tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
audk/BaseTools/Scripts/efi_debugging.py

2186 lines
71 KiB
Python
Executable File
Raw Blame History

#!/usr/bin/python3
'''
Copyright (c) Apple Inc. 2021
SPDX-License-Identifier: BSD-2-Clause-Patent
Class that abstracts PE/COFF debug info parsing via a Python file like
object. You can port this code into an arbitrary debugger by invoking
the classes and passing in a file like object that abstracts the debugger
reading memory.
If you run this file directly it will parse the passed in PE/COFF files
for debug info:
python3 ./efi_pefcoff.py DxeCore.efi
IA32`<path...>/DxeCore.dll load = 0x00000000
EntryPoint = 0x000030d2 TextAddress = 0x00000240 DataAddress = 0x000042c0
.text 0x00000240 (0x04080) flags:0x60000020
.data 0x000042C0 (0x001C0) flags:0xC0000040
.reloc 0x00004480 (0x00240) flags:0x42000040
Note: PeCoffClass uses virtual addresses and not file offsets.
It needs to work when images are loaded into memory.
as long as virtual address map to file addresses this
code can process binary files.
Note: This file can also contain generic worker functions (like GuidNames)
that abstract debugger agnostic services to the debugger.
This file should never import debugger specific modules.
'''
import sys
import os
import uuid
import struct
import re
from ctypes import c_char, c_uint8, c_uint16, c_uint32, c_uint64, c_void_p
from ctypes import ARRAY, sizeof
from ctypes import Structure, LittleEndianStructure
#
# The empty LittleEndianStructure must have _fields_ assigned prior to use or
# sizeof(). Anything that is size UINTN may need to get adjusted.
#
# The issue is ctypes matches our local machine, not the machine we are
# trying to debug. Call patch_ctypes() passing in the byte width from the
# debugger python to make sure you are in sync.
#
# Splitting out the _field_ from the Structure (LittleEndianStructure) class
# allows it to be patched.
#
class EFI_LOADED_IMAGE_PROTOCOL(LittleEndianStructure):
pass
EFI_LOADED_IMAGE_PROTOCOL_fields_ = [
('Revision', c_uint32),
('ParentHandle', c_void_p),
('SystemTable', c_void_p),
('DeviceHandle', c_void_p),
('FilePath', c_void_p),
('Reserved', c_void_p),
('LoadOptionsSize', c_uint32),
('LoadOptions', c_void_p),
('ImageBase', c_void_p),
('ImageSize', c_uint64),
('ImageCodeType', c_uint32),
('ImageDataType', c_uint32),
('Unload', c_void_p),
]
class EFI_GUID(LittleEndianStructure):
_fields_ = [
('Data1', c_uint32),
('Data2', c_uint16),
('Data3', c_uint16),
('Data4', ARRAY(c_uint8, 8))
]
class EFI_SYSTEM_TABLE_POINTER(LittleEndianStructure):
_fields_ = [
('Signature', c_uint64),
('EfiSystemTableBase', c_uint64),
('Crc32', c_uint32)
]
class EFI_DEBUG_IMAGE_INFO_NORMAL(LittleEndianStructure):
pass
EFI_DEBUG_IMAGE_INFO_NORMAL_fields_ = [
('ImageInfoType', c_uint32),
('LoadedImageProtocolInstance', c_void_p),
('ImageHandle', c_void_p)
]
class EFI_DEBUG_IMAGE_INFO(LittleEndianStructure):
pass
EFI_DEBUG_IMAGE_INFO_fields_ = [
('NormalImage', c_void_p),
]
class EFI_DEBUG_IMAGE_INFO_TABLE_HEADER(LittleEndianStructure):
pass
EFI_DEBUG_IMAGE_INFO_TABLE_HEADER_fields_ = [
('UpdateStatus', c_uint32),
('TableSize', c_uint32),
('EfiDebugImageInfoTable', c_void_p),
]
class EFI_TABLE_HEADER(LittleEndianStructure):
_fields_ = [
('Signature', c_uint64),
('Revision', c_uint32),
('HeaderSize', c_uint32),
('CRC32', c_uint32),
('Reserved', c_uint32),
]
class EFI_CONFIGURATION_TABLE(LittleEndianStructure):
pass
EFI_CONFIGURATION_TABLE_fields_ = [
('VendorGuid', EFI_GUID),
('VendorTable', c_void_p)
]
class EFI_SYSTEM_TABLE(LittleEndianStructure):
pass
EFI_SYSTEM_TABLE_fields_ = [
('Hdr', EFI_TABLE_HEADER),
('FirmwareVendor', c_void_p),
('FirmwareRevision', c_uint32),
('ConsoleInHandle', c_void_p),
('ConIn', c_void_p),
('ConsoleOutHandle', c_void_p),
('ConOut', c_void_p),
('StandardErrHandle', c_void_p),
('StdErr', c_void_p),
('RuntimeService', c_void_p),
('BootService', c_void_p),
('NumberOfTableEntries', c_void_p),
('ConfigurationTable', c_void_p),
]
class EFI_IMAGE_DATA_DIRECTORY(LittleEndianStructure):
_fields_ = [
('VirtualAddress', c_uint32),
('Size', c_uint32)
]
class EFI_TE_IMAGE_HEADER(LittleEndianStructure):
_fields_ = [
('Signature', ARRAY(c_char, 2)),
('Machine', c_uint16),
('NumberOfSections', c_uint8),
('Subsystem', c_uint8),
('StrippedSize', c_uint16),
('AddressOfEntryPoint', c_uint32),
('BaseOfCode', c_uint32),
('ImageBase', c_uint64),
('DataDirectoryBaseReloc', EFI_IMAGE_DATA_DIRECTORY),
('DataDirectoryDebug', EFI_IMAGE_DATA_DIRECTORY)
]
class EFI_IMAGE_DOS_HEADER(LittleEndianStructure):
_fields_ = [
('e_magic', c_uint16),
('e_cblp', c_uint16),
('e_cp', c_uint16),
('e_crlc', c_uint16),
('e_cparhdr', c_uint16),
('e_minalloc', c_uint16),
('e_maxalloc', c_uint16),
('e_ss', c_uint16),
('e_sp', c_uint16),
('e_csum', c_uint16),
('e_ip', c_uint16),
('e_cs', c_uint16),
('e_lfarlc', c_uint16),
('e_ovno', c_uint16),
('e_res', ARRAY(c_uint16, 4)),
('e_oemid', c_uint16),
('e_oeminfo', c_uint16),
('e_res2', ARRAY(c_uint16, 10)),
('e_lfanew', c_uint16)
]
class EFI_IMAGE_FILE_HEADER(LittleEndianStructure):
_fields_ = [
('Machine', c_uint16),
('NumberOfSections', c_uint16),
('TimeDateStamp', c_uint32),
('PointerToSymbolTable', c_uint32),
('NumberOfSymbols', c_uint32),
('SizeOfOptionalHeader', c_uint16),
('Characteristics', c_uint16)
]
class EFI_IMAGE_OPTIONAL_HEADER32(LittleEndianStructure):
_fields_ = [
('Magic', c_uint16),
('MajorLinkerVersion', c_uint8),
('MinorLinkerVersion', c_uint8),
('SizeOfCode', c_uint32),
('SizeOfInitializedData', c_uint32),
('SizeOfUninitializedData', c_uint32),
('AddressOfEntryPoint', c_uint32),
('BaseOfCode', c_uint32),
('BaseOfData', c_uint32),
('ImageBase', c_uint32),
('SectionAlignment', c_uint32),
('FileAlignment', c_uint32),
('MajorOperatingSystemVersion', c_uint16),
('MinorOperatingSystemVersion', c_uint16),
('MajorImageVersion', c_uint16),
('MinorImageVersion', c_uint16),
('MajorSubsystemVersion', c_uint16),
('MinorSubsystemVersion', c_uint16),
('Win32VersionValue', c_uint32),
('SizeOfImage', c_uint32),
('SizeOfHeaders', c_uint32),
('CheckSum', c_uint32),
('Subsystem', c_uint16),
('DllCharacteristics', c_uint16),
('SizeOfStackReserve', c_uint32),
