search

Foxboron / sbctl

:computer: :lock: :key: Secure Boot key manager
MIT License
1.5k stars 86 forks source link

Checksum mismatch #174

Open playday3008 opened 1 year ago

playday3008 commented 1 year ago

Using SetNull.efi for testing purpose When signed with osslsigncode (sudo osslsigncode sign -certs secureboot/keys/db/db.pem -key secureboot/keys/db/db.key -h sha256 -in SetNull.efi -out SetNull.efi.osslsigncode): image When signed with sbctl (sudo sbctl sign -s SetNull.efi): image Unsigned: image

I think your implementation does not change the PE checksum

In my case, any binary works only when signed with osslsigncode. When signed with sbctl, UEFI drops secure boot violation: Invalid signature, blah blah blah

playday3008 commented 1 year ago

Maybe something else causing secure boot violation, but anyway, in my case it's not works when using sbctl, only when using osslsigncode

Foxboron commented 1 year ago

The calculated PE checksum unsigned seems to be wrong, so it's not unlikely that osslsigncode is handling an edge case where the starting binary is malformed.

Where did you download this binary from?

playday3008 commented 1 year ago

From efitools package, form /usr/share/efitools/efi/SetNull.efi