Intel metadata command #399

orangecms · 2023-01-17T15:35:07Z

The command prints some metadata for Intel firmware images.

It includes information on cryptographic material, security configation, and whether a known leaked Boot Guard key has been used.
Note that the intent is not to replicate https://github.com/9elements/converged-security-suite but to offer a simple command to print the metadata. Intepretation would be up to other UIs, such as fiedka.app.

I have no idea what makes sense to add. Help wanted.

codecov-commenter · 2023-01-17T16:21:32Z

Codecov Report

Base: 42.20% // Head: 42.20% // No change to project coverage 👍

Coverage data is based on head (0f1122c) compared to base (8a127a6).
Patch coverage: 100.00% of modified lines in pull request are covered.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #399   +/-   ##
=======================================
  Coverage   42.20%   42.20%           
=======================================
  Files         125      125           
  Lines        8978     8978           
=======================================
  Hits         3789     3789           
  Misses       4484     4484           
  Partials      705      705

Impacted Files	Coverage Δ
pkg/intel/metadata/bg/bgkey/manifest.go	`0.00% <ø> (ø)`
pkg/intel/metadata/cbnt/cbntkey/manifest.go	`0.00% <ø> (ø)`
...ntel/metadata/bg/bgkey/manifest_manifestcodegen.go	`52.20% <100.00%> (ø)`
.../metadata/cbnt/cbntkey/manifest_manifestcodegen.go	`66.16% <100.00%> (ø)`

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

xaionaro · 2023-04-17T21:27:59Z

pkg/intel/metadata/common/manifestcodegen/pkg/analyze/scan.go

@@ -43,6 +43,7 @@ func getRawPkg(
 	buildCtx := build.Default
 	buildCtx.GOPATH = strings.Join(goPaths, string(filepath.ListSeparator))
 	buildCtx.BuildTags = append(buildCtx.BuildTags, `manifestcodegen`)
+	fmt.Printf("search for `%v` in `%v` (%v) \n\n", path, goPaths, buildCtx.GOPATH)


Looks like leftover garbage :)

it's from the debug commit - to be dropped once this whole thing is ready, being a draft as of now
I had other stuff to do... but now is an interesting time to get back to BoitGuard things, so here I am back on it again :)

tlaurion · 2024-09-12T21:01:32Z

Leak article containing magnet link to private keys: https://sizeof.cat/post/leak-intel-private-keys-msi-firmware/
Next steps discussion (inviting your opinion/insights for turning this into something good, maybe...): https://matrix.to/#/!HAonmNlisbeoADmnrN:matrix.org/$x9dssPoXOOR8qgLTkAdWL3Y5bhbGB8npf8WHwnYS8Lg?via=matrix.org&via=kit.edu&via=invisiblethingslab.com

CC: @orangecms

tlaurion · 2024-09-12T21:02:04Z

@orangecms : why draft and not merged?

orangecms · 2024-09-12T21:12:01Z

@orangecms : why draft and not merged?

not sure what to reply - it's been a draft... I'd be happy to team up with someone to finish this up. Doing it all alone is quite exhausting.

tlaurion · 2024-09-12T21:15:28Z

@orangecms : why draft and not merged?

not sure what to reply - it's been a draft... I'd be happy to team up with someone to finish this up.
What areas need help? Maybe adding label "help needed" and areas where work is needed (todo) in OP with a minimal description for this PR would help?

If you didn't pointed here from a twitter/X url from somwwhere else, I would never landed here.
Not sure I can help here other then trying to get you helped by those who could help :)

Doing it all alone is quite exhausting.

Keep on, I know how lonely doing a project most alone sometimes feels. Slow and steady.
Otherwise, The goal should be to make other want to help, know where to help, what/where they should help in the goal of receiving help more easily for those that can help, isn't it? :)

tlaurion · 2024-09-12T21:21:54Z

#399 (comment)
_ No description provided. _

That doesn't help receiving needed help, that is for sure, nor the generic title "Intel metadata command" of this PR :)
Please don't burn out. Help will come, hopefully.

tlaurion · 2024-09-12T21:24:40Z

Leak article containing magnet link to private keys: https://sizeof.cat/post/leak-intel-private-keys-msi-firmware/ Next steps discussion (inviting your opinion/insights for turning this into something good, maybe...): https://matrix.to/#/!HAonmNlisbeoADmnrN:matrix.org/$x9dssPoXOOR8qgLTkAdWL3Y5bhbGB8npf8WHwnYS8Lg?via=matrix.org&via=kit.edu&via=invisiblethingslab.com

CC: @orangecms

Let me know your thoughts here or there. Don't forget to tag @tlaurion(github) or insurgo(matrix). I might otherwise miss it.

orangecms · 2024-09-12T21:44:54Z

What should I say?

I'm doing lots of stuff. Doing more and more to attract others hasn't worked out. I want to make computers more comprehensible, and that's about it. I'm not burning out or anything, I just put the priorities on what seems interesting. There is a hundred things I could use lots of help with.

