From 99cc57bc0eb11ce11dd34fad73ef1a2691ee0b3e Mon Sep 17 00:00:00 2001 From: Vivian Nowka-Keane Date: Thu, 21 Mar 2024 18:14:46 -0700 Subject: [PATCH 1/8] Raw dump only --- .../Application/Windows/AdvLoggerDumpWin.sln | 37 ++++ .../AdvLoggerDumpWin/AdvLoggerDumpWin.vcxproj | 160 +++++++++++++++++ .../Windows/AdvLoggerDumpWin/ReadMe.md | 32 ++++ .../Windows/AdvLoggerDumpWin/main.cpp | 161 ++++++++++++++++++ .../Windows/AdvLoggerDumpWin/main.h | 10 ++ 5 files changed, 400 insertions(+) create mode 100644 AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin.sln create mode 100644 AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/AdvLoggerDumpWin.vcxproj create mode 100644 AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/ReadMe.md create mode 100644 AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp create mode 100644 AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin.sln b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin.sln new file mode 100644 index 0000000000..696b697898 --- /dev/null +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin.sln @@ -0,0 +1,37 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.8.34330.188 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "AdvLoggerDumpWin", "AdvLoggerDumpWin\AdvLoggerDumpWin.vcxproj", "{F983380B-B6C4-44EE-8835-0137E0876321}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|ARM64 = Debug|ARM64 + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|ARM64 = Release|ARM64 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {F983380B-B6C4-44EE-8835-0137E0876321}.Debug|ARM64.ActiveCfg = Debug|ARM64 + {F983380B-B6C4-44EE-8835-0137E0876321}.Debug|ARM64.Build.0 = Debug|ARM64 + {F983380B-B6C4-44EE-8835-0137E0876321}.Debug|x64.ActiveCfg = Debug|x64 + {F983380B-B6C4-44EE-8835-0137E0876321}.Debug|x64.Build.0 = Debug|x64 + {F983380B-B6C4-44EE-8835-0137E0876321}.Debug|x86.ActiveCfg = Debug|Win32 + {F983380B-B6C4-44EE-8835-0137E0876321}.Debug|x86.Build.0 = Debug|Win32 + {F983380B-B6C4-44EE-8835-0137E0876321}.Release|ARM64.ActiveCfg = Release|ARM64 + {F983380B-B6C4-44EE-8835-0137E0876321}.Release|ARM64.Build.0 = Release|ARM64 + {F983380B-B6C4-44EE-8835-0137E0876321}.Release|x64.ActiveCfg = Release|x64 + {F983380B-B6C4-44EE-8835-0137E0876321}.Release|x64.Build.0 = Release|x64 + {F983380B-B6C4-44EE-8835-0137E0876321}.Release|x86.ActiveCfg = Release|Win32 + {F983380B-B6C4-44EE-8835-0137E0876321}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {514003CD-1327-488E-9C4E-8761C728A1E3} + EndGlobalSection +EndGlobal diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/AdvLoggerDumpWin.vcxproj b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/AdvLoggerDumpWin.vcxproj new file mode 100644 index 0000000000..6faf8b2766 --- /dev/null +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/AdvLoggerDumpWin.vcxproj @@ -0,0 +1,160 @@ + + + + + true + true + true + true + 15.0 + {f983380b-b6c4-44ee-8835-0137e0876321} + Win32Proj + AdvLoggerDumpWin + 10.0 + 10.0.17134.0 + + + + + Debug + ARM64 + + + Debug + Win32 + + + Release + ARM64 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + Application + v143 + v142 + v141 + v140 + Unicode + + + true + true + + + false + true + true + + + Static + + + Static + + + Static + + + + + + + + + + + + + + + + NotUsing + + + + + _CONSOLE;WIN32_LEAN_AND_MEAN;WINRT_LEAN_AND_MEAN;%(PreprocessorDefinitions) + Level4 + %(AdditionalOptions) /permissive- /bigobj + + + + + Disabled + _DEBUG;%(PreprocessorDefinitions) + ProgramDatabase + MultiThreadedDebugDLL + false + ProgramDatabase + false + + + Console + false + RequireAdministrator + RequireAdministrator + true + + + + + WIN32;%(PreprocessorDefinitions) + + + + + MaxSpeed + true + true + NDEBUG;%(PreprocessorDefinitions) + MultiThreaded + MultiThreaded + Default + false + + + Console + false + + + false + + + RequireAdministrator + + + + + + + + + + + + + + + + + + + + This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. + + + + + \ No newline at end of file diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/ReadMe.md b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/ReadMe.md new file mode 100644 index 0000000000..ab916944ab --- /dev/null +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/ReadMe.md @@ -0,0 +1,32 @@ +# AdvLoggerPkg - AdvLoggerDumpWin +AdvLoggerDumpWin is used to retrieve the advanced UEFI debug log stored in system memory. + +## About +If the Advanced Logger is enabled, the debug log is stored in memory and is available through the UEFI +Variable store. +This tool creates a Windows executable that writes the UEFI variable data to a binary log file. As the +log in memory has additional metadata and alignment structure, DecodeUefiLog.py (in AdvLoggerPkg) +parses the in-memory UefiLog to a text stream and writes the decoded log to