Architecture

Architecture

Intel® Manageability Commander (IMC) is a closed-source Electron app Intel ships only for Windows. This project replaces the Windows-only native modules with Linux implementations — no changes to Intel's minified JS.

What we replace

Module	Windows version	Linux replacement
imrsdk.node	PE32 DLL wrapping imrsdk.dll	src/imrsdk/ — pure JS, ~350 lines
krb-ticket.node	Windows Kerberos native binding	src/stubs/krb-ticket/ — returns retCode:1, falls back to digest auth
winreg	Windows registry	Already safe on Linux (IMC has try/catch)
Electron	8.0.3 Windows build	Electron 28 (Chromium 120, TLS 1.3)
remote module	Built-in (removed Electron 14+)	@electron/remote + preload shim

imrsdk — AMT Redirection Protocol

src/imrsdk/
├── amt-protocol.js   # Transport layer
│                     # TCP/TLS connect → HTTP Digest auth → binary AMT session frames
│                     # IPv6 RFC 2732 Host: bracket fix
│                     # CSME 16.1+ auto-upgrade: ECONNREFUSED:16994 → TLS:16995
├── amt-ider.js       # IDER/SCSI engine
│                     # Serves disk images to AMT firmware via SCSI-over-AMT
│                     # Handles: READ10, INQUIRY, MODE_SENSE, READ_CAPACITY, READ_TOC
└── index.js          # Sync API wrapper (deasync spins libuv event loop)
                      # Matches imrsdk.node's synchronous contract

Why not libimrsdk.so?

Intel ships IMRSDK as static .a files compiled without -fPIC. They cannot link into a .so — confirmed multiple definition of stricmp linker error from xerces bundled inside. Implementing the protocol directly in JS is simpler and more maintainable.

Electron 28 migration

IMC was built on Electron 8.0.3. Two blockers on modern Electron:

1. remote module removed (Electron 14): IMC's minified main.js calls require('electron').remote.* throughout. Fixed via @electron/remote package + a preload shim that monkey-patches require('electron').remote.

2. TLS failures vs AMT 16.x (Electron 13, Chromium 91): Confirmed by Intel community reports. Electron 28 (Chromium 120) with TLS 1.3 support fixes this.

Credential vault

Renderer (IMC auth dialog)
  └─ preload.js (MutationObserver)
       ├─ detects: #id-authDlg-username, #id-authDlg-password
       ├─ injects: "Remember credentials" checkbox
       ├─ auto-fills from vault on dialog open
       └─ ipcRenderer.invoke('vault:save' / 'vault:load')
            └─ main-electron.js (ipcMain handlers)
                 └─ safeStorage.encryptString / decryptString
                      └─ OS keyring (libsecret / KWallet / macOS Keychain)
                           └─ amtvault.json (base64-encoded ciphertext)

LMS integration

/dev/mei0  ──────────────────────────────────┐
(Intel ME)                                   │
                                        [LMS Docker]
                                             │
localhost:16992 (WS-Man plain) ──────────────┤
localhost:16993 (WS-Man TLS)  ───────────────┘

AMT IP:16994/16995 (Redirection — OOB only, LMS does NOT proxy)