision Halt Active",                // 0 = Stop, 1 = Start. The "ME provisioning Halt/Activate" command must appear in the file only after "PKIDNSSuffix", "ConfigServerFQDN" and "Provisioning Server Address"
            { 0 : "Stop", 1 : "Start"}],
        29: [1, "Manual Setup and Configuration",          // 0 = Automated, 1 = Manual
            { 0 : "Automated", 1 : "Manual"}],
        30: [3, "Support Channel Identifier"],             // 4 bytes length. Support channel identifier (valid values: 1-65535)
        31: [0, "Support Channel Description"],            // 60 bytes max. Friendly name used to describe the party representedby the support channel identifier.
        32: [0, "Service Account Number"],                 // 32 bytes max. Unique string identifier given to the end user by the service provider.
        33: [0, "Enrollement Passcode"],                   // 32 bytes max
        34: [3, "Service Type"],                           // 4 bytes length. 1 = Reactive, 2 = Proactive, 4 = One Time Session
        35: [0, "Service Provider Identifier"]             // GUID Length (16 bytes)
    }
}
 
 
// Parse the Setup.bin file
var AmtSetupBinCreate = function (version, flags) {
    var obj = {};
    obj.fileType = version;
    obj.recordChunkCount = 0;
    obj.recordHeaderByteCount = 0;
    obj.recordNumber = 0;
    obj.majorVersion = version;
    obj.minorVersion = 0;
    obj.flags = flags;
    obj.dataRecordsConsumed = 0;
    obj.dataRecordChunkCount = 0;
    obj.records = [];
    return obj;
}
 
 
// Parse the Setup.bin file
var AmtSetupBinDecode = function (file) {
 
    // Format of the setup file header:
    // FileTypeUUID(16)         - uniquely identifies the file type. This identifier will remain valid and constant across all versions of the file type.
    // RecordChunkCount(2)      - indicates the number of 512-byte chunks occupied by this record, including all header, body, and reserved fields.
    // RecordHeaderBytes(2)     - indicates the length of the record header in bytes.
    // RecordNumber(4)          - uniquely identifies the record among all records in the file. The field contains a non-negative ordinal value. The value of this field is always zero in the Local Provisioning File Header Record.
    // MajorVersion(1)          - identifies the major version of the file format specification. This is a positive integer that is greater than or equal to 1. The Major Version number is incremented to indicate that changes have been introduced that will cause code written against a lower Major Version number to fail.
    // MinorVersion(1)          - identifies the minor version of the file format specification. This is an integer that is greater than or equal to 0. The Minor Version number is incremented to indicate that changes have been introduced that will not cause code written against the same Major Version and a lower Minor Version number to fail. The purpose of this behavior is to allow a single local provisioning file to be used for multiple generations of Intel® AMT platform.
    // DataRecordCount(4)       - indicates the total number of data records written in the file when it was created.
    // DataRecordsConsumed(4)   - is a counter value that begins at 0 and is incremented by 1 by each platform BIOS when it consumes a data record from the file. This value is used to determine the offset of the next data record in the file.
    // DataRecordChunkCount(2)  - contains the number of 512-byte chunks in each data record. All data records are the same length.
    // ModuleList               - contains a list of module identifiers. A module’s identifier appears in the list if and only if the data records contain entries for that module. Each module identifier is two bytes in length. The list is terminated by an identifier value of 0. 
 
    var obj = {}, UUID = file.substring(0, 16);
    obj.fileType = 0;
    for (var i in AmtSetupBinSetupGuids) { if (UUID == AmtSetupBinSetupGuids[i]) obj.fileType = (+i + 1); }
    if (obj.fileType == 0) return; // Bad header
    obj.recordChunkCount = ReadShortX(file, 16);
    obj.recordHeaderByteCount = ReadShortX(file, 18);
    obj.recordNumber = ReadIntX(file, 20);
    obj.majorVersion = file.charCodeAt(24);
    obj.minorVersion = file.charCodeAt(25);
    obj.flags = ReadShortX(file, 26);                   // Flags: 1 = Do not consume records
    var dataRecordCount = ReadIntX(file, 28);
    obj.dataRecordsConsumed = ReadIntX(file, 32);
    obj.dataRecordChunkCount = ReadShortX(file, 36);
    obj.records = [];
 
    var ptr = 512;
    while (ptr + 512 <= file.length) {
 
        // Format of a data record header:
        // RecordTypeIdentifier(4)           - identifies the type of record (in this case a data record). Record Identifiers: Invalid - 0, Data Record - 1
        // RecordFlags(4)                    - contains a set of bit flags that characterize the record.
        // RecordChunkCount(2)               - contains the number of 512-byte chunks occupied by the record including all header, body, and reserved fields.
        // RecordHeaderByteCount(2)          - indicates the length of the record header in bytes.
        // RecordNumber(4)                   - uniquely identifies the record among all records in the file, including invalid as well as valid records. The identifier is a non-negative integer.
 
        var r = {};
        r.typeIdentifier = ReadIntX(file, ptr);
        r.flags = ReadIntX(file, ptr + 4);              // Flags: 1 = Valid, 2 = Scrambled
        r.chunkCount = ReadShortX(file, ptr + 8);
        r.headerByteCount = ReadShortX(file, ptr + 10);
        r.number = ReadIntX(file, ptr + 12);
        r.variables = [];
 
        var ptr2 = 0, recbin = file.substring(ptr + 24, ptr + 512);
        if ((r.flags & 2) != 0) { recbin = AmtSetupBinDescrambleRecordData(recbin); } // De-Scramble the record
        while (true) {
 