a local file. The Python +script can be used to both retrieve the log and decode it. +AdvLoggerDumpWin is able to be used in systems without Python. + +## Usage: +With administrator privileges, run the executable. +In an administrator command prompt: +``` +AdvLoggerDumpWin.exe +``` +The program creates a new log file `new_logfile.bin` in the current directory. + + +## Building +To build the project, open the solution file in Visual Studio. +Ensure you have the necessary dependencies. + * Microsoft.Windows.CppWinRT package + * Windows SDK + * VS build tools + + +## Copyright +Copyright (C) Microsoft Corporation. All rights reserved. +SPDX-License-Identifier: BSD-2-Clause-Patent \ No newline at end of file diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp new file mode 100644 index 0000000000..d743400a03 --- /dev/null +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp @@ -0,0 +1,161 @@ +#include "main.h" +#include +#include +#include +#include +#include +#include + +using namespace winrt; +using namespace Windows::Foundation; +using namespace std; + +// +// Elevate current process system environment privileges to access UEFI variables +// +static int ElevateCurrentPrivileges() +{ + HANDLE ProcessHandle = GetCurrentProcess(); + DWORD DesiredAccess = TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY;; + HANDLE hProcessToken; + TOKEN_PRIVILEGES tp; + LUID luid; + int Status = 0; + + if (!LookupPrivilegeValue(NULL, L"SeSystemEnvironmentPrivilege", &luid)) { + Status = GetLastError(); + cout << "Failed to lookup privilege value. Errno " << Status << endl; + return Status; + } + + if (!OpenProcessToken(ProcessHandle, DesiredAccess, &hProcessToken)) { + Status = GetLastError(); + cout << "Failed to open process token. Errno " << Status << endl; + return Status; + } + + tp.PrivilegeCount = 1; + tp.Privileges[0].Luid = luid; + tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; + + if (!AdjustTokenPrivileges(hProcessToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL)) { + Status = GetLastError(); + cout << "Failed to adjust token privileges. Errno " << Status << endl; + return Status; + } + + if (GetLastError() == ERROR_NOT_ALL_ASSIGNED) { + Status = (int)ERROR_NOT_ALL_ASSIGNED; + cout << "The token does not have the specified privilege. Errno " << Status << endl; + return Status; + } + + CloseHandle(ProcessHandle); + return SUCCESS; +} + +// +// Create log file by retrieving AdvancedLogger variables from UEFI interface +// +int ReadLogFromUefiInterface(fstream& lfile) +{ + int Status = 0; + int i = 0; + DWORD length = 0; + DWORD err = 0; + + stringstream varName; + char* varBuffer = (char *) malloc(MAX_VAR_LENGTH + 1); + + // string to LPCWSTR conversion + string tmpGuid = "{a021bf2b-34ed-4a98-859c-420ef94f3e94}"; + wstring tmpGuidW = wstring(tmpGuid.begin(), tmpGuid.end()); + LPCWSTR guid = tmpGuidW.c_str(); + + // + // Parse variables by index until reached end of log + // + while (Status == 0) { + string tmpVarName = "V" + to_string(i); + wstring tmpVarNameW = wstring(tmpVarName.begin(), tmpVarName.end()); + LPCWSTR varNameConst = tmpVarNameW.c_str(); + + // Retrieve one advanced logger indexed variable via kernel32 API + length = GetFirmwareEnvironmentVariableW(varNameConst, guid, varBuffer, MAX_VAR_LENGTH); + + if (length == 0) { + err = GetLastError(); + + // If error is ERROR_NOT_FOUND (203), reached end of variables + if (err != 203) { + Status = EFI_ERROR; + cout << "Error reading variable " << tmpVarName << " errno: " << err << endl; + return Status; + } + else { + Status = (int)err; + } + } + + if (Status == 0) { + i += 1; + streamsize varSize = (streamsize)length; + lfile.write(varBuffer, varSize); + if (lfile.fail()) { + cout << "Failed to write to file\n"; + Status = CONS_ERROR; + return Status; + } + } + else if (i == 0) { + cout << "No variables found.\n"; + return Status; + } + else { + cout << i << " variables read. " << lfile.tellg() << " chars written.\n"; + } + + if (varBuffer) { + ZeroMemory(varBuffer, MAX_VAR_LENGTH); + } + } + + free(varBuffer); + return SUCCESS; +} + +int main() +{ + fstream logfile; + const char* newRawFilename = ".\\new_logfile.bin"; + int Status = 0; + + Status = ElevateCurrentPrivileges(); + if (Status !=0) { + cout << "Failed to elevate privileges, errno:" << Status << endl; + return Status; + } + + // Create new binary logfile + logfile.open(newRawFilename, ios::out | ios::binary); + if (!logfile) { + cout << "Error opening file.\n"; + Status = FILE_ERROR; + return Status; + } + + Status = ReadLogFromUefiInterface(logfile); + if (Status != SUCCESS) { + cerr << "Error reading log, exiting.\n"; + return LOG_ERROR; + } + + logfile.close(); + if (logfile.fail()) { + cout << "Error closing file.