[UEFITool] UEFI firmware image viewer and editor

Discussion in 'MDL Projects and Applications' started by CodeRush, Oct 8, 2013.

  1. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
    During the debugging of strange behavior of using UEFITool with Gigabyte BIOSes, I have found either a bug or a special non-standard region map configuration in all recent Gigabyte BIOS images.
    If you don't familiar with structure of Intel descriptor region, here is an annotated HxD-screenshot of affected part:
    View attachment 25376
    Black - empty vector
    Grey - flash descriptor signature
    Red - upper bytes of BIOS region base
    Orange - upper bytes of BIOS region limit
    Yellow - upper bytes of ME region base
    Green - upper bytes of ME region limit
    Blue - upper bytes of GbE region base
    Dark-blue - upper bytes of GbE region limit
    So, this region map says to us (and to chipset logic too, if flashed to SPI chip as is) that:
    1. GbE region starts at offset 0x1000 and ends at 0x3000 (0x02 + 1) * 0x1000, which is correct.
    2. ME region starts at offset 0x3000 and ends at 0x200000 (0x1FF + 1)* 0x1000, which is correct.
    3. BIOS region starts at offset 0x0000 and ends at 0x800000 (0x7FF + 1)* 0x1000, which is obviously incorrect!
    BIOS regions should start at any offset between 0x200000 (end of ME region) and 0x250000 (begin of first firmware volume in image file) and end at the end of image file at offset 0x800000.
    So, the right values for BIOS base and BIOS limit should be 0x0200 and 0x07FF respectively. This setup will have no unallocated space in SPI chip and no intersections between flash regions.
    The current setup is dangerous by security means (Descriptor, GbE and ME regions are accessible, because they are parts of BIOS region now), it breaks Intel specifications, breaks normal use of FITC utility and simply damn wrong!
    That's why some GB files are having debug-message about intersections in version 0.7.0. I have sent report to Stasio using TweakTown Forum PM, and hope it will be corrected soon.
     
  2. stasio

    stasio MDL Expert

    May 3, 2007
    1,193
    1,144
    60
    Thanks for PM,replied.........:p
     
  3. osmoTR

    osmoTR MDL Novice

    May 3, 2009
    15
    1
    0
    hello

    why don't you release a linux version of uefitool
    but I tried to build and it's only 32 bit buildable can't build for 64bit

    thanks anyway it's great tool
     
  4. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
    I must admit that I was a bit wrong with calculations (my memory needs external storage :)), and correct formula to calculate region offset is (base * 0x1000), and regions size (limit + 1 - base) *0x1000, but it doesn't make that bug any better.
    If you have BIOS region base as 0x0000 and limit as 0x07FF, it makes BIOS region last from 0x00000000 to 0x00800000, which is the whole 8 Mb chip. On 16Mb Z87 BIOSes it's the same.
    So, in simple words, the bug is: BIOS region has size of whole chip.
     
  5. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
    osmoTR, I don't have 64bit Qt on my Linux VM to test 64bit builds, but I think I can do something about it later. 64bit build is not a priority for me now, I will work on it once other important things be implemented. Actually, only basetypes.h must be altered for 64bit builds, I hope.
    Why don't I release Linux version? I don't sure it will work on any particular Linux with such variety of environments there. Compile-it-yourself is also a sort of release. :)
     
  6. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
    Still crashes. :(
    Will do something about that right now, I was ready for it.
     
  7. XpamAmAdEuS

    XpamAmAdEuS MDL Novice

    Oct 24, 2009
    46
    15
    0
  8. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
    XpamAmAdEuS, you are trying to add file in compressed volume inside another volume, which has enough size to fit almost anything. MMTool and PhoenixTool can't grow such volumes, but UEFITool can do it since version 0.7.0, AFAIR.
    Do not bother repacking your CoreDxe module, just add your files to volume as is and see if UEFITool can create output file.
    Insert compressed will be implemented a bit later.
    Edit: have tried that and there will be no place in root volume, if all Ozmosis files are inserted without compressing CORE_DXE first. Will implement "Insert compressed" and "Compress" operations for files ASAP.
     
  9. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
    FredWst, my Maverick insalled in VM becomes unusable after some update (finder keeps crashing after trying to open any folder, safari crashes on every page, etc.), that is why I stopped building OSX versions now. Will try to fix my OSX during this weekend.
    Have you done macdeployqt after compilation? If not, the app will require Qt Framework installed.
     
  10. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
    Edit: link added to first post, thank you.
     
  11. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
    XpamAmAdEuS, I tried tinkering with that BIOS you wrote about, and it has too little space to fit all that Ozmosis related modules, no mater how many files you compress in it. The whole DXE volume is located inside LZMA-compressed section, as you can see yourself buy opening that BIOS file with UEFITool. That is why compressing files in that volume makes not more, but even less free space after recompression.
    The only way to do modification there is to shrink boot volume (last one, 0x100000 in size) to 0x80000 manually, move previous volume for 0x20000 below and grow main volume for that free 0x20000. No tools can do in now, AFAIK, so you have to use hex editor and be extremely careful to not mess things up.
     
  12. krack38

    krack38 MDL Novice

    Aug 26, 2009
    7
    10
    0
    Hi,

    With 0.9.1 no crash after saving modified rom (remove fs and coredxe).
    When i open the saved rom, the structure is ok with uefitool but i see only one volume with mmtool:

    +-----------------------------------------------------------------------------+
    | Firmware Volume : 00 Location : 00180000 Length : 020000 |
    +---+---------------+------------------------------------+--------+------+----+
    |NO | FileName | GUID |Location| Size |Type|
    +---+---------------+------------------------------------+--------+------+----+
    |000| |CEF5B9A3-476D-497F-9FDC-E98143E0422C|00180048|01FFB8|RAW |
    +---+---------------+------------------------------------+--------+------+----+
    | Bytes Free : 000000 ( 0 KB) Bytes Used : 020000 (128 KB) |
    +-----------------------------------------------------------------------------+
    | Total Bytes Free : 000000 ( 0 KB) Total Bytes Used : 400000 (4096 KB) |
    +-----------------------------------------------------------------------------+
     
  13. krack38

    krack38 MDL Novice

    Aug 26, 2009
    7
    10
    0
    I saw this too when i tried with z68xp bios.
    The point is the total Bytes Free at the end of the report.
    I succeeded in removing legacy ROM and network uefi modules.

    Result:

    +-----------------------------------------------------------------------------+
    | Firmware Volume : 01 Location : 001C0000 Length : 190000 |
    +---+---------------+------------------------------------+--------+------+----+
    | Bytes Free : 002790 ( 9 KB) Bytes Used : 18D870 (1590 KB) |
    +-----------------------------------------------------------------------------+

    | Firmware Volume : 02 Location : 00000000 Length : 5B1000 |
    +---+---------------+------------------------------------+--------+------+----+
    | Bytes Free : 189FA0 (1575 KB) Bytes Used : 427060 (4252 KB) |
    +-----------------------------------------------------------------------------+

    +-----------------------------------------------------------------------------+
    | Total Bytes Free : 011150 ( 68 KB) Total Bytes Used : 3EEEB0 (4027 KB) |
    +-----------------------------------------------------------------------------+
     
  14. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
    krack38, don't know what to think. Have you tried using PhoenixTool on that modified file? UEFITool can't make any changes to root volumes, except recalculation of header checksum, that could be done wrong. Will try and report.