1vyrain, skulls and clean/disable/break the Intel ME

[brunocek]

On a X230, I am trying to get 1vyrain, skulls and clean/disable/break the Intel ME.

I would like to avoid making mistakes, troubleshooting, using the jumper cables (I have them), or flashing multiple times/versions.

Any help is welcome. Some questions, please, in order of perceived priority:

1. What is the order so that I get the three objectives?

Is it 1vyrain with the skulls custom BIOS, then run me_cleaner from a Live Linux (https://github.com/corna/me_cleaner)?
I am not sure me_clener will work in this case.

And from what I read, if I run me_cleaner from a Live Linux before 1vyrain, it won't work either.

Is it possible to first flash the 1vyrain modified bios with no payload and after cleaning ME with it, install skulls? Will this be a second round of boot-from-usb-and-flash 1vyrain (this second time on option 2 Flash from Custom BIOS)?

2. Does the direct internet URL to the tar.xz release file of skulls (https://github.com/merge/skulls/releases) work (option 2 Flash from Custom BIOS)? Or should I download it, untar it and make it available on the local network?

3. 1vyrain guide has a section on examining protections that uses chipsec_main. (https://github.com/gch1p/thinkpad-bios-software-flashing-guide?tab=readme-ov-file#examining-protections-theory)

Is it (https://github.com/chipsec/chipsec/tree/main)?

When should this be run during the process? Is it fine if I boot from Live Linux to run this before flashing the 1vyrain with skulls?

To be able to flash, we need SMM_BWP=0, BIOSWE=1, BLE=0, FLOCKDN=0 or SPI protected ranges (PRx) to have a WP bit set to 0.

Thank you in advance.

This question has been also posted on:

• 1vyrain, skulls and clean/disable/break the Intel ME n4ru/1vyrain#144
• https://forum.qubes-os.org/t/how-to-use-ivprep-and-1vyrain-and-disable-intel-me-on-a-lenovo-x230/18162/5
• X230 stuck on 2.75 - I cannot downgrade to 2.60! hamishcoleman/thinkpad-ec#266