jh163888/UEFITool
1
0
Fork 0
mirror of https://github.com/LongSoft/UEFITool.git synced 2024-11-21 23:48:22 +08:00
Code Issues Projects Releases Wiki Activity

Implement parsing for AMD-specific Zlib-compressed GUIDed section

Browse Source 
Fix incorrect overflow check in parsing volume block map
This commit is contained in:
Nikolaj Schlej 2022-12-23 20:24:15 -08:00 committed by Nikolaj Schlej
parent 15026849d2
commit 7337f15ec9
9 changed files with 188 additions and 104 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
UEFIExtract/ffsdumper.cpp
View File

@ -30,7 +30,7 @@ USTATUS FfsDumper::dump(const UModelIndex & root, const UString & path, const Du
USTATUS result = recursiveDump(root, path, dumpMode, sectionType, guid);
if (result) {
printf("Error %lu returned from recursiveDump (directory \"%s\").\n", result, (const char*)path.toLocal8Bit());
printf("Error %zu returned from recursiveDump (directory \"%s\").\n", result, (const char*)path.toLocal8Bit());
return result;
} else if (!dumped) {
removeDirectory(path);
@ -199,7 +199,7 @@ USTATUS FfsDumper::recursiveDump(const UModelIndex & index, const UString & path
}
result = recursiveDump(childIndex, childPath, dumpMode, sectionType, guid);
if (result) {
printf("Error %lu returned from recursiveDump (child directory \"%s\").\n", result, (const char*)childPath.toLocal8Bit());
printf("Error %zu returned from recursiveDump (child directory \"%s\").\n", result, (const char*)childPath.toLocal8Bit());
return result;
}
}

5
UEFITool/hexlineedit.cpp
View File

@ -83,9 +83,4 @@ void HexLineEdit::keyPressEvent(QKeyEvent * event)
// Call original event handler
QLineEdit::keyPressEvent(event);
if (event == QKeySequence::Paste)
{
clipboard->setText(originalText);
}
}

3
common/basetypes.h
View File

@ -75,13 +75,14 @@ typedef size_t USTATUS;
#define U_UNKNOWN_PATCH_TYPE 53
#define U_PATCH_OFFSET_OUT_OF_BOUNDS 54
#define U_INVALID_SYMBOL 55
#define U_ZLIB_DECOMPRESSION_FAILED 56
#define U_INVALID_MANIFEST 251
#define U_UNKNOWN_MANIFEST_HEADER_VERSION 252
#define U_INVALID_ME_PARTITION_TABLE 253
#define U_INVALID_ME_PARTITION 254
#define U_NOT_IMPLEMENTED 0xFF
#define U_NOT_IMPLEMENTED 255
// EDK2 porting definitions
typedef uint8_t BOOLEAN;

2
common/ffs.cpp
View File

@ -94,6 +94,8 @@ extern const UByteArray EFI_GUIDED_SECTION_LZMAF86 // D42AE6BD-1352-4BFB-909A-CA
("\xBD\xE6\x2A\xD4\x52\x13\xFB\x4B\x90\x9A\xCA\x72\xA6\xEA\xE8\x89", 16);
extern const UByteArray EFI_GUIDED_SECTION_GZIP // 1D301FE9-BE79-4353-91C2-D23BC959AE0C
("\xE9\x1F\x30\x1D\x79\xBE\x53\x43\x91\xC2\xD2\x3B\xC9\x59\xAE\x0C", 16);
extern const UByteArray EFI_GUIDED_SECTION_ZLIB_AMD // CE3233F5-2CD6-4D87-9152-4A238BB6D1C4
("\xF5\x33\x32\xCE\xD6\x2C\x87\x4D\x91\x52\x4A\x23\x8B\xB6\xD1\xC4", 16);
extern const UByteArray EFI_FIRMWARE_CONTENTS_SIGNED_GUID // 0F9D89E8-9259-4F76-A5AF-0C89E34023DF
("\xE8\x89\x9D\x0F\x59\x92\x76\x4F\xA5\xAF\x0C\x89\xE3\x40\x23\xDF", 16);
extern const UByteArray EFI_CERT_TYPE_RSA2048_SHA256_GUID // A7717414-C616-4977-9420-844712A735BF