\n"; + return FILE_ERROR; + } + + return SUCCESS; +} + \ No newline at end of file diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h new file mode 100644 index 0000000000..7d3ad496d5 --- /dev/null +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h @@ -0,0 +1,10 @@ +#pragma once +#include +#include + +#define EFI_ERROR 1 +#define CONS_ERROR 2 +#define FILE_ERROR 3 +#define LOG_ERROR 4 +#define SUCCESS 0 +#define MAX_VAR_LENGTH 1024*1024 \ No newline at end of file From 261e032a0617dbee793c06ede64d6fad14f5c314 Mon Sep 17 00:00:00 2001 From: Vivian Nowka-Keane Date: Wed, 27 Mar 2024 13:37:06 -0700 Subject: [PATCH 2/8] add project configs, fix arm64 release --- .../AdvLoggerDumpWin/AdvLoggerDumpWin.vcxproj | 4 +++- .../Windows/AdvLoggerDumpWin/PropertySheet.props | 16 ++++++++++++++++ .../Windows/AdvLoggerDumpWin/packages.config | 4 ++++ 3 files changed, 23 insertions(+), 1 deletion(-) create mode 100644 AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/PropertySheet.props create mode 100644 AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/packages.config diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/AdvLoggerDumpWin.vcxproj b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/AdvLoggerDumpWin.vcxproj index 6faf8b2766..e532be215a 100644 --- a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/AdvLoggerDumpWin.vcxproj +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/AdvLoggerDumpWin.vcxproj @@ -10,7 +10,7 @@ {f983380b-b6c4-44ee-8835-0137e0876321} Win32Proj AdvLoggerDumpWin - 10.0 + 10.0.22621.0 10.0.17134.0 @@ -133,6 +133,8 @@ RequireAdministrator + RequireAdministrator + diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/PropertySheet.props b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/PropertySheet.props new file mode 100644 index 0000000000..b0c622690f --- /dev/null +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/PropertySheet.props @@ -0,0 +1,16 @@ + + + + + + + + \ No newline at end of file diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/packages.config b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/packages.config new file mode 100644 index 0000000000..0d39ebe771 --- /dev/null +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/packages.config @@ -0,0 +1,4 @@ + + + + \ No newline at end of file From 6c2e0d520b60f028e9a1d3e5eb8ea1449a3bb895 Mon Sep 17 00:00:00 2001 From: Vivian Nowka-Keane Date: Wed, 27 Mar 2024 13:50:22 -0700 Subject: [PATCH 3/8] update readme --- .../Windows/AdvLoggerDumpWin/ReadMe.md | 27 ++++++++++++------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/ReadMe.md b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/ReadMe.md index ab916944ab..64c819bf1f 100644 --- a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/ReadMe.md +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/ReadMe.md @@ -10,6 +10,24 @@ parses the in-memory UefiLog to a text stream and writes the decoded log to a lo script can be used to both retrieve the log and decode it. AdvLoggerDumpWin is able to be used in systems without Python. +## Building +To build the project, install Visual Studio 2022 with the following workloads: +* Desktop development with C++ +* Universal Windows Platform development + +For individual components, ensure the following are installed (may be included with the above workloads): +* Windows 11 SDK +* NugGet package manager +* MSVC v143 - VS 2022 C++ (Your Architecture) build tools +* C++ ATL fot latest v143 build tools (Your Architecture) +* C++ MFC for latest v143 build tools (Your Architecture) + +In Visual Studio, open the project solution file AdvLoggerPkg\Application\Windows\AdvLoggerDumpWin.sln +The packages.config should tell NuGet to install the Microsoft.Windows.CppWinRT package. If not, add nuget.org +as a package source and install the package. + +Build the solution in Release mode. The executable will be in the Release folder for the given architecture. + ## Usage: With administrator privileges, run the executable. In an administrator command prompt: @@ -18,15 +36,6 @@ AdvLoggerDumpWin.exe ``` The program creates a new log file `new_logfile.bin` in the current directory. - -## Building -To build the project, open the solution file in Visual Studio. -Ensure you have the necessary dependencies. - * Microsoft.Windows.CppWinRT package - * Windows SDK - * VS build tools - - ## Copyright Copyright (C) Microsoft Corporation. All rights reserved. SPDX-License-Identifier: BSD-2-Clause-Patent \ No newline at end of file From 727ecf381d38ae422e9eb1ad24f6ca90840a721e Mon Sep 17 00:00:00 2001 From: Vivian Nowka-Keane Date: Wed, 27 Mar 2024 14:13:37 -0700 Subject: [PATCH 4/8] uncrustify --- .../Windows/AdvLoggerDumpWin/main.cpp | 265 +++++++++--------- .../Windows/AdvLoggerDumpWin/main.h | 12 +- 2 files changed, 140 insertions(+), 137 deletions(-) diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp index d743400a03..66df3e2dff 100644 --- a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp @@ -13,149 +13,152 @@ using namespace std; // // Elevate current process system environment privileges to access UEFI variables // -static int ElevateCurrentPrivileges() +static int +ElevateCurrentPrivileges ( + ) { - HANDLE ProcessHandle = GetCurrentProcess(); - DWORD DesiredAccess = TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY;; - HANDLE hProcessToken; - TOKEN_PRIVILEGES tp; - LUID luid; - int Status = 0; - - if (!LookupPrivilegeValue(NULL, L"SeSystemEnvironmentPrivilege", &luid)) { - Status = GetLastError(); - cout << "Failed to lookup privilege value. Errno " << Status << endl; - return Status; - } - - if (!OpenProcessToken(ProcessHandle, DesiredAccess, &hProcessToken)) { - Status = GetLastError(); - cout << "Failed to open process token. Errno " << Status << endl; - return Status; - } - - tp.PrivilegeCount = 1; - tp.Privileges[0].Luid = luid; - tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; - - if (!AdjustTokenPrivileges(hProcessToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL)) { - Status = GetLastError(); - cout << "Failed to adjust token privileges. Errno " << Status << endl; - return Status; - } - - if (GetLastError() == ERROR_NOT_ALL_ASSIGNED) { - Status = (int)ERROR_NOT_ALL_ASSIGNED; - cout << "The token does not have the specified privilege. Errno " << Status << endl; - return Status; - } - - CloseHandle(ProcessHandle); - return SUCCESS; + HANDLE ProcessHandle = GetCurrentProcess (); + DWORD DesiredAccess = TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY; + HANDLE hProcessToken; + TOKEN_PRIVILEGES tp; + LUID luid; + int Status = 0; + + if (!LookupPrivilegeValue (NULL, L"SeSystemEnvironmentPrivilege", &luid)) { + Status = GetLastError (); + cout << "Failed to lookup privilege value. Errno " << Status << endl; + return Status; + } + + if (!OpenProcessToken (ProcessHandle, DesiredAccess, &hProcessToken)) { + Status = GetLastError (); + cout << "Failed to open process token. Errno " << Status << endl; + return Status; + } + + tp.PrivilegeCount = 1; + tp.Privileges[0].Luid = luid; + tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; + + if (!AdjustTokenPrivileges (hProcessToken, FALSE, &tp, sizeof (TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL)) { + Status = GetLastError (); + cout << "Failed to adjust token privileges. Errno " << Status << endl; + return Status; + } + + if (GetLastError () == ERROR_NOT_ALL_ASSIGNED) { + Status = (int)ERROR_NOT_ALL_ASSIGNED; + cout << "The token does not have the specified privilege. Errno " << Status << endl; + return Status; + } + + CloseHandle (ProcessHandle); + return SUCCESS; } // // Create log file by retrieving AdvancedLogger variables from UEFI interface // -int ReadLogFromUefiInterface(fstream& lfile) +int +ReadLogFromUefiInterface ( + fstream &lfile + ) { - int Status = 0; - int i = 0; - DWORD length = 0; - DWORD err = 0; - - stringstream varName; - char* varBuffer = (char *) malloc(MAX_VAR_LENGTH + 1); - - // string to LPCWSTR conversion - string tmpGuid = "{a021bf2b-34ed-4a98-859c-420ef94f3e94}"; - wstring tmpGuidW = wstring(tmpGuid.begin(), tmpGuid.end()); - LPCWSTR guid = tmpGuidW.c_str(); - - // - // Parse variables by index until reached end of log - // - while (Status == 0) { - string tmpVarName = "V" + to_string(i); - wstring tmpVarNameW = wstring(tmpVarName.begin(), tmpVarName.end()); - LPCWSTR varNameConst = tmpVarNameW.c_str(); - - // Retrieve one advanced logger indexed variable via kernel32 API - length = GetFirmwareEnvironmentVariableW(varNameConst, guid, varBuffer, MAX_VAR_LENGTH); - - if (length == 0) { - err = GetLastError(); - - // If error is ERROR_NOT_FOUND (203), reached end of variables - if (err != 203) { - Status = EFI_ERROR; - cout << "Error reading variable " << tmpVarName << " errno: " << err << endl; - return Status; - } - else { - Status = (int)err; - } - } - - if (Status == 0) { - i += 1; - streamsize varSize = (streamsize)length; - lfile.write(varBuffer, varSize); - if (lfile.fail()) { - cout << "Failed to write to file\n"; - Status = CONS_ERROR; - return Status; - } - } - else if (i == 0) { - cout << "No variables found.\n"; - return Status; - } - else { - cout << i << " variables read. " << lfile.tellg() << " chars written.