Open ilyarooc opened 4 days ago
Still looking into the amd64 hashes, but for the x86 hash not included in both CSVs this is because there some hashes commented out (removed) of the DBX for devices that apply the dbx2024 update file to revoke the Windows Production PCA 2011 cert. This 363384D14D1F2E0B7815626484C459AD57A318EF4396266048D058C5A19BBF76 (exist in the x86/DBXUpdate.bin) + many others are now revoked by cert and not by hash.
Both dbx_info_msft_4_09_24.csv and dbx_info_uefi_org_7_18_23.csv files are missing some hashes, although these hashes are present in the signed binary DBX.
For example, some of the hashes from the Microsoft Security Advisory 2871690 article:
F52F83A3FA9CFBD6920F722824DBE4034534D25B8507246B3B957DAC6E1BCE7A
(exist in the amd64/DBXUpdate.bin)C5D9D8A186E2C82D09AFAA2A6F7F2E73870D3E64F72C4E08EF67796A840F0FBD
(exist in the amd64/DBXUpdate.bin)363384D14D1F2E0B7815626484C459AD57A318EF4396266048D058C5A19BBF76
(exist in the x86/DBXUpdate.bin)Of course, these files are not the actual source of the Secure Boot Forbidden Signature Database for a firmware. But it would be nice to have these CSV files up to date and reflecting the actual values in the DBX lists.