15
common/ffs.h
View File

@ -76,7 +76,7 @@ typedef struct APTIO_CAPSULE_HEADER_ {
UINT16 RomImageOffset; // offset in bytes from the beginning of the capsule header to the start of the capsule volume
UINT16 RomLayoutOffset; // offset to the table of the module descriptors in the capsule's volume that are included in the signature calculation
//FW_CERTIFICATE FWCert;
//ROM_AREA RomAreaMap[1];
//ROM_AREA RomAreaMap[];
} APTIO_CAPSULE_HEADER;
// AMI Aptio signed extended capsule GUID
@ -340,7 +340,6 @@ extern const UINT8 ffsAlignmentTable[];
// Extended FFS alignment table, added in UEFI PI 1.6
extern const UINT8 ffsAlignment2Table[];
// File states
#define EFI_FILE_HEADER_CONSTRUCTION 0x01
#define EFI_FILE_HEADER_VALID 0x02
@ -445,11 +444,19 @@ extern const UByteArray EFI_GUIDED_SECTION_LZMA; // EE4E5898-3914-4259-9D6E-DC7B
extern const UByteArray EFI_GUIDED_SECTION_LZMA_HP; // 0ED85E23-F253-413F-A03C-901987B04397
extern const UByteArray EFI_GUIDED_SECTION_LZMAF86; // D42AE6BD-1352-4BFB-909A-CA72A6EAE889
extern const UByteArray EFI_GUIDED_SECTION_GZIP; // 1D301FE9-BE79-4353-91C2-D23BC959AE0C
extern const UByteArray EFI_GUIDED_SECTION_ZLIB_AMD; // CE3233F5-2CD6-4D87-9152-4A238BB6D1C4
extern const UByteArray EFI_FIRMWARE_CONTENTS_SIGNED_GUID; // 0F9D89E8-9259-4F76-A5AF-0C89E34023DF
//#define WIN_CERT_TYPE_PKCS_SIGNED_DATA 0x0002
#define WIN_CERT_TYPE_EFI_GUID 0x0EF1
// AMD Zlib-compressed section header
typedef struct EFI_AMD_ZLIB_SECTION_HEADER_ {
UINT8 ZeroHeader[0x14];
UINT32 CompressedSize;
UINT8 ZeroFooter[0x100 - sizeof(UINT32) - 0x14];
//UINT8 CompressedData[]
} EFI_AMD_ZLIB_SECTION_HEADER;
typedef struct WIN_CERTIFICATE_ {
UINT32 Length;
UINT16 Revision;
@ -491,7 +498,7 @@ typedef struct POSTCODE_SECTION_ {
} POSTCODE_SECTION;
//*****************************************************************************
// EFI Dependency Expression
// EFI DXE Dependency Expression
//*****************************************************************************
#define EFI_DEP_OPCODE_SIZE 1

