PSPReverse / PSPTool

Display, extract, and manipulate PSP firmware inside UEFI images
GNU General Public License v3.0
612 stars 62 forks source link

psptool/fet.py: handle 2BHD magic same as 2PSP #41

Closed mkopec closed 2 years ago

mkopec commented 2 years ago

The 2BHD magic identifies combo directories, same as 2PSP.

Tested on a ThinkPad T14 Gen1 BIOS image.

Signed-off-by: Michał Kopeć michal.kopec@3mdeb.com

mkopec commented 2 years ago

Here's what the output for T14's BIOS looks like - previously the $BHD and $BL2 directories were not found:

michal@T14 ~/D/t14> psptool bios_newer.rom
Warning: Couldn't parse entry at: 0xf6800. Type: KEY_DATABASE~0x50. Size 0x1410
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x24, address=0x1be000, size=0x2eb0, len(references)=1)
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x29, address=0x209000, size=0x17e960, len(references)=1)
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x45, address=0x3fe200, size=0x1b70, len(references)=1)
+-----+------+-----------+---------+-------------------------------+
| ROM | Addr |    Size   |   FET   |             AGESA             |
+-----+------+-----------+---------+-------------------------------+
|  0  | 0x0  | 0x1000000 | 0x20000 | AGESA!V9 RenoirPI-FP6 1.0.0.8 |
+-----+------+-----------+---------+-------------------------------+
+--+-----------+---------+------+-------+---------------------+
|  | Directory |   Addr  | Type | Magic | Secondary Directory |
+--+-----------+---------+------+-------+---------------------+
|  |     0     | 0x41000 | PSP  |  $PSP |       0x143000      |
+--+-----------+---------+------+-------+---------------------+
+--+---+-------+----------+---------+---------------------------------+----------+-----------+---------------------------+
|  |   | Entry |  Address |    Size |                            Type | Magic/ID |   Version |                      Info |
+--+---+-------+----------+---------+---------------------------------+----------+-----------+---------------------------+
|  |   |     0 |  0x41400 |   0x440 |              AMD_PUBLIC_KEY~0x0 |     144E |         1 |                           |
|  |   |     1 | 0x143400 | 0x10880 |          PSP_FW_BOOT_LOADER~0x1 |     $PS1 | 0.11.0.78 | verified(144E), sha256_ok |
|  |   |     2 |  0x41900 |  0xe580 | PSP_FW_RECOVERY_BOOT_LOADER~0x3 |     $PS1 | 0.11.1.49 |            verified(144E) |
|  |   |     3 |  0x4ff00 | 0x21310 |              SMU_OFFCHIP_FW~0x8 |     $PS1 | 0.37.47.0 |                compressed |
|  |   |     4 |  0x71300 |  0xe760 |          SMU_OFF_CHIP_FW_2~0x12 |     $PS1 | 0.37.47.0 |                compressed |
|  |   |     5 |  0x7fb00 |    0x10 |               WRAPPED_IKEK~0x21 |          |           |                           |
|  |   |     6 |  0x80000 |  0x1000 |               TOKEN_UNLOCK~0x22 |          |           |                           |
|  |   |     7 |  0x81000 |  0x2f00 |                 SEC_GASKET~0x24 |     $PS1 |  B.9.0.75 |            verified(BCC5) |
|  |   |     8 |  0x83f00 |   0x2a0 |                       ABL0~0x30 |          |   0.0.0.0 |            verified(CF65) |
|  |   |     9 |  0xf6800 |  0x1410 |               KEY_DATABASE~0x50 |          |           |                           |
|  |   |    10 | 0x143000 |   0x400 |   !PL2_SECONDARY_DIRECTORY~0x40 |          |           |                           |
+--+---+-------+----------+---------+---------------------------------+----------+-----------+---------------------------+

