Improved EFI binaries search and updated blacklist config #131
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Member
c7zero
commented
Dec 2, 2016
c7zero
commented
- Calculating hashes of actual .efi executable files (PE32/TE sections of EFI binaries) rather than of entire EFI binaries. There's still an option (WRITE_ALL_HASHES) to calculate hashes of entire EFI binaries.
- Updated EFI binaries search - searching only leaf nodes (PE/TE executable sections)
- Added exclusion criteria and improved JSON format
- Changed tools.uefi.blacklist module to return a warning
- Updated ThinkPwn rules in blacklist.json
- Updated config to match by GUID AND regexp of SmmRuntime protcol GUID within the binary to skip binaries consuming SmmRuntime protcol
- Added exclusion rules for UEFI update images with patched SystemSmmRuntimeRt.efi
Calculating hashes of actual .efi executable files (PE32/TE sections of EFI binaries) rather than of entire EFI binaries. There's still an option (WRITE_ALL_HASHES) to calculate hashes of entire EFI binaries.
1. Updated EFI binaries search - searching only leaf nodes (PE/TE executable sections) 2. Added exclusion criteria and improved JSON format 3. Changed tools.uefi.blacklist module to return a warning 4. Updated ThinkPwn rules in blacklist.json - Updated config to match by GUID AND regexp of SmmRuntime protcol GUID within the binary to skip binaries consuming SmmRuntime protcol - Added exclusion rules for UEFI update images with patched SystemSmmRuntimeRt.efi. Config excludes patched binaries from Lenovo and HP. Tested on Intel, Lenovo, HP and Gigabyte images.
hcwang1126
pushed a commit
to hcwang1126/chipsec
that referenced
this pull request
Jul 4, 2017
* Changes in calculating hashes of EFI binaries Calculating hashes of actual .efi executable files (PE32/TE sections of EFI binaries) rather than of entire EFI binaries. There's still an option (WRITE_ALL_HASHES) to calculate hashes of entire EFI binaries. * Improved UEFI search and updated blacklist config 1. Updated EFI binaries search - searching only leaf nodes (PE/TE executable sections) 2. Added exclusion criteria and improved JSON format 3. Changed tools.uefi.blacklist module to return a warning 4. Updated ThinkPwn rules in blacklist.json - Updated config to match by GUID AND regexp of SmmRuntime protcol GUID within the binary to skip binaries consuming SmmRuntime protcol - Added exclusion rules for UEFI update images with patched SystemSmmRuntimeRt.efi. Config excludes patched binaries from Lenovo and HP. Tested on Intel, Lenovo, HP and Gigabyte images.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.