91
common/ffsparser.cpp
View File

@ -46,32 +46,6 @@ enum GlobalColor {
}
#endif
// Region info
struct REGION_INFO {
UINT32 offset;
UINT32 length;
UINT8 type;
UByteArray data;
friend bool operator< (const REGION_INFO & lhs, const REGION_INFO & rhs){ return lhs.offset < rhs.offset; }
};
// BPDT partition info
struct BPDT_PARTITION_INFO {
BPDT_ENTRY ptEntry;
UINT8 type;
UModelIndex index;
friend bool operator< (const BPDT_PARTITION_INFO & lhs, const BPDT_PARTITION_INFO & rhs){ return lhs.ptEntry.Offset < rhs.ptEntry.Offset; }
};
// CPD partition info
struct CPD_PARTITION_INFO {
CPD_ENTRY ptEntry;
UINT8 type;
bool hasMetaData;
UModelIndex index;
friend bool operator< (const CPD_PARTITION_INFO & lhs, const CPD_PARTITION_INFO & rhs){ return lhs.ptEntry.Offset.Offset < rhs.ptEntry.Offset.Offset; }
};
// Constructor
FfsParser::FfsParser(TreeModel* treeModel) : model(treeModel),
imageBase(0), addressDiff(0x100000000ULL), protectedRegionsBase(0) {
@ -175,7 +149,8 @@ USTATUS FfsParser::parseGenericImage(const UByteArray & buffer, const UINT32 loc
index = model->addItem(localOffset, Types::Image, Subtypes::UefiImage, name, UString(), info, UByteArray(), buffer, UByteArray(), Fixed, parent);
// Parse the image as raw area
protectedRegionsBase = imageBase = model->base(parent) + localOffset;
imageBase = model->base(parent) + localOffset;
protectedRegionsBase = imageBase;
return parseRawArea(index);
}
@ -1372,8 +1347,10 @@ USTATUS FfsParser::findNextRawAreaItem(const UModelIndex & index, const UINT32 l
nextItemAlternativeSize = 0;
const EFI_FV_BLOCK_MAP_ENTRY* entry = (const EFI_FV_BLOCK_MAP_ENTRY*)(data.constData() + offset - EFI_FV_SIGNATURE_OFFSET + sizeof(EFI_FIRMWARE_VOLUME_HEADER));
while (entry->NumBlocks != 0 && entry->Length != 0) {
if ((void*)entry >= data.constData() + data.size()) {
continue;
// Check if we are past the end of the volume
if ((const void*)entry >= data.constData() + data.size()) {
// This volume is broken, but we can't use continue here because we need to continue the outer loop
goto continue_searching;
}
nextItemAlternativeSize += entry->NumBlocks * entry->Length;
@ -1385,6 +1362,7 @@ USTATUS FfsParser::findNextRawAreaItem(const UModelIndex & index, const UINT32 l
nextItemSize = (UINT32)volumeHeader->FvLength;
nextItemOffset = offset - EFI_FV_SIGNATURE_OFFSET;
break;
continue_searching: {}
}
else if (readUnaligned(currentPos) == BPDT_GREEN_SIGNATURE
|| readUnaligned(currentPos) == BPDT_YELLOW_SIGNATURE) {
@ -2371,6 +2349,7 @@ USTATUS FfsParser::parseGuidedSectionHeader(const UByteArray & section, const UI
bool msgUnknownCertType = false;
bool msgUnknownCertSubtype = false;
bool msgProcessingRequiredAttributeOnUnknownGuidedSection = false;
bool msgInvalidCompressedSize = false;
if (baGuid == EFI_GUIDED_SECTION_CRC32) {
if ((attributes & EFI_GUIDED_SECTION_AUTH_STATUS_VALID) == 0) { // Check that AuthStatusValid attribute is set on compressed GUIDed sections
msgNoAuthStatusAttribute = true;
@ -2390,14 +2369,38 @@ USTATUS FfsParser::parseGuidedSectionHeader(const UByteArray & section, const UI
additionalInfo += usprintf("\nChecksum: %08Xh, invalid, should be %08Xh", crc, calculated);
msgInvalidCrc = true;
}
// No need to change dataOffset here
// Adjust dataOffset
dataOffset += sizeof(UINT32);
}
else if (baGuid == EFI_GUIDED_SECTION_LZMA || baGuid == EFI_GUIDED_SECTION_LZMA_HP || baGuid == EFI_GUIDED_SECTION_LZMAF86 || baGuid == EFI_GUIDED_SECTION_TIANO || baGuid == EFI_GUIDED_SECTION_GZIP) {
else if (baGuid == EFI_GUIDED_SECTION_LZMA
|| baGuid == EFI_GUIDED_SECTION_LZMA_HP
|| baGuid == EFI_GUIDED_SECTION_LZMAF86
|| baGuid == EFI_GUIDED_SECTION_TIANO
|| baGuid == EFI_GUIDED_SECTION_GZIP) {
if ((attributes & EFI_GUIDED_SECTION_PROCESSING_REQUIRED) == 0) { // Check that ProcessingRequired attribute is set on compressed GUIDed sections
msgNoProcessingRequiredAttributeCompressed = true;
}
// No need to change dataOffset here
}
else if (baGuid == EFI_GUIDED_SECTION_ZLIB_AMD) {
if ((attributes & EFI_GUIDED_SECTION_PROCESSING_REQUIRED) == 0) { // Check that ProcessingRequired attribute is set on compressed GUIDed sections
msgNoProcessingRequiredAttributeCompressed = true;
}
if ((UINT32)section.size() < headerSize + sizeof(EFI_AMD_ZLIB_SECTION_HEADER))
