MFS partition seems to contain configurations, the partition is parsed in 'BUP' and 'storage' modules, we need to reverse engineer those in order to understand the file format and figure out what exactly is contained in that MFS partition.
Description
Description
Event Timeline
Comment Actions
The format was reverse engineered by PT at Blackhat 2017 : https://www.blackhat.com/eu-17/briefings.html#intel-me-flash-file-system-explained
https://www.blackhat.com/docs/eu-17/materials/eu-17-Sklyarov-Intel-ME-Flash-File-System-Explained.pdf
https://www.blackhat.com/docs/eu-17/materials/eu-17-Sklyarov-Intel-ME-Flash-File-System-Explained-wp.pdf