internal

Documentation

Index

• Variables
• type EFIDevicePathElement
• type EFIDeviceType
• type EFIImageLoad
  • func ParseEFIImageLoad(r io.Reader) (ret EFIImageLoad, err error)
  • func (h *EFIImageLoad) DevicePath() ([]EFIDevicePathElement, error)
• type EFIImageLoadHeader
• type EFISignatureData
• type EventType
  • func UntrustedParseEventType(et uint32) (EventType, error)
  • func (e EventType) String() string
• type TaggedEventData
  • func ParseTaggedEventData(d []byte) (*TaggedEventData, error)
• type UEFIVariableAuthority
  • func ParseUEFIVariableAuthority(v UEFIVariableData) (UEFIVariableAuthority, error)
• type UEFIVariableData
  • func ParseUEFIVariableData(r io.Reader) (ret UEFIVariableData, err error)
  • func (v *UEFIVariableData) SignatureData() (certs []x509.Certificate, hashes [][]byte, err error)
  • func (v *UEFIVariableData) VarName() string
• type UEFIVariableDataHeader

Variables

var ErrSigMissingGUID = errors.New("signature data was missing owner GUID")

ErrSigMissingGUID is returned if an EFI_SIGNATURE_DATA structure was parsed successfully, however was missing the SignatureOwner GUID. This case is handled specially as a workaround for a bug relating to authority events.

Types

type EFIDevicePathElement

type EFIDevicePathElement struct {
	Type    EFIDeviceType
	Subtype uint8
	Data    []byte
}

type EFIDeviceType

type EFIDeviceType uint8

EFIDeviceType describes the type of a device specified by a device path.

const (
	HardwareDevice  EFIDeviceType = 0x01
	ACPIDevice      EFIDeviceType = 0x02
	MessagingDevice EFIDeviceType = 0x03
	MediaDevice     EFIDeviceType = 0x04
	BBSDevice       EFIDeviceType = 0x05

	EndDeviceArrayMarker EFIDeviceType = 0x7f
)

"Device Path Protocol" type values.

Section 9.3.2 of the UEFI specification, accessible at: https://uefi.org/sites/default/files/resources/UEFI%20Spec%202_6.pdf

type EFIImageLoad

type EFIImageLoad struct {
	Header      EFIImageLoadHeader
	DevPathData []byte
}

EFIImageLoad describes an EFI_IMAGE_LOAD_EVENT structure.

func ParseEFIImageLoad

func ParseEFIImageLoad(r io.Reader) (ret EFIImageLoad, err error)

ParseEFIImageLoad parses an EFI_IMAGE_LOAD_EVENT structure.

https://trustedcomputinggroup.org/wp-content/uploads/TCG_EFI_Platform_1_22_Final_-v15.pdf#page=17

func (*EFIImageLoad) DevicePath

func (h *EFIImageLoad) DevicePath() ([]EFIDevicePathElement, error)

type EFIImageLoadHeader

type EFIImageLoadHeader struct {
	LoadAddr      uint64
	Length        uint64
	LinkAddr      uint64
	DevicePathLen uint64
}

type EFISignatureData

type EFISignatureData struct {
	SignatureOwner efiGUID
	SignatureData  []byte // []int8
}

EFISignatureData represents the EFI_SIGNATURE_DATA type. See section "31.4.1 Signature Database" in the specification for more information.

type EventType

type EventType uint32

EventType describes the type of event signalled in the event log.

const (
	PrebootCert EventType = 0x00000000
	PostCode    EventType = 0x00000001

	NoAction             EventType = 0x00000003
	Separator            EventType = 0x00000004
	Action               EventType = 0x00000005
	EventTag             EventType = 0x00000006
	SCRTMContents        EventType = 0x00000007
	SCRTMVersion         EventType = 0x00000008
	CpuMicrocode         EventType = 0x00000009
	PlatformConfigFlags  EventType = 0x0000000A
	TableOfDevices       EventType = 0x0000000B
	CompactHash          EventType = 0x0000000C
	Ipl                  EventType = 0x0000000D
	IplPartitionData     EventType = 0x0000000E
	NonhostCode          EventType = 0x0000000F
	NonhostConfig        EventType = 0x00000010
	NonhostInfo          EventType = 0x00000011
	OmitBootDeviceEvents EventType = 0x00000012
)

BIOS Events (TCG PC Client Specific Implementation Specification for Conventional BIOS 1.21)

const (
	EFIEventBase               EventType = 0x80000000
	EFIVariableDriverConfig    EventType = 0x80000001
	EFIVariableBoot            EventType = 0x80000002
	EFIBootServicesApplication EventType = 0x80000003
	EFIBootServicesDriver      EventType = 0x80000004
	EFIRuntimeServicesDriver   EventType = 0x80000005
	EFIGPTEvent                EventType = 0x80000006
	EFIAction                  EventType = 0x80000007
	EFIPlatformFirmwareBlob    EventType = 0x80000008
	EFIHandoffTables           EventType = 0x80000009
	EFIHCRTMEvent              EventType = 0x80000010
	EFIVariableAuthority       EventType = 0x800000e0
)

EFI Events (TCG EFI Platform Specification Version 1.22)

func UntrustedParseEventType

func UntrustedParseEventType(et uint32) (EventType, error)

UntrustedParseEventType returns the event type indicated by the provided value.

func (EventType) String

func (e EventType) String() string

type TaggedEventData

type TaggedEventData struct {
	ID   uint32
	Data []byte
}

TaggedEventData represents the TCG_PCClientTaggedEventStruct structure, as defined by 11.3.2.1 in the "TCG PC Client Specific Implementation Specification for Conventional BIOS", version 1.21.

func ParseTaggedEventData

func ParseTaggedEventData(d []byte) (*TaggedEventData, error)

ParseTaggedEventData parses a TCG_PCClientTaggedEventStruct structure.

type UEFIVariableAuthority

type UEFIVariableAuthority struct {
	Certs []x509.Certificate
}

UEFIVariableAuthority describes the contents of a UEFI variable authority event.

func ParseUEFIVariableAuthority

func ParseUEFIVariableAuthority(v UEFIVariableData) (UEFIVariableAuthority, error)

ParseUEFIVariableAuthority parses the data section of an event structured as a UEFI variable authority.

https://uefi.org/sites/default/files/resources/UEFI_Spec_2_8_final.pdf#page=1789

type UEFIVariableData

type UEFIVariableData struct {
	Header       UEFIVariableDataHeader
	UnicodeName  []uint16
	VariableData []byte // []int8
}

UEFIVariableData represents the UEFI_VARIABLE_DATA structure.

func ParseUEFIVariableData

func ParseUEFIVariableData(r io.Reader) (ret UEFIVariableData, err error)

ParseUEFIVariableData parses the data section of an event structured as a UEFI variable.

https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_Specific_Platform_Profile_for_TPM_2p0_1p04_PUBLIC.pdf#page=100

func (*UEFIVariableData) SignatureData

func (v *UEFIVariableData) SignatureData() (certs []x509.Certificate, hashes [][]byte, err error)

func (*UEFIVariableData) VarName

func (v *UEFIVariableData) VarName() string

type UEFIVariableDataHeader

type UEFIVariableDataHeader struct {
	VariableName       efiGUID
	UnicodeNameLength  uint64 // uintN
	VariableDataLength uint64 // uintN
}

UEFIVariableDataHeader represents the leading fixed-size fields within UEFI_VARIABLE_DATA.