            // Format of a data record entry:
            // ModuleIdentifier(2)           - identifies the target ME module for the entry.
            // VariableIdentifier(2)         - an enumeration value that identifies the variable. Variable identifiers are unique to each ModuleIdentifier.
            // VariableLength(2)             - is the length of the variable value in bytes.
            // VariableValue                 - is the value to be assigned to the variable.
 
            var v = {};
            v.moduleid = ReadShortX(recbin, ptr2);
            v.varid = ReadShortX(recbin, ptr2 + 2);
            if (v.moduleid == 0 || v.varid == 0) break;
            if (AmtSetupBinVarIds[v.moduleid][v.varid]) {
                v.length = ReadShortX(recbin, ptr2 + 4);
                v.type = AmtSetupBinVarIds[v.moduleid][v.varid][0];
                v.desc = AmtSetupBinVarIds[v.moduleid][v.varid][1];
                v.value = recbin.substring(ptr2 + 8, ptr2 + 8 + v.length);
                if (v.type == 1 && v.length == 1) v.value = v.value.charCodeAt(0);
                else if (v.type == 2 && v.length == 2) v.value = ReadShortX(v.value, 0);
                else if (v.type == 3 && v.length == 4) v.value = ReadIntX(v.value, 0);
                r.variables.push(v);
            }
            ptr2 += (8 + (Math.floor((v.length + 3) / 4) * 4));
        }
 
        // Sort the variables
        r.variables.sort(AmtSetupBinVariableCompare);
 
        obj.records.push(r);
        ptr += 512;
    }
 
    if (dataRecordCount != obj.records.length) return; // Mismatch record count
    return obj;
}
 
// Construct a Setup.bin file
var AmtSetupBinEncode = function (obj) {
    if (obj.fileType < 1 && obj.fileType > AmtSetupBinSetupGuids.length) return null;
    var out = [], r = AmtSetupBinSetupGuids[obj.fileType - 1], reccount = 0;
    r += ShortToStrX(obj.recordChunkCount);
    r += ShortToStrX(obj.recordHeaderByteCount);
    r += IntToStrX(obj.recordNumber);
    r += String.fromCharCode(obj.majorVersion, obj.minorVersion);
    r += ShortToStrX(obj.flags); // Flags: 1 = Do not consume records
    r += IntToStrX(obj.records.length);
    r += IntToStrX(obj.dataRecordsConsumed);
    r += ShortToStrX(obj.dataRecordChunkCount);
    while (r.length < 512) { r += "\0"; } // Pad the header
    out.push(r);
 
    // Write each record
    for (var i in obj.records) {
        var r2 = "", rec = obj.records[i];
        r2 += IntToStrX(rec.typeIdentifier);
        r2 += IntToStrX(rec.flags);
        r2 += IntToStrX(0);                                                 // Reserved
        r2 += IntToStrX(0);                                                 // Reserved
        r2 += ShortToStrX(1);                                               // rec.chunkCount
        r2 += ShortToStrX(24);                                              // rec.headerByteCount
        r2 += IntToStrX(++reccount);
 
        // Sort the variables
        rec.variables.sort(AmtSetupBinVariableCompare);
 
        /*
        // Change variable priority
        AmtSetupBinMoveToTop(r.variables, 1, 3);                            // Manageability Feature Selection
        AmtSetupBinMoveToTop(r.variables, 1, 2);                            // New MEBx password
        AmtSetupBinMoveToTop(r.variables, 1, 1);                            // Current MEBx password
        */
 
        // Write each variable
        for (var j in rec.variables) {
            var r3 = "", v = rec.variables[j], data = v.value;
            v.type = AmtSetupBinVarIds[v.moduleid][v.varid][0];             // Set the correct type if not alreay connect
            if (v.type > 0) {                                               // If this is a numeric value, encode it correctly
                data = parseInt(data);
                if (v.type == 1) data = String.fromCharCode(data);
                if (v.type == 2) data = ShortToStrX(data);
                if (v.type == 3) data = IntToStrX(data);
            }
            r3 += ShortToStrX(v.moduleid);                                  // Module Identifier
            r3 += ShortToStrX(v.varid);                                     // Variable Identifier
            r3 += ShortToStrX(data.length);                                 // Variable Length
            r3 += ShortToStrX(0);                                           // Reserved
            r3 += data;                                                     // Variable Data
            while (r3.length % 4 != 0) { r3 += "\0"; }                      // Pad the variable
            r2 += r3;
        }
 
        while (r2.length < 512) { r2 += "\0"; }                             // Pad the record
        if ((rec.flags & 2) != 0) { r2 = r2.substring(0, 24) + AmtSetupBinScrambleRecordData(r2.substring(24)); } // Scramble the record starting at byte 24, after the header
        out.push(r2);
    }
    return out.join('');
}
 
// Used to sort variables
function AmtSetupBinVariableCompare(a, b) {
    if (a.moduleid > b.moduleid) return 1;
    if (a.moduleid < b.moduleid) return -1;
    if (a.varid > b.varid) return 1;
    if (a.varid < b.varid) return -1;
    return 0;
}
 
// Scramble and un-scramble records
function AmtSetupBinScrambleRecordData(data) { var out = ""; for (var i = 0; i < data.length; i++) { out += String.fromCharCode((data.charCodeAt(i) + 17) & 0xFF); } return out; }
function AmtSetupBinDescrambleRecordData(data) { var out = ""; for (var i = 0; i < data.length; i++) { out += String.fromCharCode((data.charCodeAt(i) + 0xEF) & 0xFF); } return out; }
 
// Find a moduleid/varid in the variable list, if found, move it to the top
//function AmtSetupBinMoveToTop(variables, moduleid, varid) { var i = -1; for (var j in variables) { if ((variables[j].moduleid == moduleid) && (variables[j].varid == varid)) { i = j; } } if (i > 1) { ArrayElementMove(variables, i, 0); } }