diff --git a/qiling/os/uefi/PiMultiPhase.py b/qiling/os/uefi/PiMultiPhase.py index ba9906f9..c2bbe7f8 100644 --- a/qiling/os/uefi/PiMultiPhase.py +++ b/qiling/os/uefi/PiMultiPhase.py @@ -1,25 +1,25 @@ #!/usr/bin/env python3 -# +# # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # -from .UefiBaseType import * -from .ProcessorBind import * +from .UefiBaseType import EFI_PHYSICAL_ADDRESS +from .ProcessorBind import UINT64, STRUCT -EFI_SMRAM_OPEN = 0x00000001 -EFI_SMRAM_CLOSED = 0x00000002 -EFI_SMRAM_LOCKED = 0x00000004 -EFI_CACHEABLE = 0x00000008 -EFI_ALLOCATED = 0x00000010 -EFI_NEEDS_TESTING = 0x00000020 -EFI_NEEDS_ECC_INITIALIZATION = 0x00000040 +EFI_SMRAM_OPEN = 0x00000001 +EFI_SMRAM_CLOSED = 0x00000002 +EFI_SMRAM_LOCKED = 0x00000004 +EFI_CACHEABLE = 0x00000008 +EFI_ALLOCATED = 0x00000010 +EFI_NEEDS_TESTING = 0x00000020 +EFI_NEEDS_ECC_INITIALIZATION = 0x00000040 class EFI_SMRAM_DESCRIPTOR(STRUCT): _fields_ = [ - ('PhysicalStart', EFI_PHYSICAL_ADDRESS), - ('CpuStart', EFI_PHYSICAL_ADDRESS), - ('PhysicalSize', UINT64), - ('RegionState', UINT64) + ('PhysicalStart', EFI_PHYSICAL_ADDRESS), + ('CpuStart', EFI_PHYSICAL_ADDRESS), + ('PhysicalSize', UINT64), + ('RegionState', UINT64) ] __all__ = [ diff --git a/qiling/os/uefi/UefiBaseType.py b/qiling/os/uefi/UefiBaseType.py index 5f9d87fb..b3702d47 100644 --- a/qiling/os/uefi/UefiBaseType.py +++ b/qiling/os/uefi/UefiBaseType.py @@ -1,5 +1,5 @@ #!/usr/bin/env python3 -# +# # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # @@ -23,17 +23,17 @@ EFI_VIRTUAL_ADDRESS = UINT64 class EFI_TIME(STRUCT): _fields_ = [ - ('Year', UINT16), - ('Month', UINT8), - ('Day', UINT8), - ('Hour', UINT8), - ('Minute', UINT8), - ('Second', UINT8), - ('Pad1', UINT8), - ('Nanosecond', UINT32), - ('TimeZone', UINT16), - ('Daylight', UINT8), - ('Pad2', UINT8) + ('Year', UINT16), + ('Month', UINT8), + ('Day', UINT8), + ('Hour', UINT8), + ('Minute', UINT8), + ('Second', UINT8), + ('Pad1', UINT8), + ('Nanosecond', UINT32), + ('TimeZone', UINT16), + ('Daylight', UINT8), + ('Pad2', UINT8) ] __all__ = [ diff --git a/qiling/os/uefi/UefiMultiPhase.py b/qiling/os/uefi/UefiMultiPhase.py index 7e44b1d9..4a67b1d9 100644 --- a/qiling/os/uefi/UefiMultiPhase.py +++ b/qiling/os/uefi/UefiMultiPhase.py @@ -1,5 +1,5 @@ #!/usr/bin/env python3 -# +# # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # @@ -8,11 +8,11 @@ from .ProcessorBind import * # @see: MdePkg\Include\Uefi\UefiMultiPhase.h class EFI_TABLE_HEADER(STRUCT): _fields_ = [ - ('Signature', UINT64), - ('Revision', UINT32), - ('HeaderSize', UINT32), - ('CRC32', UINT32), - ('Reserved', UINT32) + ('Signature', UINT64), + ('Revision', UINT32), + ('HeaderSize', UINT32), + ('CRC32', UINT32), + ('Reserved', UINT32) ] class EFI_RESET_TYPE(ENUM): diff --git a/qiling/os/uefi/UefiSpec.py b/qiling/os/uefi/UefiSpec.py index 7c236d0a..2259e8c3 100644 --- a/qiling/os/uefi/UefiSpec.py +++ b/qiling/os/uefi/UefiSpec.py @@ -1,6 +1,6 @@ #!/usr/bin/env python3 -# +# # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # @@ -48,62 +48,62 @@ class EFI_TIME_CAPABILITIES(STRUCT): _pack_ = 8 _fields_ = [ - ('Resolution', UINT32), - ('Accuracy', UINT32), - ('SetsToZero', BOOLEAN), + ('Resolution', UINT32), + ('Accuracy', UINT32), + ('SetsToZero', BOOLEAN), ] class EFI_MEMORY_DESCRIPTOR(STRUCT): _pack_ = 8 _fields_ = [ - ('Type', UINT32), - ('PhysicalStart', EFI_PHYSICAL_ADDRESS), - ('VirtualStart', EFI_VIRTUAL_ADDRESS), - ('NumberOfPages', UINT64), - ('Attribute', UINT64) + ('Type', UINT32), + ('PhysicalStart', EFI_PHYSICAL_ADDRESS), + ('VirtualStart', EFI_VIRTUAL_ADDRESS), + ('NumberOfPages', UINT64), + ('Attribute', UINT64) ] class EFI_CAPSULE_HEADER(STRUCT): _fields_ = [ - ('CapsuleGuid', EFI_GUID), - ('HeaderSize', UINT32), - ('Flags', UINT32), - ('CapsuleImageSize', UINT32) + ('CapsuleGuid', EFI_GUID), + ('HeaderSize', UINT32), + ('Flags', UINT32), + ('CapsuleImageSize', UINT32) ] -EFI_GET_TIME = FUNCPTR(EFI_STATUS, PTR(EFI_TIME), PTR(EFI_TIME_CAPABILITIES)) -EFI_SET_TIME = FUNCPTR(EFI_STATUS, PTR(EFI_TIME)) -EFI_GET_WAKEUP_TIME = FUNCPTR(EFI_STATUS, PTR(BOOLEAN), PTR(BOOLEAN), PTR(EFI_TIME)) -EFI_SET_WAKEUP_TIME = FUNCPTR(EFI_STATUS, BOOLEAN, PTR(EFI_TIME)) -EFI_SET_VIRTUAL_ADDRESS_MAP = FUNCPTR(EFI_STATUS, UINTN, UINTN, UINT32, PTR(EFI_MEMORY_DESCRIPTOR)) -EFI_CONVERT_POINTER = FUNCPTR(EFI_STATUS, UINTN, PTR(PTR(VOID))) -EFI_GET_VARIABLE = FUNCPTR(EFI_STATUS, PTR(CHAR16), PTR(EFI_GUID), PTR(UINT32), PTR(UINTN), PTR(VOID)) -EFI_GET_NEXT_VARIABLE_NAME = FUNCPTR(EFI_STATUS, PTR(UINTN), PTR(CHAR16), PTR(EFI_GUID)) -EFI_SET_VARIABLE = FUNCPTR(EFI_STATUS, PTR(CHAR16), PTR(EFI_GUID), UINT32, UINTN, PTR(VOID)) -EFI_GET_NEXT_HIGH_MONO_COUNT = FUNCPTR(EFI_STATUS, PTR(UINT32)) -EFI_RESET_SYSTEM = FUNCPTR(VOID, EFI_RESET_TYPE, EFI_STATUS, UINTN, PTR(VOID)) -EFI_UPDATE_CAPSULE = FUNCPTR(EFI_STATUS, PTR(PTR(EFI_CAPSULE_HEADER)), UINTN, EFI_PHYSICAL_ADDRESS) -EFI_QUERY_CAPSULE_CAPABILITIES = FUNCPTR(EFI_STATUS, PTR(PTR(EFI_CAPSULE_HEADER)), UINTN, PTR(UINT64), PTR(EFI_RESET_TYPE)) -EFI_QUERY_VARIABLE_INFO = FUNCPTR(EFI_STATUS, UINT32, PTR(UINT64), PTR(UINT64), PTR(UINT64)) +EFI_GET_TIME = FUNCPTR(EFI_STATUS, PTR(EFI_TIME), PTR(EFI_TIME_CAPABILITIES)) +EFI_SET_TIME = FUNCPTR(EFI_STATUS, PTR(EFI_TIME)) +EFI_GET_WAKEUP_TIME = FUNCPTR(EFI_STATUS, PTR(BOOLEAN), PTR(BOOLEAN), PTR(EFI_TIME)) +EFI_SET_WAKEUP_TIME = FUNCPTR(EFI_STATUS, BOOLEAN, PTR(EFI_TIME)) +EFI_SET_VIRTUAL_ADDRESS_MAP = FUNCPTR(EFI_STATUS, UINTN, UINTN, UINT32, PTR(EFI_MEMORY_DESCRIPTOR)) +EFI_CONVERT_POINTER = FUNCPTR(EFI_STATUS, UINTN, PTR(PTR(VOID))) +EFI_GET_VARIABLE = FUNCPTR(EFI_STATUS, PTR(CHAR16), PTR(EFI_GUID), PTR(UINT32), PTR(UINTN), PTR(VOID)) +EFI_GET_NEXT_VARIABLE_NAME = FUNCPTR(EFI_STATUS, PTR(UINTN), PTR(CHAR16), PTR(EFI_GUID)) +EFI_SET_VARIABLE = FUNCPTR(EFI_STATUS, PTR(CHAR16), PTR(EFI_GUID), UINT32, UINTN, PTR(VOID)) +EFI_GET_NEXT_HIGH_MONO_COUNT = FUNCPTR(EFI_STATUS, PTR(UINT32)) +EFI_RESET_SYSTEM = FUNCPTR(VOID, EFI_RESET_TYPE, EFI_STATUS, UINTN, PTR(VOID)) +EFI_UPDATE_CAPSULE = FUNCPTR(EFI_STATUS, PTR(PTR(EFI_CAPSULE_HEADER)), UINTN, EFI_PHYSICAL_ADDRESS) +EFI_QUERY_CAPSULE_CAPABILITIES = FUNCPTR(EFI_STATUS, PTR(PTR(EFI_CAPSULE_HEADER)), UINTN, PTR(UINT64), PTR(EFI_RESET_TYPE)) +EFI_QUERY_VARIABLE_INFO = FUNCPTR(EFI_STATUS, UINT32, PTR(UINT64), PTR(UINT64), PTR(UINT64)) class EFI_RUNTIME_SERVICES(STRUCT): _fields_ = [ - ('Hdr', EFI_TABLE_HEADER), - ('GetTime', EFI_GET_TIME), - ('SetTime', EFI_SET_TIME), - ('GetWakeupTime', EFI_GET_WAKEUP_TIME), - ('SetWakeupTime', EFI_SET_WAKEUP_TIME), - ('SetVirtualAddressMap', EFI_SET_VIRTUAL_ADDRESS_MAP), - ('ConvertPointer', EFI_CONVERT_POINTER), - ('GetVariable', EFI_GET_VARIABLE), - ('GetNextVariableName', EFI_GET_NEXT_VARIABLE_NAME), - ('SetVariable', EFI_SET_VARIABLE), - ('GetNextHighMonotonicCount', EFI_GET_NEXT_HIGH_MONO_COUNT), - ('ResetSystem', EFI_RESET_SYSTEM), - ('UpdateCapsule', EFI_UPDATE_CAPSULE), - ('QueryCapsuleCapabilities', EFI_QUERY_CAPSULE_CAPABILITIES), - ('QueryVariableInfo', EFI_QUERY_VARIABLE_INFO) + ('Hdr', EFI_TABLE_HEADER), + ('GetTime', EFI_GET_TIME), + ('SetTime', EFI_SET_TIME), + ('GetWakeupTime', EFI_GET_WAKEUP_TIME), + ('SetWakeupTime', EFI_SET_WAKEUP_TIME), + ('SetVirtualAddressMap', EFI_SET_VIRTUAL_ADDRESS_MAP), + ('ConvertPointer', EFI_CONVERT_POINTER), + ('GetVariable', EFI_GET_VARIABLE), + ('GetNextVariableName', EFI_GET_NEXT_VARIABLE_NAME), + ('SetVariable', EFI_SET_VARIABLE), + ('GetNextHighMonotonicCount', EFI_GET_NEXT_HIGH_MONO_COUNT), + ('ResetSystem', EFI_RESET_SYSTEM), + ('UpdateCapsule', EFI_UPDATE_CAPSULE), + ('QueryCapsuleCapabilities', EFI_QUERY_CAPSULE_CAPABILITIES), + ('QueryVariableInfo', EFI_QUERY_VARIABLE_INFO) ] EFI_EVENT_NOTIFY = FUNCPTR(VOID, EFI_EVENT, PTR(VOID)) @@ -112,109 +112,109 @@ EFI_EVENT_NOTIFY = FUNCPTR(VOID, EFI_EVENT, PTR(VOID)) class EFI_DEVICE_PATH_PROTOCOL(STRUCT): _fields_ = [ ('Type', UINT8), - ('SubType', UINT8), - ('Length', UINT8 * 2) + ('SubType', UINT8), + ('Length', UINT8 * 2) ] class EFI_OPEN_PROTOCOL_INFORMATION_ENTRY(STRUCT): _fields_ = [ - ('AgentHandle', EFI_HANDLE), - ('ControllerHandle',EFI_HANDLE), - ('Attributes', UINT32), + ('AgentHandle', EFI_HANDLE), + ('ControllerHandle', EFI_HANDLE), + ('Attributes', UINT32), ('OpenCount', UINT32) ] -EFI_RAISE_TPL = FUNCPTR(EFI_TPL, EFI_TPL) -EFI_RESTORE_TPL = FUNCPTR(VOID, EFI_TPL) -EFI_ALLOCATE_PAGES = FUNCPTR(EFI_STATUS, EFI_ALLOCATE_TYPE, EFI_MEMORY_TYPE, UINTN, PTR(EFI_PHYSICAL_ADDRESS)) -EFI_FREE_PAGES = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, UINTN) -EFI_GET_MEMORY_MAP = FUNCPTR(EFI_STATUS, PTR(UINTN), PTR(EFI_MEMORY_DESCRIPTOR), PTR(UINTN), PTR(UINTN), PTR(UINT32)) -EFI_ALLOCATE_POOL = FUNCPTR(EFI_STATUS, EFI_MEMORY_TYPE, UINTN, PTR(PTR(VOID))) -EFI_FREE_POOL = FUNCPTR(EFI_STATUS, PTR(VOID)) -EFI_CREATE_EVENT = FUNCPTR(EFI_STATUS, UINT32, EFI_TPL, EFI_EVENT_NOTIFY, PTR(VOID), PTR(EFI_EVENT)) -EFI_SET_TIMER = FUNCPTR(EFI_STATUS, EFI_EVENT, EFI_TIMER_DELAY, UINT64) -EFI_WAIT_FOR_EVENT = FUNCPTR(EFI_STATUS, UINTN, PTR(EFI_EVENT), PTR(UINTN)) -EFI_SIGNAL_EVENT = FUNCPTR(EFI_STATUS, EFI_EVENT) -EFI_CLOSE_EVENT = FUNCPTR(EFI_STATUS, EFI_EVENT) -EFI_CHECK_EVENT = FUNCPTR(EFI_STATUS, EFI_EVENT) -EFI_INSTALL_PROTOCOL_INTERFACE = FUNCPTR(EFI_STATUS, PTR(EFI_HANDLE), PTR(EFI_GUID), EFI_INTERFACE_TYPE, PTR(VOID)) -EFI_REINSTALL_PROTOCOL_INTERFACE = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_GUID), PTR(VOID), PTR(VOID)) -EFI_UNINSTALL_PROTOCOL_INTERFACE = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_GUID), PTR(VOID)) -EFI_HANDLE_PROTOCOL = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_GUID), PTR(PTR(VOID))) -EFI_REGISTER_PROTOCOL_NOTIFY = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), EFI_EVENT, PTR(PTR(VOID))) -EFI_LOCATE_HANDLE = FUNCPTR(EFI_STATUS, EFI_LOCATE_SEARCH_TYPE, PTR(EFI_GUID), PTR(VOID), PTR(UINTN), PTR(EFI_HANDLE)) -EFI_LOCATE_DEVICE_PATH = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), PTR(PTR(EFI_DEVICE_PATH_PROTOCOL)), PTR(EFI_HANDLE)) -EFI_INSTALL_CONFIGURATION_TABLE = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), PTR(VOID)) -EFI_IMAGE_LOAD = FUNCPTR(EFI_STATUS, BOOLEAN, EFI_HANDLE, PTR(EFI_DEVICE_PATH_PROTOCOL), PTR(VOID) , UINTN, PTR(EFI_HANDLE)) -EFI_IMAGE_START = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(UINTN), PTR(PTR(CHAR16))) -EFI_EXIT = FUNCPTR(EFI_STATUS, EFI_HANDLE, EFI_STATUS, UINTN, PTR(CHAR16)) -EFI_IMAGE_UNLOAD = FUNCPTR(EFI_STATUS, EFI_HANDLE) -EFI_EXIT_BOOT_SERVICES = FUNCPTR(EFI_STATUS, EFI_HANDLE, UINTN) -EFI_GET_NEXT_MONOTONIC_COUNT = FUNCPTR(EFI_STATUS, PTR(UINT64)) -EFI_STALL = FUNCPTR(EFI_STATUS, UINTN) -EFI_SET_WATCHDOG_TIMER = FUNCPTR(EFI_STATUS, UINTN, UINT64, UINTN, PTR(CHAR16)) -EFI_CONNECT_CONTROLLER = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_HANDLE), PTR(EFI_DEVICE_PATH_PROTOCOL), BOOLEAN) -EFI_DISCONNECT_CONTROLLER = FUNCPTR(EFI_STATUS, EFI_HANDLE, EFI_HANDLE, EFI_HANDLE) -EFI_OPEN_PROTOCOL = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_GUID), PTR(PTR(VOID)), EFI_HANDLE, EFI_HANDLE, UINT32) -EFI_CLOSE_PROTOCOL = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_GUID), EFI_HANDLE, EFI_HANDLE) -EFI_OPEN_PROTOCOL_INFORMATION = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_GUID), PTR(PTR(EFI_OPEN_PROTOCOL_INFORMATION_ENTRY)), PTR(UINTN)) -EFI_PROTOCOLS_PER_HANDLE = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(PTR(PTR(EFI_GUID))), PTR(UINTN)) -EFI_LOCATE_HANDLE_BUFFER = FUNCPTR(EFI_STATUS, EFI_LOCATE_SEARCH_TYPE, PTR(EFI_GUID), PTR(VOID), PTR(UINTN), PTR(PTR(EFI_HANDLE))) -EFI_LOCATE_PROTOCOL = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), PTR(VOID), PTR(PTR(VOID))) -EFI_INSTALL_MULTIPLE_PROTOCOL_INTERFACES = FUNCPTR(EFI_STATUS, PTR(EFI_HANDLE)) # ... -EFI_UNINSTALL_MULTIPLE_PROTOCOL_INTERFACES = FUNCPTR(EFI_STATUS, EFI_HANDLE) # ... -EFI_CALCULATE_CRC32 = FUNCPTR(EFI_STATUS, PTR(VOID), UINTN, PTR(UINT32)) -EFI_COPY_MEM = FUNCPTR(VOID, PTR(VOID), PTR(VOID), UINTN) -EFI_SET_MEM = FUNCPTR(VOID, PTR(VOID), UINTN, UINT8) -EFI_CREATE_EVENT_EX = FUNCPTR(EFI_STATUS, UINT32, EFI_TPL, EFI_EVENT_NOTIFY, PTR(VOID), PTR(EFI_GUID), PTR(EFI_EVENT)) +EFI_RAISE_TPL = FUNCPTR(EFI_TPL, EFI_TPL) +EFI_RESTORE_TPL = FUNCPTR(VOID, EFI_TPL) +EFI_ALLOCATE_PAGES = FUNCPTR(EFI_STATUS, EFI_ALLOCATE_TYPE, EFI_MEMORY_TYPE, UINTN, PTR(EFI_PHYSICAL_ADDRESS)) +EFI_FREE_PAGES = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, UINTN) +EFI_GET_MEMORY_MAP = FUNCPTR(EFI_STATUS, PTR(UINTN), PTR(EFI_MEMORY_DESCRIPTOR), PTR(UINTN), PTR(UINTN), PTR(UINT32)) +EFI_ALLOCATE_POOL = FUNCPTR(EFI_STATUS, EFI_MEMORY_TYPE, UINTN, PTR(PTR(VOID))) +EFI_FREE_POOL = FUNCPTR(EFI_STATUS, PTR(VOID)) +EFI_CREATE_EVENT = FUNCPTR(EFI_STATUS, UINT32, EFI_TPL, EFI_EVENT_NOTIFY, PTR(VOID), PTR(EFI_EVENT)) +EFI_SET_TIMER = FUNCPTR(EFI_STATUS, EFI_EVENT, EFI_TIMER_DELAY, UINT64) +EFI_WAIT_FOR_EVENT = FUNCPTR(EFI_STATUS, UINTN, PTR(EFI_EVENT), PTR(UINTN)) +EFI_SIGNAL_EVENT = FUNCPTR(EFI_STATUS, EFI_EVENT) +EFI_CLOSE_EVENT = FUNCPTR(EFI_STATUS, EFI_EVENT) +EFI_CHECK_EVENT = FUNCPTR(EFI_STATUS, EFI_EVENT) +EFI_INSTALL_PROTOCOL_INTERFACE = FUNCPTR(EFI_STATUS, PTR(EFI_HANDLE), PTR(EFI_GUID), EFI_INTERFACE_TYPE, PTR(VOID)) +EFI_REINSTALL_PROTOCOL_INTERFACE = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_GUID), PTR(VOID), PTR(VOID)) +EFI_UNINSTALL_PROTOCOL_INTERFACE = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_GUID), PTR(VOID)) +EFI_HANDLE_PROTOCOL = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_GUID), PTR(PTR(VOID))) +EFI_REGISTER_PROTOCOL_NOTIFY = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), EFI_EVENT, PTR(PTR(VOID))) +EFI_LOCATE_HANDLE = FUNCPTR(EFI_STATUS, EFI_LOCATE_SEARCH_TYPE, PTR(EFI_GUID), PTR(VOID), PTR(UINTN), PTR(EFI_HANDLE)) +EFI_LOCATE_DEVICE_PATH = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), PTR(PTR(EFI_DEVICE_PATH_PROTOCOL)), PTR(EFI_HANDLE)) +EFI_INSTALL_CONFIGURATION_TABLE = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), PTR(VOID)) +EFI_IMAGE_LOAD = FUNCPTR(EFI_STATUS, BOOLEAN, EFI_HANDLE, PTR(EFI_DEVICE_PATH_PROTOCOL), PTR(VOID) , UINTN, PTR(EFI_HANDLE)) +EFI_IMAGE_START = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(UINTN), PTR(PTR(CHAR16))) +EFI_EXIT = FUNCPTR(EFI_STATUS, EFI_HANDLE, EFI_STATUS, UINTN, PTR(CHAR16)) +EFI_IMAGE_UNLOAD = FUNCPTR(EFI_STATUS, EFI_HANDLE) +EFI_EXIT_BOOT_SERVICES = FUNCPTR(EFI_STATUS, EFI_HANDLE, UINTN) +EFI_GET_NEXT_MONOTONIC_COUNT = FUNCPTR(EFI_STATUS, PTR(UINT64)) +EFI_STALL = FUNCPTR(EFI_STATUS, UINTN) +EFI_SET_WATCHDOG_TIMER = FUNCPTR(EFI_STATUS, UINTN, UINT64, UINTN, PTR(CHAR16)) +EFI_CONNECT_CONTROLLER = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_HANDLE), PTR(EFI_DEVICE_PATH_PROTOCOL), BOOLEAN) +EFI_DISCONNECT_CONTROLLER = FUNCPTR(EFI_STATUS, EFI_HANDLE, EFI_HANDLE, EFI_HANDLE) +EFI_OPEN_PROTOCOL = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_GUID), PTR(PTR(VOID)), EFI_HANDLE, EFI_HANDLE, UINT32) +EFI_CLOSE_PROTOCOL = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_GUID), EFI_HANDLE, EFI_HANDLE) +EFI_OPEN_PROTOCOL_INFORMATION = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_GUID), PTR(PTR(EFI_OPEN_PROTOCOL_INFORMATION_ENTRY)), PTR(UINTN)) +EFI_PROTOCOLS_PER_HANDLE = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(PTR(PTR(EFI_GUID))), PTR(UINTN)) +EFI_LOCATE_HANDLE_BUFFER = FUNCPTR(EFI_STATUS, EFI_LOCATE_SEARCH_TYPE, PTR(EFI_GUID), PTR(VOID), PTR(UINTN), PTR(PTR(EFI_HANDLE))) +EFI_LOCATE_PROTOCOL = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), PTR(VOID), PTR(PTR(VOID))) +EFI_INSTALL_MULTIPLE_PROTOCOL_INTERFACES = FUNCPTR(EFI_STATUS, PTR(EFI_HANDLE)) # ... +EFI_UNINSTALL_MULTIPLE_PROTOCOL_INTERFACES = FUNCPTR(EFI_STATUS, EFI_HANDLE) # ... +EFI_CALCULATE_CRC32 = FUNCPTR(EFI_STATUS, PTR(VOID), UINTN, PTR(UINT32)) +EFI_COPY_MEM = FUNCPTR(VOID, PTR(VOID), PTR(VOID), UINTN) +EFI_SET_MEM = FUNCPTR(VOID, PTR(VOID), UINTN, UINT8) +EFI_CREATE_EVENT_EX = FUNCPTR(EFI_STATUS, UINT32, EFI_TPL, EFI_EVENT_NOTIFY, PTR(VOID), PTR(EFI_GUID), PTR(EFI_EVENT)) class EFI_BOOT_SERVICES(STRUCT): _fields_ = [ - ('Hdr', EFI_TABLE_HEADER), - ('RaiseTPL', EFI_RAISE_TPL), - ('RestoreTPL', EFI_RESTORE_TPL), - ('AllocatePages', EFI_ALLOCATE_PAGES), - ('FreePages', EFI_FREE_PAGES), - ('GetMemoryMap', EFI_GET_MEMORY_MAP), - ('AllocatePool', EFI_ALLOCATE_POOL), - ('FreePool', EFI_FREE_POOL), - ('CreateEvent', EFI_CREATE_EVENT), - ('SetTimer', EFI_SET_TIMER), - ('WaitForEvent', EFI_WAIT_FOR_EVENT), - ('SignalEvent', EFI_SIGNAL_EVENT), - ('CloseEvent', EFI_CLOSE_EVENT), - ('CheckEvent', EFI_CHECK_EVENT), - ('InstallProtocolInterface', EFI_INSTALL_PROTOCOL_INTERFACE), - ('ReinstallProtocolInterface', EFI_REINSTALL_PROTOCOL_INTERFACE), - ('UninstallProtocolInterface', EFI_UNINSTALL_PROTOCOL_INTERFACE), - ('HandleProtocol', EFI_HANDLE_PROTOCOL), - ('Reserved', PTR(VOID)), - ('RegisterProtocolNotify', EFI_REGISTER_PROTOCOL_NOTIFY), - ('LocateHandle', EFI_LOCATE_HANDLE), - ('LocateDevicePath', EFI_LOCATE_DEVICE_PATH), - ('InstallConfigurationTable', EFI_INSTALL_CONFIGURATION_TABLE), - ('LoadImage', EFI_IMAGE_LOAD), - ('StartImage', EFI_IMAGE_START), - ('Exit', EFI_EXIT), - ('UnloadImage', EFI_IMAGE_UNLOAD), - ('ExitBootServices', EFI_EXIT_BOOT_SERVICES), - ('GetNextMonotonicCount', EFI_GET_NEXT_MONOTONIC_COUNT), - ('Stall', EFI_STALL), - ('SetWatchdogTimer', EFI_SET_WATCHDOG_TIMER), - ('ConnectController', EFI_CONNECT_CONTROLLER), - ('DisconnectController', EFI_DISCONNECT_CONTROLLER), - ('OpenProtocol', EFI_OPEN_PROTOCOL), - ('CloseProtocol', EFI_CLOSE_PROTOCOL), - ('OpenProtocolInformation', EFI_OPEN_PROTOCOL_INFORMATION), - ('ProtocolsPerHandle', EFI_PROTOCOLS_PER_HANDLE), - ('LocateHandleBuffer', EFI_LOCATE_HANDLE_BUFFER), - ('LocateProtocol', EFI_LOCATE_PROTOCOL), - ('InstallMultipleProtocolInterfaces', EFI_INSTALL_MULTIPLE_PROTOCOL_INTERFACES), - ('UninstallMultipleProtocolInterfaces', EFI_UNINSTALL_MULTIPLE_PROTOCOL_INTERFACES), - ('CalculateCrc32', EFI_CALCULATE_CRC32), - ('CopyMem', EFI_COPY_MEM), - ('SetMem', EFI_SET_MEM), - ('CreateEventEx', EFI_CREATE_EVENT_EX) + ('Hdr', EFI_TABLE_HEADER), + ('RaiseTPL', EFI_RAISE_TPL), + ('RestoreTPL', EFI_RESTORE_TPL), + ('AllocatePages', EFI_ALLOCATE_PAGES), + ('FreePages', EFI_FREE_PAGES), + ('GetMemoryMap', EFI_GET_MEMORY_MAP), + ('AllocatePool', EFI_ALLOCATE_POOL), + ('FreePool', EFI_FREE_POOL), + ('CreateEvent', EFI_CREATE_EVENT), + ('SetTimer', EFI_SET_TIMER), + ('WaitForEvent', EFI_WAIT_FOR_EVENT), + ('SignalEvent', EFI_SIGNAL_EVENT), + ('CloseEvent', EFI_CLOSE_EVENT), + ('CheckEvent', EFI_CHECK_EVENT), + ('InstallProtocolInterface', EFI_INSTALL_PROTOCOL_INTERFACE), + ('ReinstallProtocolInterface', EFI_REINSTALL_PROTOCOL_INTERFACE), + ('UninstallProtocolInterface', EFI_UNINSTALL_PROTOCOL_INTERFACE), + ('HandleProtocol', EFI_HANDLE_PROTOCOL), + ('Reserved', PTR(VOID)), + ('RegisterProtocolNotify', EFI_REGISTER_PROTOCOL_NOTIFY), + ('LocateHandle', EFI_LOCATE_HANDLE), + ('LocateDevicePath', EFI_LOCATE_DEVICE_PATH), + ('InstallConfigurationTable', EFI_INSTALL_CONFIGURATION_TABLE), + ('LoadImage', EFI_IMAGE_LOAD), + ('StartImage', EFI_IMAGE_START), + ('Exit', EFI_EXIT), + ('UnloadImage', EFI_IMAGE_UNLOAD), + ('ExitBootServices', EFI_EXIT_BOOT_SERVICES), + ('GetNextMonotonicCount', EFI_GET_NEXT_MONOTONIC_COUNT), + ('Stall', EFI_STALL), + ('SetWatchdogTimer', EFI_SET_WATCHDOG_TIMER), + ('ConnectController', EFI_CONNECT_CONTROLLER), + ('DisconnectController', EFI_DISCONNECT_CONTROLLER), + ('OpenProtocol', EFI_OPEN_PROTOCOL), + ('CloseProtocol', EFI_CLOSE_PROTOCOL), + ('OpenProtocolInformation', EFI_OPEN_PROTOCOL_INFORMATION), + ('ProtocolsPerHandle', EFI_PROTOCOLS_PER_HANDLE), + ('LocateHandleBuffer', EFI_LOCATE_HANDLE_BUFFER), + ('LocateProtocol', EFI_LOCATE_PROTOCOL), + ('InstallMultipleProtocolInterfaces', EFI_INSTALL_MULTIPLE_PROTOCOL_INTERFACES), + ('UninstallMultipleProtocolInterfaces', EFI_UNINSTALL_MULTIPLE_PROTOCOL_INTERFACES), + ('CalculateCrc32', EFI_CALCULATE_CRC32), + ('CopyMem', EFI_COPY_MEM), + ('SetMem', EFI_SET_MEM), + ('CreateEventEx', EFI_CREATE_EVENT_EX) ] class EFI_CONFIGURATION_TABLE(STRUCT): @@ -235,19 +235,19 @@ class EFI_SYSTEM_TABLE(STRUCT): _pack_ = 8 _fields_ = [ - ('Hdr', EFI_TABLE_HEADER), - ('FirmwareVendor', PTR(CHAR16)), - ('FirmwareRevision', UINT32), - ('ConsoleInHandle', EFI_HANDLE), - ('ConIn', PTR(EFI_SIMPLE_TEXT_INPUT_PROTOCOL)), - ('ConsoleOutHandle', EFI_HANDLE), - ('ConOut', PTR(EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL)), - ('StandardErrorHandle', EFI_HANDLE), - ('StdErr', PTR(EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL)), - ('RuntimeServices', PTR(EFI_RUNTIME_SERVICES)), - ('BootServices', PTR(EFI_BOOT_SERVICES)), - ('NumberOfTableEntries', UINTN), - ('ConfigurationTable', PTR(EFI_CONFIGURATION_TABLE)) + ('Hdr', EFI_TABLE_HEADER), + ('FirmwareVendor', PTR(CHAR16)), + ('FirmwareRevision', UINT32), + ('ConsoleInHandle', EFI_HANDLE), + ('ConIn', PTR(EFI_SIMPLE_TEXT_INPUT_PROTOCOL)), + ('ConsoleOutHandle', EFI_HANDLE), + ('ConOut', PTR(EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL)), + ('StandardErrorHandle', EFI_HANDLE), + ('StdErr', PTR(EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL)), + ('RuntimeServices', PTR(EFI_RUNTIME_SERVICES)), + ('BootServices', PTR(EFI_BOOT_SERVICES)), + ('NumberOfTableEntries', UINTN), + ('ConfigurationTable', PTR(EFI_CONFIGURATION_TABLE)) ] __all__ = [ diff --git a/qiling/os/uefi/bs.py b/qiling/os/uefi/bs.py index 5c00cc51..79319899 100644 --- a/qiling/os/uefi/bs.py +++ b/qiling/os/uefi/bs.py @@ -17,11 +17,11 @@ from qiling.os.uefi.UefiSpec import * from qiling.os.uefi.protocols import common if TYPE_CHECKING: - from qiling import Qiling + from qiling import Qiling @dxeapi(params = { - "NewTpl" : ULONGLONG # EFI_TPL + "NewTpl": ULONGLONG # EFI_TPL }) def hook_RaiseTPL(ql: Qiling, address: int, params): prev_tpl = ql.loader.tpl @@ -30,16 +30,16 @@ def hook_RaiseTPL(ql: Qiling, address: int, params): return prev_tpl @dxeapi(params = { - "OldTpl": ULONGLONG # EFI_TPL + "OldTpl": ULONGLONG # EFI_TPL }) def hook_RestoreTPL(ql: Qiling, address: int, params): ql.loader.tpl = params["OldTpl"] @dxeapi(params = { - "type" : INT, # EFI_ALLOCATE_TYPE - "MemoryType": INT, # EFI_MEMORY_TYPE - "Pages" : ULONGLONG, # UINTN - "Memory" : POINTER # PTR(EFI_PHYSICAL_ADDRESS) + "type": INT, # EFI_ALLOCATE_TYPE + "MemoryType": INT, # EFI_MEMORY_TYPE + "Pages": ULONGLONG, # UINTN + "Memory": POINTER # PTR(EFI_PHYSICAL_ADDRESS) }) def hook_AllocatePages(ql: Qiling, address: int, params): alloc_size = params["Pages"] * PAGE_SIZE @@ -61,8 +61,8 @@ def hook_AllocatePages(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "Memory" : ULONGLONG, # EFI_PHYSICAL_ADDRESS - "Pages" : ULONGLONG # UINTN + "Memory": ULONGLONG, # EFI_PHYSICAL_ADDRESS + "Pages": ULONGLONG # UINTN }) def hook_FreePages(ql: Qiling, address: int, params): address = params["Memory"] @@ -72,19 +72,19 @@ def hook_FreePages(ql: Qiling, address: int, params): return EFI_SUCCESS if ret else EFI_INVALID_PARAMETER @dxeapi(params = { - "MemoryMapSize" : POINTER, # PTR(UINTN) - "MemoryMap" : POINTER, # PTR(EFI_MEMORY_DESCRIPTOR) - "MapKey" : POINTER, # PTR(UINTN) - "DescriptorSize" : POINTER, # PTR(UINTN) - "DescriptorVersion" : POINTER # PTR(UINT32) + "MemoryMapSize": POINTER, # PTR(UINTN) + "MemoryMap": POINTER, # PTR(EFI_MEMORY_DESCRIPTOR) + "MapKey": POINTER, # PTR(UINTN) + "DescriptorSize": POINTER, # PTR(UINTN) + "DescriptorVersion": POINTER # PTR(UINT32) }) def hook_GetMemoryMap(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "PoolType" : INT, # EFI_MEMORY_TYPE - "Size" : INT, # UINTN - "Buffer" : POINTER # PTR(PTR(VOID)) + "PoolType": INT, # EFI_MEMORY_TYPE + "Size": INT, # UINTN + "Buffer": POINTER # PTR(PTR(VOID)) }) def hook_AllocatePool(ql: Qiling, address: int, params): # TODO: allocate memory acording to "PoolType" @@ -97,7 +97,7 @@ def hook_AllocatePool(ql: Qiling, address: int, params): return EFI_SUCCESS if address else EFI_OUT_OF_RESOURCES @dxeapi(params = { - "Buffer": POINTER # PTR(VOID) + "Buffer": POINTER # PTR(VOID) }) def hook_FreePool(ql: Qiling, address: int, params): Buffer = params["Buffer"] @@ -107,33 +107,33 @@ def hook_FreePool(ql: Qiling, address: int, params): return EFI_SUCCESS if ret else EFI_INVALID_PARAMETER @dxeapi(params = { - "Type" : UINT, # UINT32 - "NotifyTpl" : UINT, # EFI_TPL - "NotifyFunction": POINTER, # EFI_EVENT_NOTIFY - "NotifyContext" : POINTER, # PTR(VOID) - "Event" : POINTER # PTR(EFI_EVENT) + "Type": UINT, # UINT32 + "NotifyTpl": UINT, # EFI_TPL + "NotifyFunction": POINTER, # EFI_EVENT_NOTIFY + "NotifyContext": POINTER, # PTR(VOID) + "Event": POINTER # PTR(EFI_EVENT) }) def hook_CreateEvent(ql: Qiling, address: int, params): return CreateEvent(ql, params) @dxeapi(params = { - "Event" : POINTER, # EFI_EVENT - "Type" : ULONGLONG, # EFI_TIMER_DELAY - "TriggerTime" : ULONGLONG # UINT64 + "Event": POINTER, # EFI_EVENT + "Type": ULONGLONG, # EFI_TIMER_DELAY + "TriggerTime": ULONGLONG # UINT64 }) def hook_SetTimer(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { "NumberOfEvents": ULONGLONG, # UINTN - "Event" : POINTER, # PTR(EFI_EVENT) - "Index" : POINTER, # PTR(UINTN) + "Event": POINTER, # PTR(EFI_EVENT) + "Index": POINTER, # PTR(UINTN) }) def hook_WaitForEvent(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "Event": POINTER # EFI_EVENT + "Event": POINTER # EFI_EVENT }) def hook_SignalEvent(ql: Qiling, address: int, params): event_id = params["Event"] @@ -146,7 +146,7 @@ def hook_SignalEvent(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "Event": POINTER # EFI_EVENT + "Event": POINTER # EFI_EVENT }) def hook_CloseEvent(ql: Qiling, address: int, params): event_id = params["Event"] @@ -159,7 +159,7 @@ def hook_CloseEvent(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "Event": POINTER # EFI_EVENT + "Event": POINTER # EFI_EVENT }) def hook_CheckEvent(ql: Qiling, address: int, params): event_id = params["Event"] @@ -167,19 +167,19 @@ def hook_CheckEvent(ql: Qiling, address: int, params): return EFI_SUCCESS if ql.loader.events[event_id]["Set"] else EFI_NOT_READY @dxeapi(params = { - "Handle" : POINTER, # PTR(EFI_HANDLE) - "Protocol" : GUID, # PTR(EFI_GUID) - "InterfaceType" : ULONGLONG, # EFI_INTERFACE_TYPE - "Interface" : POINTER, # PTR(VOID) + "Handle": POINTER, # PTR(EFI_HANDLE) + "Protocol": GUID, # PTR(EFI_GUID) + "InterfaceType": ULONGLONG, # EFI_INTERFACE_TYPE + "Interface": POINTER, # PTR(VOID) }) def hook_InstallProtocolInterface(ql: Qiling, address: int, params): return common.InstallProtocolInterface(ql.loader.dxe_context, params) @dxeapi(params = { - "Handle" : POINTER, # EFI_HANDLE - "Protocol" : GUID, # PTR(EFI_GUID) - "OldInterface" : POINTER, # PTR(VOID) - "NewInterface" : POINTER # PTR(VOID) + "Handle": POINTER, # EFI_HANDLE + "Protocol": GUID, # PTR(EFI_GUID) + "OldInterface": POINTER, # PTR(VOID) + "NewInterface": POINTER # PTR(VOID) }) def hook_ReinstallProtocolInterface(ql: Qiling, address: int, params): handle = params["Handle"] @@ -198,25 +198,25 @@ def hook_ReinstallProtocolInterface(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "Handle" : POINTER, # EFI_HANDLE - "Protocol" : GUID, # PTR(EFI_GUID) - "Interface" : POINTER # PTR(VOID) + "Handle": POINTER, # EFI_HANDLE + "Protocol": GUID, # PTR(EFI_GUID) + "Interface": POINTER # PTR(VOID) }) def hook_UninstallProtocolInterface(ql: Qiling, address: int, params): return common.UninstallProtocolInterface(ql.loader.dxe_context, params) @dxeapi(params = { - "Handle" : POINTER, # EFI_HANDLE - "Protocol" : GUID, # PTR(EFI_GUID) - "Interface" : POINTER # PTR(PTR(VOID)) + "Handle": POINTER, # EFI_HANDLE + "Protocol": GUID, # PTR(EFI_GUID) + "Interface": POINTER # PTR(PTR(VOID)) }) def hook_HandleProtocol(ql: Qiling, address: int, params): return common.HandleProtocol(ql.loader.dxe_context, params) @dxeapi(params = { - "Protocol" : GUID, # PTR(EFI_GUID) - "Event" : POINTER, # EFI_EVENT - "Registration" : POINTER # PTR(PTR(VOID)) + "Protocol": GUID, # PTR(EFI_GUID) + "Event": POINTER, # EFI_EVENT + "Registration": POINTER # PTR(PTR(VOID)) }) def hook_RegisterProtocolNotify(ql: Qiling, address: int, params): event = params['Event'] @@ -230,54 +230,54 @@ def hook_RegisterProtocolNotify(ql: Qiling, address: int, params): return EFI_INVALID_PARAMETER @dxeapi(params = { - "SearchType": INT, # EFI_LOCATE_SEARCH_TYPE - "Protocol" : GUID, # PTR(EFI_GUID) - "SearchKey" : POINTER, # PTR(VOID) - "BufferSize": POINTER, # PTR(UINTN) - "Buffer" : POINTER # PTR(EFI_HANDLE) + "SearchType": INT, # EFI_LOCATE_SEARCH_TYPE + "Protocol": GUID, # PTR(EFI_GUID) + "SearchKey": POINTER, # PTR(VOID) + "BufferSize": POINTER, # PTR(UINTN) + "Buffer": POINTER # PTR(EFI_HANDLE) }) def hook_LocateHandle(ql: Qiling, address: int, params): return common.LocateHandle(ql.loader.dxe_context, params) @dxeapi(params = { - "Protocol" : GUID, # PTR(EFI_GUID) - "DevicePath": POINTER, # PTR(PTR(EFI_DEVICE_PATH_PROTOCOL)) - "Device" : POINTER # PTR(EFI_HANDLE) + "Protocol": GUID, # PTR(EFI_GUID) + "DevicePath": POINTER, # PTR(PTR(EFI_DEVICE_PATH_PROTOCOL)) + "Device": POINTER # PTR(EFI_HANDLE) }) def hook_LocateDevicePath(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "Guid" : GUID, # PTR(EFI_GUID) - "Table" : POINTER # PTR(VOID) + "Guid": GUID, # PTR(EFI_GUID) + "Table": POINTER # PTR(VOID) }) def hook_InstallConfigurationTable(ql: Qiling, address: int, params): return common.InstallConfigurationTable(ql.loader.dxe_context, params) @dxeapi(params = { - "BootPolicy" : BOOL, # BOOLEAN - "ParentImageHandle" : POINTER, # EFI_HANDLE - "DevicePath" : POINTER, # PTR(EFI_DEVICE_PATH_PROTOCOL) - "SourceBuffer" : POINTER, # PTR(VOID) - "SourceSize" : ULONGLONG, # UINTN - "ImageHandle" : POINTER # PTR(EFI_HANDLE) + "BootPolicy": BOOL, # BOOLEAN + "ParentImageHandle": POINTER, # EFI_HANDLE + "DevicePath": POINTER, # PTR(EFI_DEVICE_PATH_PROTOCOL) + "SourceBuffer": POINTER, # PTR(VOID) + "SourceSize": ULONGLONG, # UINTN + "ImageHandle": POINTER # PTR(EFI_HANDLE) }) def hook_LoadImage(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "ImageHandle" : POINTER, # EFI_HANDLE - "ExitDataSize" : POINTER, # PTR(UINTN) - "ExitData" : POINTER # PTR(PTR(CHAR16)) + "ImageHandle": POINTER, # EFI_HANDLE + "ExitDataSize": POINTER, # PTR(UINTN) + "ExitData": POINTER # PTR(PTR(CHAR16)) }) def hook_StartImage(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "ImageHandle" : POINTER, # EFI_HANDLE - "ExitStatus" : ULONGLONG, # EFI_STATUS - "ExitDataSize" : ULONGLONG, # UINTN - "ExitData" : POINTER # PTR(CHAR16) + "ImageHandle": POINTER, # EFI_HANDLE + "ExitStatus": ULONGLONG, # EFI_STATUS + "ExitDataSize": ULONGLONG, # UINTN + "ExitData": POINTER # PTR(CHAR16) }) def hook_Exit(ql: Qiling, address: int, params): ql.emu_stop() @@ -285,25 +285,25 @@ def hook_Exit(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "ImageHandle" : POINTER # EFI_HANDLE + "ImageHandle": POINTER # EFI_HANDLE }) def hook_UnloadImage(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "ImageHandle" : POINTER, # EFI_HANDLE - "MapKey" : ULONGLONG # UINTN + "ImageHandle": POINTER, # EFI_HANDLE + "MapKey": ULONGLONG # UINTN }) def hook_ExitBootServices(ql: Qiling, address: int, params): ql.emu_stop() - # TODO: cleanup BS tableas and data, and notify signal list gEfiEventExitBootServicesGuid + # TODO: cleanup BS tables and data, and notify signal list gEfiEventExitBootServicesGuid # @see: MdeModulePkg\Core\Dxe\DxeMain\DxeMain.c, CoreExitBootServices return EFI_SUCCESS @dxeapi(params = { - "Count": POINTER # PTR(UINT64) + "Count": POINTER # PTR(UINT64) }) def hook_GetNextMonotonicCount(ql: Qiling, address: int, params): out = params["Count"] @@ -314,80 +314,80 @@ def hook_GetNextMonotonicCount(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "Microseconds": ULONGLONG # UINTN + "Microseconds": ULONGLONG # UINTN }) def hook_Stall(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "Timeout" : ULONGLONG, # UINTN - "WatchdogCode" : ULONGLONG, # UINT64 - "DataSize" : ULONGLONG, # UINTN - "WatchdogData" : POINTER # PTR(CHAR16) + "Timeout": ULONGLONG, # UINTN + "WatchdogCode": ULONGLONG, # UINT64 + "DataSize": ULONGLONG, # UINTN + "WatchdogData": POINTER # PTR(CHAR16) }) def hook_SetWatchdogTimer(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "ControllerHandle" : POINTER, # EFI_HANDLE - "DriverImageHandle" : POINTER, #PTR(EFI_HANDLE) - "RemainingDevicePath" : POINTER, # PTR(EFI_DEVICE_PATH_PROTOCOL) - "Recursive" : BOOL # BOOLEAN + "ControllerHandle": POINTER, # EFI_HANDLE + "DriverImageHandle": POINTER, #PTR(EFI_HANDLE) + "RemainingDevicePath": POINTER, # PTR(EFI_DEVICE_PATH_PROTOCOL) + "Recursive": BOOL # BOOLEAN }) def hook_ConnectController(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "ControllerHandle" : POINTER, # EFI_HANDLE - "DriverImageHandle" : POINTER, # EFI_HANDLE - "ChildHandle" : POINTER # EFI_HANDLE + "ControllerHandle": POINTER, # EFI_HANDLE + "DriverImageHandle": POINTER, # EFI_HANDLE + "ChildHandle": POINTER # EFI_HANDLE }) def hook_DisconnectController(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "Handle" : POINTER, # EFI_HANDLE - "Protocol" : GUID, # PTR(EFI_GUID) - "Interface" : POINTER, # PTR(PTR(VOID)) - "AgentHandle" : POINTER, # EFI_HANDLE - "ControllerHandle" : POINTER, # EFI_HANDLE - "Attributes" : UINT # UINT32 + "Handle": POINTER, # EFI_HANDLE + "Protocol": GUID, # PTR(EFI_GUID) + "Interface": POINTER, # PTR(PTR(VOID)) + "AgentHandle": POINTER, # EFI_HANDLE + "ControllerHandle": POINTER, # EFI_HANDLE + "Attributes": UINT # UINT32 }) def hook_OpenProtocol(ql: Qiling, address: int, params): return common.LocateProtocol(ql.loader.dxe_context, params) @dxeapi(params = { - "Handle" : POINTER, # EFI_HANDLE - "Protocol" : GUID, # PTR(EFI_GUID) - "AgentHandle" : POINTER, # EFI_HANDLE - "ControllerHandle" : POINTER # EFI_HANDLE + "Handle": POINTER, # EFI_HANDLE + "Protocol": GUID, # PTR(EFI_GUID) + "AgentHandle": POINTER, # EFI_HANDLE + "ControllerHandle": POINTER # EFI_HANDLE }) def hook_CloseProtocol(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "Handle" : POINTER, # EFI_HANDLE - "Protocol" : GUID, # PTR(EFI_GUID) - "EntryBuffer" : POINTER, # PTR(PTR(EFI_OPEN_PROTOCOL_INFORMATION_ENTRY)) - "EntryCount" : POINTER # PTR(UINTN) + "Handle": POINTER, # EFI_HANDLE + "Protocol": GUID, # PTR(EFI_GUID) + "EntryBuffer": POINTER, # PTR(PTR(EFI_OPEN_PROTOCOL_INFORMATION_ENTRY)) + "EntryCount": POINTER # PTR(UINTN) }) def hook_OpenProtocolInformation(ql: Qiling, address: int, params): return EFI_NOT_FOUND @dxeapi(params = { - "Handle" : POINTER, # EFI_HANDLE - "ProtocolBuffer" : POINTER, # PTR(PTR(PTR(EFI_GUID))) - "ProtocolBufferCount" : POINTER # PTR(UINTN) + "Handle": POINTER, # EFI_HANDLE + "ProtocolBuffer": POINTER, # PTR(PTR(PTR(EFI_GUID))) + "ProtocolBufferCount": POINTER # PTR(UINTN) }) def hook_ProtocolsPerHandle(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "SearchType": INT, # EFI_LOCATE_SEARCH_TYPE - "Protocol" : GUID, # PTR(EFI_GUID) - "SearchKey" : POINTER, # PTR(VOID) - "NoHandles" : POINTER, # PTR(UINTN) - "Buffer" : POINTER # PTR(PTR(EFI_HANDLE)) + "SearchType": INT, # EFI_LOCATE_SEARCH_TYPE + "Protocol": GUID, # PTR(EFI_GUID) + "SearchKey": POINTER, # PTR(VOID) + "NoHandles": POINTER, # PTR(UINTN) + "Buffer": POINTER # PTR(PTR(EFI_HANDLE)) }) def hook_LocateHandleBuffer(ql: Qiling, address: int, params): buffer_size, handles = common.LocateHandles(ql.loader.dxe_context, params) @@ -409,15 +409,15 @@ def hook_LocateHandleBuffer(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "Protocol" : GUID, # PTR(EFI_GUID) - "Registration" : POINTER, # PTR(VOID) - "Interface" : POINTER # PTR(PTR(VOID)) + "Protocol": GUID, # PTR(EFI_GUID) + "Registration": POINTER, # PTR(VOID) + "Interface": POINTER # PTR(PTR(VOID)) }) def hook_LocateProtocol(ql: Qiling, address: int, params): return common.LocateProtocol(ql.loader.dxe_context, params) @dxeapi(params = { - "Handle" : POINTER # PTR(EFI_HANDLE) + "Handle": POINTER # PTR(EFI_HANDLE) # ... }) def hook_InstallMultipleProtocolInterfaces(ql: Qiling, address: int, params): @@ -447,7 +447,7 @@ def hook_InstallMultipleProtocolInterfaces(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "Handle" : POINTER # EFI_HANDLE + "Handle": POINTER # EFI_HANDLE # ... }) def hook_UninstallMultipleProtocolInterfaces(ql: Qiling, address: int, params): @@ -477,9 +477,9 @@ def hook_UninstallMultipleProtocolInterfaces(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "Data" : POINTER, # PTR(VOID) - "DataSize" : ULONGLONG, # UINTN - "Crc32" : POINTER # PTR(UINT32) + "Data": POINTER, # PTR(VOID) + "DataSize": ULONGLONG, # UINTN + "Crc32": POINTER # PTR(UINT32) }) def hook_CalculateCrc32(ql: Qiling, address: int, params): data = ql.mem.read(params['Data'], params['DataSize']) @@ -488,9 +488,9 @@ def hook_CalculateCrc32(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "Destination" : POINTER, # PTR(VOID) - "Source" : POINTER, # PTR(VOID) - "Length" : SIZE_T # UINTN + "Destination": POINTER, # PTR(VOID) + "Source": POINTER, # PTR(VOID) + "Length": SIZE_T # UINTN }) def hook_CopyMem(ql: Qiling, address: int, params): dst = params["Destination"] @@ -500,9 +500,9 @@ def hook_CopyMem(ql: Qiling, address: int, params): ql.mem.write(dst, bytes(ql.mem.read(src, length))) @dxeapi(params = { - "Buffer": POINTER, # PTR(VOID) - "Size" : SIZE_T, # UINTN - "Value" : BYTE # UINT8 + "Buffer": POINTER, # PTR(VOID) + "Size": SIZE_T, # UINTN + "Value": BYTE # UINT8 }) def hook_SetMem(ql: Qiling, address: int, params): buffer = params["Buffer"] @@ -512,12 +512,12 @@ def hook_SetMem(ql: Qiling, address: int, params): ql.mem.write(buffer, bytes([value]) * size) @dxeapi(params = { - "Type" : UINT, # UINT32 - "NotifyTpl" : ULONGLONG,# EFI_TPL - "NotifyFunction": POINTER, # EFI_EVENT_NOTIFY - "NotifyContext" : POINTER, # PTR(VOID) - "EventGroup" : GUID, # PTR(EFI_GUID) - "Event" : POINTER # PTR(EFI_EVENT) + "Type": UINT, # UINT32 + "NotifyTpl": ULONGLONG, # EFI_TPL + "NotifyFunction": POINTER, # EFI_EVENT_NOTIFY + "NotifyContext": POINTER, # PTR(VOID) + "EventGroup": GUID, # PTR(EFI_GUID) + "Event": POINTER # PTR(EFI_EVENT) }) def hook_CreateEventEx(ql: Qiling, address: int, params): return CreateEvent(ql, params) @@ -526,9 +526,9 @@ def CreateEvent(ql: Qiling, params): event_id = len(ql.loader.events) event_dic = { "NotifyFunction": params["NotifyFunction"], - "CallbackArgs" : [event_id, params["NotifyContext"]], - "Guid" : "", - "Set" : False + "CallbackArgs": [event_id, params["NotifyContext"]], + "Guid": "", + "Set": False } if "EventGroup" in params: @@ -543,51 +543,51 @@ def initialize(ql: Qiling, gBS: int): descriptor = { 'struct' : EFI_BOOT_SERVICES, 'fields' : ( - ('Hdr', None), - ('RaiseTPL', hook_RaiseTPL), - ('RestoreTPL', hook_RestoreTPL), - ('AllocatePages', hook_AllocatePages), - ('FreePages', hook_FreePages), - ('GetMemoryMap', hook_GetMemoryMap), - ('AllocatePool', hook_AllocatePool), - ('FreePool', hook_FreePool), - ('CreateEvent', hook_CreateEvent), - ('SetTimer', hook_SetTimer), - ('WaitForEvent', hook_WaitForEvent), - ('SignalEvent', hook_SignalEvent), - ('CloseEvent', hook_CloseEvent), - ('CheckEvent', hook_CheckEvent), - ('InstallProtocolInterface', hook_InstallProtocolInterface), - ('ReinstallProtocolInterface', hook_ReinstallProtocolInterface), - ('UninstallProtocolInterface', hook_UninstallProtocolInterface), - ('HandleProtocol', hook_HandleProtocol), - ('Reserved', None), - ('RegisterProtocolNotify', hook_RegisterProtocolNotify), - ('LocateHandle', hook_LocateHandle), - ('LocateDevicePath', hook_LocateDevicePath), - ('InstallConfigurationTable', hook_InstallConfigurationTable), - ('LoadImage', hook_LoadImage), - ('StartImage', hook_StartImage), - ('Exit', hook_Exit), - ('UnloadImage', hook_UnloadImage), - ('ExitBootServices', hook_ExitBootServices), - ('GetNextMonotonicCount', hook_GetNextMonotonicCount), - ('Stall', hook_Stall), - ('SetWatchdogTimer', hook_SetWatchdogTimer), - ('ConnectController', hook_ConnectController), - ('DisconnectController', hook_DisconnectController), - ('OpenProtocol', hook_OpenProtocol), - ('CloseProtocol', hook_CloseProtocol), - ('OpenProtocolInformation', hook_OpenProtocolInformation), - ('ProtocolsPerHandle', hook_ProtocolsPerHandle), - ('LocateHandleBuffer', hook_LocateHandleBuffer), - ('LocateProtocol', hook_LocateProtocol), - ('InstallMultipleProtocolInterfaces', hook_InstallMultipleProtocolInterfaces), - ('UninstallMultipleProtocolInterfaces', hook_UninstallMultipleProtocolInterfaces), - ('CalculateCrc32', hook_CalculateCrc32), - ('CopyMem', hook_CopyMem), - ('SetMem', hook_SetMem), - ('CreateEventEx', hook_CreateEventEx) + ('Hdr', None), + ('RaiseTPL', hook_RaiseTPL), + ('RestoreTPL', hook_RestoreTPL), + ('AllocatePages', hook_AllocatePages), + ('FreePages', hook_FreePages), + ('GetMemoryMap', hook_GetMemoryMap), + ('AllocatePool', hook_AllocatePool), + ('FreePool', hook_FreePool), + ('CreateEvent', hook_CreateEvent), + ('SetTimer', hook_SetTimer), + ('WaitForEvent', hook_WaitForEvent), + ('SignalEvent', hook_SignalEvent), + ('CloseEvent', hook_CloseEvent), + ('CheckEvent', hook_CheckEvent), + ('InstallProtocolInterface', hook_InstallProtocolInterface), + ('ReinstallProtocolInterface', hook_ReinstallProtocolInterface), + ('UninstallProtocolInterface', hook_UninstallProtocolInterface), + ('HandleProtocol', hook_HandleProtocol), + ('Reserved', None), + ('RegisterProtocolNotify', hook_RegisterProtocolNotify), + ('LocateHandle', hook_LocateHandle), + ('LocateDevicePath', hook_LocateDevicePath), + ('InstallConfigurationTable', hook_InstallConfigurationTable), + ('LoadImage', hook_LoadImage), + ('StartImage', hook_StartImage), + ('Exit', hook_Exit), + ('UnloadImage', hook_UnloadImage), + ('ExitBootServices', hook_ExitBootServices), + ('GetNextMonotonicCount', hook_GetNextMonotonicCount), + ('Stall', hook_Stall), + ('SetWatchdogTimer', hook_SetWatchdogTimer), + ('ConnectController', hook_ConnectController), + ('DisconnectController', hook_DisconnectController), + ('OpenProtocol', hook_OpenProtocol), + ('CloseProtocol', hook_CloseProtocol), + ('OpenProtocolInformation', hook_OpenProtocolInformation), + ('ProtocolsPerHandle', hook_ProtocolsPerHandle), + ('LocateHandleBuffer', hook_LocateHandleBuffer), + ('LocateProtocol', hook_LocateProtocol), + ('InstallMultipleProtocolInterfaces', hook_InstallMultipleProtocolInterfaces), + ('UninstallMultipleProtocolInterfaces', hook_UninstallMultipleProtocolInterfaces), + ('CalculateCrc32', hook_CalculateCrc32), + ('CopyMem', hook_CopyMem), + ('SetMem', hook_SetMem), + ('CreateEventEx', hook_CreateEventEx) ) } diff --git a/qiling/os/uefi/const.py b/qiling/os/uefi/const.py index b4d0704a..cc95b07e 100644 --- a/qiling/os/uefi/const.py +++ b/qiling/os/uefi/const.py @@ -1,46 +1,46 @@ #!