Hello vPro Experts,

In case you've worked with any of the Powershell code samples I've previously posted, you've probably noticed that the AmtSystem.Connect() method executes asynchronously, and returns immediately. In this case, you'd have to develop some sort of loop in order to determine whether or not the connection was successful. Typically, I would just use this code to prevent a script from continuing before the connection was established:

while ($amtdevice.State -eq "Connecting") { Start-Sleep 1 }

But that's ugly, because, what happens if it never connects? Although it's nice to have the ability to asychronously connect to AMT devices, writing code and understanding the logic, to handle async processes is significantly more difficult than writing code that is synchronous. For this reason, we will look at how to modify and recompile the ManageabilityStack .NET assembly in the Intel AMT Developer Toolkit (DTK) to allow synchronous connections to AMT from PowerShell code.

In order to perform the next steps, you'll need the following:

• The Intel AMT DTK source code
• Microsoft Visual Studio 2008 (the Express edition is fully functional and free!)
• Microsoft Windows PowerShell 1.0 or 2.0 CTP3

Once you've installed these components, continue on:

1. Download the Intel AMT DTK source code and extract to a folder
2. Navigate to <Source>\Manageability Stack and open the Manageability Stack.csproj file in Visual Studio 2008
3. Open the AmtSystem.cs file in the Visual Studio Solution Explorer
4. Rename the Connect() method to ConnectAsync()
5. Copy the following code above the ConnectAsync() method:
   public void Connect()
   {
      if (State != AmtSystemObjState.Disconnected) return;
      ChangeState(AmtSystemObjState.Connecting);
      ConnectEx(this);
   }
6. In the Visual Studio Solution Explorer, right-click the Manageability Stack project, and click Build
7. Go to your <Source>\Manageability Stack\obj\Debug folder, and grab your new ManageabilityStack.dll .NET assembly

Now that you have a recompiled ManageabilityStack assembly, you can load this into PowerShell, and connect synchronously using the Connect() method!

Update: I attached the AmtSystem.cs file to this blog post, if you're not comfortable modifying source code yourself! You'll still need to replace the file, open the project, and recompile the library though

Trevor Sullivan

Systems Engineer

OfficeMax Corporation

I am been taking a two day class on C/C++ secure coding, a required class for every coder within my group at Intel. First, I am so thankful I mostly don’t code in C/C++ because as I learned in the class, it’s quite challenging to write secure code that is not susceptible to stack overflow attacks or any number of other attacks. My co-worker Sandeep who works on Intel AMT Switchbox and Guardpost, both entirely built in C/C++ is going to have a challenge.

This said, C# is not immune to security issues and there is an ongoing debate whether the Intel AMT DTK C# and C/C++ tools should complete a security review. One argument is that as long at Intel AMT is secure and does not expose vulnerabilities, any Intel AMT tool is also safe and does not need to be reviewed. On the other hand, many people use the DTK source code for other projects and which we make no claims of security; it’s probably not a bad idea to check.

Right now, the DTK is not being checked for any security issues, but there are so design considerations that can, at a high level, help with security. One of them is to minimize or remove completely any listening sockets. In Intel AMT Commander there is one listening for SNMP traps, in Intel AMT Terminal there is also a socket used to connect debug terminals to pass serial-over-LAN information thru for debugging. On the agent side, Intel AMT Outpost have no incoming sockets, its powerful serial agent is connected to the serial-over-LAN COM port and so, relies on Intel AMT authentication.

I would like to invite the community to comment or post me directly any security issues you find with the DTK. I will certainly try my best to fix all of the issues.

Ylian (Intel AMT Blog)