search

a1ive / grub

Fork of GRUB 2 to add various features.
GNU General Public License v3.0
138 stars 38 forks source link

Add BCD (Boot Configuration Data) parser #18

Closed a1ive closed 4 years ago

a1ive commented 4 years ago

https://docs.microsoft.com/en-us/previous-versions/windows/desktop/bcd/boot-configuration-data-portal

a1ive commented 4 years ago

https://github.com/libyal/libregf/blob/master/documentation/Windows%20NT%20Registry%20File%20(REGF)%20format.asciidoc

a1ive commented 4 years ago

https://www.geoffchappell.com/notes/windows/boot/bcd/elements.htm

a1ive commented 4 years ago 
11000001
    wim/vhd/os device & file path ??
12000002
    winload path
    \Windows\system32\boot\winload.efi
12000004
    title
    Boot from WIM
12000005
    lang
    en-US
14000006
    BcdLibraryObjectList_InheritedObjects (Windows Loader only) ??
    {6efb52bf-1766-41db-a6b3-0ee5eff72bd7}
    {7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
15000052
    graphicsresolution
    0 1024x768
    1 800x600
    2 1024x600
16000020
    EMS
    00 Disable
    01 Enable
16000048
    DisableIntegrityChecks (Windows Boot Manager only)
    01 True
    00 False
16000049
    Test Mode (testsigning)
    01 Enable
    00 Disable
16000054
    GraphicsForceHighestMode
    01 True
    00 False
21000001
    wim/vhd/os device & file path ??
22000002
    windows dir
    \Windows
    \hiberfil.sys
23000003
    Windows Resume Application GUID (Windows Loader only)
    {bbf30fe1-ffff-4cb5-9c43-8f5c1e15b3d9}
    Default Menu GUID (Windows Boot Manager only)
    {84203d36-a38d-4b90-8829-42b5372bbe83}
24000001
    Display Order GUID (Windows Boot Manager only)
    {06aa01ea-a7b6-4321-a270-b017823960b4}
    {077a5dc3-1d58-4c3d-a5ce-b816c5bfce78}
    {84203d36-a38d-4b90-8829-42b5372bbe83}
24000002
    BootSequence GUID
25000004
    Timeout (Windows Boot Manager only)
    1e 00 00 00 00 00 00 00 timeout=30
25000020
    Nx Policy
    Enables, disables, and configures Data Execution Prevention (DEP),
    a set of hardware and software technologies designed to prevent
    harmful code from running in protected memory locations.
    01 00 00 00 00 00 00 00 OptOut
    00 00 00 00 00 00 00 00 OptIn
    02 00 00 00 00 00 00 00 AlwaysOff
    03 00 00 00 00 00 00 00 AlwaysOn
25000021
    PAE Policy
    00 00 00 00 00 00 00 00 Default
    01 00 00 00 00 00 00 00 Enable
    02 00 00 00 00 00 00 00 Disable
250000C2
    Metro Menu (BootMenuPolicy)
    01 00 00 00 00 00 00 00 Standard
    00 00 00 00 00 00 00 00 Legacy
26000004
    BcdOSLoaderBoolean_StampDisks
    00
    01
26000005
    AttemptResume
    01 True
    00 False
26000006
    BcdResumeBoolean_DebugOptionEnabled
    01
    00
26000010
    Detect HAL and kernel
    01 True
    00 False
26000020
    Display Boot Menu (Windows Boot Manager only)
    01 Enable
    00 Disable
26000022
    Boot into WinPE
    01 True
    00 False
260000C4
    Allow F10 Edit
    01 True
    00 False
31000003
    boot.sdi device & file path ??
32000004
    boot.sdi path
    \boot\boot.sdi
35000001
    RamdiskImageOffset 
    00 00 01 00 00 00 00 00
35000005
    RamdiskImageLength
    00 00 00 00 00 00 00 00
36000006
    RamdiskExportAsCd
    01 True
    00 False
a1ive commented 4 years ago 
// gpt
     00 01 02 03 04 05 06 07  08 09 0a 0b 0c 0d 0e 0f
0x00 e0,34,55,ae,24,a9,6c,46, b8,36,75,85,39,a3,ee,3a,
0x10 00,00,00,00,01,00,00,00, 90,00,00,00,00,00,00,00,
0x20 03,00,00,00,00,00,00,00, 00,00,00,00,7c,00,00,00,
0x30 00,00,00,00,05,00,00,00, 01,00,00,00,68,00,00,00,
0x40 05,00,00,00,06,00,00,00, 00,00,00,00,48,00,00,00,
0x50 00,00,00,00,14,47,1f,bb, f2,4a,c8,47,96,eb,6f,16,
0x60 2b,1b,57,ad,00,00,00,00, 00,00,00,00,75,fa,fa,92,
0x70 8a,cc,6b,45,b0,82,16,c4, 99,ff,f0,c1,00,00,00,00,
0x80 00,00,00,00,00,00,00,00, 00,00,00,00,5c,00,66,00,
0x90 75,00,63,00,6b,00,2e,00, 77,00,69,00,6d,00,00,00