('SizeOfStackCommit', c_uint32),
('SizeOfHeapReserve', c_uint32),
('SizeOfHeapCommit', c_uint32),
('LoaderFlags', c_uint32),
('NumberOfRvaAndSizes', c_uint32),
('DataDirectory', ARRAY(EFI_IMAGE_DATA_DIRECTORY, 16))
]
class EFI_IMAGE_NT_HEADERS32(LittleEndianStructure):
_fields_ = [
('Signature', c_uint32),
('FileHeader', EFI_IMAGE_FILE_HEADER),
('OptionalHeader', EFI_IMAGE_OPTIONAL_HEADER32)
]
class EFI_IMAGE_OPTIONAL_HEADER64(LittleEndianStructure):
_fields_ = [
('Magic', c_uint16),
('MajorLinkerVersion', c_uint8),
('MinorLinkerVersion', c_uint8),
('SizeOfCode', c_uint32),
('SizeOfInitializedData', c_uint32),
('SizeOfUninitializedData', c_uint32),
('AddressOfEntryPoint', c_uint32),
('BaseOfCode', c_uint32),
('BaseOfData', c_uint32),
('ImageBase', c_uint32),
('SectionAlignment', c_uint32),
('FileAlignment', c_uint32),
('MajorOperatingSystemVersion', c_uint16),
('MinorOperatingSystemVersion', c_uint16),
('MajorImageVersion', c_uint16),
('MinorImageVersion', c_uint16),
('MajorSubsystemVersion', c_uint16),
('MinorSubsystemVersion', c_uint16),
('Win32VersionValue', c_uint32),
('SizeOfImage', c_uint32),
('SizeOfHeaders', c_uint32),
('CheckSum', c_uint32),
('Subsystem', c_uint16),
('DllCharacteristics', c_uint16),
('SizeOfStackReserve', c_uint64),
('SizeOfStackCommit', c_uint64),
('SizeOfHeapReserve', c_uint64),
('SizeOfHeapCommit', c_uint64),
('LoaderFlags', c_uint32),
('NumberOfRvaAndSizes', c_uint32),
('DataDirectory', ARRAY(EFI_IMAGE_DATA_DIRECTORY, 16))
]
class EFI_IMAGE_NT_HEADERS64(LittleEndianStructure):
_fields_ = [
('Signature', c_uint32),
('FileHeader', EFI_IMAGE_FILE_HEADER),
('OptionalHeader', EFI_IMAGE_OPTIONAL_HEADER64)
]
class EFI_IMAGE_DEBUG_DIRECTORY_ENTRY(LittleEndianStructure):
_fields_ = [
('Characteristics', c_uint32),
('TimeDateStamp', c_uint32),
('MajorVersion', c_uint16),
('MinorVersion', c_uint16),
('Type', c_uint32),
('SizeOfData', c_uint32),
('RVA', c_uint32),
('FileOffset', c_uint32),
]
class EFI_IMAGE_SECTION_HEADER(LittleEndianStructure):
_fields_ = [
('Name', ARRAY(c_char, 8)),
('VirtualSize', c_uint32),
('VirtualAddress', c_uint32),
('SizeOfRawData', c_uint32),
('PointerToRawData', c_uint32),
('PointerToRelocations', c_uint32),
('PointerToLinenumbers', c_uint32),
('NumberOfRelocations', c_uint16),
('NumberOfLinenumbers', c_uint16),
('Characteristics', c_uint32),
]
EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC = 0x10b
EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC = 0x20b
DIRECTORY_DEBUG = 6
image_machine_dict = {
0x014c: "IA32",
0x0200: "IPF",
0x0EBC: "EBC",
0x8664: "X64",
0x01c2: "ARM",
0xAA64: "AArch64",
0x5032: "RISC32",
0x5064: "RISC64",
0x5128: "RISCV128",
}
def patch_void_p_to_ctype(patch_type, to_patch):
'''Optionally patch c_void_p in the Structure._fields_'''
if patch_type is None:
return to_patch
result = []
for name, c_type in to_patch:
if type(c_type) == type(c_void_p):
result.append((name, c_uint32))
else:
result.append((name, c_type))
return result
def patch_ctypes(pointer_width=8):
'''
Pass in the pointer width of the system being debugged. If it is not
the same as c_void_p then patch the _fields_ with the correct type.
For any ctypes Structure that has a c_void_p this function needs to be
called prior to use or sizeof() to initialize _fields_.
'''
if sizeof(c_void_p) == pointer_width:
patch_type = None
elif pointer_width == 16:
assert False
elif pointer_width == 8:
patch_type = c_uint64
elif pointer_width == 4:
patch_type = c_uint32
else:
raise Exception(f'ERROR: Unkown pointer_width = {pointer_width}')
# If you add a ctypes Structure class with a c_void_p you need to add
# it to this list. Note: you should use c_void_p for UINTN values.
EFI_LOADED_IMAGE_PROTOCOL._fields_ = patch_void_p_to_ctype(
patch_type, EFI_LOADED_IMAGE_PROTOCOL_fields_)
EFI_DEBUG_IMAGE_INFO_NORMAL._fields_ = patch_void_p_to_ctype(
patch_type, EFI_DEBUG_IMAGE_INFO_NORMAL_fields_)
EFI_DEBUG_IMAGE_INFO._fields_ = patch_void_p_to_ctype(
patch_type, EFI_DEBUG_IMAGE_INFO_fields_)
EFI_DEBUG_IMAGE_INFO_TABLE_HEADER._fields_ = patch_void_p_to_ctype(
patch_type, EFI_DEBUG_IMAGE_INFO_TABLE_HEADER_fields_)
EFI_CONFIGURATION_TABLE._fields_ = patch_void_p_to_ctype(
patch_type, EFI_CONFIGURATION_TABLE_fields_)
EFI_SYSTEM_TABLE._fields_ = patch_void_p_to_ctype(
patch_type, EFI_SYSTEM_TABLE_fields_)
# patch up anything else that needs to know pointer_width
EfiStatusClass(pointer_width)
def ctype_to_str(ctype, indent='', hide_list=[]):
'''
Given a ctype object print out as a string by walking the _fields_
in the cstring Class
'''
result = ''
for field in ctype._fields_:
attr = getattr(ctype, field[0])
tname = type(attr).__name__
if field[0] in hide_list:
continue
result += indent + f'{field[0]} = '
if tname == 'EFI_GUID':
result += GuidNames.to_name(GuidNames.to_uuid(attr)) + '\n'
elif issubclass(type(attr), Structure):
result += f'{tname}\n' + \
ctype_to_str(attr, indent + ' ', hide_list)
elif isinstance(attr, int):
result += f'0x{attr:x}\n'
else:
result += f'{attr}\n'
return result
def hexline(addr, data):
hexstr = ''
printable = ''
for i in range(0, len(data)):
hexstr += f'{data[i]:02x} '
printable += chr(data[i]) if data[i] > 0x20 and data[i] < 0x7f else '.'
return f'{addr:04x} {hexstr:48s} |{printable:s}|'
def hexdump(data, indent=''):
if not isinstance(data, bytearray):
data = bytearray(data)
result = ''
for i in range(0, len(data), 16):
result += indent + hexline(i, data[i:i+16]) + '\n'
return result
class EfiTpl:
''' Return string for EFI_TPL'''
def __init__(self, tpl):
self.tpl = tpl
def __str__(self):
if self.tpl < 4:
result = f'{self.tpl:d}'
elif self.tpl < 8:
result = "TPL_APPLICATION"
if self.tpl - 4 > 0:
result += f' + {self.tpl - 4:d}'
elif self.tpl < 16:
result = "TPL_CALLBACK"
if self.tpl - 8 > 0:
result += f' + {self.tpl - 8:d}'
elif self.tpl < 31:
result = "TPL_NOTIFY"
if self.tpl - 16 > 0:
result += f' + {self.tpl - 16:d}'
elif self.tpl == 31:
result = "TPL_HIGH_LEVEL"
else:
result = f'Invalid TPL = {self.tpl:d}'
return result
class EfiBootMode:
'''
Class to return human readable string for EFI_BOOT_MODE
Methods
-----------
to_str(boot_mode, default)
return string for boot_mode, and return default if there is not a
match.