/usr/bin/env python3 -# +# # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # EFI_MAX_BIT = (1 << 63) EFI_SUCCESS = 0 -EFI_LOAD_ERROR = EFI_MAX_BIT | 1 -EFI_INVALID_PARAMETER = EFI_MAX_BIT | 2 -EFI_UNSUPPORTED = EFI_MAX_BIT | 3 -EFI_BAD_BUFFER_SIZE = EFI_MAX_BIT | 4 -EFI_BUFFER_TOO_SMALL = EFI_MAX_BIT | 5 -EFI_NOT_READY = EFI_MAX_BIT | 6 -EFI_DEVICE_ERROR = EFI_MAX_BIT | 7 -EFI_WRITE_PROTECTED = EFI_MAX_BIT | 8 -EFI_OUT_OF_RESOURCES = EFI_MAX_BIT | 9 -EFI_VOLUME_CORRUPTED = EFI_MAX_BIT | 10 -EFI_VOLUME_FULL = EFI_MAX_BIT | 11 -EFI_NO_MEDIA = EFI_MAX_BIT | 12 -EFI_MEDIA_CHANGED = EFI_MAX_BIT | 13 -EFI_NOT_FOUND = EFI_MAX_BIT | 14 -EFI_ACCESS_DENIED = EFI_MAX_BIT | 15 -EFI_NO_RESPONSE = EFI_MAX_BIT | 16 -EFI_NO_MAPPING = EFI_MAX_BIT | 17 -EFI_TIMEOUT = EFI_MAX_BIT | 18 -EFI_NOT_STARTED = EFI_MAX_BIT | 19 -EFI_ALREADY_STARTED = EFI_MAX_BIT | 20 -EFI_ABORTED = EFI_MAX_BIT | 21 -EFI_ICMP_ERROR = EFI_MAX_BIT | 22 -EFI_TFTP_ERROR = EFI_MAX_BIT | 23 -EFI_PROTOCOL_ERROR = EFI_MAX_BIT | 24 -EFI_INCOMPATIBLE_VERSION = EFI_MAX_BIT | 25 -EFI_SECURITY_VIOLATION = EFI_MAX_BIT | 26 -EFI_CRC_ERROR = EFI_MAX_BIT | 27 -EFI_END_OF_MEDIA = EFI_MAX_BIT | 28 -EFI_END_OF_FILE = EFI_MAX_BIT | 31 -EFI_INVALID_LANGUAGE = EFI_MAX_BIT | 32 +EFI_LOAD_ERROR = EFI_MAX_BIT | 1 +EFI_INVALID_PARAMETER = EFI_MAX_BIT | 2 +EFI_UNSUPPORTED = EFI_MAX_BIT | 3 +EFI_BAD_BUFFER_SIZE = EFI_MAX_BIT | 4 +EFI_BUFFER_TOO_SMALL = EFI_MAX_BIT | 5 +EFI_NOT_READY = EFI_MAX_BIT | 6 +EFI_DEVICE_ERROR = EFI_MAX_BIT | 7 +EFI_WRITE_PROTECTED = EFI_MAX_BIT | 8 +EFI_OUT_OF_RESOURCES = EFI_MAX_BIT | 9 +EFI_VOLUME_CORRUPTED = EFI_MAX_BIT | 10 +EFI_VOLUME_FULL = EFI_MAX_BIT | 11 +EFI_NO_MEDIA = EFI_MAX_BIT | 12 +EFI_MEDIA_CHANGED = EFI_MAX_BIT | 13 +EFI_NOT_FOUND = EFI_MAX_BIT | 14 +EFI_ACCESS_DENIED = EFI_MAX_BIT | 15 +EFI_NO_RESPONSE = EFI_MAX_BIT | 16 +EFI_NO_MAPPING = EFI_MAX_BIT | 17 +EFI_TIMEOUT = EFI_MAX_BIT | 18 +EFI_NOT_STARTED = EFI_MAX_BIT | 19 +EFI_ALREADY_STARTED = EFI_MAX_BIT | 20 +EFI_ABORTED = EFI_MAX_BIT | 21 +EFI_ICMP_ERROR = EFI_MAX_BIT | 22 +EFI_TFTP_ERROR = EFI_MAX_BIT | 23 +EFI_PROTOCOL_ERROR = EFI_MAX_BIT | 24 +EFI_INCOMPATIBLE_VERSION = EFI_MAX_BIT | 25 +EFI_SECURITY_VIOLATION = EFI_MAX_BIT | 26 +EFI_CRC_ERROR = EFI_MAX_BIT | 27 +EFI_END_OF_MEDIA = EFI_MAX_BIT | 28 +EFI_END_OF_FILE = EFI_MAX_BIT | 31 +EFI_INVALID_LANGUAGE = EFI_MAX_BIT | 32 -EFI_WARN_UNKNOWN_GLYPH = EFI_MAX_BIT | 1 -EFI_WARN_DELETE_FAILURE = EFI_MAX_BIT | 2 -EFI_WARN_WRITE_FAILURE = EFI_MAX_BIT | 3 -EFI_WARN_BUFFER_TOO_SMALL = EFI_MAX_BIT | 4 +EFI_WARN_UNKNOWN_GLYPH = EFI_MAX_BIT | 1 +EFI_WARN_DELETE_FAILURE = EFI_MAX_BIT | 2 +EFI_WARN_WRITE_FAILURE = EFI_MAX_BIT | 3 +EFI_WARN_BUFFER_TOO_SMALL = EFI_MAX_BIT | 4 # @see: MdePkg\Include\Base.h EFI_ERROR = lambda status: (status & EFI_MAX_BIT) != 0 diff --git a/qiling/os/uefi/ds.py b/qiling/os/uefi/ds.py index ada10b1d..5665ecbc 100644 --- a/qiling/os/uefi/ds.py +++ b/qiling/os/uefi/ds.py @@ -1,5 +1,5 @@ #!/usr/bin/env python3 -# +# # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # @@ -28,13 +28,13 @@ class EFI_GCD_MEMORY_SPACE_DESCRIPTOR(STRUCT): _pack_ = 8 _fields_ = [ - ('BaseAddress', EFI_PHYSICAL_ADDRESS), - ('Length', UINT64), - ('Capabilities', UINT64), - ('Attributes', UINT64), - ('GcdMemoryType', EFI_GCD_MEMORY_TYPE), - ('ImageHandle', EFI_HANDLE), - ('DeviceHandle', EFI_HANDLE) + ('BaseAddress', EFI_PHYSICAL_ADDRESS), + ('Length', UINT64), + ('Capabilities', UINT64), + ('Attributes', UINT64), + ('GcdMemoryType', EFI_GCD_MEMORY_TYPE), + ('ImageHandle', EFI_HANDLE), + ('DeviceHandle', EFI_HANDLE) ] class EFI_GCD_IO_TYPE(ENUM): @@ -49,11 +49,11 @@ class EFI_GCD_IO_SPACE_DESCRIPTOR(STRUCT): _pack_ = 8 _fields_ = [ - ('BaseAddress', EFI_PHYSICAL_ADDRESS), - ('Length', UINT64), - ('GcdIoType', EFI_GCD_IO_TYPE), - ('ImageHandle', EFI_HANDLE), - ('DeviceHandle', EFI_HANDLE) + ('BaseAddress', EFI_PHYSICAL_ADDRESS), + ('Length', UINT64), + ('GcdIoType', EFI_GCD_IO_TYPE), + ('ImageHandle', EFI_HANDLE), + ('DeviceHandle', EFI_HANDLE) ] class EFI_GCD_ALLOCATE_TYPE(ENUM): @@ -66,46 +66,46 @@ class EFI_GCD_ALLOCATE_TYPE(ENUM): 'EfiGcdMaxAllocateType' ] -EFI_ADD_MEMORY_SPACE = FUNCPTR(EFI_STATUS, EFI_GCD_MEMORY_TYPE, EFI_PHYSICAL_ADDRESS, UINT64, UINT64) -EFI_ALLOCATE_MEMORY_SPACE = FUNCPTR(EFI_STATUS, EFI_GCD_ALLOCATE_TYPE, EFI_GCD_MEMORY_TYPE, UINTN, UINT64, PTR(EFI_PHYSICAL_ADDRESS), EFI_HANDLE, EFI_HANDLE) -EFI_FREE_MEMORY_SPACE = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, UINT64) -EFI_REMOVE_MEMORY_SPACE = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, UINT64) -EFI_GET_MEMORY_SPACE_DESCRIPTOR = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, PTR(EFI_GCD_MEMORY_SPACE_DESCRIPTOR)) -EFI_SET_MEMORY_SPACE_ATTRIBUTES = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, UINT64, UINT64) -EFI_GET_MEMORY_SPACE_MAP = FUNCPTR(EFI_STATUS, PTR(UINTN), PTR(PTR(EFI_GCD_MEMORY_SPACE_DESCRIPTOR))) -EFI_ADD_IO_SPACE = FUNCPTR(EFI_STATUS, EFI_GCD_IO_TYPE, EFI_PHYSICAL_ADDRESS, UINT64) -EFI_ALLOCATE_IO_SPACE = FUNCPTR(EFI_STATUS, EFI_GCD_ALLOCATE_TYPE, EFI_GCD_IO_TYPE, UINTN, UINT64, PTR(EFI_PHYSICAL_ADDRESS), EFI_HANDLE, EFI_HANDLE) -EFI_FREE_IO_SPACE = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, UINT64) -EFI_REMOVE_IO_SPACE = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, UINT64) -EFI_GET_IO_SPACE_DESCRIPTOR = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, PTR(EFI_GCD_IO_SPACE_DESCRIPTOR)) -EFI_GET_IO_SPACE_MAP = FUNCPTR(EFI_STATUS, PTR(UINTN), PTR(PTR(EFI_GCD_IO_SPACE_DESCRIPTOR))) -EFI_DISPATCH = FUNCPTR(EFI_STATUS) -EFI_SCHEDULE = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_GUID)) -EFI_TRUST = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_GUID)) -EFI_PROCESS_FIRMWARE_VOLUME = FUNCPTR(EFI_STATUS, PTR(VOID), UINTN, PTR(EFI_HANDLE)) -EFI_SET_MEMORY_SPACE_CAPABILITIES = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, UINT64, UINT64) +EFI_ADD_MEMORY_SPACE = FUNCPTR(EFI_STATUS, EFI_GCD_MEMORY_TYPE, EFI_PHYSICAL_ADDRESS, UINT64, UINT64) +EFI_ALLOCATE_MEMORY_SPACE = FUNCPTR(EFI_STATUS, EFI_GCD_ALLOCATE_TYPE, EFI_GCD_MEMORY_TYPE, UINTN, UINT64, PTR(EFI_PHYSICAL_ADDRESS), EFI_HANDLE, EFI_HANDLE) +EFI_FREE_MEMORY_SPACE = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, UINT64) +EFI_REMOVE_MEMORY_SPACE = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, UINT64) +EFI_GET_MEMORY_SPACE_DESCRIPTOR = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, PTR(EFI_GCD_MEMORY_SPACE_DESCRIPTOR)) +EFI_SET_MEMORY_SPACE_ATTRIBUTES = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, UINT64, UINT64) +EFI_GET_MEMORY_SPACE_MAP = FUNCPTR(EFI_STATUS, PTR(UINTN), PTR(PTR(EFI_GCD_MEMORY_SPACE_DESCRIPTOR))) +EFI_ADD_IO_SPACE = FUNCPTR(EFI_STATUS, EFI_GCD_IO_TYPE, EFI_PHYSICAL_ADDRESS, UINT64) +EFI_ALLOCATE_IO_SPACE = FUNCPTR(EFI_STATUS, EFI_GCD_ALLOCATE_TYPE, EFI_GCD_IO_TYPE, UINTN, UINT64, PTR(EFI_PHYSICAL_ADDRESS), EFI_HANDLE, EFI_HANDLE) +EFI_FREE_IO_SPACE = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, UINT64) +EFI_REMOVE_IO_SPACE = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, UINT64) +EFI_GET_IO_SPACE_DESCRIPTOR = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, PTR(EFI_GCD_IO_SPACE_DESCRIPTOR)) +EFI_GET_IO_SPACE_MAP = FUNCPTR(EFI_STATUS, PTR(UINTN), PTR(PTR(EFI_GCD_IO_SPACE_DESCRIPTOR))) +EFI_DISPATCH = FUNCPTR(EFI_STATUS) +EFI_SCHEDULE = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_GUID)) +EFI_TRUST = FUNCPTR(EFI_STATUS, EFI_HANDLE, PTR(EFI_GUID)) +EFI_PROCESS_FIRMWARE_VOLUME = FUNCPTR(EFI_STATUS, PTR(VOID), UINTN, PTR(EFI_HANDLE)) +EFI_SET_MEMORY_SPACE_CAPABILITIES = FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, UINT64, UINT64) class EFI_DXE_SERVICES(STRUCT): _fields_ = [ - ('Hdr', EFI_TABLE_HEADER), - ('AddMemorySpace', EFI_ADD_MEMORY_SPACE), - ('AllocateMemorySpace', EFI_ALLOCATE_MEMORY_SPACE), - ('FreeMemorySpace', EFI_FREE_MEMORY_SPACE), - ('RemoveMemorySpace', EFI_REMOVE_MEMORY_SPACE), - ('GetMemorySpaceDescriptor', EFI_GET_MEMORY_SPACE_DESCRIPTOR), - ('SetMemorySpaceAttributes', EFI_SET_MEMORY_SPACE_ATTRIBUTES), - ('GetMemorySpaceMap', EFI_GET_MEMORY_SPACE_MAP), - ('AddIoSpace', EFI_ADD_IO_SPACE), - ('AllocateIoSpace', EFI_ALLOCATE_IO_SPACE), - ('FreeIoSpace', EFI_FREE_IO_SPACE), - ('RemoveIoSpace', EFI_REMOVE_IO_SPACE), - ('GetIoSpaceDescriptor', EFI_GET_IO_SPACE_DESCRIPTOR), - ('GetIoSpaceMap', EFI_GET_IO_SPACE_MAP), - ('Dispatch', EFI_DISPATCH), - ('Schedule', EFI_SCHEDULE), - ('Trust', EFI_TRUST), - ('ProcessFirmwareVolume', EFI_PROCESS_FIRMWARE_VOLUME), - ('SetMemorySpaceCapabilities', EFI_SET_MEMORY_SPACE_CAPABILITIES) + ('Hdr', EFI_TABLE_HEADER), + ('AddMemorySpace', EFI_ADD_MEMORY_SPACE), + ('AllocateMemorySpace', EFI_ALLOCATE_MEMORY_SPACE), + ('FreeMemorySpace', EFI_FREE_MEMORY_SPACE), + ('RemoveMemorySpace', EFI_REMOVE_MEMORY_SPACE), + ('GetMemorySpaceDescriptor', EFI_GET_MEMORY_SPACE_DESCRIPTOR), + ('SetMemorySpaceAttributes', EFI_SET_MEMORY_SPACE_ATTRIBUTES), + ('GetMemorySpaceMap', EFI_GET_MEMORY_SPACE_MAP), + ('AddIoSpace', EFI_ADD_IO_SPACE), + ('AllocateIoSpace', EFI_ALLOCATE_IO_SPACE), + ('FreeIoSpace', EFI_FREE_IO_SPACE), + ('RemoveIoSpace', EFI_REMOVE_IO_SPACE), + ('GetIoSpaceDescriptor', EFI_GET_IO_SPACE_DESCRIPTOR), + ('GetIoSpaceMap', EFI_GET_IO_SPACE_MAP), + ('Dispatch', EFI_DISPATCH), + ('Schedule', EFI_SCHEDULE), + ('Trust', EFI_TRUST), + ('ProcessFirmwareVolume', EFI_PROCESS_FIRMWARE_VOLUME), + ('SetMemorySpaceCapabilities', EFI_SET_MEMORY_SPACE_CAPABILITIES) ] @dxeapi(params={ @@ -122,9 +122,9 @@ def hook_AddMemorySpace(ctx, address, params): "a1": ULONGLONG, "a2": ULONGLONG, "a3": ULONGLONG, - "a4": POINTER, #POINTER_T(ctypes.c_uint64) - "a5": POINTER, #POINTER_T(None) - "a6": POINTER, #POINTER_T(None) + "a4": POINTER, # POINTER_T(ctypes.c_uint64) + "a5": POINTER, # POINTER_T(None) + "a6": POINTER, # POINTER_T(None) }) def hook_AllocateMemorySpace(ctx, address, params): return EFI_OUT_OF_RESOURCES @@ -145,7 +145,7 @@ def hook_RemoveMemorySpace(ctx, address, params): @dxeapi(params={ "a0": ULONGLONG, - "a1": POINTER, #POINTER_T(struct_EFI_GCD_MEMORY_SPACE_DESCRIPTOR) + "a1": POINTER, # POINTER_T(struct_EFI_GCD_MEMORY_SPACE_DESCRIPTOR) }) def hook_GetMemorySpaceDescriptor(ctx, address, params): return EFI_UNSUPPORTED @@ -159,8 +159,8 @@ def hook_SetMemorySpaceAttributes(ctx, address, params): return EFI_UNSUPPORTED @dxeapi(params={ - "a0": POINTER, #POINTER_T(ctypes.c_uint64) - "a1": POINTER, #POINTER_T(POINTER_T(struct_EFI_GCD_MEMORY_SPACE_DESCRIPTOR)) + "a0": POINTER, # POINTER_T(ctypes.c_uint64) + "a1": POINTER, # POINTER_T(POINTER_T(struct_EFI_GCD_MEMORY_SPACE_DESCRIPTOR)) }) def hook_GetMemorySpaceMap(ctx, address, params): return EFI_UNSUPPORTED @@ -178,9 +178,9 @@ def hook_AddIoSpace(ctx, address, params): "a1": ULONGLONG, "a2": ULONGLONG, "a3": ULONGLONG, - "a4": POINTER, #POINTER_T(ctypes.c_uint64) - "a5": POINTER, #POINTER_T(None) - "a6": POINTER, #POINTER_T(None) + "a4": POINTER, # POINTER_T(ctypes.c_uint64) + "a5": POINTER, # POINTER_T(None) + "a6": POINTER, # POINTER_T(None) }) def hook_AllocateIoSpace(ctx, address, params): return EFI_OUT_OF_RESOURCES @@ -201,14 +201,14 @@ def hook_RemoveIoSpace(ctx, address, params): @dxeapi(params={ "a0": ULONGLONG, - "a1": POINTER, #POINTER_T(struct_EFI_GCD_IO_SPACE_DESCRIPTOR) + "a1": POINTER, # POINTER_T(struct_EFI_GCD_IO_SPACE_DESCRIPTOR) }) def hook_GetIoSpaceDescriptor(ctx, address, params): return EFI_NOT_FOUND @dxeapi(params={ - "a0": POINTER, #POINTER_T(ctypes.c_uint64) - "a1": POINTER, #POINTER_T(POINTER_T(struct_EFI_GCD_IO_SPACE_DESCRIPTOR)) + "a0": POINTER, # POINTER_T(ctypes.c_uint64) + "a1": POINTER, # POINTER_T(POINTER_T(struct_EFI_GCD_IO_SPACE_DESCRIPTOR)) }) def hook_GetIoSpaceMap(ctx, address, params): return EFI_OUT_OF_RESOURCES @@ -219,23 +219,23 @@ def hook_Dispatch(ctx, address, params): return EFI_SUCCESS @dxeapi(params={ - "a0": POINTER, #POINTER_T(None) + "a0": POINTER, # POINTER_T(None) "a1": GUID, }) def hook_Schedule(ctx, address, params): return EFI_SUCCESS @dxeapi(params={ - "a0": POINTER, #POINTER_T(None) + "a0": POINTER, # POINTER_T(None) "a1": GUID, }) def hook_Trust(ctx, address, params): return EFI_NOT_FOUND @dxeapi(params={ - "a0": POINTER, #POINTER_T(None) + "a0": POINTER, # POINTER_T(None) "a1": ULONGLONG, - "a2": POINTER, #POINTER_T(POINTER_T(None)) + "a2": POINTER, # POINTER_T(POINTER_T(None)) }) def