eventlog

README

to run the tool, do go build ./... and the binary will be created in the same dir

Documentation

Index

• Constants
• Variables
• func DumpEventLog(events []Event, verbose bool)
• func EventLogIterate(events []Event) map[int][]byte
• func ParseGPTEntries(events []Event)
• func ValidateEventLog(events []Event, pcrs map[int][]byte, templateEvents []TemplateEvent) error
• type Algorithm
• type Digest
• type EFIDPathNodeType
• type EFIVariableEventData
  • func (e *EFIVariableEventData) Bytes() []byte
  • func (e *EFIVariableEventData) String() string
• type Event
  • func ParseEvents(eventLogFile string) ([]Event, error)
  • func (e *Event) Sha256Digest() []byte
• type EventType
• type Guid
  • func (g *Guid) String() string
• type HashAlg
  • func (a HashAlg) String() string
• type SpecAlgSize
• type SpecIDEvent
• type SpecIDHdr
• type TemplateEvent
  • func PrepareMeasurements(events []Event) []TemplateEvent

Constants

const (
	EFIDPathNodeHardware EFIDPathNodeType = 0x01
	EFIDPathNodeACPI                      = 0x02
	EFIDPathNodeMsg                       = 0x03
	EFIDPathNodeMedia                     = 0x04
	EFIDPathNodeBBS                       = 0x05
	EFIDPathNodeEoH                       = 0x7f
)

const (
	ImgA = "IMGA"
	ImgB = "IMGB"
)

Variables

var (
	HashSHA1   = HashAlg(AlgSHA1)
	HashSHA256 = HashAlg(AlgSHA256)
)

Valid hash algorithms.

Functions

func DumpEventLog

func DumpEventLog(events []Event, verbose bool)

func EventLogIterate

func EventLogIterate(events []Event) map[int][]byte

func ParseGPTEntries

func ParseGPTEntries(events []Event)

func ValidateEventLog

func ValidateEventLog(events []Event, pcrs map[int][]byte, templateEvents []TemplateEvent) error

Types

type Algorithm

type Algorithm uint16

const (
	AlgSHA1   Algorithm = 0x0004
	AlgSHA256 Algorithm = 0x000B
)

type Digest

type Digest struct {
	Hash crypto.Hash
	Data []byte
}

type EFIDPathNodeType

type EFIDPathNodeType uint8

type EFIVariableEventData

type EFIVariableEventData struct {
	VariableName Guid
	UnicodeName  string
	VariableData []byte
	// contains filtered or unexported fields
}

EFIVariableEventData corresponds to the EFI_VARIABLE_DATA type.

func (*EFIVariableEventData) Bytes

func (e *EFIVariableEventData) Bytes() []byte

func (*EFIVariableEventData) String

func (e *EFIVariableEventData) String() string

type Event

type Event struct {
	Sequence int
	Index    int
	Typ      EventType
	Data     []byte
	Digests  []Digest
}

func ParseEvents

func ParseEvents(eventLogFile string) ([]Event, error)

func (*Event) Sha256Digest

func (e *Event) Sha256Digest() []byte

type EventType

type EventType uint32

const (
	PrebootCert EventType = 0x00000000
	PostCode    EventType = 0x00000001

	NoAction             EventType = 0x00000003
	Separator            EventType = 0x00000004
	Action               EventType = 0x00000005
	EventTag             EventType = 0x00000006
	SCRTMContents        EventType = 0x00000007
	SCRTMVersion         EventType = 0x00000008
	CpuMicrocode         EventType = 0x00000009
	PlatformConfigFlags  EventType = 0x0000000A
	TableOfDevices       EventType = 0x0000000B
	CompactHash          EventType = 0x0000000C
	Ipl                  EventType = 0x0000000D
	IplPartitionData     EventType = 0x0000000E
	NonhostCode          EventType = 0x0000000F
	NonhostConfig        EventType = 0x00000010
	NonhostInfo          EventType = 0x00000011
	OmitBootDeviceEvents EventType = 0x00000012
)

const (
	EFIEventBase               EventType = 0x80000000
	EFIVariableDriverConfig    EventType = 0x80000001
	EFIVariableBoot            EventType = 0x80000002
	EFIBootServicesApplication EventType = 0x80000003
	EFIBootServicesDriver      EventType = 0x80000004
	EFIRuntimeServicesDriver   EventType = 0x80000005
	EFIGPTEvent                EventType = 0x80000006
	EFIAction                  EventType = 0x80000007
	EFIPlatformFirmwareBlob    EventType = 0x80000008
	EFIHandoffTables           EventType = 0x80000009
	EFIHCRTMEvent              EventType = 0x80000010
	EFIVariableAuthority       EventType = 0x800000e0
)

type Guid

type Guid struct {
	Data1 uint32
	Data2 uint16
	Data3 uint16
	Data4 [8]uint8
}

Guid corresponds to the EFI_GUID type

func (*Guid) String

func (g *Guid) String() string

type HashAlg

type HashAlg uint8

func (HashAlg) String

func (a HashAlg) String() string

String returns a human-friendly representation of the hash algorithm.

type SpecAlgSize

type SpecAlgSize struct {
	ID   Algorithm
	Size uint16
}

type SpecIDEvent

type SpecIDEvent struct {
	// contains filtered or unexported fields
}

type SpecIDHdr

type SpecIDHdr struct {
	Sign  [16]byte
	Pc    uint32
	VMi   uint8
	VMa   uint8
	Erta  uint8
	Siz   uint8
	NAlgs uint32
}

type TemplateEvent

type TemplateEvent struct {
	Data   string
	Digest []byte
}

func PrepareMeasurements

func PrepareMeasurements(events []Event) []TemplateEvent