'''
EFI_BOOT_MODE_dict = {
0x00: "BOOT_WITH_FULL_CONFIGURATION",
0x01: "BOOT_WITH_MINIMAL_CONFIGURATION",
0x02: "BOOT_ASSUMING_NO_CONFIGURATION_CHANGES",
0x03: "BOOT_WITH_FULL_CONFIGURATION_PLUS_DIAGNOSTICS",
0x04: "BOOT_WITH_DEFAULT_SETTINGS",
0x05: "BOOT_ON_S4_RESUME",
0x06: "BOOT_ON_S5_RESUME",
0x07: "BOOT_WITH_MFG_MODE_SETTINGS",
0x10: "BOOT_ON_S2_RESUME",
0x11: "BOOT_ON_S3_RESUME",
0x12: "BOOT_ON_FLASH_UPDATE",
0x20: "BOOT_IN_RECOVERY_MODE",
}
def __init__(self, boot_mode):
self._boot_mode = boot_mode
def __str__(self):
return self.to_str(self._boot_mode)
@classmethod
def to_str(cls, boot_mode, default=''):
return cls.EFI_BOOT_MODE_dict.get(boot_mode, default)
class EfiStatusClass:
'''
Class to decode EFI_STATUS to a human readable string. You need to
pass in pointer_width to get the corret value since the EFI_STATUS
code values are different based on the sizeof UINTN. The default is
sizeof(UINTN) == 8.
Attributes
??????
_dict_ : dictionary
dictionary of EFI_STATUS that has beed updated to match
pointer_width.
Methods
-----------
patch_dictionary(pointer_width)
to_str(status, default)
'''
_dict_ = {}
_EFI_STATUS_UINT32_dict = {
0: "Success",
1: "Warning Unknown Glyph",
2: "Warning Delete Failure",
3: "Warning Write Failure",
4: "Warning Buffer Too Small",
5: "Warning Stale Data",
6: "Warngin File System",
(0x20000000 | 0): "Warning interrupt source pending",
(0x20000000 | 1): "Warning interrupt source quiesced",
(0x80000000 | 1): "Load Error",
(0x80000000 | 2): "Invalid Parameter",
(0x80000000 | 3): "Unsupported",
(0x80000000 | 4): "Bad Buffer Size",
(0x80000000 | 5): "Buffer Too Small",
(0x80000000 | 6): "Not Ready",
(0x80000000 | 7): "Device Error",
(0x80000000 | 8): "Write Protected",
(0x80000000 | 9): "Out of Resources",
(0x80000000 | 10): "Volume Corrupt",
(0x80000000 | 11): "Volume Full",
(0x80000000 | 12): "No Media",
(0x80000000 | 13): "Media changed",
(0x80000000 | 14): "Not Found",
(0x80000000 | 15): "Access Denied",
(0x80000000 | 16): "No Response",
(0x80000000 | 17): "No mapping",
(0x80000000 | 18): "Time out",
(0x80000000 | 19): "Not started",
(0x80000000 | 20): "Already started",
(0x80000000 | 21): "Aborted",
(0x80000000 | 22): "ICMP Error",
(0x80000000 | 23): "TFTP Error",
(0x80000000 | 24): "Protocol Error",
(0x80000000 | 25): "Incompatible Version",
(0x80000000 | 26): "Security Violation",
(0x80000000 | 27): "CRC Error",
(0x80000000 | 28): "End of Media",
(0x80000000 | 31): "End of File",
(0x80000000 | 32): "Invalid Language",
(0x80000000 | 33): "Compromised Data",
(0x80000000 | 35): "HTTP Error",
(0xA0000000 | 0): "Interrupt Pending",
}
def __init__(self, status=None, pointer_width=8):
self.status = status
# this will convert to 64-bit version if needed
self.patch_dictionary(pointer_width)
def __str__(self):
return self.to_str(self.status)
@classmethod
def to_str(cls, status, default=''):
return cls._dict_.get(status, default)
@classmethod
def patch_dictionary(cls, pointer_width):
'''Patch UINTN upper bits like values '''
if cls._dict_:
# only patch the class variable once
return False
if pointer_width == 4:
cls._dict = cls._EFI_STATUS_UINT32_dict
elif pointer_width == 8:
for key, value in cls._EFI_STATUS_UINT32_dict.items():
mask = (key & 0xE0000000) << 32
new_key = (key & 0x1FFFFFFF) | mask
cls._dict_[new_key] = value
return True
else:
return False
class GuidNames:
'''
Class to expose the C names of EFI_GUID's. The _dict_ starts with
common EFI System Table entry EFI_GUID's. _dict_ can get updated with the
build generated Guid.xref file if a path to a module is passed
into add_build_guid_file(). If symbols are loaded for any module
in the build the path the build product should imply the
relative location of that builds Guid.xref file.
Attributes
??????----
_dict_ : dictionary
dictionary of EFI_GUID (uuid) strings to C global names
Methods
-------
to_uuid(uuid)
convert a hex UUID string or bytearray to a uuid.UUID
to_name(uuid)
convert a UUID string to a C global constant name.
to_guid(guid_name)
convert a C global constant EFI_GUID name to uuid hex string.
is_guid_str(name)
name is a hex UUID string.
Example: 49152E77-1ADA-4764-B7A2-7AFEFED95E8B
to_c_guid(value)
convert a uuid.UUID or UUID string to a c_guid string
(see is_c_guid())
from_c_guid(value)
covert a C guid string to a hex UUID string.
is_c_guid(name)
name is the C initialization value for an EFI_GUID. Example:
{ 0x414e6bdd, 0xe47b, 0x47cc, { 0xb2, 0x44, 0xbb, 0x61,
0x02, 0x0c, 0xf5, 0x16 }}
add_build_guid_file(module_path, custom_file):
assume module_path is an edk2 build product and load the Guid.xref
file from that build to fill in _dict_. If you know the path and
file name of a custom Guid.xref you can pass it in as custom_file.
