AMD + Intel analyze commands #351

orangecms · 2022-01-09T16:44:14Z

No description provided.

codecov-commenter · 2022-01-10T15:35:35Z

Codecov Report

Merging #351 (acb074e) into master (9a56b74) will decrease coverage by 0.01%.
The diff coverage is 0.00%.

❗ Current head acb074e differs from pull request most recent head 2d5c7fc. Consider uploading reports for the commit 2d5c7fc to get more accurate results

@@            Coverage Diff             @@
##           master     #351      +/-   ##
==========================================
- Coverage   41.63%   41.61%   -0.02%     
==========================================
  Files         110      110              
  Lines        7545     7547       +2     
==========================================
  Hits         3141     3141              
- Misses       3831     3832       +1     
- Partials      573      574       +1

Impacted Files	Coverage Δ
pkg/intel/metadata/fit/entry.go	`45.45% <0.00%> (-0.70%)`	⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9a56b74...2d5c7fc. Read the comment docs.

orangecms · 2024-09-22T20:31:14Z

Another instance of "no idea what's up here", and now I remember why I put this in draft:

== IFD ==
BIOS  region not found: invalid FV length (is greater than the data length): 211669285660000467 > 9199616
ME    region not found: invalid FV length (is greater than the data length): 211669285660000467 > 9199616
GBE   region not found: invalid FV length (is greater than the data length): 211669285660000467 > 9199616
PTT   region not found: invalid FV length (is greater than the data length): 211669285660000467 > 9199616
EC    region not found: invalid FV length (is greater than the data length): 211669285660000467 > 9199616
ucode region not found: invalid FV length (is greater than the data length): 211669285660000467 > 9199616

== FIT ==
{
  "Address": 15420327944232370193,
  "Size": 0,
  "Reserved": 5,
  "Version": {
    "maj": 255,
    "min": 255
  },
  "Type": 127,
  "IsChecksumValid": true,
  "Checksum": 255
}

this is from parsing a System76 Lemp10 firmware image... am I holding it wrong?

orangecms · 2024-09-24T00:09:12Z

Another example, MSI Pulse smth:

intelana Pulse\ GL76\ 12UEK/E17L3IMS.10C

== IFD ==
2024/09/24 02:07:23 [fiano][ERROR] error parsing ME Flash Partition Table: ME Flash Partition Table signature 0x24465054 not found: first 20 bytes are:
00000000  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000010  48 00 00 00                                       |H...|
BIOS  offset 1000000 size 1000000
2024/09/24 02:07:24 [fiano][ERROR] error parsing ME Flash Partition Table: ME Flash Partition Table signature 0x24465054 not found: first 20 bytes are:
00000000  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000010  48 00 00 00                                       |H...|
ME    offset 1000 size 4b6000
2024/09/24 02:07:25 [fiano][ERROR] error parsing ME Flash Partition Table: ME Flash Partition Table signature 0x24465054 not found: first 20 bytes are:
00000000  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000010  48 00 00 00                                       |H...|
GBE   region not found: couldn't find region 2
2024/09/24 02:07:26 [fiano][ERROR] error parsing ME Flash Partition Table: ME Flash Partition Table signature 0x24465054 not found: first 20 bytes are:
00000000  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000010  48 00 00 00                                       |H...|
PTT   region not found: couldn't find region 14
2024/09/24 02:07:27 [fiano][ERROR] error parsing ME Flash Partition Table: ME Flash Partition Table signature 0x24465054 not found: first 20 bytes are:
00000000  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000010  48 00 00 00                                       |H...|
EC    region not found: couldn't find region 7
2024/09/24 02:07:28 [fiano][ERROR] error parsing ME Flash Partition Table: ME Flash Partition Table signature 0x24465054 not found: first 20 bytes are:
00000000  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000010  48 00 00 00                                       |H...|
ucode region not found: couldn't find region 6

== FIT ==
{
  "Address": 15420327944232370193,
  "Size": 0,
  "Reserved": 5,
  "Version": {
    "maj": 255,
    "min": 255
  },
  "Type": 127,
  "IsChecksumValid": true,
  "Checksum": 255
}

Here is an excerpt from the hex dump:

