Intel ME - Flash File System Explained

Explore the intricacies of Intel Management Engine's flash file system in this 53-minute Black Hat conference talk. Delve into the details of how ME 11.x stores its state on flash memory and examine other file system types supported by ME 11.x. Learn about the MFS partition layout, flash memory characteristics, and file system design goals. Discover the pagination system, including page chunks and types of pages. Understand the process of data area and system area reconstruction, as well as data extraction from files. Examine MFS templates, special files, and the structure of intel.cfg. Gain insights into the directory structure, security measures including integrity, encryption, and anti-replay mechanisms. Explore the crypto engine, key derivation, and usage practices. Investigate the various file system types in VFS. Presented by Dmitry Sklyarov, this talk provides a comprehensive look at the inner workings of Intel ME's flash file system.

Intro
black hat ME Position in Computer System
black hat MFS Partition Layout
black hat Flash Memory Characteristics
black hat Flash File System Design Goals
black hat Recommended Materials
black hat MFS Pagination
black hat Page Chunks Single Chunk (66 bytes)
black hat System Pages
black hat Data Pages
black hat Data Area Reconstruction
black hat System Area Reconstruction
black hat Data Extraction from Files
black hat MFS Templates from fit.exe
black hat Special Files
black hat intel.cfg (fitc.cfg) Structure
black hat intel.cfg Partial Dump
black hat MFS Directory
black hat Integrity, Encryption, Anti-Replay
black hat FS Security Keys
black hat Crypto Engine / Usage Practices
black hat Key Derivation and Usage
black hat File System Types in VFS
black hat Black Hat Sound Bytes