'''
_dict_ = { # Common EFI System Table values
'05AD34BA-6F02-4214-952E-4DA0398E2BB9':
'gEfiDxeServicesTableGuid',
'7739F24C-93D7-11D4-9A3A-0090273FC14D':
'gEfiHobListGuid',
'4C19049F-4137-4DD3-9C10-8B97A83FFDFA':
'gEfiMemoryTypeInformationGuid',
'49152E77-1ADA-4764-B7A2-7AFEFED95E8B':
'gEfiDebugImageInfoTableGuid',
'060CC026-4C0D-4DDA-8F41-595FEF00A502':
'gMemoryStatusCodeRecordGuid',
'EB9D2D31-2D88-11D3-9A16-0090273FC14D':
'gEfiSmbiosTableGuid',
'EB9D2D30-2D88-11D3-9A16-0090273FC14D':
'gEfiAcpi10TableGuid',
'8868E871-E4F1-11D3-BC22-0080C73C8881':
'gEfiAcpi20TableGuid',
}
guid_files = []
def __init__(self, uuid=None, pointer_width=8):
self.uuid = None if uuid is None else self.to_uuid(uuid)
def __str__(self):
if self.uuid is None:
result = ''
for key, value in GuidNames._dict_.items():
result += f'{key}: {value}\n'
else:
result = self.to_name(self.uuid)
return result
@classmethod
def to_uuid(cls, obj):
try:
return uuid.UUID(bytes_le=bytes(obj))
except (ValueError, TypeError):
try:
return uuid.UUID(bytes_le=obj)
except (ValueError, TypeError):
return uuid.UUID(obj)
@classmethod
def to_name(cls, uuid):
if not isinstance(uuid, str):
uuid = str(uuid)
if cls.is_c_guid(uuid):
uuid = cls.from_c_guid(uuid)
return cls._dict_.get(uuid.upper(), uuid.upper())
@classmethod
def to_guid(cls, guid_name):
for key, value in cls._dict_.items():
if guid_name == value:
return key.upper()
else:
raise KeyError(key)
@classmethod
def is_guid_str(cls, name):
if not isinstance(name, str):
return False
return name.count('-') >= 4
@classmethod
def to_c_guid(cls, value):
if isinstance(value, uuid.UUID):
guid = value
else:
guid = uuid.UUID(value)
(data1, data2, data3,
data4_0, data4_1, data4_2, data4_3,
data4_4, data4_5, data4_6, data4_7) = struct.unpack(
'<IHH8B', guid.bytes_le)
return (f'{{ 0x{data1:08X}, 0x{data2:04X}, 0x{data3:04X}, '
f'{{ 0x{data4_0:02X}, 0x{data4_1:02X}, 0x{data4_2:02X}, '
f'0x{data4_3:02X}, 0x{data4_4:02X}, 0x{data4_5:02X}, '
f'0x{data4_6:02X}, 0x{data4_7:02X} }} }}')
@ classmethod
def from_c_guid(cls, value):
try:
hex = [int(x, 16) for x in re.findall(r"[\w']+", value)]
return (f'{hex[0]:08X}-{hex[1]:04X}-{hex[2]:04X}'
+ f'-{hex[3]:02X}{hex[4]:02X}-{hex[5]:02X}{hex[6]:02X}'
+ f'{hex[7]:02X}{hex[8]:02X}{hex[9]:02X}{hex[10]:02X}')
except ValueError:
return value
@ classmethod
def is_c_guid(cls, name):
if not isinstance(name, str):
return False
return name.count('{') == 2 and name.count('}') == 2
@ classmethod
def add_build_guid_file(cls, module_path, custom_file=None):
if custom_file is not None:
xref = custom_file
else:
# module_path will look like:
# <repo>/Build/OvmfX64/DEBUG_XCODE5/X64/../DxeCore.dll
# Walk backwards looking for a toolchain like name.
# Then look for GUID database:
# Build/OvmfX64//DEBUG_XCODE5/FV/Guid.xref
for i in reversed(module_path.split(os.sep)):
if (i.startswith('DEBUG_') or
i.startswith('RELEASE_') or
i.startswith('NOOPT_')):
build_root = os.path.join(
module_path.rsplit(i, 1)[0], i)
break
xref = os.path.join(build_root, 'FV', 'Guid.xref')
if xref in cls.guid_files:
# only processes the file one time
return True
with open(xref) as f:
content = f.readlines()
cls.guid_files.append(xref)
for lines in content:
try:
if cls.is_guid_str(lines):
# a regex would be more pedantic
words = lines.split()
cls._dict_[words[0].upper()] = words[1].strip('\n')
except ValueError:
pass
return True
return False
class EFI_HOB_GENERIC_HEADER(LittleEndianStructure):
_fields_ = [
('HobType', c_uint16),
('HobLength', c_uint16),
('Reserved', c_uint32)
]
class EFI_HOB_HANDOFF_INFO_TABLE(LittleEndianStructure):
_fields_ = [
('Header', EFI_HOB_GENERIC_HEADER),
('Version', c_uint32),
('BootMode', c_uint32),
('EfiMemoryTop', c_uint64),
('EfiMemoryBottom', c_uint64),
('EfiFreeMemoryTop', c_uint64),
('EfiFreeMemoryBottom', c_uint64),
('EfiEndOfHobList', c_uint64),
]
class EFI_HOB_MEMORY_ALLOCATION(LittleEndianStructure):
_fields_ = [
('Header', EFI_HOB_GENERIC_HEADER),
('Name', EFI_GUID),
('MemoryBaseAddress', c_uint64),
('MemoryLength', c_uint64),
('MemoryType', c_uint32),
('Reserved', c_uint32),
]
class EFI_HOB_RESOURCE_DESCRIPTOR(LittleEndianStructure):
_fields_ = [
('Header', EFI_HOB_GENERIC_HEADER),
('Owner', EFI_GUID),
('ResourceType', c_uint32),
('ResourceAttribute', c_uint32),
('PhysicalStart', c_uint64),
('ResourceLength', c_uint64),
]
class EFI_HOB_GUID_TYPE(LittleEndianStructure):
_fields_ = [
('Header', EFI_HOB_GENERIC_HEADER),
('Name', EFI_GUID),
]
class EFI_HOB_FIRMWARE_VOLUME(LittleEndianStructure):
_fields_ = [
('Header', EFI_HOB_GENERIC_HEADER),
('BaseAddress', c_uint64),
('Length', c_uint64),
]
class EFI_HOB_CPU(LittleEndianStructure):
_fields_ = [
('Header', EFI_HOB_GENERIC_HEADER),
('SizeOfMemorySpace', c_uint8),
('SizeOfIoSpace', c_uint8),
('Reserved', ARRAY(c_uint8, 6)),
]
class EFI_HOB_MEMORY_POOL(LittleEndianStructure):
_fields_ = [
('Header', EFI_HOB_GENERIC_HEADER),
]
class EFI_HOB_FIRMWARE_VOLUME2(LittleEndianStructure):
_fields_ = [
('Header', EFI_HOB_GENERIC_HEADER),
('BaseAddress', c_uint64),
('Length', c_uint64),
('FvName', EFI_GUID),
('FileName', EFI_GUID)
]
class EFI_HOB_FIRMWARE_VOLUME3(LittleEndianStructure):
_fields_ = [
('HobType', c_uint16),
('HobLength', c_uint16),
('Reserved', c_uint32),
('BaseAddress', c_uint64),
('Length', c_uint64),
('AuthenticationStatus', c_uint32),
('ExtractedFv', c_uint8),
('FvName', EFI_GUID),
('FileName', EFI_GUID),
]
class EFI_HOB_UEFI_CAPSULE(LittleEndianStructure):
_fields_ = [
('HobType', c_uint16),
('HobLength', c_uint16),
('Reserved', c_uint32),
('BaseAddress', c_uint64),
('Length', c_uint64),
]
class EfiHob:
'''
Parse EFI Device Paths based on the edk2 C Structures defined above.
In the context of this class verbose means hexdump extra data.
Attributes
??????
Hob : list
List of HOBs. Each entry contains the name, HOB type, HOB length,
the ctype struct for the HOB, and any extra data.
Methods
-----------
get_hob_by_type(hob_type)
return string that decodes the HOBs of hob_type. If hob_type is
None then return all HOBs.