\n"; - } - - if (varBuffer) { - ZeroMemory(varBuffer, MAX_VAR_LENGTH); - } + int Status = 0; + int i = 0; + DWORD length = 0; + DWORD err = 0; + + stringstream varName; + char *varBuffer = (char *)malloc (MAX_VAR_LENGTH + 1); + + // string to LPCWSTR conversion + string tmpGuid = "{a021bf2b-34ed-4a98-859c-420ef94f3e94}"; + wstring tmpGuidW = wstring (tmpGuid.begin (), tmpGuid.end ()); + LPCWSTR guid = tmpGuidW.c_str (); + + // + // Parse variables by index until reached end of log + // + while (Status == 0) { + string tmpVarName = "V" + to_string (i); + wstring tmpVarNameW = wstring (tmpVarName.begin (), tmpVarName.end ()); + LPCWSTR varNameConst = tmpVarNameW.c_str (); + + // Retrieve one advanced logger indexed variable via kernel32 API + length = GetFirmwareEnvironmentVariableW (varNameConst, guid, varBuffer, MAX_VAR_LENGTH); + + if (length == 0) { + err = GetLastError (); + + // If error is ERROR_NOT_FOUND (203), reached end of variables + if (err != 203) { + Status = EFI_ERROR; + cout << "Error reading variable " << tmpVarName << " errno: " << err << endl; + return Status; + } else { + Status = (int)err; + } } - - free(varBuffer); - return SUCCESS; -} -int main() -{ - fstream logfile; - const char* newRawFilename = ".\\new_logfile.bin"; - int Status = 0; - - Status = ElevateCurrentPrivileges(); - if (Status !=0) { - cout << "Failed to elevate privileges, errno:" << Status << endl; - return Status; - } - - // Create new binary logfile - logfile.open(newRawFilename, ios::out | ios::binary); - if (!logfile) { - cout << "Error opening file.\n"; - Status = FILE_ERROR; + if (Status == 0) { + i += 1; + streamsize varSize = (streamsize)length; + lfile.write (varBuffer, varSize); + if (lfile.fail ()) { + cout << "Failed to write to file\n"; + Status = CONS_ERROR; return Status; + } + } else if (i == 0) { + cout << "No variables found.\n"; + return Status; + } else { + cout << i << " variables read. " << lfile.tellg () << " chars written.\n"; } - Status = ReadLogFromUefiInterface(logfile); - if (Status != SUCCESS) { - cerr << "Error reading log, exiting.\n"; - return LOG_ERROR; - } - - logfile.close(); - if (logfile.fail()) { - cout << "Error closing file.\n"; - return FILE_ERROR; + if (varBuffer) { + ZeroMemory (varBuffer, MAX_VAR_LENGTH); } + } - return SUCCESS; + free (varBuffer); + return SUCCESS; +} + +int +main ( + ) +{ + fstream logfile; + const char *newRawFilename = ".\\new_logfile.bin"; + int Status = 0; + + Status = ElevateCurrentPrivileges (); + if (Status != 0) { + cout << "Failed to elevate privileges, errno:" << Status << endl; + return Status; + } + + // Create new binary logfile + logfile.open (newRawFilename, ios::out | ios::binary); + if (!logfile) { + cout << "Error opening file.\n"; + Status = FILE_ERROR; + return Status; + } + + Status = ReadLogFromUefiInterface (logfile); + if (Status != SUCCESS) { + cerr << "Error reading log, exiting.\n"; + return LOG_ERROR; + } + + logfile.close (); + if (logfile.fail ()) { + cout << "Error closing file.\n"; + return FILE_ERROR; + } + + return SUCCESS; } - \ No newline at end of file diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h index 7d3ad496d5..d1ecd925dd 100644 --- a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h @@ -2,9 +2,9 @@ #include #include -#define EFI_ERROR 1 -#define CONS_ERROR 2 -#define FILE_ERROR 3 -#define LOG_ERROR 4 -#define SUCCESS 0 -#define MAX_VAR_LENGTH 1024*1024 \ No newline at end of file +#define EFI_ERROR 1 +#define CONS_ERROR 2 +#define FILE_ERROR 3 +#define LOG_ERROR 4 +#define SUCCESS 0 +#define MAX_VAR_LENGTH 1024*1024 From 67964b469fc423a80303e30d35285ea16c310247 Mon Sep 17 00:00:00 2001 From: Vivian Nowka-Keane Date: Wed, 27 Mar 2024 14:40:01 -0700 Subject: [PATCH 5/8] line endings --- .../AdvLoggerDumpWin/PropertySheet.props | 30 +- .../Windows/AdvLoggerDumpWin/main.cpp | 328 +++++++++--------- 2 files changed, 179 insertions(+), 179 deletions(-) diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/PropertySheet.props b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/PropertySheet.props index b0c622690f..255feff4a3 100644 --- a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/PropertySheet.props +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/PropertySheet.props @@ -1,16 +1,16 @@ - - - - - - - + + + + + + + \ No newline at end of file diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp index 66df3e2dff..6830d1ffae 100644 --- a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp @@ -1,164 +1,164 @@ -#include "main.h" -#include -#include -#include -#include -#include -#include - -using namespace winrt; -using namespace Windows::Foundation; -using namespace std; - -// -// Elevate current process system environment privileges to access UEFI variables -// -static int -ElevateCurrentPrivileges ( - ) -{ - HANDLE ProcessHandle = GetCurrentProcess (); - DWORD DesiredAccess = TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY; - HANDLE hProcessToken; - TOKEN_PRIVILEGES tp; - LUID luid; - int Status = 0; - - if (!LookupPrivilegeValue (NULL, L"SeSystemEnvironmentPrivilege", &luid)) { - Status = GetLastError (); - cout << "Failed to lookup privilege value. Errno " << Status << endl; - return Status; - } - - if (!OpenProcessToken (ProcessHandle, DesiredAccess, &hProcessToken)) { - Status = GetLastError (); - cout << "Failed to open process token. Errno " << Status << endl; - return Status; - } - - tp.PrivilegeCount = 1; - tp.Privileges[0].Luid = luid; - tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; - - if (!AdjustTokenPrivileges (hProcessToken, FALSE, &tp, sizeof (TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL)) { - Status = GetLastError (); - cout << "Failed to adjust token privileges. Errno " << Status << endl; - return Status; - } - - if (GetLastError () == ERROR_NOT_ALL_ASSIGNED) { - Status = (int)ERROR_NOT_ALL_ASSIGNED; - cout << "The token does not have the specified privilege. Errno " << Status << endl; - return Status; - } - - CloseHandle (ProcessHandle); - return SUCCESS; -} - -// -// Create log file by retrieving AdvancedLogger variables from UEFI interface -// -int -ReadLogFromUefiInterface ( - fstream &lfile - ) -{ - int Status = 0; - int i = 0; - DWORD length = 0; - DWORD err = 0; - - stringstream varName; - char *varBuffer = (char *)malloc (MAX_VAR_LENGTH + 1); - - // string to LPCWSTR conversion - string tmpGuid = "{a021bf2b-34ed-4a98-859c-420ef94f3e94}"; - wstring tmpGuidW = wstring (tmpGuid.begin (), tmpGuid.end ()); - LPCWSTR guid = tmpGuidW.c_str (); - - // - // Parse variables by index until reached end of log - // - while (Status == 0) { - string tmpVarName = "V" + to_string (i); - wstring tmpVarNameW = wstring (tmpVarName.begin (), tmpVarName.end ()); - LPCWSTR varNameConst = tmpVarNameW.c_str (); - - // Retrieve one advanced logger indexed variable via kernel32 API - length = GetFirmwareEnvironmentVariableW (varNameConst, guid, varBuffer, MAX_VAR_LENGTH); - - if (length == 0) { - err = GetLastError (); - - // If error is ERROR_NOT_FOUND (203), reached end of variables - if (err != 203) { - Status = EFI_ERROR; - cout << "Error reading variable " << tmpVarName << " errno: " << err << endl; - return Status; - } else { - Status = (int)err; - } - } - - if (Status == 0) { - i += 1; - streamsize varSize = (streamsize)length; - lfile.write (varBuffer, varSize); - if (lfile.fail ()) { - cout << "Failed to write to file\n"; - Status = CONS_ERROR; - return Status; - } - } else if (i == 0) { - cout << "No variables found.\n"; - return Status; - } else { - cout << i << " variables read. " << lfile.tellg () << " chars written.\n"; - } - - if (varBuffer) { - ZeroMemory (varBuffer, MAX_VAR_LENGTH); - } - } - - free (varBuffer); - return SUCCESS; -} - -int -main ( - ) -{ - fstream logfile; - const char *newRawFilename = ".\\new_logfile.bin"; - int Status = 0; - - Status = ElevateCurrentPrivileges (); - if (Status != 0) { - cout << "Failed to elevate privileges, errno:" << Status << endl; - return Status; - } - - // Create new binary logfile - logfile.open (newRawFilename, ios::out | ios::binary); - if (!logfile) { - cout << "Error opening file.\n"; - Status = FILE_ERROR; - return Status; - } - - Status = ReadLogFromUefiInterface (logfile); - if (Status != SUCCESS) { - cerr << "Error reading log, exiting.\n"; - return LOG_ERROR; - } - - logfile.close (); - if (logfile.fail ()) { - cout << "Error closing file.\n"; - return FILE_ERROR; - } - - return SUCCESS; -} +#include "main.h" +#include +#include +#include +#include +#include +#include + +using namespace winrt; +using namespace Windows::Foundation; +using namespace std; + +// +// Elevate current process system environment privileges to access UEFI variables +// +static int +ElevateCurrentPrivileges ( + ) +{ + HANDLE ProcessHandle = GetCurrentProcess (); + DWORD DesiredAccess = TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY; + HANDLE hProcessToken; + TOKEN_PRIVILEGES tp; + LUID luid; + int Status = 0; + + if (!LookupPrivilegeValue (NULL, L"SeSystemEnvironmentPrivilege", &luid)) { + Status = GetLastError (); + cout << "Failed to lookup privilege value. Errno " << Status << endl; + return Status; + } + + if (!OpenProcessToken (ProcessHandle, DesiredAccess, &hProcessToken)) { + Status = GetLastError (); + cout << "Failed to open process token. Errno " << Status << endl; + return Status; + } + + tp.PrivilegeCount = 1; + tp.Privileges[0].Luid = luid; + tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; + + if (!AdjustTokenPrivileges (hProcessToken, FALSE, &tp, sizeof (TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL)) { + Status = GetLastError (); + cout << "Failed to adjust token privileges. Errno " << Status << endl; + return Status; + } + + if (GetLastError () == ERROR_NOT_ALL_ASSIGNED) { + Status = (int)ERROR_NOT_ALL_ASSIGNED; + cout << "The token does not have the specified privilege. Errno " << Status << endl; + return Status; + } + + CloseHandle (ProcessHandle); + return SUCCESS; +} + +// +// Create log file by retrieving AdvancedLogger variables