If you really want to help out, let's hop on a multi-hour Jitsi session, work through this, and get it into the main branch. :-)

tlaurion · 2024-09-13T15:24:02Z

@orangecms I restate the PR should have a description and areas where help is needed should be stated to move this PR from draft-> ready for review. Unfortunately this is not my area of expertise and I do not think I have neither the interest/time/needed skills to make this go forward on my own, but doing those little things might get this move forward by others having the interest/time/skills.

orangecms · 2024-09-13T16:16:23Z

@orangecms I restate the PR should have a description and areas where help is needed should be stated to move this PR from draft-> ready for review. Unfortunately this is not my area of expertise and I do not think I have neither the interest/time/needed skills to make this go forward on my own, but doing those little things might get this move forward by others having the interest/time/skills.

Neither do I have time nor any clue. There is no public documentation, and I just put two and two together.
As I said, I put my priorities as I do, and if someone wants to pair up to get this into a good initial state, I'm open for that.
I've added a description reflecting that.

rminnich

This all seems very reasonable, time to make it not a draft?

cmds/intelmeta/main.go

orangecms · 2024-09-16T19:46:42Z

This all seems very reasonable, time to make it not a draft?

yea, let me get back to this over the next days - a similar thing is #351

essentially, Fiano has lots of APIs but not so many CLIs, and those here are simple enough to just parse a ton of stuff; that's how I started with Fiedka before fully integrating everything, since it's easy to just take fixtures and transform them

cmds/bginfo/main.go

rminnich · 2024-09-18T18:57:18Z

cmds/intelmeta/main.go

+	flagJSON = flag.Bool("j", false, "Output as JSON")
+)
+
+func getLeakedKeys() ([10][]byte, error) {


Is there a reason to specify 10 here? not just a slice?

It's just my lack of Go knowledge. This whole thing is just hacked up.

cmds/intelmeta/main.go

rminnich · 2024-09-18T19:00:42Z

pkg/intel/metadata/fit/ent_startup_ac_module_entry.go

@@ -18,11 +18,11 @@ import (
 )

 // EntrySACM represents a FIT entry of type "Startup AC Module Entry" (0x02)
-type EntrySACM struct{ EntryBase }


SACM as a name b/c it matches the many docs. Many you can have a comment to the effect that
SACM
means
Startup Anchor Cove Module

or some such.

I will just revert this change, it isn't necessary. It helped me to change it when I worked on this because I cannot remember all those damn acronyms.

OTOH, we also have EntryDiagnosticACM - so ... I think going with EntryStartupACM is actually sensible and I'll adjust the docs, too. I didn't know that Go strongly couples doc semantics with identifiers.

cmds/bginfo/main.go

cmds/intelmeta/main.go

cmds/km/main.go

Signed-off-by: Daniel Maslowski <[email protected]>

manifest v2.1 Test images: https://www.gigabyte.com/Motherboard/H410M-H-V3-rev-10-12/support#support-dl-bios Key leakage test images: https://www.msi.com/Laptop/Pulse-GL76-12UX/support?sub_product=Pulse-GL76-12UEK https://download.msi.com/bos_exe/nb/E17L3IMS.10D.zip https://download.msi.com/bos_exe/nb/E17L3IMS.10E.zip Signed-off-by: Daniel Maslowski <[email protected]>

Signed-off-by: Daniel Maslowski <[email protected]>

This makes it easier to grasp. Intel docs also spell it out. See: https://www.intel.com/content/dam/develop/external/us/en/documents/firmware-interface-table-bios-specification-r1p2p1.pdf Signed-off-by: Daniel Maslowski <[email protected]>

Signed-off-by: Daniel Maslowski <[email protected]>

The IndexIOAddress variant only applies for version 0. Signed-off-by: Daniel Maslowski <[email protected]>

Signed-off-by: Daniel Maslowski <[email protected]>

orangecms · 2024-09-22T16:33:05Z

Thanks for all the suggestion so far!

I've pushed a handful of fixups. And this whole thing had been left in a state of "I have no idea what all of this is" - really because I had never found the time to look into and make sense of everything. There is a lot of stuff I cannot know due to lack of public docs. That's why I'm still looking for help.

Signed-off-by: Daniel Maslowski <[email protected]>

orangecms · 2024-09-24T23:17:46Z

I think it makes sense to make this here part of the analysis command I drafted in #351.
Just take some flags to say "print metadata", "analyze ME config and key material" etc.