'''
Hob = []
verbose = False
hob_dict = {
1: EFI_HOB_HANDOFF_INFO_TABLE,
2: EFI_HOB_MEMORY_ALLOCATION,
3: EFI_HOB_RESOURCE_DESCRIPTOR,
4: EFI_HOB_GUID_TYPE,
5: EFI_HOB_FIRMWARE_VOLUME,
6: EFI_HOB_CPU,
7: EFI_HOB_MEMORY_POOL,
9: EFI_HOB_FIRMWARE_VOLUME2,
0xb: EFI_HOB_UEFI_CAPSULE,
0xc: EFI_HOB_FIRMWARE_VOLUME3,
0xffff: EFI_HOB_GENERIC_HEADER,
}
def __init__(self, file, address=None, verbose=False, count=1000):
self._file = file
EfiHob.verbose = verbose
if len(EfiHob.Hob) != 0 and address is None:
return
if address is not None:
hob_ptr = address
else:
hob_ptr = EfiConfigurationTable(file).GetConfigTable(
'7739F24C-93D7-11D4-9A3A-0090273FC14D')
self.read_hobs(hob_ptr)
@ classmethod
def __str__(cls):
return cls.get_hob_by_type(None)
@ classmethod
def get_hob_by_type(cls, hob_type):
result = ""
for (Name, HobType, HobLen, chob, extra) in cls.Hob:
if hob_type is not None:
if hob_type != HobType:
continue
result += f'Type: {Name:s} (0x{HobType:01x}) Len: 0x{HobLen:03x}\n'
result += ctype_to_str(chob, ' ', ['Reserved'])
if cls.verbose:
if extra is not None:
result += hexdump(extra, ' ')
return result
def read_hobs(self, hob_ptr, count=1000):
if hob_ptr is None:
return
try:
for _ in range(count): # while True
hdr, _ = self._ctype_read_ex(EFI_HOB_GENERIC_HEADER, hob_ptr)
if hdr.HobType == 0xffff:
break
type_str = self.hob_dict.get(
hdr.HobType, EFI_HOB_GENERIC_HEADER)
hob, extra = self._ctype_read_ex(
type_str, hob_ptr, hdr.HobLength)
EfiHob.Hob.append(
(type(hob).__name__,
hdr.HobType,
hdr.HobLength,
hob,
extra))
hob_ptr += hdr.HobLength
except ValueError:
pass
def _ctype_read_ex(self, ctype_struct, offset=0, rsize=None):
if offset != 0:
self._file.seek(offset)
type_size = sizeof(ctype_struct)
size = rsize if rsize else type_size
data = self._file.read(size)
cdata = ctype_struct.from_buffer(bytearray(data))
if size > type_size:
return cdata, data[type_size:]
else:
return cdata, None
class EFI_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Type', c_uint8),
('SubType', c_uint8),
# UINT8 Length[2]
# Cheat and use c_uint16 since we don't care about alignment
('Length', c_uint16)
]
class PCI_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('Function', c_uint8),
('Device', c_uint8)
]
class PCCARD_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('FunctionNumber', c_uint8),
]
class MEMMAP_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('StartingAddress', c_uint64),
('EndingAddress', c_uint64),
]
class VENDOR_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('Guid', EFI_GUID),
]
class CONTROLLER_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('ControllerNumber', c_uint32),
]
class BMC_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('InterfaceType', c_uint8),
('BaseAddress', ARRAY(c_uint8, 8)),
]
class BBS_BBS_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('DeviceType', c_uint16),
('StatusFlag', c_uint16)
]
class ACPI_HID_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('HID', c_uint32),
('UID', c_uint32)
]
class ACPI_EXTENDED_HID_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('HID', c_uint32),
('UID', c_uint32),
('CID', c_uint32)
]
class ACPI_ADR_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('ARD', c_uint32)
]
class ACPI_NVDIMM_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('NFITDeviceHandle', c_uint32)
]
class ATAPI_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("PrimarySecondary", c_uint8),
("SlaveMaster", c_uint8),
("Lun", c_uint16)
]
class SCSI_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("Pun", c_uint16),
("Lun", c_uint16)
]
class FIBRECHANNEL_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("Reserved", c_uint32),
("WWN", c_uint64),
("Lun", c_uint64)
]
class F1394_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("Reserved", c_uint32),
("Guid", c_uint64)
]
class USB_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("ParentPortNumber", c_uint8),
("InterfaceNumber", c_uint8),
]
class I2O_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("Tid", c_uint32)
]
class INFINIBAND_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("ResourceFlags", c_uint32),
("PortGid", ARRAY(c_uint8, 16)),
("ServiceId", c_uint64),
("TargetPortId", c_uint64),
("DeviceId", c_uint64)
]
class UART_FLOW_CONTROL_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("Guid", EFI_GUID),
("FlowControlMap", c_uint32)
]
class SAS_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("Guid", EFI_GUID),
("Reserved", c_uint32),
("SasAddress", c_uint64),
("Lun", c_uint64),
("DeviceTopology", c_uint16),
("RelativeTargetPort", c_uint16)
]
class EFI_MAC_ADDRESS(LittleEndianStructure):
_pack_ = 1
_fields_ = [
("Addr", ARRAY(c_uint8, 32)),
]
class MAC_ADDR_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('MacAddress', EFI_MAC_ADDRESS),
('IfType', c_uint8)
]
class IPv4_ADDRESS(LittleEndianStructure):
_fields_ = [
("Addr", ARRAY(c_uint8, 4)),
]
class IPv4_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('LocalIpAddress', IPv4_ADDRESS),
('RemoteIpAddress', IPv4_ADDRESS),
('LocalPort', c_uint16),
('RemotePort', c_uint16),
('Protocol', c_uint16),
('StaticIpAddress', c_uint8),
('GatewayIpAddress', IPv4_ADDRESS),
('SubnetMask', IPv4_ADDRESS)
]
class IPv6_ADDRESS(LittleEndianStructure):
_fields_ = [
("Addr", ARRAY(c_uint8, 16)),
]
class IPv6_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('LocalIpAddress', IPv6_ADDRESS),
('RemoteIpAddress', IPv6_ADDRESS),
('LocalPort', c_uint16),
('RemotePort', c_uint16),
('Protocol', c_uint16),
('IpAddressOrigin', c_uint8),
('PrefixLength', c_uint8),
('GatewayIpAddress', IPv6_ADDRESS)
]
class UART_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('Reserved', c_uint32),
('BaudRate', c_uint64),
('DataBits', c_uint8),
('Parity', c_uint8),
('StopBits', c_uint8)
]
class USB_CLASS_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('VendorId', c_uint16),
('ProductId', c_uint16),
('DeviceClass', c_uint8),
('DeviceCSjblass', c_uint8),
('DeviceProtocol', c_uint8),
]
class USB_WWID_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('InterfaceNumber', c_uint16),
('VendorId', c_uint16),
('ProductId', c_uint16),
]
class DEVICE_LOGICAL_UNIT_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('Lun', c_uint8)
]
class SATA_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('HBAPortNumber', c_uint16),
('PortMultiplierPortNumber', c_uint16),
('Lun', c_uint16),
]
class ISCSI_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('NetworkProtocol', c_uint16),
('LoginOption', c_uint16),
('Lun', c_uint64),
('TargetPortalGroupTag', c_uint16),
]
class VLAN_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("VlandId", c_uint16)
]
class FIBRECHANNELEX_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("Reserved", c_uint16),
("WWN", ARRAY(c_uint8, 8)),
("Lun", ARRAY(c_uint8, 8)),
]
class SASEX_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("SasAddress", ARRAY(c_uint8, 8)),
("Lun", ARRAY(c_uint8, 8)),
("DeviceTopology", c_uint16),
("RelativeTargetPort", c_uint16)
]
class NVME_NAMESPACE_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("NamespaceId", c_uint32),
("NamespaceUuid", c_uint64)
]
class DNS_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("IsIPv6", c_uint8),
("DnsServerIp", IPv6_ADDRESS)
]
class UFS_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("Pun", c_uint8),
("Lun", c_uint8),
]
class SD_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("SlotNumber", c_uint8)
]
class BLUETOOTH_ADDRESS(LittleEndianStructure):
_pack_ = 1
_fields_ = [
("Address", ARRAY(c_uint8, 6))
]
class BLUETOOTH_LE_ADDRESS(LittleEndianStructure):
_pack_ = 1
_fields_ = [
("Format", c_uint8),
("Class", c_uint16)
]
class BLUETOOTH_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("BD_ADDR", BLUETOOTH_ADDRESS)
]
class WIFI_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("SSId", ARRAY(c_uint8, 32))
]
class EMMC_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("SlotNumber", c_uint8)
]
class BLUETOOTH_LE_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("BD_ADDR", BLUETOOTH_LE_ADDRESS)
]
class NVDIMM_NAMESPACE_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("Uuid", EFI_GUID)
]
class REST_SERVICE_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("RESTService", c_uint8),
("AccessMode", c_uint8)
]
class REST_VENDOR_SERVICE_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
("RESTService", c_uint8),
("AccessMode", c_uint8),
("Guid", EFI_GUID),
]
class HARDDRIVE_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('PartitionNumber', c_uint32),
('PartitionStart', c_uint64),
('PartitionSize', c_uint64),
('Signature', ARRAY(c_uint8, 16)),
('MBRType', c_uint8),
('SignatureType', c_uint8)
]
class CDROM_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('BootEntry', c_uint32),
('PartitionStart', c_uint64),
('PartitionSize', c_uint64)
]
class MEDIA_PROTOCOL_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('Protocol', EFI_GUID)
]
class MEDIA_FW_VOL_FILEPATH_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('FvFileName', EFI_GUID)
]
class MEDIA_FW_VOL_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('FvName', EFI_GUID)
]
class MEDIA_RELATIVE_OFFSET_RANGE_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('Reserved', c_uint32),
('StartingOffset', c_uint64),
('EndingOffset', c_uint64)
]
class MEDIA_RAM_DISK_DEVICE_PATH(LittleEndianStructure):
_pack_ = 1
_fields_ = [
('Header', EFI_DEVICE_PATH),
('StartingAddr', c_uint64),
('EndingAddr', c_uint64),
('TypeGuid', EFI_GUID),
('Instance', c_uint16)
]
class EfiDevicePath:
'''
Parse EFI Device Paths based on the edk2 C Structures defined above.