+--+-----------+----------+-----------+-------+---------------------+
|  | Directory |   Addr   |    Type   | Magic | Secondary Directory |
+--+-----------+----------+-----------+-------+---------------------+
|  |     1     | 0x143000 | secondary |  $PL2 |          --         |
+--+-----------+----------+-----------+-------+---------------------+
+--+---+-------+----------+----------+-----------------------------+----------+------------+-------------------------------------+
|  |   | Entry |  Address |     Size |                        Type | Magic/ID |    Version |                                Info |
+--+---+-------+----------+----------+-----------------------------+----------+------------+-------------------------------------+
|  |   |     0 | 0x143400 |  0x10880 |      PSP_FW_BOOT_LOADER~0x1 |     $PS1 |  0.11.0.78 |           verified(144E), sha256_ok |
|  |   |     1 | 0x153d00 |    0x440 |          AMD_PUBLIC_KEY~0x0 |     144E |          1 |                                     |
|  |   |     2 | 0x154200 |  0x15380 |       PSP_FW_TRUSTED_OS~0x2 |     $PS1 |  0.11.0.78 |           verified(D945), sha256_ok |
|  |   |     3 |  0x21000 |  0x20000 |             PSP_NV_DATA~0x4 |          |            |                                     |
|  |   |     4 | 0x169600 |  0x20fb0 |          SMU_OFFCHIP_FW~0x8 |     $PS1 |  0.37.5B.0 |               compressed, sha256_ok |
|  |   |     5 | 0x18a600 |    0x440 |      SEC_DBG_PUBLIC_KEY~0x9 |     0475 |          1 |                      verified(144E) |
|  |   |     6 |      0x1 |      0x0 |      SOFT_FUSE_CHAIN_01~0xb |          |            |                                     |
|  |   |     7 | 0x18ab00 |  0x1f100 | PSP_BOOT_TIME_TRUSTLETS~0xc |     $PS1 |   3.4D.0.5 |                      verified(CC7D) |
|  |   |     8 | 0x1a9c00 |  0x10070 |      SMU_OFF_CHIP_FW_2~0x12 |     $PS1 |  0.37.5B.0 |               compressed, sha256_ok |
|  |   |     9 | 0x1b9d00 |   0x2100 |           DEBUG_UNLOCK~0x13 |     $PS1 |  0.11.0.78 |           verified(11F8), sha256_ok |
|  |   |    10 | 0x1bbe00 |    0x664 |                        0x20 |          |    0.0.0.0 |                      verified(76AC) |
|  |   |    11 | 0x1bc500 |     0x10 |           WRAPPED_IKEK~0x21 |          |            |                                     |
|  |   |    12 | 0x1bd000 |   0x1000 |           TOKEN_UNLOCK~0x22 |          |            |                                     |
|  |   |    13 | 0x1be000 |   0x2eb0 |             SEC_GASKET~0x24 |     $PS1 |   B.9.0.85 | verified(BCC5), sha256_inconsistent |
|  |   |    14 | 0x1c0f00 |  0x2a83b |                 MP2_FW~0x25 |          |    4.0.5.8 |                      verified(7C83) |
|  |   |    15 | 0x1eb800 |  0x1d770 |         DRIVER_ENTRIES~0x28 |     $PS1 |  0.11.0.78 |           verified(D945), sha256_ok |
|  |   |    16 | 0x209000 | 0x17e960 |                        0x29 |          |   1.8A.2.2 |      sha256_inconsistent, encrypted |
|  |   |    17 | 0x387a00 |   0x3100 |            S0I3_DRIVER~0x2d |     $PS1 | 8.17.30.30 |           verified(CC7D), sha256_ok |
|  |   |    18 | 0x38ab00 |    0x290 |                   ABL0~0x30 |          |    0.0.0.0 |           verified(CF65), sha256_ok |
|  |   |    19 | 0x3f8100 |   0x6100 |                        0x3c |     $PS1 |  11.A.0.1B |                      verified(2FCA) |
|  |   |    20 | 0x3fe200 |   0x1b70 |                        0x45 |     $PS1 |   B.9.1.85 | verified(BCC5), sha256_inconsistent |
|  |   |    21 | 0x3ffe00 |    0x210 |             FW_INVALID~0x44 |     $PS1 |    0.0.0.0 |                      verified(462E) |
|  |   |    22 | 0x406500 |   0x1900 |           KEY_DATABASE~0x50 |     $PS1 |          1 |           verified(144E), sha256_ok |
|  |   |    23 | 0x407e00 |   0x1070 |                        0x51 |     $PS1 |          1 |           verified(144E), sha256_ok |
|  |   |    24 | 0x408f00 |   0x5b70 |                        0x58 |     $PS1 |    0.0.0.0 |                      verified(EBDF) |
|  |   |    25 | 0x40eb00 |    0x220 |                        0x59 |     $PS1 |    0.0.0.0 |                      verified(EBDF) |
|  |   |    26 | 0x40ee00 |   0x4100 |                        0x47 |     $PS1 |  4.11.0.2E |                      verified(61CE) |
|  |   |    27 | 0x4d0000 |  0x40000 |                        0x54 |          |            |                                     |
+--+---+-------+----------+----------+-----------------------------+----------+------------+-------------------------------------+