from UEFI interface +// +int +ReadLogFromUefiInterface ( + fstream &lfile + ) +{ + int Status = 0; + int i = 0; + DWORD length = 0; + DWORD err = 0; + + stringstream varName; + char *varBuffer = (char *)malloc (MAX_VAR_LENGTH + 1); + + // string to LPCWSTR conversion + string tmpGuid = "{a021bf2b-34ed-4a98-859c-420ef94f3e94}"; + wstring tmpGuidW = wstring (tmpGuid.begin (), tmpGuid.end ()); + LPCWSTR guid = tmpGuidW.c_str (); + + // + // Parse variables by index until reached end of log + // + while (Status == 0) { + string tmpVarName = "V" + to_string (i); + wstring tmpVarNameW = wstring (tmpVarName.begin (), tmpVarName.end ()); + LPCWSTR varNameConst = tmpVarNameW.c_str (); + + // Retrieve one advanced logger indexed variable via kernel32 API + length = GetFirmwareEnvironmentVariableW (varNameConst, guid, varBuffer, MAX_VAR_LENGTH); + + if (length == 0) { + err = GetLastError (); + + // If error is ERROR_NOT_FOUND (203), reached end of variables + if (err != 203) { + Status = EFI_ERROR; + cout << "Error reading variable " << tmpVarName << " errno: " << err << endl; + return Status; + } else { + Status = (int)err; + } + } + + if (Status == 0) { + i += 1; + streamsize varSize = (streamsize)length; + lfile.write (varBuffer, varSize); + if (lfile.fail ()) { + cout << "Failed to write to file\n"; + Status = CONS_ERROR; + return Status; + } + } else if (i == 0) { + cout << "No variables found.\n"; + return Status; + } else { + cout << i << " variables read. " << lfile.tellg () << " chars written.\n"; + } + + if (varBuffer) { + ZeroMemory (varBuffer, MAX_VAR_LENGTH); + } + } + + free (varBuffer); + return SUCCESS; +} + +int +main ( + ) +{ + fstream logfile; + const char *newRawFilename = ".\\new_logfile.bin"; + int Status = 0; + + Status = ElevateCurrentPrivileges (); + if (Status != 0) { + cout << "Failed to elevate privileges, errno:" << Status << endl; + return Status; + } + + // Create new binary logfile + logfile.open (newRawFilename, ios::out | ios::binary); + if (!logfile) { + cout << "Error opening file.\n"; + Status = FILE_ERROR; + return Status; + } + + Status = ReadLogFromUefiInterface (logfile); + if (Status != SUCCESS) { + cerr << "Error reading log, exiting.\n"; + return LOG_ERROR; + } + + logfile.close (); + if (logfile.fail ()) { + cout << "Error closing file.\n"; + return FILE_ERROR; + } + + return SUCCESS; +} From 6be76429614f48636193f7cd8655407b2bc86f2c Mon Sep 17 00:00:00 2001 From: Vivian Nowka-Keane Date: Wed, 27 Mar 2024 14:50:14 -0700 Subject: [PATCH 6/8] copyright --- .../Application/Windows/AdvLoggerDumpWin/ReadMe.md | 2 +- .../Application/Windows/AdvLoggerDumpWin/main.cpp | 9 ++++++++- AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h | 7 +++++++ 3 files changed, 16 insertions(+), 2 deletions(-) diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/ReadMe.md b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/ReadMe.md index 64c819bf1f..f74d5c0b9c 100644 --- a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/ReadMe.md +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/ReadMe.md @@ -37,5 +37,5 @@ AdvLoggerDumpWin.exe The program creates a new log file `new_logfile.bin` in the current directory. ## Copyright -Copyright (C) Microsoft Corporation. All rights reserved. +Copyright (C) Microsoft Corporation. SPDX-License-Identifier: BSD-2-Clause-Patent \ No newline at end of file diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp index 6830d1ffae..28606827a5 100644 --- a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp @@ -1,4 +1,11 @@ -#include "main.h" +/** @file +main.cpp + +Copyright (C) Microsoft Corporation. +SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ +#include "main.h" #include #include #include diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h index d1ecd925dd..4a01d4eb28 100644 --- a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h @@ -1,3 +1,10 @@ +/** @file +main.h + +Copyright (C) Microsoft Corporation. +SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ #pragma once #include #include From 54d4cd58133cab0467bf25ee45e8515f631e176d Mon Sep 17 00:00:00 2001 From: Vivian Nowka-Keane Date: Wed, 27 Mar 2024 15:53:42 -0700 Subject: [PATCH 7/8] format --- .../Windows/AdvLoggerDumpWin/AdvLoggerDumpWin.vcxproj | 4 +++- .../Application/Windows/AdvLoggerDumpWin/PropertySheet.props | 2 +- AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp | 2 +- AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h | 2 +- .../Application/Windows/AdvLoggerDumpWin/packages.config | 2 +- 5 files changed, 7 insertions(+), 5 deletions(-) diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/AdvLoggerDumpWin.vcxproj b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/AdvLoggerDumpWin.vcxproj index e532be215a..768e896926 100644 --- a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/AdvLoggerDumpWin.vcxproj +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/AdvLoggerDumpWin.vcxproj @@ -122,7 +122,9 @@ MultiThreaded MultiThreaded Default - false + true + true + true Console diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/PropertySheet.props b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/PropertySheet.props index 255feff4a3..9099073af9 100644 --- a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/PropertySheet.props +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/PropertySheet.props @@ -13,4 +13,4 @@ --> - \ No newline at end of file + diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp index 28606827a5..6e41deed07 100644 --- a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.cpp @@ -1,7 +1,7 @@ /** @file main.cpp -Copyright (C) Microsoft Corporation. +Copyright (C) Microsoft Corporation. SPDX-License-Identifier: BSD-2-Clause-Patent **/ diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h index 4a01d4eb28..bff9be79c9 100644 --- a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/main.h @@ -1,7 +1,7 @@ /** @file main.h -Copyright (C) Microsoft Corporation. +Copyright (C) Microsoft Corporation. SPDX-License-Identifier: BSD-2-Clause-Patent **/ diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/packages.config b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/packages.config index 0d39ebe771..90f0d13a53 100644 --- a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/packages.config +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/packages.config @@ -1,4 +1,4 @@  - \ No newline at end of file + From 44904ad8f00e44281fbd865780ecb0ce3fa01954 Mon Sep 17 00:00:00 2001 From: Vivian Nowka-Keane Date: Thu, 28 Mar 2024 13:31:32 -0700 Subject: [PATCH 8/8] md lint --- .../Windows/AdvLoggerDumpWin/ReadMe.md | 32 ++++++++++++------- 1 file changed, 21 insertions(+), 11 deletions(-) diff --git a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/ReadMe.md b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/ReadMe.md index f74d5c0b9c..4186477966 100644 --- a/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/ReadMe.md +++ b/AdvLoggerPkg/Application/Windows/AdvLoggerDumpWin/ReadMe.md @@ -1,21 +1,26 @@ # AdvLoggerPkg - AdvLoggerDumpWin -AdvLoggerDumpWin is used to retrieve the advanced UEFI debug log stored in system memory. -## About +AdvLoggerDumpWin is used to retrieve the advanced UEFI debug log stored in system memory. If the Advanced Logger is enabled, the debug log is stored in memory and is available through the UEFI Variable store. -This tool creates a Windows executable that writes the UEFI variable data to a binary log file. As the -log in memory has additional metadata and alignment structure, DecodeUefiLog.py (in AdvLoggerPkg) + +## About + +This tool creates a Windows executable that writes the UEFI variable data to a binary log file. As the +log in memory has additional metadata and alignment structure, DecodeUefiLog.py (in AdvLoggerPkg) parses the in-memory UefiLog to a text stream and writes the decoded log to a local file. The Python -script can be used to both retrieve the log and decode it. +script can be used to both retrieve the log and decode it. AdvLoggerDumpWin is able to be used in systems without Python. ## Building + To build the project, install Visual Studio 2022 with the following workloads: + * Desktop development with C++ * Universal Windows Platform development For individual components, ensure the following are installed (may be included with the above workloads): + * Windows 11 SDK * NugGet package manager * MSVC v143 - VS 2022 C++ (Your Architecture) build tools @@ -23,19 +28,24 @@ For individual components, ensure the following are installed (may be included w * C++ MFC for latest v143 build tools (Your Architecture) In Visual Studio, open the project solution file AdvLoggerPkg\Application\Windows\AdvLoggerDumpWin.sln -The packages.config should tell NuGet to install the Microsoft.Windows.CppWinRT package. If not, add nuget.org + +The packages.config should tell NuGet to install the Microsoft.Windows.CppWinRT package. If not, add nuget.org as a package source and install the package. Build the solution in Release mode. The executable will be in the Release folder for the given architecture. -## Usage: -With administrator privileges, run the executable. +## Usage + +With administrator privileges, run the executable. In an administrator command prompt: -``` + +```.sh AdvLoggerDumpWin.exe ``` + The program creates a new log file `new_logfile.bin` in the current directory. ## Copyright -Copyright (C) Microsoft Corporation. -SPDX-License-Identifier: BSD-2-Clause-Patent \ No newline at end of file + +Copyright (C) Microsoft Corporation. \ +SPDX-License-Identifier: BSD-2-Clause-Patent