MCExtractor – Intel, AMD, VIA &Amp; Freescale Microcode Extraction Tool

Intel, AMD, VIA & Freescale Microcode Extraction ToolMC Extractor News FeedMC Extractor Discussion TopicIntel, AMD & VIA CPU Microcode RepositoriesA. About MC ExtractorMC Extractor is a tool which parses Intel, AMD, VIA and Freescale processor microcode binaries. It can be used by end-users who are looking for all relevant microcode information such as CPUID, Platform, Version, Date, Release, Size, Checksum etc. It is capable of converting Intel microcode containers (dat, inc, h, txt) to binary images for BIOS integration, detecting new/unknown microcodes, checking microcode health, Updated/Outdated status and more. MC Extractor can be also used as a research analysis tool with multiple structures which allow, among others, full parsing & information display of all documented or not microcode Headers. Moreover, with the help of its extensive database, MC Extractor is capable of uniquely categorizing all supported microcodes as well as check for any microcodes which have not been stored at the Microcode Repositories yet.A1. MC Extractor FeaturesSupports all current & legacy Microcodes from 1995 and onwardScans for all Intel, AMD, VIA & Freescale microcodes in one runVerifies all extracted microcode integrity via ChecksumsChecks if all Intel, AMD & VIA microcodes are Latest or OutdatedConverts Intel containers (dat,inc,txt,h) to binary imagesSearches on demand for all microcodes based on CPUIDShows microcode Header structures and details on demandIgnores most false positives based on sanity checksSupports known special, fixed or modded microcodesAbility to quickly add new microcode entries to the databaseAbility to detect Intel Production/Pre-Production Release tagAbility to analyze multiple files by drag & drop or by input pathAbility to ignore extracted duplicates based on name and contentsReports all microcodes which are not found at the Microcode RepositoriesFeatures command line parameters to enhance functionality & assist researchFeatures user friendly messages & proper handling of unexpected code errorsShows results in nice tables with colored text to signify emphasisOpen Source project licensed under GNU GPL v3, comment assisted codeA2. Microcode Repository DatabaseMC Extractor allows end-users and/or researchers to quickly extract, view, convert & report new microcode versions without the use of special tools or Hex Editors. To do that effectively, a database had to be built. The Intel, AMD & VIA CPU Microcode Repositories is a collection of every Intel, AMD & VIA CPU Microcodes we have found. Its existence is very important for MC Extractor as it allows us to continue doing research, find new types of microcode, compare releases for similarities, check for updated binaries etc. Bundled with MC Extractor is a file called MCE.db which is required for the program to run. It includes entries for all Microcode binaries that are available to us. This accommodates primarily two actions: a) Check whether the imported microcode is up to date and b) Help find new Microcode releases sooner by reporting them at the Intel, AMD & VIA CPU Microcode Repositories Discussion thread.A3. Sources and InspirationMC Extractor was initially based on a fraction of Lordkag’s UEFIStrip tool so, first and foremost, I thank him for all his work which inspired this project. Among others, great places to learn about microcodes are Intel’s own download site and official documentation, Intel Microcode Patch Authentication, Coreboot (a,b,c), Microparse by Dominic Chen, Ben Hawkes’s Notes and Research, Richard A Burton’s Microdecode, AIDA64 CPUID dumps, Sandpile CPUID, Free Electrons (a, b), Freescale and many more which I may have forgotten but would have been here otherwise.B. How to use MC ExtractorThere are two ways to use MC Extractor, MCE executable & Command Prompt. The MCE executable allows you to drag & drop one or more firmware and view them one by one or recursively scan entire directories. To manually call MC Extractor, a Command Prompt can be used with -skip as parameter.B1. MC Extractor ExecutableTo use MC Extractor, select one or multiple files and Drag & Drop them to its executable. You can also input certain optional parameters either by running MCE directly or by first dropping one or more files to it. Keep in mind that, due to operating system limitations, there is a limit on how many files can be dropped at once. If the latter is a problem, you can always use the -mass parameter to recursively scan entire directories as explained below.B2. MC Extractor ParametersThere are various parameters which enhance or modify the default behavior of MC Extractor:-? : Displays help & usage screen-skip : Skips welcome & options screen-exit : Skips Press enter to exit prompt-redir : Enables console redirection support-mass : Scans all files of a given directory-info : Displays microcode header(s)-add : Adds new input microcode to DB-dbname : Renames input file based on DB name-cont : Extracts Intel containers (dat,inc,h,txt)-search : Searches for microcodes based on CPUID-last : Shows Latest status based on user input-repo : Builds microcode repositories from inputB3. MC Extractor Error ControlDuring operation, MC Extractor may encounter issues that can trigger Notes, Warnings and/or Errors. Notes (yellow/green color) provide useful information about a characteristic of this particular firmware. Warnings (purple color) notify the user of possible problems that can cause system instability. Errors (red color) are shown when something unexpected or problematic is encountered.C. Download MC ExtractorMC Extractor consists of two files, the executable (MCE.exe or MCE) and the database (MCE.db). An already built/frozen/compiled binary is provided by me for Windows only (icon designed by Alfredo Hernandez). Thus, you don’t need to manually build/freeze/compile MC Extractor under Windows. Instead, download the latest version from the Releases tab, title should be “MC Extractor v1.X.X". You may need to scroll down a bit if there are DB releases at the top. The latter can be used to update the outdated DB which was bundled with the latest executable release, title should be "DB rXX". To extract the already built/frozen/compiled archive, you need to use programs which support RAR5 compression.C1. CompatibilityMC Extractor should work at all Windows, Linux or macOS operating systems which have Python 3.6 support. Windows users who plan to use the already built/frozen/compiled binaries must make sure that they have the latest Windows Updates installed which include all required "Universal C Runtime (CRT)" libraries.C2. Code PrerequisitesTo run MC Extractor’s python script, you need to have the following 3rd party Python modules installed:Coloramapip3 install coloramaPTablepip3 install https://github.com/platomav/PTable/archive/boxchar.zipC3. Build/Freeze/Compile with PyInstallerPyInstaller can build/freeze/compile MC Extractor at all three supported platforms, it is simple to run and gets updated often.Make sure Python 3.6.0 or newer is installed:python –versionUse pip to install PyInstaller:pip3 install pyinstallerUse pip to install colorama:pip3 install coloramaUse pip to install PTable:pip3 install https://github.com/platomav/PTable/archive/boxchar.zipBuild/Freeze/Compile MC Extractor:pyinstaller –noupx –onefile MCE.pyAt dist folder you should find the final MCE executableD. PicturesNote: Some pictures are outdated and depict older MC Extractor versions.Download MCExtractor

Link: http://feedproxy.google.com/~r/PentestTools/~3/UdW1gu5O6Ds/mcextractor-intel-amd-via-freescale.html