In the context of this class verbose means hexdump extra data.
Attributes
??????
DevicePath : list
List of devixe path instances. Each instance is a list of nodes
for the given Device Path instance.
Methods
-----------
device_path_node(address)
return the Device Path ctype hdr, ctype, and any extra data in
the Device Path node. This is just a single Device Path node,
not the entire Device Path.
device_path_node_str(address)
return the device path node (not the entire Device Path) as a string
'''
DevicePath = []
device_path_dict = {
# ( Type, SubType ) : Device Path C typedef
# HARDWARE_DEVICE_PATH
(1, 1): PCI_DEVICE_PATH,
(1, 2): PCCARD_DEVICE_PATH,
(1, 3): MEMMAP_DEVICE_PATH,
(1, 4): VENDOR_DEVICE_PATH,
(1, 5): CONTROLLER_DEVICE_PATH,
(1, 6): BMC_DEVICE_PATH,
# ACPI_DEVICE_PATH
(2, 1): ACPI_HID_DEVICE_PATH,
(2, 2): ACPI_EXTENDED_HID_DEVICE_PATH,
(2, 3): ACPI_ADR_DEVICE_PATH,
(2, 4): ACPI_NVDIMM_DEVICE_PATH,
# MESSAGING_DEVICE_PATH
(3, 1): ATAPI_DEVICE_PATH,
(3, 2): SCSI_DEVICE_PATH,
(3, 3): FIBRECHANNEL_DEVICE_PATH,
(3, 4): F1394_DEVICE_PATH,
(3, 5): USB_DEVICE_PATH,
(3, 6): I2O_DEVICE_PATH,
(3, 9): INFINIBAND_DEVICE_PATH,
(3, 10): VENDOR_DEVICE_PATH,
(3, 11): MAC_ADDR_DEVICE_PATH,
(3, 12): IPv4_DEVICE_PATH,
(3, 13): IPv6_DEVICE_PATH,
(3, 14): UART_DEVICE_PATH,
(3, 15): USB_CLASS_DEVICE_PATH,
(3, 16): USB_WWID_DEVICE_PATH,
(3, 17): DEVICE_LOGICAL_UNIT_DEVICE_PATH,
(3, 18): SATA_DEVICE_PATH,
(3, 19): ISCSI_DEVICE_PATH,
(3, 20): VLAN_DEVICE_PATH,
(3, 21): FIBRECHANNELEX_DEVICE_PATH,
(3, 22): SASEX_DEVICE_PATH,
(3, 23): NVME_NAMESPACE_DEVICE_PATH,
(3, 24): DNS_DEVICE_PATH,
(3, 25): UFS_DEVICE_PATH,
(3, 26): SD_DEVICE_PATH,
(3, 27): BLUETOOTH_DEVICE_PATH,
(3, 28): WIFI_DEVICE_PATH,
(3, 29): EMMC_DEVICE_PATH,
(3, 30): BLUETOOTH_LE_DEVICE_PATH,
(3, 31): DNS_DEVICE_PATH,
(3, 32): NVDIMM_NAMESPACE_DEVICE_PATH,
(3, 33): REST_SERVICE_DEVICE_PATH,
(3, 34): REST_VENDOR_SERVICE_DEVICE_PATH,
# MEDIA_DEVICE_PATH
(4, 1): HARDDRIVE_DEVICE_PATH,
(4, 2): CDROM_DEVICE_PATH,
(4, 3): VENDOR_DEVICE_PATH,
(4, 4): EFI_DEVICE_PATH,
(4, 5): MEDIA_PROTOCOL_DEVICE_PATH,
(4, 6): MEDIA_FW_VOL_FILEPATH_DEVICE_PATH,
(4, 7): MEDIA_FW_VOL_DEVICE_PATH,
(4, 8): MEDIA_RELATIVE_OFFSET_RANGE_DEVICE_PATH,
(4, 9): MEDIA_RAM_DISK_DEVICE_PATH,
# BBS_DEVICE_PATH
(5, 1): BBS_BBS_DEVICE_PATH,
}
guid_override_dict = {
uuid.UUID('37499A9D-542F-4C89-A026-35DA142094E4'):
UART_FLOW_CONTROL_DEVICE_PATH,
uuid.UUID('D487DDB4-008B-11D9-AFDC-001083FFCA4D'):
SAS_DEVICE_PATH,
}
def __init__(self, file, ptr=None, verbose=False, count=64):
'''
Convert ptr into a list of Device Path nodes. If verbose also hexdump
extra data.
'''
self._file = file
self._verbose = verbose
if ptr is None:
return
try:
instance = []
for _ in range(count): # while True
hdr, _ = self._ctype_read_ex(EFI_DEVICE_PATH, ptr)
if hdr.Length < sizeof(EFI_DEVICE_PATH):
# Not a valid device path
break
if hdr.Type == 0x7F: # END_DEVICE_PATH_TYPE
self.DevicePath.append(instance)
if hdr.SubType == 0xFF: # END_ENTIRE_DEVICE_PATH_SUBTYPE
break
if hdr.SubType == 0x01: # END_INSTANCE_DEVICE_PATH_SUBTYPE
# start new device path instance
instance = []
type_str = self.device_path_dict.get(
(hdr.Type, hdr.SubType), EFI_DEVICE_PATH)
node, extra = self._ctype_read_ex(type_str, ptr, hdr.Length)
if 'VENDOR_DEVICE_PATH' in type(node).__name__:
guid_type = self.guid_override_dict.get(
GuidNames.to_uuid(node.Guid), None)
if guid_type:
# use the ctype associated with the GUID
node, extra = self._ctype_read_ex(
guid_type, ptr, hdr.Length)
instance.append((type(node).__name__, hdr.Type,
hdr.SubType, hdr.Length, node, extra))
ptr += hdr.Length
except ValueError:
pass
def __str__(self):
''' '''
if not self.valid():
return '<class: EfiDevicePath>'
result = ""
for instance in self.DevicePath:
for (Name, Type, SubType, Length, cnode, extra) in instance:
result += f'{Name:s} {Type:2d}:{SubType:2d} Len: {Length:3d}\n'
result += ctype_to_str(cnode, ' ', ['Reserved'])
if self._verbose:
if extra is not None:
result += hexdump(extra, ' ')
result += '\n'
return result
def valid(self):
return True if self.DevicePath else False
def device_path_node(self, address):
try:
hdr, _ = self._ctype_read_ex(EFI_DEVICE_PATH, address)
if hdr.Length < sizeof(EFI_DEVICE_PATH):
return None, None, None
type_str = self.device_path_dict.get(
(hdr.Type, hdr.SubType), EFI_DEVICE_PATH)
cnode, extra = self._ctype_read_ex(type_str, address, hdr.Length)
return hdr, cnode, extra
except ValueError:
return None, None, None
def device_path_node_str(self, address, verbose=False):
hdr, cnode, extra = self.device_path_node(address)
if hdr is None:
return ''
cname = type(cnode).__name__
result = f'{cname:s} {hdr.Type:2d}:{hdr.SubType:2d} '
result += f'Len: 0x{hdr.Length:03x}\n'
result += ctype_to_str(cnode, ' ', ['Reserved'])
if verbose:
if extra is not None:
result += hexdump(extra, ' ')
return result
def _ctype_read_ex(self, ctype_struct, offset=0, rsize=None):
if offset != 0:
self._file.seek(offset)
type_size = sizeof(ctype_struct)
size = rsize if rsize else type_size
data = self._file.read(size)
if data is None:
return None, None
cdata = ctype_struct.from_buffer(bytearray(data))
if size > type_size:
return cdata, data[type_size:]
else:
return cdata, None
class EfiConfigurationTable:
'''
A class to abstract EFI Configuration Tables from gST->ConfigurationTable
and gST->NumberOfTableEntries. Pass in the gST pointer from EFI,
likely you need to look up this address after you have loaded symbols
Attributes
??????
