me_cleaner is a Python script for partial deblobbing of Intel ME firmware images.
Intel ME is a mandatory co-processor in post-2006 Intel systems that runs with full hardware access but cannot be disabled or reimplemented due to tight integration in the boot process and cryptographic signing. The tool addresses privacy and free firmware concerns by modifying ME firmware to restrict its operation to the boot phase only, rather than running continuously during normal system operation. For pre-Nehalem systems, me_cleaner removes the ME firmware entirely by setting bits in the flash descriptor. For newer generations, it strips non-essential modules while preserving only those required for correct boot, reducing firmware size from several megabytes to roughly 90 kilobytes for generation 2 systems or 300 kilobytes for generation 3 and later.
Adoption depends on your Intel platform generation and tolerance for firmware modification risk. The tool works across most Intel platforms but reliability varies by board due to different firmware implementations. Users should be aware that obtaining and flashing the modified firmware typically requires external SPI programmers, as the ME region is usually write-protected from the operating system. The approach differs fundamentally by generation: complete removal for pre-Nehalem ME, minimal module retention for Nehalem through Broadwell, and a different subsystem structure for Skylake onwards.
The project shows consistent maintenance with regular updates addressing different Intel ME generations and their structural changes. Development activity includes ongoing platform compatibility testing and refinement of the deblobbing process across hardware variants.
