Windows PE/Tips and tricks

Update Intel Management Engine firmware

You can use Windows PE in order to install updates for firmware such as Intel ME if your hardware manufacturer only provides Windows binaries, and you cannot update via Fwupd.

You will need to download :

• your manufacturer's Intel ME update tool
• drivers for the Intel Management Engine.

Store both extracted archives in a folder, e.g.

/vendor_files
  ├── me_driver
  └── update_tool

Note: You might need to use Wine and/or cabextract in order to extract the drivers, according to how they are packaged.

Proceed with Windows PE#Creating a bootable Windows PE image but make sure to :

• choose a windows PE version for which your device vendor provides Intel ME drivers, i.e. 32-bit or 64-bit.
• include the device drivers and update tool with --overlay, e.g. :

$ mkwinpeimg --iso --windows-dir=/media/winimg --overlay=vendor_files winpe.iso

Proceed with Windows PE#Booting Windows PE, then load the drivers with

X:\Windows\Systems32>cd \
X:\>drvload me_driver\...\heci.inf

Finally, update the Intel ME firmware by using the update tool.

Tip: You can use the Intel CSME version detection tool to check for vulnerabilities

Custom Windows PE images

Tools like Hiren's BootCD and others include Windows PE and are around half the size (~2.8GB) of a full Windows ISO. They are often fuller featured boot environments and can include Internet Explorer, which may be helpful to look up bcdedit or bootrec commands to repair Windows boot manager.

Hiren's BootCd is already bootable, it only needs to be extracted to a USB.

dd bs=4M if=./HBCD_PE_x64.iso of=/dev/sdX status=progress && sync

Make sure the USB key uses a GPT partition table as described in Windows PE#Prepare a bootable Windows PE USB key for UEFI systems.