Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add validation function for Microsoft signing(supersede #531) #567

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add validation function for Microsoft signing(supersede #531) #567

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f88a010
enable/disable checking for NX-Compatible,4K-Alignment,Section-Wr-Exe
dennis-tseng99 Apr 28, 2023
cfddd7a
Merge branch 'rhboot:main' into post-process-pe
dennis-tseng99 Dec 30, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
46 changes: 45 additions & 1 deletion post-process-pe.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ static int verbosity;
})

static bool set_nx_compat = true;
static bool set_ms_validation = true;

typedef uint8_t UINT8;
typedef uint16_t UINT16;
Expand Down Expand Up @@ -360,6 +361,32 @@ set_dll_characteristics(PE_COFF_LOADER_IMAGE_CONTEXT *ctx)
}
}

static void
ms_validation(PE_COFF_LOADER_IMAGE_CONTEXT *ctx)
{
EFI_IMAGE_SECTION_HEADER *Section;
int i;

debug(INFO, "%14s: %s\n","NX-Compat-Flag",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's with all this "%14s: stuff? Why not just "NX-Compat-Flag: %s\n"? Same with all the cases below it.

EFI_IMAGE_DLLCHARACTERISTICS_NX_COMPAT ==
ctx->PEHdr->Pe32.OptionalHeader.DllCharacteristics ?
"PASS":"FAIL");

debug(INFO, "%14s: %s\n","4K-Alignment",
PAGE_SIZE == ctx->PEHdr->Pe32Plus.OptionalHeader.SectionAlignment ?
"PASS":"FAIL");

Section = ctx->FirstSection;
for (i=0, Section = ctx->FirstSection; i < ctx->NumberOfSections; i++, Section++) {
if ((Section->Characteristics & EFI_IMAGE_SCN_MEM_WRITE) &&
(Section->Characteristics & EFI_IMAGE_SCN_MEM_EXECUTE)) {
debug(INFO, "%14s: %s\n","Section-Wr-Exe", "FAIL");
return;
}
}
debug(INFO, "%14s: %s\n","Section-Wr-Exe", "PASS");
}

static void
fix_timestamp(PE_COFF_LOADER_IMAGE_CONTEXT *ctx)
{
Expand Down Expand Up @@ -449,6 +476,9 @@ handle_one(char *f)

set_dll_characteristics(&ctx);

if (set_ms_validation)
ms_validation(&ctx);

fix_timestamp(&ctx);

fix_checksum(&ctx, map, sz);
Expand Down Expand Up @@ -483,6 +513,8 @@ static void __attribute__((__noreturn__)) usage(int status)
fprintf(out, " -v Be more verbose\n");
fprintf(out, " -N Disable the NX compatibility flag\n");
fprintf(out, " -n Enable the NX compatibility flag\n");
fprintf(out, " -M Disable test for Microsoft's signing requirements\n");
fprintf(out, " -m Enable test for Microsoft's signing requirements\n");
fprintf(out, " -h Print this help text and exit\n");

exit(status);
Expand All @@ -504,6 +536,12 @@ int main(int argc, char **argv)
{.name = "enable-nx-compat",
.val = 'n',
},
{.name = "disable ms-validation",
.val = 'M',
},
{.name = "enable ms-validation",
.val = 'm',
},
{.name = "quiet",
.val = 'q',
},
Expand All @@ -514,7 +552,7 @@ int main(int argc, char **argv)
};
int longindex = -1;

while ((i = getopt_long(argc, argv, "hNnqv", options, &longindex)) != -1) {
while ((i = getopt_long(argc, argv, "hNnMmqv", options, &longindex)) != -1) {
switch (i) {
case 'h':
case '?':
Expand All @@ -526,6 +564,12 @@ int main(int argc, char **argv)
case 'n':
set_nx_compat = true;
break;
case 'M':
set_ms_validation = false;
break;
case 'm':
set_ms_validation = true;
break;
case 'q':
verbosity = MAX(verbosity - 1, MIN_VERBOSITY);
break;
Expand Down