ConfigurationTableDict : dictionary
dictionary of EFI Configuration Table entries
Methods
-----------
GetConfigTable(uuid)
pass in VendorGuid and return VendorTable from EFI System Table
DebugImageInfo(table)
return tuple of load address and size of PE/COFF images
'''
ConfigurationTableDict = {}
def __init__(self, file, gST_addr=None):
self._file = file
if gST_addr is None:
# ToDo add code to search for gST via EFI_SYSTEM_TABLE_POINTER
return
gST = self._ctype_read(EFI_SYSTEM_TABLE, gST_addr)
self.read_efi_config_table(gST.NumberOfTableEntries,
gST.ConfigurationTable,
self._ctype_read)
@ classmethod
def __str__(cls):
'''return EFI_CONFIGURATION_TABLE entries as a string'''
result = ""
for key, value in cls.ConfigurationTableDict.items():
result += f'{GuidNames().to_name(key):>37s}: '
result += f'VendorTable = 0x{value:08x}\n'
return result
def _ctype_read(self, ctype_struct, offset=0):
'''ctype worker function to read data'''
if offset != 0:
self._file.seek(offset)
data = self._file.read(sizeof(ctype_struct))
return ctype_struct.from_buffer(bytearray(data))
@ classmethod
def read_efi_config_table(cls, table_cnt, table_ptr, ctype_read):
'''Create a dictionary of EFI Configuration table entries'''
EmptryTables = EFI_CONFIGURATION_TABLE * table_cnt
Tables = ctype_read(EmptryTables, table_ptr)
for i in range(table_cnt):
cls.ConfigurationTableDict[str(GuidNames.to_uuid(
Tables[i].VendorGuid)).upper()] = Tables[i].VendorTable
return cls.ConfigurationTableDict
def GetConfigTable(self, uuid):
''' Return VendorTable for VendorGuid (uuid.UUID) or None'''
return self.ConfigurationTableDict.get(uuid.upper())
def DebugImageInfo(self, table=None):
'''
Walk the debug image info table to find the LoadedImage protocols
for all the loaded PE/COFF images and return a list of load address
and image size.
'''
ImageLoad = []
if table is None:
table = self.GetConfigTable('49152e77-1ada-4764-b7a2-7afefed95e8b')
DbgInfoHdr = self._ctype_read(EFI_DEBUG_IMAGE_INFO_TABLE_HEADER, table)
NormalImageArray = EFI_DEBUG_IMAGE_INFO * DbgInfoHdr.TableSize
NormalImageArray = self._ctype_read(
NormalImageArray, DbgInfoHdr.EfiDebugImageInfoTable)
for i in range(DbgInfoHdr.TableSize):
ImageInfo = self._ctype_read(
EFI_DEBUG_IMAGE_INFO_NORMAL, NormalImageArray[i].NormalImage)
LoadedImage = self._ctype_read(
EFI_LOADED_IMAGE_PROTOCOL,
ImageInfo.LoadedImageProtocolInstance)
ImageLoad.append((LoadedImage.ImageBase, LoadedImage.ImageSize))
return ImageLoad
class PeTeImage:
'''
A class to abstract PE/COFF or TE image processing via passing in a
Python file like object. If you pass in an address the PE/COFF is parsed,
if you pass in NULL for an address then you get a class instance you can
use to search memory for a PE/COFF hader given a pc value.
Attributes
??????
LoadAddress : int
Load address of the PE/COFF image
AddressOfEntryPoint : int
Address of the Entry point of the PE/COFF image
TextAddress : int
Start of the PE/COFF text section
DataAddress : int
Start of the PE/COFF data section
CodeViewPdb : str
File name of the symbols file
CodeViewUuid : uuid:UUID
GUID for "RSDS" Debug Directory entry, or Mach-O UUID for "MTOC"
Methods
-----------
pcToPeCoff(address, step, max_range, rom_range)
Given an address(pc) find the PE/COFF image it is in
sections_to_str()
return a string giving info for all the PE/COFF sections
'''
def __init__(self, file, address=0):
self._file = file
# book keeping, but public
self.PeHdr = None
self.TeHdr = None
self.Machine = None
self.Subsystem = None
self.CodeViewSig = None
self.e_lfanew = 0
self.NumberOfSections = 0
self.Sections = None
# Things debuggers may want to know
self.LoadAddress = 0 if address is None else address
self.EndLoadAddress = 0
self.AddressOfEntryPoint = 0
self.TextAddress = 0
self.DataAddress = 0
self.CodeViewPdb = None
self.CodeViewUuid = None
self.TeAdjust = 0
self.dir_name = {
0: 'Export Table',
1: 'Import Table',
2: 'Resource Table',
3: 'Exception Table',
4: 'Certificate Table',
5: 'Relocation Table',
6: 'Debug',
7: 'Architecture',
8: 'Global Ptr',
9: 'TLS Table',
10: 'Load Config Table',
11: 'Bound Import',
12: 'IAT',
13: 'Delay Import Descriptor',
14: 'CLR Runtime Header',
15: 'Reserved',
}
if address is not None:
if self.maybe():
self.parse()
def __str__(self):
if self.PeHdr is None and self.TeHdr is None:
# no PE/COFF header found
return "<class: PeTeImage>"
if self.CodeViewPdb:
pdb = f'{self.Machine}`{self.CodeViewPdb}'
else:
pdb = 'No Debug Info:'
if self.CodeViewUuid:
guid = f'{self.CodeViewUuid}:'
else:
guid = ''
slide = f'slide = {self.TeAdjust:d} ' if self.TeAdjust != 0 else ' '
res = guid + f'{pdb} load = 0x{self.LoadAddress:08x} ' + slide
return res
def _seek(self, offset):
"""
seek() relative to start of PE/COFF (TE) image
"""
self._file.seek(self.LoadAddress + offset)
def _read_offset(self, size, offset=None):
"""
read() relative to start of PE/COFF (TE) image
if offset is not None then seek() before the read
"""
if offset is not None:
self._seek(offset)
return self._file.read(size)
def _read_ctype(self, ctype_struct, offset=None):
data = self._read_offset(sizeof(ctype_struct), offset)
return ctype_struct.from_buffer(bytearray(data), 0)
def _unsigned(self, i):
"""return a 32-bit unsigned int (UINT32) """
return int.from_bytes(i, byteorder='little', signed=False)
def pcToPeCoff(self,
address,
step=None,
max_range=None,
rom_range=[0xFE800000, 0xFFFFFFFF]):
"""
Given an address search backwards for PE/COFF (TE) header
For DXE 4K is probably OK
For PEI you might have to search every 4 bytes.