orangecms force-pushed the intel-manifest branch 2 times, most recently from 84629e5 to 0b5bfca Compare January 17, 2023 15:50

xaionaro reviewed Apr 17, 2023

View reviewed changes

orangecms mentioned this pull request May 8, 2023

visualize Intel Boot Guard data, warn on leaked keys fiedka/fiedka#85

Open

orangecms force-pushed the intel-manifest branch 3 times, most recently from 595edd5 to da19e31 Compare May 14, 2023 18:32

rminnich reviewed Sep 16, 2024

View reviewed changes

cmds/intelmeta/main.go Show resolved Hide resolved

rminnich reviewed Sep 18, 2024

View reviewed changes

binjip978 reviewed Sep 21, 2024

View reviewed changes

cmds/bginfo/main.go Outdated Show resolved Hide resolved

cmds/intelmeta/main.go Outdated Show resolved Hide resolved

cmds/intelmeta/main.go Outdated Show resolved Hide resolved

cmds/km/main.go Outdated Show resolved Hide resolved

orangecms added 9 commits September 22, 2024 18:11

WIP: pkg/intel/metadata: debug manifest codegen

65df104

Signed-off-by: Daniel Maslowski <[email protected]>

Draft km and bginfo commands (to be discarded)

f1e8c5d

Signed-off-by: Daniel Maslowski <[email protected]>

intelmeta: get the whole FIT

4897ae6

Signed-off-by: Daniel Maslowski <[email protected]>

intelmeta: pick up TXT policy, print main info on FIT entries

f784df2

Signed-off-by: Daniel Maslowski <[email protected]>

intelmeta: special handling for TXT entry

7be1d57

Signed-off-by: Daniel Maslowski <[email protected]>

intelmeta: pretty-print TXT policy manifest

ec7a37a

Signed-off-by: Daniel Maslowski <[email protected]>

intelmeta: pretty-print TXT policy manifest - fixup

f5f60d6

The IndexIOAddress variant only applies for version 0. Signed-off-by: Daniel Maslowski <[email protected]>

WIP

fea7a79

Signed-off-by: Daniel Maslowski <[email protected]>

orangecms force-pushed the intel-manifest branch from f45267c to fea7a79 Compare September 22, 2024 16:22

orangecms added 3 commits September 22, 2024 18:29

intelmeta fixup

3d398e8

Signed-off-by: Daniel Maslowski <[email protected]>

bginfo fixup

044a9ee

Signed-off-by: Daniel Maslowski <[email protected]>

km fixup

546b561

Signed-off-by: Daniel Maslowski <[email protected]>

orangecms added the help wanted Extra attention is needed label Sep 22, 2024

bginfo fixup

e5012df

Signed-off-by: Daniel Maslowski <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Intel metadata command #399

Intel metadata command #399

orangecms commented Jan 17, 2023 •

edited

Loading

codecov-commenter commented Jan 17, 2023

xaionaro Apr 17, 2023

orangecms May 13, 2023

tlaurion commented Sep 12, 2024 •

edited

Loading

tlaurion commented Sep 12, 2024

orangecms commented Sep 12, 2024

tlaurion commented Sep 12, 2024 •

edited

Loading

tlaurion commented Sep 12, 2024 •

edited

Loading

tlaurion commented Sep 12, 2024 •

edited

Loading

orangecms commented Sep 12, 2024

tlaurion commented Sep 13, 2024 •

edited

Loading

orangecms commented Sep 13, 2024

rminnich left a comment

orangecms commented Sep 16, 2024

rminnich Sep 18, 2024

orangecms Sep 18, 2024

rminnich Sep 18, 2024

orangecms Sep 18, 2024

orangecms Sep 18, 2024

orangecms commented Sep 22, 2024

orangecms commented Sep 24, 2024

Intel metadata command #399

Are you sure you want to change the base?

Intel metadata command #399

Conversation

orangecms commented Jan 17, 2023 • edited Loading

codecov-commenter commented Jan 17, 2023

Codecov Report

xaionaro Apr 17, 2023

Choose a reason for hiding this comment

orangecms May 13, 2023

Choose a reason for hiding this comment

tlaurion commented Sep 12, 2024 • edited Loading

tlaurion commented Sep 12, 2024

orangecms commented Sep 12, 2024

tlaurion commented Sep 12, 2024 • edited Loading

tlaurion commented Sep 12, 2024 • edited Loading

tlaurion commented Sep 12, 2024 • edited Loading

orangecms commented Sep 12, 2024

tlaurion commented Sep 13, 2024 • edited Loading

orangecms commented Sep 13, 2024

rminnich left a comment

Choose a reason for hiding this comment

orangecms commented Sep 16, 2024

rminnich Sep 18, 2024

Choose a reason for hiding this comment

orangecms Sep 18, 2024

Choose a reason for hiding this comment

rminnich Sep 18, 2024

Choose a reason for hiding this comment

orangecms Sep 18, 2024

Choose a reason for hiding this comment

orangecms Sep 18, 2024

Choose a reason for hiding this comment

orangecms commented Sep 22, 2024

orangecms commented Sep 24, 2024

orangecms commented Jan 17, 2023 •

edited

Loading

tlaurion commented Sep 12, 2024 •

edited

Loading

tlaurion commented Sep 12, 2024 •

edited

Loading

tlaurion commented Sep 12, 2024 •

edited

Loading

tlaurion commented Sep 12, 2024 •

edited

Loading

tlaurion commented Sep 13, 2024 •

edited

Loading