return U_INVALID_SECTION;
const EFI_AMD_ZLIB_SECTION_HEADER* amdZlibSectionHeader = (const EFI_AMD_ZLIB_SECTION_HEADER*)(section.constData() + headerSize);
// Check the compressed size to be sane
if ((UINT32)section.size() != headerSize + sizeof(EFI_AMD_ZLIB_SECTION_HEADER) + amdZlibSectionHeader->CompressedSize) {
msgInvalidCompressedSize = true;
}
// Adjust dataOffset
dataOffset += sizeof(EFI_AMD_ZLIB_SECTION_HEADER);
}
else if (baGuid == EFI_CERT_TYPE_RSA2048_SHA256_GUID) {
if ((attributes & EFI_GUIDED_SECTION_PROCESSING_REQUIRED) == 0) { // Check that ProcessingRequired attribute is set on signed GUIDed sections
msgNoProcessingRequiredAttributeSigned = true;
@ -2465,12 +2468,11 @@ USTATUS FfsParser::parseGuidedSectionHeader(const UByteArray & section, const UI
// Get info
UString name = guidToUString(guid);
UString info = UString("Section GUID: ") + guidToUString(guid, false) +
usprintf("\nType: %02Xh\nFull size: %Xh (%u)\nHeader size: %Xh (%u)\nBody size: %Xh (%u)\nData offset: %Xh\nAttributes: %04Xh",
usprintf("\nType: %02Xh\nFull size: %Xh (%u)\nHeader size: %Xh (%u)\nBody size: %Xh (%u)\nAttributes: %04Xh",
sectionHeader->Type,
(UINT32)section.size(), (UINT32)section.size(),
(UINT32)header.size(), (UINT32)header.size(),
(UINT32)body.size(), (UINT32)body.size(),
dataOffset,
attributes);
// Append additional info
@ -2487,7 +2489,7 @@ USTATUS FfsParser::parseGuidedSectionHeader(const UByteArray & section, const UI
// Show messages
if (msgSignedSectionFound)
msg(usprintf("%s: section signature may become invalid after any modification", __FUNCTION__), index);
msg(usprintf("%s: GUIDed section signature may become invalid after modification", __FUNCTION__), index);
if (msgNoAuthStatusAttribute)
msg(usprintf("%s: CRC32 GUIDed section without AuthStatusValid attribute", __FUNCTION__), index);
if (msgNoProcessingRequiredAttributeCompressed)
@ -2495,13 +2497,15 @@ USTATUS FfsParser::parseGuidedSectionHeader(const UByteArray & section, const UI
if (msgNoProcessingRequiredAttributeSigned)
msg(usprintf("%s: signed GUIDed section without ProcessingRequired attribute", __FUNCTION__), index);
if (msgInvalidCrc)
msg(usprintf("%s: GUID defined section with invalid CRC32", __FUNCTION__), index);
msg(usprintf("%s: CRC32 GUIDed section with invalid checksum", __FUNCTION__), index);
if (msgUnknownCertType)
msg(usprintf("%s: signed GUIDed section with unknown type", __FUNCTION__), index);
msg(usprintf("%s: signed GUIDed section with unknown certificate type", __FUNCTION__), index);
if (msgUnknownCertSubtype)
msg(usprintf("%s: signed GUIDed section with unknown subtype", __FUNCTION__), index);
msg(usprintf("%s: signed GUIDed section with unknown certificate subtype", __FUNCTION__), index);
if (msgProcessingRequiredAttributeOnUnknownGuidedSection)
msg(usprintf("%s: processing required bit set for GUIDed section with unknown GUID", __FUNCTION__), index);
if (msgInvalidCompressedSize)
msg(usprintf("%s: AMD Zlib-compressed section with invalid compressed size", __FUNCTION__), index);
}
return U_SUCCESS;
@ -2906,6 +2910,17 @@ USTATUS FfsParser::parseGuidedSectionBody(const UModelIndex & index)
info += UString("\nCompression algorithm: GZip");
info += usprintf("\nDecompressed size: %Xh (%u)", (UINT32)processed.size(), (UINT32)processed.size());
}
// Zlib compressed section
else if (baGuid == EFI_GUIDED_SECTION_ZLIB_AMD) {
USTATUS result = zlibDecompress(model->body(index), processed);
if (result) {
msg(usprintf("%s: decompression failed with error ", __FUNCTION__) + errorCodeToUString(result), index);
return U_SUCCESS;
}
info += UString("\nCompression algorithm: Zlib");
info += usprintf("\nDecompressed size: %Xh (%u)", (UINT32)processed.size(), (UINT32)processed.size());
}
// Add info
model->addInfo(index, info);
@ -3212,7 +3227,7 @@ USTATUS FfsParser::parsePeImageSectionBody(const UModelIndex & index)
imageFileHeader->NumberOfSections,
imageFileHeader->Characteristics);
EFI_IMAGE_OPTIONAL_HEADER_POINTERS_UNION optionalHeader;
EFI_IMAGE_OPTIONAL_HEADER_POINTERS_UNION optionalHeader = {};
optionalHeader.H32 = (const EFI_IMAGE_OPTIONAL_HEADER32*)(imageFileHeader + 1);
if (body.size() < (UINT8*)optionalHeader.H32 - (UINT8*)dosHeader) {
info += UString("\nPE optional header: invalid");

