search

theopolis / uefi-firmware-parser

Parse BIOS/Intel ME/UEFI firmware related structures: Volumes, FileSystems, Files, etc
Other
780 stars 156 forks source link

Support parsing of EFI_FIRMWARE_VOLUME_EXT_HEADER in firmware volumes. #86

Closed assafcarlsbad closed 4 years ago

assafcarlsbad commented 4 years ago

The current definition for EFI_FIRMWARE_VOLUME_HEADER is:

struct EFI_FIRMWARE_VOLUME_HEADER {
    UINT8: Zeros[16]
    UCHAR: FileSystemGUID[16]
    UINT64: Length
    UINT32: Signature (_FVH)
    UINT8: Attribute mask
    UINT16: Header Length
    UINT16: Checksum
    UINT8: Reserved[3]
    UINT8: Revision
    [<BlockMap>]+, <BlockMap(0,0)>
};

However, as per https://dox.ipxe.org/structEFI__FIRMWARE__VOLUME__HEADER.html this definition needs to be rectified to include ExtHeaderOffset as well:

struct EFI_FIRMWARE_VOLUME_HEADER {
    UINT8: Zeros[16]
    UCHAR: FileSystemGUID[16]
    UINT64: Length
    UINT32: Signature (_FVH)
    UINT8: Attribute mask
    UINT16: Header Length
    UINT16: Checksum
    UINT16: ExtHeaderOffset
    UINT8: Reserved[1]
    UINT8: Revision
    ...
};

Following ExtHeaderOffset will lead us to a EFI_FIRMWARE_VOLUME_EXT_HEADER structure, through which we can obtain the actual volume GUID (right now the library only parses the filesystem's GUID, which is a different identifier).