"""
if step is None:
step = 0x1000
if max_range is None:
max_range = 0x200000
if address in range(*rom_range):
# The XIP code in the ROM ends up 4 byte aligned.
step = 4
max_range = min(max_range, 0x100000)
# Align address to page boundary for memory image search.
address = address & ~(step-1)
# Search every step backward
offset_range = list(range(0, min(max_range, address), step))
for offset in offset_range:
if self.maybe(address - offset):
if self.parse():
return True
return False
def maybe(self, offset=None):
"""Probe to see if this offset is likely a PE/COFF or TE file """
self.LoadAddress = 0
e_magic = self._read_offset(2, offset)
header_ok = e_magic == b'MZ' or e_magic == b'VZ'
if offset is not None and header_ok:
self.LoadAddress = offset
return header_ok
def parse(self):
"""Parse PE/COFF (TE) debug directory entry """
DosHdr = self._read_ctype(EFI_IMAGE_DOS_HEADER, 0)
if DosHdr.e_magic == self._unsigned(b'VZ'):
# TE image
self.TeHdr = self._read_ctype(EFI_TE_IMAGE_HEADER, 0)
self.TeAdjust = sizeof(self.TeHdr) - self.TeHdr.StrippedSize
self.Machine = image_machine_dict.get(self.TeHdr.Machine, None)
self.Subsystem = self.TeHdr.Subsystem
self.AddressOfEntryPoint = self.TeHdr.AddressOfEntryPoint
debug_dir_size = self.TeHdr.DataDirectoryDebug.Size
debug_dir_offset = (self.TeAdjust +
self.TeHdr.DataDirectoryDebug.VirtualAddress)
else:
if DosHdr.e_magic == self._unsigned(b'MZ'):
self.e_lfanew = DosHdr.e_lfanew
else:
self.e_lfanew = 0
self.PeHdr = self._read_ctype(
EFI_IMAGE_NT_HEADERS64, self.e_lfanew)
if self.PeHdr.Signature != self._unsigned(b'PE\0\0'):
return False
if self.PeHdr.OptionalHeader.Magic == \
EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC:
self.PeHdr = self._read_ctype(
EFI_IMAGE_NT_HEADERS32, self.e_lfanew)
if self.PeHdr.OptionalHeader.NumberOfRvaAndSizes <= \
DIRECTORY_DEBUG:
return False
self.Machine = image_machine_dict.get(
self.PeHdr.FileHeader.Machine, None)
self.Subsystem = self.PeHdr.OptionalHeader.Subsystem
self.AddressOfEntryPoint = \
self.PeHdr.OptionalHeader.AddressOfEntryPoint
self.TeAdjust = 0
debug_dir_size = self.PeHdr.OptionalHeader.DataDirectory[
DIRECTORY_DEBUG].Size
debug_dir_offset = self.PeHdr.OptionalHeader.DataDirectory[
DIRECTORY_DEBUG].VirtualAddress
if self.Machine is None or self.Subsystem not in [0, 10, 11, 12]:
return False
self.AddressOfEntryPoint += self.LoadAddress
self.sections()
return self.processDebugDirEntry(debug_dir_offset, debug_dir_size)
def sections(self):
'''Parse the PE/COFF (TE) section table'''
if self.Sections is not None:
return
elif self.TeHdr is not None:
self.NumberOfSections = self.TeHdr.NumberOfSections
offset = sizeof(EFI_TE_IMAGE_HEADER)
elif self.PeHdr is not None:
self.NumberOfSections = self.PeHdr.FileHeader.NumberOfSections
offset = sizeof(c_uint32) + \
sizeof(EFI_IMAGE_FILE_HEADER)
offset += self.PeHdr.FileHeader.SizeOfOptionalHeader
offset += self.e_lfanew
else:
return
self.Sections = EFI_IMAGE_SECTION_HEADER * self.NumberOfSections
self.Sections = self._read_ctype(self.Sections, offset)
for i in range(self.NumberOfSections):
name = str(self.Sections[i].Name, 'ascii', 'ignore')
addr = self.Sections[i].VirtualAddress
addr += self.LoadAddress + self.TeAdjust
if name == '.text':
self.TextAddress = addr
elif name == '.data':
self.DataAddress = addr
end_addr = addr + self.Sections[i].VirtualSize - 1
if end_addr > self.EndLoadAddress:
self.EndLoadAddress = end_addr
def sections_to_str(self):
# return text summary of sections
# name virt addr (virt size) flags:Characteristics
result = ''
for i in range(self.NumberOfSections):
name = str(self.Sections[i].Name, 'ascii', 'ignore')
result += f'{name:8s} '
result += f'0x{self.Sections[i].VirtualAddress:08X} '
result += f'(0x{self.Sections[i].VirtualSize:05X}) '
result += f'flags:0x{self.Sections[i].Characteristics:08X}\n'
return result
def directory_to_str(self):
result = ''
if self.TeHdr:
debug_size = self.TeHdr.DataDirectoryDebug.Size
if debug_size > 0:
debug_offset = (self.TeAdjust
+ self.TeHdr.DataDirectoryDebug.VirtualAddress)
result += f"Debug 0x{debug_offset:08X} 0x{debug_size}\n"
relocation_size = self.TeHdr.DataDirectoryBaseReloc.Size
if relocation_size > 0:
relocation_offset = (
self.TeAdjust
+ self.TeHdr.DataDirectoryBaseReloc.VirtualAddress)
result += f'Relocation 0x{relocation_offset:08X} '
result += f' 0x{relocation_size}\n'
elif self.PeHdr:
for i in range(self.PeHdr.OptionalHeader.NumberOfRvaAndSizes):
size = self.PeHdr.OptionalHeader.DataDirectory[i].Size
if size == 0:
continue
virt_addr = self.PeHdr.OptionalHeader.DataDirectory[
i].VirtualAddress
name = self.dir_name.get(i, '?')
result += f'{name:s} 0x{virt_addr:08X} 0x{size:X}\n'
return result
def processDebugDirEntry(self, virt_address, virt_size):
"""Process PE/COFF Debug Directory Entry"""
if (virt_address == 0 or
virt_size < sizeof(EFI_IMAGE_DEBUG_DIRECTORY_ENTRY)):
return False
data = bytearray(self._read_offset(virt_size, virt_address))
for offset in range(0,
virt_size,
sizeof(EFI_IMAGE_DEBUG_DIRECTORY_ENTRY)):
DirectoryEntry = EFI_IMAGE_DEBUG_DIRECTORY_ENTRY.from_buffer(
data[offset:])
if DirectoryEntry.Type != 2:
continue
entry = self._read_offset(
DirectoryEntry.SizeOfData, DirectoryEntry.RVA + self.TeAdjust)
self.CodeViewSig = entry[:4]
if self.CodeViewSig == b'MTOC':
self.CodeViewUuid = uuid.UUID(bytes_le=entry[4:4+16])
PdbOffset = 20
elif self.CodeViewSig == b'RSDS':
self.CodeViewUuid = uuid.UUID(bytes_le=entry[4:4+16])
PdbOffset = 24
elif self.CodeViewSig == b'NB10':
PdbOffset = 16
else:
continue
# can't find documentation about Pdb string encoding?
# guessing utf-8 since that will match file systems in macOS
# and Linux Windows is UTF-16, or ANSI adjusted for local.
# We might need a different value for Windows here?
self.CodeViewPdb = entry[PdbOffset:].split(b'\x00')[
0].decode('utf-8')
return True
return False
def main():
'''Process arguments as PE/COFF files'''
for fname in sys.argv[1:]:
with open(fname, 'rb') as f:
image = PeTeImage(f)
print(image)
res = f'EntryPoint = 0x{image.AddressOfEntryPoint:08x} '
res += f'TextAddress = 0x{image.TextAddress:08x} '
res += f'DataAddress = 0x{image.DataAddress:08x}'
print(res)
print(image.sections_to_str())
print('Data Directories:')
print(image.directory_to_str())
if __name__ == "__main__":
main()
Reference in New Issue View Git Blame Copy Permalink