+--+-----------+---------+------+-------+---------------------+
|  | Directory |   Addr  | Type | Magic | Secondary Directory |
+--+-----------+---------+------+-------+---------------------+
|  |     2     | 0xf9000 | BIOS |  $BHD |       0x473000      |
+--+-----------+---------+------+-------+---------------------+
+--+---+-------+----------+----------+-------------------------------+----------+----------+----------------+
|  |   | Entry |  Address |     Size |                          Type | Magic/ID |  Version |           Info |
+--+---+-------+----------+----------+-------------------------------+----------+----------+----------------+
|  |   |     0 |  0xf9400 |    0x440 |           BIOS_PUBLIC_KEY~0x5 |     6F19 |        1 | verified(144E) |
|  |   |     1 |  0xf9900 |    0x100 |        BIOS_RTM_SIGNATURE~0x7 |          |          |                |
|  |   |     2 |  0xfa000 |   0x2000 |                   FW_IMC~0x60 |          |          |                |
|  |   |     3 |  0xfc000 |   0x8000 |                          0x68 |          |          |                |
|  |   |     4 | 0x104000 |   0x2000 |                      0x800068 |          |          |                |
|  |   |     5 |      0x0 |      0x0 |                   FW_GEC~0x61 |          |          |                |
|  |   |     6 | 0xf00000 | 0x100000 |                          BIOS |          |          |                |
|  |   |     7 | 0x106000 |   0x4890 |                      0x100064 |     0x05 | 0.0.10.1 |     compressed |
|  |   |     8 | 0x10a900 |    0x360 |                      0x100065 |     0x05 | 0.0.10.1 |     compressed |
|  |   |     9 | 0x10ad00 |   0x4ae0 |                      0x400064 |     0x05 | 0.0.10.1 |     compressed |
|  |   |    10 | 0x10f800 |    0x340 |                      0x400065 |     0x05 | 0.0.10.1 |     compressed |
|  |   |    11 | 0x473000 |    0x400 | !BL2_SECONDARY_DIRECTORY~0x70 |          |          |                |
+--+---+-------+----------+----------+-------------------------------+----------+----------+----------------+

+--+-----------+----------+-----------+-------+---------------------+
|  | Directory |   Addr   |    Type   | Magic | Secondary Directory |
+--+-----------+----------+-----------+-------+---------------------+
|  |     3     | 0x473000 | secondary |  $BL2 |          --         |
+--+-----------+----------+-----------+-------+---------------------+
+--+---+-------+----------+----------+------------------------+----------+----------+----------------+
|  |   | Entry |  Address |     Size |                   Type | Magic/ID |  Version |           Info |
+--+---+-------+----------+----------+------------------------+----------+----------+----------------+
|  |   |     0 | 0x473400 |    0x440 |    BIOS_PUBLIC_KEY~0x5 |     07E6 |        1 | verified(144E) |
|  |   |     1 | 0x473900 |    0x100 | BIOS_RTM_SIGNATURE~0x7 |          |          |                |
|  |   |     2 | 0x474000 |   0x2000 |            FW_IMC~0x60 |          |          |                |
|  |   |     3 | 0x476000 |   0x8000 |                   0x68 |          |          |                |
|  |   |     4 | 0x47e000 |   0x2000 |               0x800068 |          |          |                |
|  |   |     5 |      0x0 |      0x0 |            FW_GEC~0x61 |          |          |                |
|  |   |     6 | 0xf00000 | 0x100000 |                   BIOS |          |          |                |
|  |   |     7 | 0x480000 |  0x10000 |        FW_INVALID~0x63 |          |          |                |
|  |   |     8 | 0x490000 |   0x4890 |               0x100064 |     0x05 | 0.0.10.1 |     compressed |
|  |   |     9 | 0x494900 |    0x360 |               0x100065 |     0x05 | 0.0.10.1 |     compressed |
|  |   |    10 | 0x494d00 |   0x4ae0 |               0x400064 |     0x05 | 0.0.10.1 |     compressed |
|  |   |    11 | 0x499800 |    0x340 |               0x400065 |     0x05 | 0.0.10.1 |     compressed |
|  |   |    12 | 0x499c00 |    0xc80 |                   0x66 |          |          |                |
|  |   |    13 | 0x49a900 |    0xc80 |               0x100066 |          |          |                |
|  |   |    14 | 0x49b600 |    0x244 |                   0x6a |          |  0.0.0.0 | verified(7C83) |
+--+---+-------+----------+----------+------------------------+----------+----------+----------------+
cwerling commented 2 years ago

Good stuff, much appreciated!