0x44 +0x04 dp type: QualifiedPartitionData (0x06)
0x4c  == 0x48 (+0x08) ???
0x54 +0x10 part guid
0x68 +0x04 partmap: gpt 0x00
0x6c +0x10 disk guid

// mbr
     00 01 02 03 04 05 06 07  08 09 0a 0b 0c 0d 0e 0f
0x00 e0,34,55,ae,24,a9,6c,46, b8,36,75,85,39,a3,ee,3a,
0x10 00,00,00,00,01,00,00,00, 90,00,00,00,00,00,00,00,
0x20 03,00,00,00,00,00,00,00, 00,00,00,00,7c,00,00,00,
0x30 00,00,00,00,05,00,00,00, 01,00,00,00,68,00,00,00,
0x40 05,00,00,00,06,00,00,00, 00,00,00,00,48,00,00,00,
0x50 00,00,00,00,00,00,10,00, 08,00,00,00,00,00,00,00,
0x60 00,00,00,00,00,00,00,00, 01,00,00,00,f4,d4,7d,1e,
0x70 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x80 00,00,00,00,00,00,00,00, 00,00,00,00,5c,00,66,00,
0x90 75,00,63,00,6b,00,2e,00, 77,00,69,00,6d,00,00,00

// ntboot
     00 01 02 03 04 05 06 07  08 09 0a 0b 0c 0d 0e 0f
0x00 df,e1,94,a2,7c,8a,de,11, 94,2c,f2,4e,6a,36,7b,43,
0x10 00,00,00,00,01,00,00,00, 86,02,00,00,00,00,00,00,
0x20 03,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x30 00,00,00,00,00,00,00,00, 01,00,00,00,5e,02,00,00,
0x40 05,00,00,00,06,00,00,00, 00,00,00,00,48,00,00,00,
0x50 00,00,00,00,00,7e,00,00, 00,00,00,00,00,00,00,00,
0x60 00,00,00,00,00,00,00,00, 01,00,00,00,53,b7,53,b7,
0x70 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x80 00,00,00,00,00,00,00,00, 00,00,00,00,5c,57,49,4d,
0x90 5f,46,49,4c,45,5f,50,41, 54,48,20,20,30,00,30,00
0x44 +0x04 dp type: QualifiedPartitionData (0x06)
0x54 +0x04 part start (+0x10)
0x68 +0x04 partmap: mbr 0x01 (+0x24)
0x6c +0x04 disk signature (+0x28)
0x8c +.... path (+0x48)

