LongSoft / UEFITool

UEFI firmware image viewer and editor
BSD 2-Clause "Simplified" License
4.46k stars 630 forks source link

UEFITool is unable to find DXE volume in the image #384

Open Kostr opened 1 year ago

Kostr commented 1 year ago

Recently I've encountered an image (BIOS.zip) in which UEFITool can't parse DXE volume.

For example here I search for (D6A2CB7F-6A18-4E2F-B43B-9920A733700A = DxeCore) and as it can be seen this GUID is only found in the unparsed padding area: 2023-11-25_18-07-39

At the same time MMTool successfully finds the DxeCore EFI module: 2023-11-25_18-16-07

Not sure if this is relevant, but UEFITool outputs some debug information at the image load: 2023-11-25_18-06-32

Can I get some hints about what is wrong and how can I get DXE FV and parse it with the UEFITool?

NikolajSchlej commented 1 year ago

Nice catch!

The problem with this particular image is that a volume of 0x407000 bytes is inserted into an OBB region of 0x37A000 bytes, and Intel FIT (the software that created all those structures) has no diagnostics to detect that, but UEFITool has some.

It is a problem with the image itself, and it will stop being harmless and start breaking the image once the actual non-FF file content of that volume will become larger than 0x37A000.

I don't have any ideas yet on how to fix it in UEFITool other than creating "bruteforce" parsing mode that would ignore any non-UEFI structures.