28
common/ffsparser.h
View File

@ -20,8 +20,36 @@ WITHWARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#include "ubytearray.h"
#include "treemodel.h"
#include "intel_microcode.h"
#include "ffs.h"
#include "fitparser.h"
// Region info
typedef struct REGION_INFO_ {
UINT32 offset = 0;
UINT32 length = 0;
UINT8 type = 0;
UByteArray data;
friend bool operator< (const struct REGION_INFO_ & lhs, const struct REGION_INFO_ & rhs) { return lhs.offset < rhs.offset; }
} REGION_INFO;
// BPDT partition info
typedef struct BPDT_PARTITION_INFO_ {
BPDT_ENTRY ptEntry = {};
UINT8 type = 0;
UModelIndex index;
friend bool operator< (const struct BPDT_PARTITION_INFO_ & lhs, const struct BPDT_PARTITION_INFO_ & rhs) { return lhs.ptEntry.Offset < rhs.ptEntry.Offset; }
} BPDT_PARTITION_INFO;
// CPD partition info
typedef struct CPD_PARTITION_INFO_ {
CPD_ENTRY ptEntry = {};
UINT8 type = 0;
bool hasMetaData = false;
UModelIndex index;
friend bool operator< (const struct CPD_PARTITION_INFO_ & lhs, const struct CPD_PARTITION_INFO_ & rhs) { return lhs.ptEntry.Offset.Offset < rhs.ptEntry.Offset.Offset; }
} CPD_PARTITION_INFO;
// Protected range
typedef struct PROTECTED_RANGE_ {
UINT32 Offset;
UINT32 Size;

39
common/utility.cpp
View File

@ -526,20 +526,20 @@ USTATUS gzipDecompress(const UByteArray & input, UByteArray & output)
if (input.size() == 0)
return U_SUCCESS;
z_stream stream;
z_stream stream = {};
stream.next_in = (z_const Bytef *)input.data();
stream.avail_in = (uInt)input.size();
stream.zalloc = Z_NULL;
stream.zfree = Z_NULL;
stream.opaque = Z_NULL;
// 15 for the maximum history buffer, 16 for gzip only input.
// 15 for the maximum history buffer, 16 for gzip only input
int ret = inflateInit2(&stream, 15U | 16U);
if (ret != Z_OK)
return U_GZIP_DECOMPRESSION_FAILED;
while (ret == Z_OK) {
Bytef out[4096];
Bytef out[0x1000] = {};
stream.next_out = out;
stream.avail_out = sizeof(out);
@ -551,3 +551,36 @@ USTATUS gzipDecompress(const UByteArray & input, UByteArray & output)
inflateEnd(&stream);
return ret == Z_STREAM_END ? U_SUCCESS : U_GZIP_DECOMPRESSION_FAILED;
}
USTATUS zlibDecompress(const UByteArray& input, UByteArray& output)
{
output.clear();
if (input.size() == 0)
return U_SUCCESS;
z_stream stream = {};
stream.next_in = (z_const Bytef*)input.data();
stream.avail_in = (uInt)input.size();
stream.zalloc = Z_NULL;
stream.zfree = Z_NULL;
stream.opaque = Z_NULL;
// 15 for the maximum history buffer
int ret = inflateInit2(&stream, 15U);
if (ret != Z_OK)
return U_ZLIB_DECOMPRESSION_FAILED;
while (ret == Z_OK) {
Bytef out[0x1000] = {};
stream.next_out = out;
stream.avail_out = sizeof(out);
ret = inflate(&stream, Z_NO_FLUSH);
if ((ret == Z_OK || ret == Z_STREAM_END) && stream.avail_out != sizeof(out))
output += UByteArray((char*)out, sizeof(out) - stream.avail_out);
}
inflateEnd(&stream);
return ret == Z_STREAM_END ? U_SUCCESS : U_ZLIB_DECOMPRESSION_FAILED;
}

5
common/utility.h
View File

@ -41,6 +41,9 @@ USTATUS decompress(const UByteArray & compressed, const UINT8 compressionType, U
// GZIP decompression routine
USTATUS gzipDecompress(const UByteArray & compressed, UByteArray & decompressed);
// ZLIB decompression routine
USTATUS zlibDecompress(const UByteArray& compressed, UByteArray& decompressed);
// 8bit sum calculation routine
UINT8 calculateSum8(const UINT8* buffer, UINT32 bufferSize);
@ -66,7 +69,7 @@ INTN findPattern(const UINT8 *pattern, const UINT8 *patternMask, UINTN patternSi
// Safely dereferences misaligned pointers
template <typename T>
inline T readUnaligned(const T *v) {
T tmp;
T tmp = {};
memcpy(&tmp, v, sizeof(T));
return tmp;
}