hook_ProcessFirmwareVolume(ctx, address, params): return EFI_OUT_OF_RESOURCES @@ -252,25 +252,25 @@ def initialize(ql: Qiling, gDS: int): descriptor = { 'struct' : EFI_DXE_SERVICES, 'fields' : ( - ('Hdr', None), - ('AddMemorySpace', hook_AddMemorySpace), - ('AllocateMemorySpace', hook_AllocateMemorySpace), - ('FreeMemorySpace', hook_FreeMemorySpace), - ('RemoveMemorySpace', hook_RemoveMemorySpace), - ('GetMemorySpaceDescriptor', hook_GetMemorySpaceDescriptor), - ('SetMemorySpaceAttributes', hook_SetMemorySpaceAttributes), - ('GetMemorySpaceMap', hook_GetMemorySpaceMap), - ('AddIoSpace', hook_AddIoSpace), - ('AllocateIoSpace', hook_AllocateIoSpace), - ('FreeIoSpace', hook_FreeIoSpace), - ('RemoveIoSpace', hook_RemoveIoSpace), - ('GetIoSpaceDescriptor', hook_GetIoSpaceDescriptor), - ('GetIoSpaceMap', hook_GetIoSpaceMap), - ('Dispatch', hook_Dispatch), - ('Schedule', hook_Schedule), - ('Trust', hook_Trust), - ('ProcessFirmwareVolume', hook_ProcessFirmwareVolume), - ('SetMemorySpaceCapabilities', hook_SetMemorySpaceCapabilities) + ('Hdr', None), + ('AddMemorySpace', hook_AddMemorySpace), + ('AllocateMemorySpace', hook_AllocateMemorySpace), + ('FreeMemorySpace', hook_FreeMemorySpace), + ('RemoveMemorySpace', hook_RemoveMemorySpace), + ('GetMemorySpaceDescriptor', hook_GetMemorySpaceDescriptor), + ('SetMemorySpaceAttributes', hook_SetMemorySpaceAttributes), + ('GetMemorySpaceMap', hook_GetMemorySpaceMap), + ('AddIoSpace', hook_AddIoSpace), + ('AllocateIoSpace', hook_AllocateIoSpace), + ('FreeIoSpace', hook_FreeIoSpace), + ('RemoveIoSpace', hook_RemoveIoSpace), + ('GetIoSpaceDescriptor', hook_GetIoSpaceDescriptor), + ('GetIoSpaceMap', hook_GetIoSpaceMap), + ('Dispatch', hook_Dispatch), + ('Schedule', hook_Schedule), + ('Trust', hook_Trust), + ('ProcessFirmwareVolume', hook_ProcessFirmwareVolume), + ('SetMemorySpaceCapabilities', hook_SetMemorySpaceCapabilities) ) } diff --git a/qiling/os/uefi/hob.py b/qiling/os/uefi/hob.py index a1a07f0f..c0df98e3 100644 --- a/qiling/os/uefi/hob.py +++ b/qiling/os/uefi/hob.py @@ -1,5 +1,5 @@ #!/usr/bin/env python3 -# +# # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # @@ -9,20 +9,20 @@ from qiling.os.uefi.utils import GetEfiConfigurationTable, CompareGuid, str_to_g from qiling.os.uefi.UefiBaseType import STRUCT, EFI_GUID, UINT32, UINT16 EFI_HOB_TYPE_HANDOFF = 0x0001 -EFI_HOB_TYPE_GUID_EXTENSION = 0x0004 +EFI_HOB_TYPE_GUID_EXTENSION = 0x0004 EFI_HOB_TYPE_END_OF_HOB_LIST = 0xffff class EFI_HOB_GENERIC_HEADER(STRUCT): _fields_ = [ - ('HobType', UINT16), - ('HobLength', UINT16), - ('Reserved', UINT32) + ('HobType', UINT16), + ('HobLength', UINT16), + ('Reserved', UINT32) ] class EFI_HOB_GUID_TYPE(STRUCT): _fields_ = [ - ('Header', EFI_HOB_GENERIC_HEADER), - ('Name', EFI_GUID) + ('Header', EFI_HOB_GENERIC_HEADER), + ('Name', EFI_GUID) ] def GetHobList(ql: Qiling, context: UefiContext) -> int: diff --git a/qiling/os/uefi/protocols/EfiLoadedImageProtocol.py b/qiling/os/uefi/protocols/EfiLoadedImageProtocol.py index f422cdf5..ef424526 100644 --- a/qiling/os/uefi/protocols/EfiLoadedImageProtocol.py +++ b/qiling/os/uefi/protocols/EfiLoadedImageProtocol.py @@ -1,5 +1,5 @@ #!/usr/bin/env python3 -# +# # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # @@ -14,17 +14,17 @@ class EFI_LOADED_IMAGE_PROTOCOL(STRUCT): _fields_ = [ ('Revision', UINT32), ('ParentHandle', EFI_HANDLE), - ('SystemTable', PTR(EFI_SYSTEM_TABLE)), + ('SystemTable', PTR(EFI_SYSTEM_TABLE)), ('DeviceHandle', EFI_HANDLE), ('FilePath', PTR(EFI_DEVICE_PATH_PROTOCOL)), - ('Reserved', PTR(VOID)), - ('LoadOptionsSize', UINT32), - ('LoadOptions', PTR(VOID)), - ('ImageBase', PTR(VOID)), - ('ImageSize', UINT64), - ('ImageCodeType', EFI_MEMORY_TYPE), - ('ImageDataType', EFI_MEMORY_TYPE), - ('Unload', EFI_IMAGE_UNLOAD) + ('Reserved', PTR(VOID)), + ('LoadOptionsSize', UINT32), + ('LoadOptions', PTR(VOID)), + ('ImageBase', PTR(VOID)), + ('ImageSize', UINT64), + ('ImageCodeType', EFI_MEMORY_TYPE), + ('ImageDataType', EFI_MEMORY_TYPE), + ('Unload', EFI_IMAGE_UNLOAD) ] def make_descriptor(fields): @@ -34,16 +34,16 @@ def make_descriptor(fields): "fields" : ( ('Revision', 0x1000), ('ParentHandle', 0), - ('SystemTable', fields['gST']), + ('SystemTable', fields['gST']), ('DeviceHandle', fields['image_base']), ('FilePath', 0), # This is a handle to a complex path object, skip it for now. - ('LoadOptionsSize', 0), - ('LoadOptions', 0), - ('ImageBase', fields['image_base']), - ('ImageSize', fields['image_size']), - ('ImageCodeType', EFI_MEMORY_TYPE.EfiLoaderCode), - ('ImageDataType', EFI_MEMORY_TYPE.EfiLoaderData), - ('Unload', 0) + ('LoadOptionsSize', 0), + ('LoadOptions', 0), + ('ImageBase', fields['image_base']), + ('ImageSize', fields['image_size']), + ('ImageCodeType', EFI_MEMORY_TYPE.EfiLoaderCode), + ('ImageDataType', EFI_MEMORY_TYPE.EfiLoaderData), + ('Unload', 0) ) } diff --git a/qiling/os/uefi/protocols/EfiSmmAccess2Protocol.py b/qiling/os/uefi/protocols/EfiSmmAccess2Protocol.py index 9e34fe80..3bf81e61 100644 --- a/qiling/os/uefi/protocols/EfiSmmAccess2Protocol.py +++ b/qiling/os/uefi/protocols/EfiSmmAccess2Protocol.py @@ -35,7 +35,7 @@ class EFI_SMM_ACCESS2_PROTOCOL(STRUCT): ] @dxeapi(params = { - "This" : POINTER + "This": POINTER }) def hook_Open(ql: Qiling, address: int, params): ql.loader.smm_context.tseg_open = True @@ -43,7 +43,7 @@ def hook_Open(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "This" : POINTER + "This": POINTER }) def hook_Close(ql: Qiling, address: int, params): ql.loader.smm_context.tseg_open = False @@ -51,7 +51,7 @@ def hook_Close(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "This" : POINTER + "This": POINTER }) def hook_Lock(ql: Qiling, address: int, params): ql.loader.smm_context.tseg_locked = True @@ -80,9 +80,9 @@ def _coalesce(seq): return res @dxeapi(params = { - "This" : POINTER, # PTR(EFI_SMM_ACCESS2_PROTOCOL) - "MmramMapSize" : POINTER, # IN OUT PTR(UINTN) - "MmramMap" : POINTER # OUT PTR(EFI_MMRAM_DESCRIPTOR) + "This": POINTER, # PTR(EFI_SMM_ACCESS2_PROTOCOL) + "MmramMapSize": POINTER, # IN OUT PTR(UINTN) + "MmramMap": POINTER # OUT PTR(EFI_MMRAM_DESCRIPTOR) }) def hook_GetCapabilities(ql: Qiling, address: int, params): heap = ql.loader.smm_context.heap @@ -148,8 +148,8 @@ descriptor = { "struct" : EFI_SMM_ACCESS2_PROTOCOL, "fields" : ( ("Open", hook_Open), - ("Close", hook_Close), + ("Close", hook_Close), ("Lock", hook_Lock), - ("GetCapabilities", hook_GetCapabilities) + ("GetCapabilities", hook_GetCapabilities) ) } diff --git a/qiling/os/uefi/protocols/EfiSmmBase2Protocol.py b/qiling/os/uefi/protocols/EfiSmmBase2Protocol.py index a6a567d1..7b2c8084 100644 --- a/qiling/os/uefi/protocols/EfiSmmBase2Protocol.py +++ b/qiling/os/uefi/protocols/EfiSmmBase2Protocol.py @@ -17,13 +17,13 @@ class EFI_SMM_BASE2_PROTOCOL(STRUCT): EFI_SMM_BASE2_PROTOCOL = STRUCT _fields_ = [ - ('InSmm', FUNCPTR(EFI_STATUS, PTR(EFI_SMM_BASE2_PROTOCOL), PTR(BOOLEAN))), - ('GetSmstLocation', FUNCPTR(EFI_STATUS, PTR(EFI_SMM_BASE2_PROTOCOL), PTR(PTR(EFI_SMM_SYSTEM_TABLE2)))), + ('InSmm', FUNCPTR(EFI_STATUS, PTR(EFI_SMM_BASE2_PROTOCOL), PTR(BOOLEAN))), + ('GetSmstLocation', FUNCPTR(EFI_STATUS, PTR(EFI_SMM_BASE2_PROTOCOL), PTR(PTR(EFI_SMM_SYSTEM_TABLE2)))), ] @dxeapi(params = { - "This" : POINTER, - "InSmram" : POINTER + "This": POINTER, + "InSmram": POINTER }) def hook_InSmm(ql: Qiling, address: int, params): ql.log.debug(f'InSmram = {ql.os.smm.active}') @@ -33,8 +33,8 @@ def hook_InSmm(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "This" : POINTER, - "Smst" : POINTER + "This": POINTER, + "Smst": POINTER }) def hook_GetSmstLocation(ql: Qiling, address: int, params): Smst = params["Smst"] @@ -50,7 +50,7 @@ descriptor = { "guid" : "f4ccbfb7-f6e0-47fd-9dd4-10a8f150c191", "struct" : EFI_SMM_BASE2_PROTOCOL, "fields" : ( - ("InSmm", hook_InSmm), - ("GetSmstLocation", hook_GetSmstLocation) + ("InSmm", hook_InSmm), + ("GetSmstLocation", hook_GetSmstLocation) ) } diff --git a/qiling/os/uefi/protocols/EfiSmmCpuProtocol.py b/qiling/os/uefi/protocols/EfiSmmCpuProtocol.py index 3b24ea8e..d225fa40 100644 --- a/qiling/os/uefi/protocols/EfiSmmCpuProtocol.py +++ b/qiling/os/uefi/protocols/EfiSmmCpuProtocol.py @@ -1,5 +1,5 @@ #!/usr/bin/env python3 -# +# # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # @@ -12,96 +12,96 @@ from ..const import * # @see: MdePkg/Include/Protocol/MmCpu.h class EFI_SMM_SAVE_STATE_REGISTER(ENUM_UC): _members_ = { - # note: members names were shorten from 'EFI_SMM_SAVE_STATE_REGISTER_regname' to just 'regname' - 'GDTBASE' : 4, - 'IDTBASE' : 5, - 'LDTBASE' : 6, - 'GDTLIMIT' : 7, - 'IDTLIMIT' : 8, - 'LDTLIMIT' : 9, - 'LDTINFO' : 10, + # note: members names were shorten from 'EFI_SMM_SAVE_STATE_REGISTER_regname' to just 'regname' + 'GDTBASE': 4, + 'IDTBASE': 5, + 'LDTBASE': 6, + 'GDTLIMIT': 7, + 'IDTLIMIT': 8, + 'LDTLIMIT': 9, + 'LDTINFO': 10, - 'ES' : 20, - 'CS' : 21, - 'SS' : 22, - 'DS' : 23, - 'FS' : 24, - 'GS' : 25, - 'LDTR_SEL' : 26, - 'TR_SEL' : 27, - 'DR7' : 28, - 'DR6' : 29, - 'R8' : 30, - 'R9' : 31, - 'R10' : 32, - 'R11' : 33, - 'R12' : 34, - 'R13' : 35, - 'R14' : 36, - 'R15' : 37, - 'RAX' : 38, - 'RBX' : 39, - 'RCX' : 40, - 'RDX' : 41, - 'RSP' : 42, - 'RBP' : 43, - 'RSI' : 44, - 'RDI' : 45, - 'RIP' : 46, + 'ES': 20, + 'CS': 21, + 'SS': 22, + 'DS': 23, + 'FS': 24, + 'GS': 25, + 'LDTR_SEL': 26, + 'TR_SEL': 27, + 'DR7': 28, + 'DR6': 29, + 'R8': 30, + 'R9': 31, + 'R10': 32, + 'R11': 33, + 'R12': 34, + 'R13': 35, + 'R14': 36, + 'R15': 37, + 'RAX': 38, + 'RBX': 39, + 'RCX': 40, + 'RDX': 41, + 'RSP': 42, + 'RBP': 43, + 'RSI': 44, + 'RDI': 45, + 'RIP': 46, - 'RFLAGS' : 51, - 'CR0' : 52, - 'CR3' : 53, - 'CR4' : 54, + 'RFLAGS': 51, + 'CR0': 52, + 'CR3': 53, + 'CR4': 54, - 'FCW' : 256, - 'FSW' : 257, - 'FTW' : 258, - 'OPCODE' : 259, - 'FP_EIP' : 260, - 'FP_CS' : 261, + 'FCW': 256, + 'FSW': 257, + 'FTW': 258, + 'OPCODE': 259, + 'FP_EIP': 260, + 'FP_CS': 261, 'DATAOFFSET': 262, - 'FP_DS' : 263, - 'MM0' : 264, - 'MM1' : 265, - 'MM2' : 266, - 'MM3' : 267, - 'MM4' : 268, - 'MM5' : 269, - 'MM6' : 270, - 'MM7' : 271, - 'XMM0' : 272, - 'XMM1' : 273, - 'XMM2' : 274, - 'XMM3' : 275, - 'XMM4' : 276, - 'XMM5' : 277, - 'XMM6' : 278, - 'XMM7' : 279, - 'XMM8' : 280, - 'XMM9' : 281, - 'XMM10' : 282, - 'XMM11' : 283, - 'XMM12' : 284, - 'XMM13' : 285, - 'XMM14' : 286, - 'XMM15' : 287, + 'FP_DS': 263, + 'MM0': 264, + 'MM1': 265, + 'MM2': 266, + 'MM3': 267, + 'MM4': 268, + 'MM5': 269, + 'MM6': 270, + 'MM7': 271, + 'XMM0': 272, + 'XMM1': 273, + 'XMM2': 274, + 'XMM3': 275, + 'XMM4': 276, + 'XMM5': 277, + 'XMM6': 278, + 'XMM7': 279, + 'XMM8': 280, + 'XMM9': 281, + 'XMM10': 282, + 'XMM11': 283, + 'XMM12': 284, + 'XMM13': 285, + 'XMM14': 286, + 'XMM15': 287, - 'IO' : 512, - 'LMA' : 513, - 'PROCESSOR_ID' : 514 + 'IO': 512, + 'LMA': 513, + 'PROCESSOR_ID': 514 } -# EFI_SUCCESS The register was written from Save State -# EFI_NOT_FOUND The register is not defined for the Save State of Processor -# EFI_INVALID_PARAMETER ProcessorIndex or Width is not correct +# EFI_SUCCESS The register was written from Save State +# EFI_NOT_FOUND The register is not defined for the Save State of Processor +# EFI_INVALID_PARAMETER ProcessorIndex or Width is not correct @dxeapi(params = { - "This" : POINTER, # EFI_SMM_CPU_PROTOCOL - "Width" : ULONGLONG,# UINTN - "Register" : INT, # EFI_SMM_SAVE_STATE_REGISTER - "CpuIndex" : ULONGLONG,# UINTN - "Buffer" : POINTER # PTR(VOID) + "This": POINTER, # EFI_SMM_CPU_PROTOCOL + "Width": ULONGLONG, # UINTN + "Register": INT, # EFI_SMM_SAVE_STATE_REGISTER + "CpuIndex": ULONGLONG, # UINTN + "Buffer": POINTER # PTR(VOID) }) def hook_SmmReadSaveState(ql: Qiling, address: int, params): Width = params['Width'] @@ -119,11 +119,11 @@ def hook_SmmReadSaveState(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "This" : POINTER, # EFI_SMM_CPU_PROTOCOL - "Width" : ULONGLONG,# UINTN - "Register" : INT, # EFI_SMM_SAVE_STATE_REGISTER - "CpuIndex" : ULONGLONG,# UINTN - "Buffer" : POINTER # PTR(VOID) + "This": POINTER, # EFI_SMM_CPU_PROTOCOL + "Width": ULONGLONG, # UINTN + "Register": INT, # EFI_SMM_SAVE_STATE_REGISTER + "CpuIndex": ULONGLONG, # UINTN + "Buffer": POINTER # PTR(VOID) }) def hook_SmmWriteSaveState(ql: Qiling, address: int, params): Width = params['Width'] @@ -144,15 +144,15 @@ class EFI_SMM_CPU_PROTOCOL(STRUCT): EFI_SMM_CPU_PROTOCOL = STRUCT _fields_ = [ - ('SmmReadSaveState', FUNCPTR(PTR(EFI_SMM_CPU_PROTOCOL), UINTN, EFI_SMM_SAVE_STATE_REGISTER, UINTN, PTR(VOID))), - ('SmmWriteSaveState', FUNCPTR(PTR(EFI_SMM_CPU_PROTOCOL), UINTN, EFI_SMM_SAVE_STATE_REGISTER, UINTN, PTR(VOID))) + ('SmmReadSaveState', FUNCPTR(PTR(EFI_SMM_CPU_PROTOCOL), UINTN, EFI_SMM_SAVE_STATE_REGISTER, UINTN, PTR(VOID))), + ('SmmWriteSaveState', FUNCPTR(PTR(EFI_SMM_CPU_PROTOCOL), UINTN, EFI_SMM_SAVE_STATE_REGISTER, UINTN, PTR(VOID))) ] descriptor = { "guid" : "eb346b97-975f-4a9f-8b22-f8e92bb3d569", "struct" : EFI_SMM_CPU_PROTOCOL, "fields" : ( - ("SmmReadSaveState", hook_SmmReadSaveState), - ("SmmWriteSaveState", hook_SmmWriteSaveState) + ("SmmReadSaveState", hook_SmmReadSaveState), + ("SmmWriteSaveState", hook_SmmWriteSaveState) ) } diff --git a/qiling/os/uefi/protocols/EfiSmmSwDispatch2Protocol.py b/qiling/os/uefi/protocols/EfiSmmSwDispatch2Protocol.py index 008db407..4596dc16 100644 --- a/qiling/os/uefi/protocols/EfiSmmSwDispatch2Protocol.py +++ b/qiling/os/uefi/protocols/EfiSmmSwDispatch2Protocol.py @@ -16,9 +16,9 @@ class EFI_SMM_SW_CONTEXT(STRUCT): _pack_ = 8 _fields_ = [ - ('SwSmiCpuIndex', UINTN), # index of the cpu which generated the swsmi - ('CommandPort', UINT8), # port number used to trigger the swsmi - ('DataPort', UINT8) # irrelevant + ('SwSmiCpuIndex', UINTN), # index of the cpu which generated the swsmi + ('CommandPort', UINT8), # port