I thought that management engine CPU was still a black box, and the best anyone has done is neuter the firmware running there by judiciously zeroing bits out.