// mbr vhd
     00 01 02 03 04 05 06 07  08 09 0a 0b 0c 0d 0e 0f
0x00 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x10 08,00,00,00,00,00,00,00, c2,00,00,00,00,00,00,00,
0x20 00,00,00,00,02,00,00,12, 1e,00,00,00,00,00,00,00,
0x30 00,00,00,00,00,00,a4,00, 00,00,00,00,00,00,06,00,
0x40 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x50 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,7c,00,
0x60 00,00,00,00,00,00,05,00, 00,00,01,00,00,00,68,00,
0x70 00,00,05,00,00,00,06,00, 00,00,00,00,00,00,48,00,
0x80 00,00,00,00,00,00,14,47, 1f,bb,f2,4a,c8,47,96,eb,
0x90 6f,16,2b,1b,57,ad,00,00, 00,00,00,00,00,00,75,fa,
0xa0 fa,92,8a,cc,6b,45,b0,82, 16,c4,99,ff,f0,c1,00,00,
0xb0 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,5c,00,
0xc0 66,00,75,00,63,00,6b,00, 2e,00,76,00,68,00,64,00,
0xd0 00,00
0x76 +0x04 dp type: QualifiedPartitionData (0x06)
0x86 +0x10 part guid (+0x10)
0x9e +0x10 disk guid (+0x28)
0xbe +.... path (+0x48)

//ntboot vhd
     00 01 02 03 04 05 06 07  08 09 0a 0b 0c 0d 0e 0f
0x00 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x10 08,00,00,00,00,00,00,00, b8,02,00,00,00,00,00,00,
0x20 00,00,00,00,02,00,00,12, 1e,00,00,00,00,00,00,00,
0x30 00,00,00,00,00,00,9a,02, 00,00,00,00,00,00,06,00,
0x40 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x50 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,72,02,
0x60 00,00,00,00,00,00,05,00, 00,00,01,00,00,00,5e,02,
0x70 00,00,05,00,00,00,06,00, 00,00,00,00,00,00,48,00,
0x80 00,00,00,00,00,00,00,7e, 00,00,00,00,00,00,00,00,
0x90 00,00,00,00,00,00,00,00, 00,00,01,00,00,00,53,b7,
0xa0 53,b7,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0xb0 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,5c,56,
0xc0 48,44,5f,46,49,4c,45,5f, 50,41,54,48,20,20,30,00
0x76 +0x04 dp type: QualifiedPartitionData (0x06)

//boot.sdi
     00 01 02 03 04 05 06 07  08 09 0a 0b 0c 0d 0e 0f
0x00 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x10 05,00,00,00,00,00,00,00, 48,00,00,00,00,00,00,00,
0x20 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x30 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x40 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x50 00,00,00,00,00,00,00,00

//Windows OS Loader
     00 01 02 03 04 05 06 07  08 09 0a 0b 0c 0d 0e 0f
0x00 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x10 06,00,00,00,00,00,00,00, 48,00,00,00,00,00,00,00,
0x20 14,47,1f,bb,f2,4a,c8,47, 96,eb,6f,16,2b,1b,57,ad,
0x30 00,00,00,00,00,00,00,00, 75,fa,fa,92,8a,cc,6b,45,
0x40 b0,82,16,c4,99,ff,f0,c1, 00,00,00,00,00,00,00,00,
0x50 00,00,00,00,00,00,00,00
0x10 +0x04 dp type: QualifiedPartitionData (0x06)
0x20 +0x10 part guid (+0x10)
0x38 +0x10 disk guid (+0x28)
a1ive commented 4 years ago

https://github.com/a1ive/grub/blob/68596aea36cea22012f6d372fc3012b72a6a23d9/grub-core/lib/libreg/reg.h#L67 #define CM_KEY_LEAF 0x666c // "lf" https://github.com/a1ive/grub/blob/68596aea36cea22012f6d372fc3012b72a6a23d9/grub-core/lib/libreg/reg.h#L136-L140

typedef struct
{
  uint32_t Cell;
  char Name[4];
} GRUB_PACKED CM_INDEX;