number used to trigger the swsmi + ('DataPort', UINT8) # irrelevant ] # @file: MdePkg\Include\Protocol\SmmSwDispatch2.h @@ -35,15 +35,15 @@ class EFI_SMM_SW_DISPATCH2_PROTOCOL(STRUCT): _fields_ = [ ('Register', FUNCPTR(EFI_STATUS, PTR(EFI_SMM_SW_DISPATCH2_PROTOCOL), EFI_SMM_HANDLER_ENTRY_POINT2, PTR(EFI_SMM_SW_REGISTER_CONTEXT), PTR(EFI_HANDLE))), - ('UnRegister', FUNCPTR(EFI_STATUS, PTR(EFI_SMM_SW_DISPATCH2_PROTOCOL), EFI_HANDLE)), - ('MaximumSwiValue', UINTN) + ('UnRegister', FUNCPTR(EFI_STATUS, PTR(EFI_SMM_SW_DISPATCH2_PROTOCOL), EFI_HANDLE)), + ('MaximumSwiValue', UINTN) ] @dxeapi(params = { - "This" : POINTER, # PTR(EFI_SMM_SW_DISPATCH2_PROTOCOL) - "DispatchFunction" : POINTER, # EFI_SMM_HANDLER_ENTRY_POINT2 - "RegisterContext" : POINTER, # PTR(EFI_SMM_SW_REGISTER_CONTEXT) - "DispatchHandle" : POINTER # PTR(EFI_HANDLE) + "This": POINTER, # PTR(EFI_SMM_SW_DISPATCH2_PROTOCOL) + "DispatchFunction": POINTER, # EFI_SMM_HANDLER_ENTRY_POINT2 + "RegisterContext": POINTER, # PTR(EFI_SMM_SW_REGISTER_CONTEXT) + "DispatchHandle": POINTER # PTR(EFI_HANDLE) }) def hook_Register(ql: Qiling, address: int, params): DispatchFunction: int = params['DispatchFunction'] @@ -83,8 +83,8 @@ def hook_Register(ql: Qiling, address: int, params): ql.mem.write_ptr(DispatchHandle, Handle) args = { - 'DispatchHandle' : Handle, - 'RegisterContext' : SwRegisterContext + 'DispatchHandle': Handle, + 'RegisterContext': SwRegisterContext } handlers[idx] = (DispatchFunction, args) @@ -92,8 +92,8 @@ def hook_Register(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "This" : POINTER, - "DispatchHandle" : POINTER + "This": POINTER, + "DispatchHandle": POINTER }) def hook_UnRegister(ql: Qiling, address: int, params): DispatchHandle: int = params['DispatchHandle'] @@ -116,7 +116,7 @@ descriptor = { "struct" : EFI_SMM_SW_DISPATCH2_PROTOCOL, "fields" : ( ("Register", hook_Register), - ("UnRegister", hook_UnRegister), - ('MaximumSwiValue', MAXIMUM_SWI_VALUE) + ("UnRegister", hook_UnRegister), + ('MaximumSwiValue', MAXIMUM_SWI_VALUE) ) } diff --git a/qiling/os/uefi/protocols/PcdProtocol.py b/qiling/os/uefi/protocols/PcdProtocol.py index e1eaafab..f8ef5d6a 100644 --- a/qiling/os/uefi/protocols/PcdProtocol.py +++ b/qiling/os/uefi/protocols/PcdProtocol.py @@ -1,5 +1,5 @@ #!/usr/bin/env python3 -# +# # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # @@ -10,287 +10,287 @@ from ..UefiBaseType import * PCD_PROTOCOL_CALLBACK = FUNCPTR(VOID, PTR(EFI_GUID), UINTN, PTR(VOID), UINTN) -PCD_PROTOCOL_SET_SKU = FUNCPTR(VOID, UINTN) +PCD_PROTOCOL_SET_SKU = FUNCPTR(VOID, UINTN) PCD_PROTOCOL_GET8 = FUNCPTR(UINT8, UINTN) -PCD_PROTOCOL_GET16 = FUNCPTR(UINT16, UINTN) -PCD_PROTOCOL_GET32 = FUNCPTR(UINT32, UINTN) -PCD_PROTOCOL_GET64 = FUNCPTR(UINT64, UINTN) -PCD_PROTOCOL_GET_POINTER = FUNCPTR(PTR(VOID), UINTN) -PCD_PROTOCOL_GET_BOOLEAN = FUNCPTR(BOOLEAN, UINTN) +PCD_PROTOCOL_GET16 = FUNCPTR(UINT16, UINTN) +PCD_PROTOCOL_GET32 = FUNCPTR(UINT32, UINTN) +PCD_PROTOCOL_GET64 = FUNCPTR(UINT64, UINTN) +PCD_PROTOCOL_GET_POINTER = FUNCPTR(PTR(VOID), UINTN) +PCD_PROTOCOL_GET_BOOLEAN = FUNCPTR(BOOLEAN, UINTN) PCD_PROTOCOL_GET_SIZE = FUNCPTR(UINTN, UINTN) PCD_PROTOCOL_GET_EX_8 = FUNCPTR(UINT8, PTR(EFI_GUID), UINTN) -PCD_PROTOCOL_GET_EX_16 = FUNCPTR(UINT16, PTR(EFI_GUID), UINTN) -PCD_PROTOCOL_GET_EX_32 = FUNCPTR(UINT32, PTR(EFI_GUID), UINTN) -PCD_PROTOCOL_GET_EX_64 = FUNCPTR(UINT64, PTR(EFI_GUID), UINTN) -PCD_PROTOCOL_GET_EX_POINTER = FUNCPTR(PTR(VOID), PTR(EFI_GUID), UINTN) -PCD_PROTOCOL_GET_EX_BOOLEAN = FUNCPTR(BOOLEAN, PTR(EFI_GUID), UINTN) -PCD_PROTOCOL_GET_EX_SIZE = FUNCPTR(UINTN, PTR(EFI_GUID), UINTN) +PCD_PROTOCOL_GET_EX_16 = FUNCPTR(UINT16, PTR(EFI_GUID), UINTN) +PCD_PROTOCOL_GET_EX_32 = FUNCPTR(UINT32, PTR(EFI_GUID), UINTN) +PCD_PROTOCOL_GET_EX_64 = FUNCPTR(UINT64, PTR(EFI_GUID), UINTN) +PCD_PROTOCOL_GET_EX_POINTER = FUNCPTR(PTR(VOID), PTR(EFI_GUID), UINTN) +PCD_PROTOCOL_GET_EX_BOOLEAN = FUNCPTR(BOOLEAN, PTR(EFI_GUID), UINTN) +PCD_PROTOCOL_GET_EX_SIZE = FUNCPTR(UINTN, PTR(EFI_GUID), UINTN) PCD_PROTOCOL_SET8 = FUNCPTR(EFI_STATUS, UINTN, UINT8) -PCD_PROTOCOL_SET16 = FUNCPTR(EFI_STATUS, UINTN, UINT16) -PCD_PROTOCOL_SET32 = FUNCPTR(EFI_STATUS, UINTN, UINT32) -PCD_PROTOCOL_SET64 = FUNCPTR(EFI_STATUS, UINTN, UINT64) -PCD_PROTOCOL_SET_POINTER = FUNCPTR(EFI_STATUS, UINTN, PTR(UINTN), PTR(VOID)) -PCD_PROTOCOL_SET_BOOLEAN = FUNCPTR(EFI_STATUS, UINTN, BOOLEAN) +PCD_PROTOCOL_SET16 = FUNCPTR(EFI_STATUS, UINTN, UINT16) +PCD_PROTOCOL_SET32 = FUNCPTR(EFI_STATUS, UINTN, UINT32) +PCD_PROTOCOL_SET64 = FUNCPTR(EFI_STATUS, UINTN, UINT64) +PCD_PROTOCOL_SET_POINTER = FUNCPTR(EFI_STATUS, UINTN, PTR(UINTN), PTR(VOID)) +PCD_PROTOCOL_SET_BOOLEAN = FUNCPTR(EFI_STATUS, UINTN, BOOLEAN) PCD_PROTOCOL_SET_EX_8 = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), UINTN, UINT8) -PCD_PROTOCOL_SET_EX_16 = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), UINTN, UINT16) -PCD_PROTOCOL_SET_EX_32 = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), UINTN, UINT32) -PCD_PROTOCOL_SET_EX_64 = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), UINTN, UINT64) -PCD_PROTOCOL_SET_EX_POINTER = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), UINTN, PTR(UINTN), PTR(VOID)) -PCD_PROTOCOL_SET_EX_BOOLEAN = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), UINTN, BOOLEAN) -PCD_PROTOCOL_CALLBACK_ONSET = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), UINTN, PCD_PROTOCOL_CALLBACK) -PCD_PROTOCOL_CANCEL_CALLBACK= FUNCPTR(EFI_STATUS, PTR(EFI_GUID), UINTN, PCD_PROTOCOL_CALLBACK) -PCD_PROTOCOL_GET_NEXT_TOKEN = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), PTR(UINTN)) +PCD_PROTOCOL_SET_EX_16 = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), UINTN, UINT16) +PCD_PROTOCOL_SET_EX_32 = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), UINTN, UINT32) +PCD_PROTOCOL_SET_EX_64 = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), UINTN, UINT64) +PCD_PROTOCOL_SET_EX_POINTER = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), UINTN, PTR(UINTN), PTR(VOID)) +PCD_PROTOCOL_SET_EX_BOOLEAN = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), UINTN, BOOLEAN) +PCD_PROTOCOL_CALLBACK_ONSET = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), UINTN, PCD_PROTOCOL_CALLBACK) +PCD_PROTOCOL_CANCEL_CALLBACK = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), UINTN, PCD_PROTOCOL_CALLBACK) +PCD_PROTOCOL_GET_NEXT_TOKEN = FUNCPTR(EFI_STATUS, PTR(EFI_GUID), PTR(UINTN)) PCD_PROTOCOL_GET_NEXT_TOKENSPACE = FUNCPTR(EFI_STATUS, PTR(PTR(EFI_GUID))) class PCD_PROTOCOL(STRUCT): _fields_ = [ - ('SetSku', PCD_PROTOCOL_SET_SKU), - ('Get8', PCD_PROTOCOL_GET8), - ('Get16', PCD_PROTOCOL_GET16), - ('Get32', PCD_PROTOCOL_GET32), - ('Get64', PCD_PROTOCOL_GET64), - ('GetPtr', PCD_PROTOCOL_GET_POINTER), - ('GetBool', PCD_PROTOCOL_GET_BOOLEAN), - ('GetSize', PCD_PROTOCOL_GET_SIZE), - ('Get8Ex', PCD_PROTOCOL_GET_EX_8), - ('Get16Ex', PCD_PROTOCOL_GET_EX_16), - ('Get32Ex', PCD_PROTOCOL_GET_EX_32), - ('Get64Ex', PCD_PROTOCOL_GET_EX_64), - ('GetPtrEx', PCD_PROTOCOL_GET_EX_POINTER), - ('GetBoolEx', PCD_PROTOCOL_GET_EX_BOOLEAN), - ('GetSizeEx', PCD_PROTOCOL_GET_EX_SIZE), - ('Set8', PCD_PROTOCOL_SET8), - ('Set16', PCD_PROTOCOL_SET16), - ('Set32', PCD_PROTOCOL_SET32), - ('Set64', PCD_PROTOCOL_SET64), - ('SetPtr', PCD_PROTOCOL_SET_POINTER), - ('SetBool', PCD_PROTOCOL_SET_BOOLEAN), - ('Set8Ex', PCD_PROTOCOL_SET_EX_8), - ('Set16Ex', PCD_PROTOCOL_SET_EX_16), - ('Set32Ex', PCD_PROTOCOL_SET_EX_32), - ('Set64Ex', PCD_PROTOCOL_SET_EX_64), - ('SetPtrEx', PCD_PROTOCOL_SET_EX_POINTER), - ('SetBoolEx', PCD_PROTOCOL_SET_EX_BOOLEAN), - ('CallbackOnSet', PCD_PROTOCOL_CALLBACK_ONSET), - ('CancelCallback', PCD_PROTOCOL_CANCEL_CALLBACK), - ('GetNextToken', PCD_PROTOCOL_GET_NEXT_TOKEN), - ('GetNextTokenSpace', PCD_PROTOCOL_GET_NEXT_TOKENSPACE) + ('SetSku', PCD_PROTOCOL_SET_SKU), + ('Get8', PCD_PROTOCOL_GET8), + ('Get16', PCD_PROTOCOL_GET16), + ('Get32', PCD_PROTOCOL_GET32), + ('Get64', PCD_PROTOCOL_GET64), + ('GetPtr', PCD_PROTOCOL_GET_POINTER), + ('GetBool', PCD_PROTOCOL_GET_BOOLEAN), + ('GetSize', PCD_PROTOCOL_GET_SIZE), + ('Get8Ex', PCD_PROTOCOL_GET_EX_8), + ('Get16Ex', PCD_PROTOCOL_GET_EX_16), + ('Get32Ex', PCD_PROTOCOL_GET_EX_32), + ('Get64Ex', PCD_PROTOCOL_GET_EX_64), + ('GetPtrEx', PCD_PROTOCOL_GET_EX_POINTER), + ('GetBoolEx', PCD_PROTOCOL_GET_EX_BOOLEAN), + ('GetSizeEx', PCD_PROTOCOL_GET_EX_SIZE), + ('Set8', PCD_PROTOCOL_SET8), + ('Set16', PCD_PROTOCOL_SET16), + ('Set32', PCD_PROTOCOL_SET32), + ('Set64', PCD_PROTOCOL_SET64), + ('SetPtr', PCD_PROTOCOL_SET_POINTER), + ('SetBool', PCD_PROTOCOL_SET_BOOLEAN), + ('Set8Ex', PCD_PROTOCOL_SET_EX_8), + ('Set16Ex', PCD_PROTOCOL_SET_EX_16), + ('Set32Ex', PCD_PROTOCOL_SET_EX_32), + ('Set64Ex', PCD_PROTOCOL_SET_EX_64), + ('SetPtrEx', PCD_PROTOCOL_SET_EX_POINTER), + ('SetBoolEx', PCD_PROTOCOL_SET_EX_BOOLEAN), + ('CallbackOnSet', PCD_PROTOCOL_CALLBACK_ONSET), + ('CancelCallback', PCD_PROTOCOL_CANCEL_CALLBACK), + ('GetNextToken', PCD_PROTOCOL_GET_NEXT_TOKEN), + ('GetNextTokenSpace', PCD_PROTOCOL_GET_NEXT_TOKENSPACE) ] @dxeapi(params = { - "SkuId" : UINT + "SkuId": UINT }) def hook_SetSku(ql, address, params): pass @dxeapi(params = { - "TokenNumber" : UINT + "TokenNumber": UINT }) def hook_Get8(ql, address, params): pass @dxeapi(params = { - "TokenNumber" : UINT + "TokenNumber": UINT }) def hook_Get16(ql, address, params): pass @dxeapi(params = { - "TokenNumber" : UINT + "TokenNumber": UINT }) def hook_Get32(ql, address, params): pass @dxeapi(params = { - "TokenNumber" : UINT + "TokenNumber": UINT }) def hook_Get64(ql, address, params): pass @dxeapi(params = { - "TokenNumber" : UINT + "TokenNumber": UINT }) def hook_GetPtr(ql, address, params): pass @dxeapi(params = { - "TokenNumber" : UINT + "TokenNumber": UINT }) def hook_GetBool(ql, address, params): pass @dxeapi(params = { - "TokenNumber" : UINT + "TokenNumber": UINT }) def hook_GetSize(ql, address, params): pass @dxeapi(params = { - "Guid" : GUID, - "TokenNumber" : UINT + "Guid": GUID, + "TokenNumber": UINT }) def hook_Get8Ex(ql, address, params): pass @dxeapi(params = { - "Guid" : GUID, - "TokenNumber" : UINT + "Guid": GUID, + "TokenNumber": UINT }) def hook_Get16Ex(ql, address, params): pass @dxeapi(params = { - "Guid" : GUID, - "TokenNumber" : UINT + "Guid": GUID, + "TokenNumber": UINT }) def hook_Get32Ex(ql, address, params): pass @dxeapi(params = { - "Guid" : GUID, - "TokenNumber" : UINT + "Guid": GUID, + "TokenNumber": UINT }) def hook_Get64Ex(ql, address, params): pass @dxeapi(params = { - "Guid" : GUID, - "TokenNumber" : UINT + "Guid": GUID, + "TokenNumber": UINT }) def hook_GetPtrEx(ql, address, params): pass @dxeapi(params = { - "Guid" : GUID, - "TokenNumber" : UINT + "Guid": GUID, + "TokenNumber": UINT }) def hook_GetBoolEx(ql, address, params): pass @dxeapi(params = { - "Guid" : GUID, - "TokenNumber" : UINT + "Guid": GUID, + "TokenNumber": UINT }) def hook_GetSizeEx(ql, address, params): pass @dxeapi(params = { - "TokenNumber" : UINT, - "Value" : INT + "TokenNumber": UINT, + "Value": INT }) def hook_Set8(ql, address, params): pass @dxeapi(params = { - "TokenNumber" : UINT, - "Value" : INT + "TokenNumber": UINT, + "Value": INT }) def hook_Set16(ql, address, params): pass @dxeapi(params = { - "TokenNumber" : UINT, - "Value" : INT + "TokenNumber": UINT, + "Value": INT }) def hook_Set32(ql, address, params): pass @dxeapi(params = { - "TokenNumber" : UINT, - "Value" : INT + "TokenNumber": UINT, + "Value": INT }) def hook_Set64(ql, address, params): pass @dxeapi(params = { - "TokenNumber" : UINT, - "SizeOfValue" : POINTER, - "Buffer" : POINTER + "TokenNumber": UINT, + "SizeOfValue": POINTER, + "Buffer": POINTER }) def hook_SetPtr(ql, address, params): pass @dxeapi(params = { - "TokenNumber" : UINT, - "Value" : INT + "TokenNumber": UINT, + "Value": INT }) def hook_SetBool(ql, address, params): pass @dxeapi(params = { - "Guid" : GUID, - "TokenNumber" : UINT, - "Value" : INT + "Guid": GUID, + "TokenNumber": UINT, + "Value": INT }) def hook_Set8Ex(ql, address, params): pass @dxeapi(params = { - "Guid" : GUID, - "TokenNumber" : UINT, - "Value" : INT + "Guid": GUID, + "TokenNumber": UINT, + "Value": INT }) def hook_Set16Ex(ql, address, params): pass @dxeapi(params = { - "Guid" : GUID, - "TokenNumber" : UINT, - "Value" : INT + "Guid": GUID, + "TokenNumber": UINT, + "Value": INT }) def hook_Set32Ex(ql, address, params): pass @dxeapi(params = { - "Guid" : GUID, - "TokenNumber" : UINT, - "Value" : INT + "Guid": GUID, + "TokenNumber": UINT, + "Value": INT }) def hook_Set64Ex(ql, address, params): pass @dxeapi(params = { - "Guid" : GUID, - "TokenNumber" : UINT, - "SizeOfValue" : POINTER, - "Buffer" : POINTER + "Guid": GUID, + "TokenNumber": UINT, + "SizeOfValue": POINTER, + "Buffer": POINTER }) def hook_SetPtrEx(ql, address, params): pass @dxeapi(params = { - "Guid" : GUID, - "TokenNumber" : UINT, - "Value" : INT + "Guid": GUID, + "TokenNumber": UINT, + "Value": INT }) def hook_SetBoolEx(ql, address, params): pass @dxeapi(params = { - "Guid" : GUID, - "TokenNumber" : UINT, - "CallBackFunction" : POINTER + "Guid": GUID, + "TokenNumber": UINT, + "CallBackFunction": POINTER }) def hook_CallbackOnSet(ql, address, params): pass @dxeapi(params = { - "Guid" : GUID, - "TokenNumber" : UINT, - "CallBackFunction" : POINTER + "Guid": GUID, + "TokenNumber": UINT, + "CallBackFunction": POINTER }) def hook_CancelCallback(ql, address, params): pass @dxeapi(params = { - "Guid" : GUID, - "TokenNumber" : POINTER + "Guid": GUID, + "TokenNumber": POINTER }) def hook_GetNextToken(ql, address, params): pass @dxeapi(params = { - "Guid" : POINTER + "Guid": POINTER }) def hook_GetNextTokenSpace(ql, address, params): pass @@ -299,36 +299,36 @@ descriptor = { "guid" : "11b34006-d85b-4d0a-a290-d5a571310ef7", "struct" : PCD_PROTOCOL, "fields" : ( - ('SetSku', hook_SetSku), - ('Get8', hook_Get8), - ('Get16', hook_Get16), - ('Get32', hook_Get32), - ('Get64', hook_Get64), - ('GetPtr', hook_GetPtr), - ('GetBool', hook_GetBool), - ('GetSize', hook_GetSize), - ('Get8Ex', hook_Get8Ex), - ('Get16Ex', hook_Get16Ex), - ('Get32Ex', hook_Get32Ex), - ('Get64Ex', hook_Get64Ex), - ('GetPtrEx', hook_GetPtrEx), - ('GetBoolEx', hook_GetBoolEx), - ('GetSizeEx', hook_GetSizeEx), - ('Set8', hook_Set8), - ('Set16', hook_Set16), - ('Set32', hook_Set32), - ('Set64', hook_Set64), - ('SetPtr', hook_SetPtr), - ('SetBool', hook_SetBool), - ('Set8Ex', hook_Set8Ex), - ('Set16Ex', hook_Set16Ex), - ('Set32Ex', hook_Set32Ex), - ('Set64Ex', hook_Set64Ex), - ('SetPtrEx', hook_SetPtrEx), - ('SetBoolEx', hook_SetBoolEx), - ('CallbackOnSet', hook_CallbackOnSet), - ('CancelCallback', hook_CancelCallback), - ('GetNextToken', hook_GetNextToken), - ('GetNextTokenSpace', hook_GetNextTokenSpace) + ('SetSku', hook_SetSku), + ('Get8', hook_Get8), + ('Get16', hook_Get16), + ('Get32', hook_Get32), + ('Get64', hook_Get64), + ('GetPtr', hook_GetPtr), + ('GetBool', hook_GetBool), + ('GetSize', hook_GetSize), + ('Get8Ex', hook_Get8Ex), + ('Get16Ex', hook_Get16Ex), + ('Get32Ex', hook_Get32Ex), + ('Get64Ex', hook_Get64Ex), + ('GetPtrEx', hook_GetPtrEx), + ('GetBoolEx', hook_GetBoolEx), + ('GetSizeEx', hook_GetSizeEx), + ('Set8', hook_Set8), + ('Set16', hook_Set16), + ('Set32', hook_Set32), + ('Set64', hook_Set64), + ('SetPtr', hook_SetPtr), + ('SetBool', hook_SetBool), + ('Set8Ex', hook_Set8Ex), + ('Set16Ex', hook_Set16Ex), + ('Set32Ex', hook_Set32Ex), + ('Set64Ex', hook_Set64Ex), + ('SetPtrEx', hook_SetPtrEx), + ('SetBoolEx', hook_SetBoolEx), + ('CallbackOnSet', hook_CallbackOnSet), + ('CancelCallback', hook_CancelCallback), + ('GetNextToken', hook_GetNextToken), + ('GetNextTokenSpace', hook_GetNextTokenSpace) ) } diff --git a/qiling/os/uefi/rt.py b/qiling/os/uefi/rt.py index a9d7889d..dae97b2b 100644 --- a/qiling/os/uefi/rt.py +++ b/qiling/os/uefi/rt.py @@ -15,8 +15,8 @@ from .UefiBaseType import EFI_TIME from .UefiSpec import * @dxeapi(params={ - "Time" : POINTER, # OUT PTR(EFI_TIME) - "Capabilities" : POINTER # OUT PTR(EFI_TIME_CAPABILITIES) + "Time": POINTER, # OUT PTR(EFI_TIME) + "Capabilities": POINTER # OUT PTR(EFI_TIME_CAPABILITIES) }) def hook_GetTime(ql: Qiling, address: int, params): Time = params['Time'] @@ -45,48 +45,48 @@ def hook_GetTime(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params={ - "Time": POINTER # IN PTR(EFI_TIME) + "Time": POINTER # IN PTR(EFI_TIME) }) def hook_SetTime(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params={ - "Enabled" : POINTER, # OUT PTR(BOOLEAN) - "Pending" : POINTER, # OUT PTR(BOOLEAN) - "Time" : POINTER # OUT PTR(EFI_TIME) + "Enabled": POINTER, # OUT PTR(BOOLEAN) + "Pending": POINTER, # OUT PTR(BOOLEAN) + "Time": POINTER # OUT PTR(EFI_TIME) }) def hook_GetWakeupTime(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params={ - "Enable": BOOL, # BOOLEAN - "Time" : POINTER # PTR(EFI_TIME) + "Enable": BOOL, # BOOLEAN + "Time": POINTER # PTR(EFI_TIME) }) def hook_SetWakeupTime(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params={ - "MemoryMapSize" : UINT, # UINTN - "DescriptorSize" : UINT, # UINTN - "DescriptorVersion" : UINT, # UINT32 - "VirtualMap" : POINTER # PTR(EFI_MEMORY_DESCRIPTOR) + "MemoryMapSize": UINT, # UINTN + "DescriptorSize": UINT, # UINTN + "DescriptorVersion": UINT, # UINT32 + "VirtualMap": POINTER # PTR(EFI_MEMORY_DESCRIPTOR) }) def hook_SetVirtualAddressMap(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params={ - "DebugDisposition" : UINT, # UINTN - "Address" : POINTER # OUT PTR(PTR(VOID)) + "DebugDisposition": UINT, # UINTN + "Address": POINTER # OUT PTR(PTR(VOID)) }) def hook_ConvertPointer(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params={ - "VariableName" : WSTRING, # PTR(CHAR16) - "VendorGuid" : GUID, # PTR(EFI_GUID) - "Attributes" : POINTER, # OUT PTR(UINT32) - "DataSize" : POINTER, # IN OUT PTR(UINTN) - "Data" : POINTER # OUT PTR(VOID) + "VariableName": WSTRING, # PTR(CHAR16) + "VendorGuid": GUID, # PTR(EFI_GUID) + "Attributes": POINTER, # OUT PTR(UINT32) + "DataSize": POINTER, # IN OUT PTR(UINTN) + "Data": POINTER # OUT PTR(VOID) }) def hook_GetVariable(ql: Qiling, address: int, params): name = params['VariableName'] @@ -113,9 +113,9 @@ def hook_GetVariable(ql: Qiling, address: int, params): return EFI_NOT_FOUND @dxeapi(params={ - "VariableNameSize" : POINTER, # IN OUT PTR(UINTN) - "VariableName" : POINTER, # IN OUT PTR(CHAR16) - "VendorGuid" : GUID # IN OUT PTR(EFI_GUID) + "VariableNameSize": POINTER, # IN OUT PTR(UINTN) + "VariableName": POINTER, # IN OUT PTR(CHAR16) + "VendorGuid": GUID # IN OUT PTR(EFI_GUID) }) def hook_GetNextVariableName(ql: Qiling, address: int, params): var_name_size = params["VariableNameSize"] @@ -153,11 +153,11 @@ def hook_GetNextVariableName(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params={ - "VariableName" : WSTRING, # PTR(CHAR16) - "VendorGuid" : GUID, # PTR(EFI_GUID) - "Attributes" : UINT, # UINT32 - "DataSize" : UINT, # UINTN - "Data" : POINTER # PTR(VOID) + "VariableName": WSTRING, # PTR(CHAR16) + "VendorGuid": GUID, # PTR(EFI_GUID) + "Attributes": UINT, # UINT32 + "DataSize": UINT, # UINTN + "Data": POINTER # PTR(VOID) }) def hook_SetVariable(ql: Qiling, address: int, params): ql.env[params['VariableName']] = bytes(ql.mem.read(params['Data'], params['DataSize'])) @@ -176,10 +176,10 @@ def hook_GetNextHighMonotonicCount(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params={ - "ResetType" : INT, # EFI_RESET_TYPE - "ResetStatus" : INT, # EFI_STATUS - "DataSize" : UINT, # UINTN - "ResetData" : POINTER # PTR(VOID) + "ResetType": INT, # EFI_RESET_TYPE + "ResetStatus": INT, # EFI_STATUS + "DataSize": UINT, # UINTN + "ResetData": POINTER # PTR(VOID) }) def hook_ResetSystem(ql: Qiling, address: int, params): ql.emu_stop() @@ -187,27 +187,27 @@ def hook_ResetSystem(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params={ - "CapsuleHeaderArray": POINTER, # PTR(PTR(EFI_CAPSULE_HEADER)) - "CapsuleCount" : UINT, # UINTN - "ScatterGatherList" : ULONGLONG # EFI_PHYSICAL_ADDRESS + "CapsuleHeaderArray": POINTER, # PTR(PTR(EFI_CAPSULE_HEADER)) + "CapsuleCount": UINT, # UINTN + "ScatterGatherList": ULONGLONG # EFI_PHYSICAL_ADDRESS }) def hook_UpdateCapsule(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params={ - "CapsuleHeaderArray": POINTER, # PTR(PTR(EFI_CAPSULE_HEADER)) - "CapsuleCount" : UINT, # UINTN - "MaximumCapsuleSize": POINTER, # OUT PTR(UINT64) - "ResetType" : POINTER # OUT PTR(EFI_RESET_TYPE) + "CapsuleHeaderArray": POINTER, # PTR(PTR(EFI_CAPSULE_HEADER)) + "CapsuleCount": UINT, # UINTN + "MaximumCapsuleSize": POINTER, # OUT PTR(UINT64) + "ResetType": POINTER # OUT PTR(EFI_RESET_TYPE) }) def hook_QueryCapsuleCapabilities(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params={ - "Attributes" : UINT, # UINT32 - "MaximumVariableStorageSize" : POINTER, # OUT PTR(UINT64) - "RemainingVariableStorageSize" : POINTER, # OUT PTR(UINT64) - "MaximumVariableSize" : POINTER # OUT PTR(UINT64) + "Attributes": UINT, # UINT32 + "MaximumVariableStorageSize": POINTER, # OUT PTR(UINT64) + "RemainingVariableStorageSize": POINTER, # OUT PTR(UINT64) + "MaximumVariableSize": POINTER # OUT PTR(UINT64) }) def hook_QueryVariableInfo(ql: Qiling, address: int, params): return EFI_SUCCESS @@ -216,21 +216,21 @@ def initialize(ql: Qiling, gRT: int): descriptor = { 'struct' : EFI_RUNTIME_SERVICES, 'fields' : ( - ('Hdr', None), - ('GetTime', hook_GetTime), - ('SetTime', hook_SetTime), - ('GetWakeupTime', hook_GetWakeupTime), - ('SetWakeupTime', hook_SetWakeupTime), - ('SetVirtualAddressMap', hook_SetVirtualAddressMap), - ('ConvertPointer', hook_ConvertPointer), - ('GetVariable', hook_GetVariable), - ('GetNextVariableName', hook_GetNextVariableName), - ('SetVariable', hook_SetVariable), - ('GetNextHighMonotonicCount', hook_GetNextHighMonotonicCount), - ('ResetSystem', hook_ResetSystem), - ('UpdateCapsule', hook_UpdateCapsule), - ('QueryCapsuleCapabilities', hook_QueryCapsuleCapabilities), - ('QueryVariableInfo', hook_QueryVariableInfo) + ('Hdr', None), + ('GetTime', hook_GetTime), + ('SetTime', hook_SetTime), + ('GetWakeupTime', hook_GetWakeupTime), + ('SetWakeupTime', hook_SetWakeupTime), + ('SetVirtualAddressMap', hook_SetVirtualAddressMap), + ('ConvertPointer', hook_ConvertPointer), + ('GetVariable', hook_GetVariable), + ('GetNextVariableName', hook_GetNextVariableName), + ('SetVariable', hook_SetVariable), + ('GetNextHighMonotonicCount', hook_GetNextHighMonotonicCount), + ('ResetSystem', hook_ResetSystem), + ('UpdateCapsule', hook_UpdateCapsule), + ('QueryCapsuleCapabilities', hook_QueryCapsuleCapabilities), + ('QueryVariableInfo', hook_QueryVariableInfo) ) } diff --git a/qiling/os/uefi/smm.py b/qiling/os/uefi/smm.py index b85a59e8..824148f6 100644 --- a/qiling/os/uefi/smm.py +++ b/qiling/os/uefi/smm.py @@ -18,46 +18,46 @@ class SaveStateArea: # # see: Intel SDM vol. 3 chapter 30.4.1.1 offsets = { - EFI_SMM_SAVE_STATE_REGISTER.GDTBASE : 0x7E8C, - EFI_SMM_SAVE_STATE_REGISTER.IDTBASE : 0x7E94, - EFI_SMM_SAVE_STATE_REGISTER.LDTBASE : 0x7E9C, + EFI_SMM_SAVE_STATE_REGISTER.GDTBASE: 0x7E8C, + EFI_SMM_SAVE_STATE_REGISTER.IDTBASE: 0x7E94, + EFI_SMM_SAVE_STATE_REGISTER.LDTBASE: 0x7E9C, EFI_SMM_SAVE_STATE_REGISTER.GDTLIMIT: 0x7DD0, EFI_SMM_SAVE_STATE_REGISTER.IDTLIMIT: 0x7DD8, EFI_SMM_SAVE_STATE_REGISTER.LDTLIMIT: 0x7DD4, - # EFI_SMM_SAVE_STATE_REGISTER.LDTINFO : ?, + # EFI_SMM_SAVE_STATE_REGISTER.LDTINFO: ?, - EFI_SMM_SAVE_STATE_REGISTER.ES : 0x7FA8, - EFI_SMM_SAVE_STATE_REGISTER.CS : 0x7FAC, - EFI_SMM_SAVE_STATE_REGISTER.SS : 0x7FB0, - EFI_SMM_SAVE_STATE_REGISTER.DS : 0x7FB4, - EFI_SMM_SAVE_STATE_REGISTER.FS : 0x7FB8, - EFI_SMM_SAVE_STATE_REGISTER.GS : 0x7FBC, + EFI_SMM_SAVE_STATE_REGISTER.ES: 0x7FA8, + EFI_SMM_SAVE_STATE_REGISTER.CS: 0x7FAC, + EFI_SMM_SAVE_STATE_REGISTER.SS: 0x7FB0, + EFI_SMM_SAVE_STATE_REGISTER.DS: 0x7FB4, + EFI_SMM_SAVE_STATE_REGISTER.FS: 0x7FB8, + EFI_SMM_SAVE_STATE_REGISTER.GS: 0x7FBC, EFI_SMM_SAVE_STATE_REGISTER.LDTR_SEL: 0x7FC0, - EFI_SMM_SAVE_STATE_REGISTER.TR_SEL : 0x7FC4, - EFI_SMM_SAVE_STATE_REGISTER.DR7 : 0x7FC8, - EFI_SMM_SAVE_STATE_REGISTER.DR6 : 0x7FD0, - EFI_SMM_SAVE_STATE_REGISTER.R8 : 0x7F54, - EFI_SMM_SAVE_STATE_REGISTER.R9 : 0x7F4C, - EFI_SMM_SAVE_STATE_REGISTER.R10 : 0x7F44, - EFI_SMM_SAVE_STATE_REGISTER.R11 : 0x7F3C, - EFI_SMM_SAVE_STATE_REGISTER.R12 : 0x7F34, - EFI_SMM_SAVE_STATE_REGISTER.R13 : 0x7F2C, - EFI_SMM_SAVE_STATE_REGISTER.R14 : 0x7F24, - EFI_SMM_SAVE_STATE_REGISTER.R15 : 0x7F1C, - EFI_SMM_SAVE_STATE_REGISTER.RAX : 0x7F5C, - EFI_SMM_SAVE_STATE_REGISTER.RBX : 0x7F74, - EFI_SMM_SAVE_STATE_REGISTER.RCX : 0x7F64, - EFI_SMM_SAVE_STATE_REGISTER.RDX : 0x7F6C, - EFI_SMM_SAVE_STATE_REGISTER.RSP : 0x7F7C, - EFI_SMM_SAVE_STATE_REGISTER.RBP : 0x7F84, - EFI_SMM_SAVE_STATE_REGISTER.RSI : 0x7F8C, - EFI_SMM_SAVE_STATE_REGISTER.RDI : 0x7F94, - EFI_SMM_SAVE_STATE_REGISTER.RIP : 0x7FD8, + EFI_SMM_SAVE_STATE_REGISTER.TR_SEL: 0x7FC4, + EFI_SMM_SAVE_STATE_REGISTER.DR7: 0x7FC8, + EFI_SMM_SAVE_STATE_REGISTER.DR6: 0x7FD0, + EFI_SMM_SAVE_STATE_REGISTER.R8: 0x7F54, + EFI_SMM_SAVE_STATE_REGISTER.R9: 0x7F4C, + EFI_SMM_SAVE_STATE_REGISTER.R10: 0x7F44, + EFI_SMM_SAVE_STATE_REGISTER.R11: 0x7F3C, + EFI_SMM_SAVE_STATE_REGISTER.R12: 0x7F34, + EFI_SMM_SAVE_STATE_REGISTER.R13: 0x7F2C, + EFI_SMM_SAVE_STATE_REGISTER.R14: 0x7F24, + EFI_SMM_SAVE_STATE_REGISTER.R15: 0x7F1C, + EFI_SMM_SAVE_STATE_REGISTER.RAX: 0x7F5C, + EFI_SMM_SAVE_STATE_REGISTER.RBX: 0x7F74, + EFI_SMM_SAVE_STATE_REGISTER.RCX: 0x7F64, + EFI_SMM_SAVE_STATE_REGISTER.RDX: 0x7F6C, + EFI_SMM_SAVE_STATE_REGISTER.RSP: 0x7F7C, + EFI_SMM_SAVE_STATE_REGISTER.RBP: 0x7F84, + EFI_SMM_SAVE_STATE_REGISTER.RSI: 0x7F8C, + EFI_SMM_SAVE_STATE_REGISTER.RDI: 0x7F94, + EFI_SMM_SAVE_STATE_REGISTER.RIP: 0x7FD8, - EFI_SMM_SAVE_STATE_REGISTER.RFLAGS : 0x7FE8, - EFI_SMM_SAVE_STATE_REGISTER.CR0 : 0x7FF8, - EFI_SMM_SAVE_STATE_REGISTER.CR3 : 0x7FF0, - EFI_SMM_SAVE_STATE_REGISTER.CR4 : 0x7E40 + EFI_SMM_SAVE_STATE_REGISTER.RFLAGS: 0x7FE8, + EFI_SMM_SAVE_STATE_REGISTER.CR0: 0x7FF8, + EFI_SMM_SAVE_STATE_REGISTER.CR3: 0x7FF0, + EFI_SMM_SAVE_STATE_REGISTER.CR4: 0x7E40 } def __init__(self, ql: Qiling): @@ -88,14 +88,14 @@ class SaveStateArea: class SmmEnv: SSA_REG_MAP = { - UC_X86_REG_ES : (4, EFI_SMM_SAVE_STATE_REGISTER.ES), - UC_X86_REG_CS : (4, EFI_SMM_SAVE_STATE_REGISTER.CS), - UC_X86_REG_SS : (4, EFI_SMM_SAVE_STATE_REGISTER.SS), - UC_X86_REG_DS : (4, EFI_SMM_SAVE_STATE_REGISTER.DS), - UC_X86_REG_FS : (4, EFI_SMM_SAVE_STATE_REGISTER.FS), - UC_X86_REG_GS : (4, EFI_SMM_SAVE_STATE_REGISTER.GS), - UC_X86_REG_R8 : (8, EFI_SMM_SAVE_STATE_REGISTER.R8), - UC_X86_REG_R9 : (8, EFI_SMM_SAVE_STATE_REGISTER.R9), + UC_X86_REG_ES : (4, EFI_SMM_SAVE_STATE_REGISTER.ES), + UC_X86_REG_CS : (4, EFI_SMM_SAVE_STATE_REGISTER.CS), + UC_X86_REG_SS : (4, EFI_SMM_SAVE_STATE_REGISTER.SS), + UC_X86_REG_DS : (4, EFI_SMM_SAVE_STATE_REGISTER.DS), + UC_X86_REG_FS : (4, EFI_SMM_SAVE_STATE_REGISTER.FS), + UC_X86_REG_GS : (4, EFI_SMM_SAVE_STATE_REGISTER.GS), + UC_X86_REG_R8 : (8, EFI_SMM_SAVE_STATE_REGISTER.R8), + UC_X86_REG_R9 : (8, EFI_SMM_SAVE_STATE_REGISTER.R9), UC_X86_REG_R10 : (8, EFI_SMM_SAVE_STATE_REGISTER.R10), UC_X86_REG_R11 : (8, EFI_SMM_SAVE_STATE_REGISTER.R11), UC_X86_REG_R12 : (8, EFI_SMM_SAVE_STATE_REGISTER.R12), @@ -213,10 +213,10 @@ class SmmEnv: self.enter() - DispatchHandle = args['DispatchHandle'] - Context = heap.alloc(EFI_SMM_SW_REGISTER_CONTEXT.sizeof()) - CommBuffer = heap.alloc(EFI_SMM_SW_CONTEXT.sizeof()) - CommBufferSize = heap.alloc(ql.arch.pointersize) + DispatchHandle = args['DispatchHandle'] + Context = heap.alloc(EFI_SMM_SW_REGISTER_CONTEXT.sizeof()) + CommBuffer = heap.alloc(EFI_SMM_SW_CONTEXT.sizeof()) + CommBufferSize = heap.alloc(ql.arch.pointersize) # setup Context args['RegisterContext'].saveTo(ql, Context) diff --git a/qiling/os/uefi/smst.py b/qiling/os/uefi/smst.py index 5de88fb9..39018b5e 100644 --- a/qiling/os/uefi/smst.py +++ b/qiling/os/uefi/smst.py @@ -33,14 +33,14 @@ class EFI_MM_IO_ACCESS(STRUCT): EFI_SMM_CPU_IO2_PROTOCOL = STRUCT _fields_ = [ - ('Read', FUNCPTR(EFI_STATUS, PTR(EFI_SMM_CPU_IO2_PROTOCOL), EFI_MM_IO_WIDTH, UINT64, UINTN, PTR(VOID))), - ('Write', FUNCPTR(EFI_STATUS, PTR(EFI_SMM_CPU_IO2_PROTOCOL), EFI_MM_IO_WIDTH, UINT64, UINTN, PTR(VOID))), + ('Read', FUNCPTR(EFI_STATUS, PTR(EFI_SMM_CPU_IO2_PROTOCOL), EFI_MM_IO_WIDTH, UINT64, UINTN, PTR(VOID))), + ('Write', FUNCPTR(EFI_STATUS, PTR(EFI_SMM_CPU_IO2_PROTOCOL), EFI_MM_IO_WIDTH, UINT64, UINTN, PTR(VOID))), ] class EFI_SMM_CPU_IO2_PROTOCOL(STRUCT): _fields_ = [ - ('Mem', EFI_MM_IO_ACCESS), - ('Io', EFI_MM_IO_ACCESS) + ('Mem', EFI_MM_IO_ACCESS), + ('Io', EFI_MM_IO_ACCESS) ] class EFI_SMM_SYSTEM_TABLE2(STRUCT): @@ -48,45 +48,45 @@ class EFI_SMM_SYSTEM_TABLE2(STRUCT): _pack_ = 8 _fields_ = [ - ('Hdr', EFI_TABLE_HEADER), - ('SmmFirmwareVendor', PTR(CHAR16)), - ('SmmFirmwareRevision', UINT32), - ('SmmInstallConfigurationTable', FUNCPTR(EFI_STATUS, PTR(EFI_SMM_SYSTEM_TABLE2), PTR(EFI_GUID), PTR(VOID), UINTN)), - ('SmmIo', EFI_SMM_CPU_IO2_PROTOCOL), - ('SmmAllocatePool', FUNCPTR(EFI_STATUS, EFI_MEMORY_TYPE, UINTN, PTR(PTR(VOID)))), - ('SmmFreePool', FUNCPTR(EFI_STATUS, PTR(VOID))), - ('SmmAllocatePages', FUNCPTR(EFI_STATUS, EFI_ALLOCATE_TYPE, EFI_MEMORY_TYPE, UINTN, PTR(EFI_PHYSICAL_ADDRESS))), - ('SmmFreePages', FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, UINTN)), - ('SmmStartupThisAp', FUNCPTR(EFI_STATUS, FUNCPTR(VOID, PTR(VOID)), UINTN, PTR(VOID))), - ('CurrentlyExecutingCpu', UINTN), - ('NumberOfCpus', UINTN), - ('CpuSaveStateSize', PTR(UINTN)), - ('CpuSaveState', PTR(PTR(VOID))), - ('NumberOfTableEntries', UINTN), - ('SmmConfigurationTable', PTR(EFI_CONFIGURATION_TABLE)), - ('SmmInstallProtocolInterface', FUNCPTR(EFI_STATUS, PTR(EFI_HANDLE), PTR(EFI_GUID), EFI_INTERFACE_TYPE, PTR(VOID))), - ('SmmUninstallProtocolInterface', FUNCPTR(EFI_STATUS, PTR(VOID), PTR(EFI_GUID), PTR(VOID))), - ('SmmHandleProtocol', FUNCPTR(EFI_STATUS, PTR(VOID), PTR(EFI_GUID), PTR(PTR(VOID)))), - ('SmmRegisterProtocolNotify', FUNCPTR(EFI_STATUS, PTR(EFI_GUID), EFI_MM_NOTIFY_FN, PTR(PTR(VOID)))), - ('SmmLocateHandle', FUNCPTR(EFI_STATUS, EFI_LOCATE_SEARCH_TYPE, PTR(EFI_GUID), PTR(VOID), PTR(UINTN), PTR(EFI_HANDLE))), - ('SmmLocateProtocol', FUNCPTR(EFI_STATUS, PTR(EFI_GUID), PTR(VOID), PTR(PTR(VOID)))), - ('SmiManage', FUNCPTR(EFI_STATUS, PTR(EFI_GUID), PTR(VOID), PTR(VOID), PTR(UINTN))), - ('SmiHandlerRegister', FUNCPTR(EFI_STATUS, EFI_MM_HANDLER_ENTRY_POINT, PTR(EFI_GUID), PTR(EFI_HANDLE))), - ('SmiHandlerUnRegister', FUNCPTR(EFI_STATUS, EFI_HANDLE)), + ('Hdr', EFI_TABLE_HEADER), + ('SmmFirmwareVendor', PTR(CHAR16)), + ('SmmFirmwareRevision', UINT32), + ('SmmInstallConfigurationTable', FUNCPTR(EFI_STATUS, PTR(EFI_SMM_SYSTEM_TABLE2), PTR(EFI_GUID), PTR(VOID), UINTN)), + ('SmmIo', EFI_SMM_CPU_IO2_PROTOCOL), + ('SmmAllocatePool', FUNCPTR(EFI_STATUS, EFI_MEMORY_TYPE, UINTN, PTR(PTR(VOID)))), + ('SmmFreePool', FUNCPTR(EFI_STATUS, PTR(VOID))), + ('SmmAllocatePages', FUNCPTR(EFI_STATUS, EFI_ALLOCATE_TYPE, EFI_MEMORY_TYPE, UINTN, PTR(EFI_PHYSICAL_ADDRESS))), + ('SmmFreePages', FUNCPTR(EFI_STATUS, EFI_PHYSICAL_ADDRESS, UINTN)), + ('SmmStartupThisAp', FUNCPTR(EFI_STATUS, FUNCPTR(VOID, PTR(VOID)), UINTN, PTR(VOID))), + ('CurrentlyExecutingCpu', UINTN), + ('NumberOfCpus', UINTN), + ('CpuSaveStateSize', PTR(UINTN)), + ('CpuSaveState', PTR(PTR(VOID))), + ('NumberOfTableEntries', UINTN), + ('SmmConfigurationTable', PTR(EFI_CONFIGURATION_TABLE)), + ('SmmInstallProtocolInterface', FUNCPTR(EFI_STATUS, PTR(EFI_HANDLE), PTR(EFI_GUID), EFI_INTERFACE_TYPE, PTR(VOID))), + ('SmmUninstallProtocolInterface', FUNCPTR(EFI_STATUS, PTR(VOID), PTR(EFI_GUID), PTR(VOID))), + ('SmmHandleProtocol', FUNCPTR(EFI_STATUS, PTR(VOID), PTR(EFI_GUID), PTR(PTR(VOID)))), + ('SmmRegisterProtocolNotify', FUNCPTR(EFI_STATUS, PTR(EFI_GUID), EFI_MM_NOTIFY_FN, PTR(PTR(VOID)))), + ('SmmLocateHandle', FUNCPTR(EFI_STATUS, EFI_LOCATE_SEARCH_TYPE, PTR(EFI_GUID), PTR(VOID), PTR(UINTN), PTR(EFI_HANDLE))), + ('SmmLocateProtocol', FUNCPTR(EFI_STATUS, PTR(EFI_GUID), PTR(VOID), PTR(PTR(VOID)))), + ('SmiManage', FUNCPTR(EFI_STATUS, PTR(EFI_GUID), PTR(VOID), PTR(VOID), PTR(UINTN))), + ('SmiHandlerRegister', FUNCPTR(EFI_STATUS, EFI_MM_HANDLER_ENTRY_POINT, PTR(EFI_GUID), PTR(EFI_HANDLE))), + ('SmiHandlerUnRegister', FUNCPTR(EFI_STATUS, EFI_HANDLE)), ] @dxeapi(params = { - "Guid" : GUID, # PTR(EFI_GUID) - "Table" : POINTER # PTR(VOID) + "Guid": GUID, # PTR(EFI_GUID) + "Table": POINTER # PTR(VOID) }) def hook_SmmInstallConfigurationTable(ql: Qiling, address: int, params): return common.InstallConfigurationTable(ql.loader.smm_context, params) @dxeapi(params = { - "type" : INT, # EFI_ALLOCATE_TYPE - "MemoryType": INT, # EFI_MEMORY_TYPE - "Pages" : ULONGLONG, # UINTN - "Memory" : POINTER # PTR(EFI_PHYSICAL_ADDRESS) + "type": INT, # EFI_ALLOCATE_TYPE + "MemoryType": INT, # EFI_MEMORY_TYPE + "Pages": ULONGLONG, # UINTN + "Memory": POINTER # PTR(EFI_PHYSICAL_ADDRESS) }) def hook_SmmAllocatePages(ql: Qiling, address: int, params): alloc_size = params["Pages"] * PAGE_SIZE @@ -108,8 +108,8 @@ def hook_SmmAllocatePages(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "Memory" : ULONGLONG, # EFI_PHYSICAL_ADDRESS - "Pages" : ULONGLONG # UINTN + "Memory": ULONGLONG, # EFI_PHYSICAL_ADDRESS + "Pages": ULONGLONG # UINTN }) def hook_SmmFreePages(ql: Qiling, address: int, params): address = params["Memory"] @@ -119,9 +119,9 @@ def hook_SmmFreePages(ql: Qiling, address: int, params): return EFI_SUCCESS if ret else EFI_INVALID_PARAMETER @dxeapi(params = { - "PoolType" : INT, # EFI_MEMORY_TYPE - "Size" : INT, # UINTN - "Buffer" : POINTER # PTR(PTR(VOID)) + "PoolType": INT, # EFI_MEMORY_TYPE + "Size": INT, # UINTN + "Buffer": POINTER # PTR(PTR(VOID)) }) def hook_SmmAllocatePool(ql: Qiling, address: int, params): # TODO: allocate memory acording to "PoolType" @@ -131,7 +131,7 @@ def hook_SmmAllocatePool(ql: Qiling, address: int, params): return EFI_SUCCESS if address else EFI_OUT_OF_RESOURCES @dxeapi(params = { - "Buffer": POINTER # PTR(VOID) + "Buffer": POINTER # PTR(VOID) }) def hook_SmmFreePool(ql: Qiling, address: int, params): address = params["Buffer"] @@ -140,50 +140,50 @@ def hook_SmmFreePool(ql: Qiling, address: int, params): return EFI_SUCCESS if ret else EFI_INVALID_PARAMETER @dxeapi(params = { - "Procedure" : POINTER, - "CpuNumber" : INT, - "ProcArguments" : POINTER + "Procedure": POINTER, + "CpuNumber": INT, + "ProcArguments": POINTER }) def hook_SmmStartupThisAp(ql: Qiling, address: int, params): return EFI_INVALID_PARAMETER @dxeapi(params = { - "Handle" : POINTER, # PTR(EFI_HANDLE) - "Protocol" : GUID, # PTR(EFI_GUID) - "InterfaceType" : ULONGLONG, # EFI_INTERFACE_TYPE - "Interface" : POINTER, # PTR(VOID) + "Handle": POINTER, # PTR(EFI_HANDLE) + "Protocol": GUID, # PTR(EFI_GUID) + "InterfaceType": ULONGLONG, # EFI_INTERFACE_TYPE + "Interface": POINTER, # PTR(VOID) }) def hook_SmmInstallProtocolInterface(ql: Qiling, address: int, params): return common.InstallProtocolInterface(ql.loader.smm_context, params) @dxeapi(params = { - "Handle" : POINTER, # EFI_HANDLE - "Protocol" : GUID, # PTR(EFI_GUID) - "Interface" : POINTER # PTR(VOID) + "Handle": POINTER, # EFI_HANDLE + "Protocol": GUID, # PTR(EFI_GUID) + "Interface": POINTER # PTR(VOID) }) def hook_SmmUninstallProtocolInterface(ql: Qiling, address: int, params): return common.UninstallProtocolInterface(ql.loader.smm_context, params) @dxeapi(params = { - "Handle" : POINTER, # EFI_HANDLE - "Protocol" : GUID, # PTR(EFI_GUID) - "Interface" : POINTER # PTR(PTR(VOID)) + "Handle": POINTER, # EFI_HANDLE + "Protocol": GUID, # PTR(EFI_GUID) + "Interface": POINTER # PTR(PTR(VOID)) }) def hook_SmmHandleProtocol(ql: Qiling, address: int, params): return common.HandleProtocol(ql.loader.smm_context, params) @dxeapi(params = { - "Protocol" : GUID, # PTR(EFI_GUID) - "Function" : POINTER, # EFI_MM_NOTIFY_FN - "Registration" : POINTER # PTR(PTR(VOID)) + "Protocol": GUID, # PTR(EFI_GUID) + "Function": POINTER, # EFI_MM_NOTIFY_FN + "Registration": POINTER # PTR(PTR(VOID)) }) def hook_SmmRegisterProtocolNotify(ql: Qiling, address: int, params): event_id = len(ql.loader.events) event_dic = { "NotifyFunction": params["Function"], - "CallbackArgs" : None, - "Guid" : params["Protocol"], - "Set" : False + "CallbackArgs": None, + "Guid": params["Protocol"], + "Set": False } ql.loader.events[event_id] = event_dic @@ -192,35 +192,35 @@ def hook_SmmRegisterProtocolNotify(ql: Qiling, address: int, params): return EFI_SUCCESS @dxeapi(params = { - "SearchType": INT, # EFI_LOCATE_SEARCH_TYPE - "Protocol" : GUID, # PTR(EFI_GUID) - "SearchKey" : POINTER, # PTR(VOID) - "BufferSize": POINTER, # PTR(UINTN) - "Buffer" : POINTER # PTR(EFI_HANDLE) + "SearchType": INT, # EFI_LOCATE_SEARCH_TYPE + "Protocol": GUID, # PTR(EFI_GUID) + "SearchKey": POINTER, # PTR(VOID) + "BufferSize": POINTER, # PTR(UINTN) + "Buffer": POINTER # PTR(EFI_HANDLE) }) def hook_SmmLocateHandle(ql: Qiling, address: int, params): return common.LocateHandle(ql.loader.smm_context, params) @dxeapi(params = { - "Protocol" : GUID, # PTR(EFI_GUID) - "Registration" : POINTER, # PTR(VOID) - "Interface" : POINTER # PTR(PTR(VOID)) + "Protocol": GUID, # PTR(EFI_GUID) + "Registration": POINTER, # PTR(VOID) + "Interface": POINTER # PTR(PTR(VOID)) }) def hook_SmmLocateProtocol(ql: Qiling, address: int, params): return common.LocateProtocol(ql.loader.smm_context, params) @dxeapi(params = { - "HandlerType" : GUID, - "Context" : POINTER, - "CommBuffer" : POINTER, + "HandlerType": GUID, + "Context": POINTER, + "CommBuffer": POINTER, "CommBufferSize": POINTER }) def hook_SmiManage(ql: Qiling, address: int, params): return EFI_NOT_FOUND @dxeapi(params = { - "Handler" : POINTER, - "HandlerType" : GUID, + "Handler": POINTER, + "HandlerType": GUID, "DispatchHandle": POINTER }) def hook_SmiHandlerRegister(ql: Qiling, address: int, params): @@ -243,31 +243,31 @@ def initialize(ql: Qiling, context, gSmst: int): descriptor = { 'struct' : EFI_SMM_SYSTEM_TABLE2, 'fields' : ( - ('Hdr', None), - ('SmmFirmwareVendor', None), - ('SmmFirmwareRevision', None), - ('SmmInstallConfigurationTable', hook_SmmInstallConfigurationTable), - ('SmmIo', None), - ('SmmAllocatePool', hook_SmmAllocatePool), - ('SmmFreePool', hook_SmmFreePool), - ('SmmAllocatePages', hook_SmmAllocatePages), - ('SmmFreePages', hook_SmmFreePages), - ('SmmStartupThisAp', hook_SmmStartupThisAp), - ('CurrentlyExecutingCpu', None), - ('NumberOfCpus', None), - ('CpuSaveStateSize', None), - ('CpuSaveState', None), - ('NumberOfTableEntries', 0), - ('SmmConfigurationTable', cfg), - ('SmmInstallProtocolInterface', hook_SmmInstallProtocolInterface), - ('SmmUninstallProtocolInterface', hook_SmmUninstallProtocolInterface), - ('SmmHandleProtocol', hook_SmmHandleProtocol), - ('SmmRegisterProtocolNotify', hook_SmmRegisterProtocolNotify), - ('SmmLocateHandle', hook_SmmLocateHandle), - ('SmmLocateProtocol', hook_SmmLocateProtocol), - ('SmiManage', hook_SmiManage), - ('SmiHandlerRegister', hook_SmiHandlerRegister), - ('SmiHandlerUnRegister', hook_SmiHandlerUnRegister), + ('Hdr', None), + ('SmmFirmwareVendor', None), + ('SmmFirmwareRevision', None), + ('SmmInstallConfigurationTable', hook_SmmInstallConfigurationTable), + ('SmmIo', None), + ('SmmAllocatePool', hook_SmmAllocatePool), + ('SmmFreePool', hook_SmmFreePool), + ('SmmAllocatePages', hook_SmmAllocatePages), + ('SmmFreePages', hook_SmmFreePages), + ('SmmStartupThisAp', hook_SmmStartupThisAp), + ('CurrentlyExecutingCpu', None), + ('NumberOfCpus', None), + ('CpuSaveStateSize', None), + ('CpuSaveState', None), + ('NumberOfTableEntries', 0), + ('SmmConfigurationTable', cfg), + ('SmmInstallProtocolInterface', hook_SmmInstallProtocolInterface), + ('SmmUninstallProtocolInterface', hook_SmmUninstallProtocolInterface), + ('SmmHandleProtocol', hook_SmmHandleProtocol), + ('SmmRegisterProtocolNotify', hook_SmmRegisterProtocolNotify), + ('SmmLocateHandle', hook_SmmLocateHandle), + ('SmmLocateProtocol', hook_SmmLocateProtocol), + ('SmiManage', hook_SmiManage), + ('SmiHandlerRegister', hook_SmiHandlerRegister), + ('SmiHandlerUnRegister', hook_SmiHandlerUnRegister), ) } diff --git a/qiling/os/uefi/st.py b/qiling/os/uefi/st.py index 5e0199dd..4175100c 100644 --- a/qiling/os/uefi/st.py +++ b/qiling/os/uefi/st.py @@ -1,5 +1,5 @@ #!/usr/bin/env python3 -# +# # Cross Platform and Multi Architecture Advanced Binary Emulation Framework # @@ -19,19 +19,19 @@ from qiling.os.uefi.UefiSpec import EFI_SYSTEM_TABLE, EFI_BOOT_SERVICES, EFI_RUN # | NumberOfTableEntries | # | ConfigurationTable* -> (4) | # +-----------------------------+ -# (1) +-- EFI_RUNTIME_SERVICES -----+ +# (1) +-- EFI_RUNTIME_SERVICES -----+ # | | # | ... | # +-----------------------------+ -# (2) +-- EFI_BOOT_SERVICES --------+ +# (2) +-- EFI_BOOT_SERVICES --------+ # | | # | ... | # +-----------------------------+ -# (3) +-- EFI_DXE_SERVICES ---------+ +# (3) +-- EFI_DXE_SERVICES ---------+ # | | # | ... | # +-----------------------------+ -# (4) +-- EFI_CONFIGURATION_TABLE --+ of HOB_LIST +# (4) +-- EFI_CONFIGURATION_TABLE --+ of HOB_LIST # | VendorGuid | # | VendorTable* -> (5) | # +-----------------------------+ @@ -44,7 +44,7 @@ from qiling.os.uefi.UefiSpec import EFI_SYSTEM_TABLE, EFI_BOOT_SERVICES, EFI_RUN # dynamically allocated (context.conf_table_data_ptr): # -# (5) +-- VOID* --------------------+ +# (5) +-- VOID* --------------------+ # | ... | # +-----------------------------+