01c39900: ffff ffff ffff ffff ffff ffff ffff ffff  ................
01c39910: b8aa f000 6800 00f8 ffff ffff ffff ffff  ....h...........
01c39920: ffff ffff ffff ffff ffff ffff ffff ffff  ................
01c39930: ffff ffff ffff ffff ffff ffff ffff ffff  ................
01c39940: ffff ffff ffff ffff ffff ffff ffff ffff  ................
01c39950: ffff ffff ffff ffff ffff ffff ffff ffff  ................
01c39960: ffff ffff ffff ffff ee82 22b5 669b b944  ..........".f..D
01c39970: b1cf 7e50 40f7 87c1 44aa 0110 9801 00f8  [email protected].......
01c39980: 5f46 4954 5f20 2020 0700 0000 0001 0000  _FIT_   ........
01c39990: 0004 bdff 0000 0000 0000 0000 0001 0100  ................
01c399a0: 0028 c0ff 0000 0000 0000 0000 0001 0100  .(..............
01c399b0: 0000 f8ff 0000 0000 0000 0000 0001 0200  ................
01c399c0: 7000 7100 0104 7d00 0000 0000 0000 0a00  p.q...}.........
01c399d0: 0046 feff 0000 0000 5503 0000 0001 0b00  .F......U.......
01c399e0: 0041 feff 0000 0000 9504 0000 0001 0c00  .A..............
01c399f0: ffff ffff ffff ffff ffff ffff ffff ffff  ................

Also: do I still need to implementing something to find the FIT / decide whether FIT or IFD, or do we have a library function?

orangecms · 2024-09-24T00:17:50Z

Any idea why the FIT is supposedly at 15420327944232370193 (0xd60002909c000000)?

The second file is 32MB, i.e., 33554432 bytes - so is there a 🐛 bug in the FIT parsing?

I just tried feeding the above excerpt minus the first line instead of the full image file:

== FIT ==
{
  "Address": 17870283768098499256,
  "Size": 16777215,
  "Reserved": 255,
  "Version": {
    "maj": 255,
    "min": 255
  },
  "Type": 127,
  "IsChecksumValid": true,
  "Checksum": 255
}

The Address is sort of this here, but mapped to elsewhere maybe? What does "Address" mean here, a virtual one?

01c39910: b8aa f000 6800 00f8 ffff ffff ffff ffff  ....h...........

orangecms · 2024-09-24T00:43:15Z

Alright, using GetTable() gets me here:

[
  {
    "Address": 2314885802276505183,
    "Size": 7,
    "Version": {
      "maj": 1
    },
    "Type": 0,
    "IsChecksumValid": false,
    "Checksum": 0
  },
  {
    "Address": 4290577408,
    "Size": 0,
    "Version": {
      "maj": 1
    },
    "Type": 1,
    "IsChecksumValid": false,
    "Checksum": 0
  },
  {
    "Address": 4290783232,
    "Size": 0,
    "Version": {
      "maj": 1
    },
    "Type": 1,
    "IsChecksumValid": false,
    "Checksum": 0
  },
  {
    "Address": 4294443008,
    "Size": 0,
    "Version": {
      "maj": 1
    },
    "Type": 2,
    "IsChecksumValid": false,
    "Checksum": 0
  },
  {
    "Address": 35188774437716080,
    "Size": 0,
    "Version": {
      "maj": 0
    },
    "Type": 10,
    "IsChecksumValid": false,
    "Checksum": 0
  },
  {
    "Address": 4294854144,
    "Size": 853,
    "Version": {
      "maj": 1
    },
    "Type": 11,
    "IsChecksumValid": false,
    "Checksum": 0
  },
  {
    "Address": 4294852864,
    "Size": 1173,
    "Version": {
      "maj": 1
    },
    "Type": 12,
    "IsChecksumValid": false,
    "Checksum": 0
  }
]

The first Address still seems odd to me though.

orangecms · 2024-09-24T00:49:11Z

in tabular form:

#   | Type                             | Address              | Size     | Version | Checksum valid  | Checksum
---------------------------------------------------------------------------------------------------------------
0   | FITHeaderEntry            (0x00) | 0x2020205f5449465f   | 7        | 0x0100  | false           | 0
1   | MicrocodeUpdateEntry      (0x01) | 0xffbd0400           | 0        | 0x0100  | false           | 0
2   | MicrocodeUpdateEntry      (0x01) | 0xffc02800           | 0        | 0x0100  | false           | 0
3   | SACM                      (0x02) | 0xfff80000           | 0        | 0x0100  | false           | 0
4   | TXTPolicyRecord           (0x0A) | 0x7d040100710070     | 0        | 0x0000  | false           | 0
5   | KeyManifestRecord         (0x0B) | 0xfffe4600           | 853      | 0x0100  | false           | 0
6   | BootPolicyManifestRecord  (0x0C) | 0xfffe4100           | 1173     | 0x0100  | false           | 0

orangecms · 2024-09-24T23:15:36Z

Alright, another couple of things:

The Fiano code (Intel analysis command for reference) runs extremely slow, sometimes taking many seconds to parse a firmware image. I'm not sure why.
The Rust code I've written to parse Intel ME file systems runs way faster, taking milliseconds to parse multiple images, and that even walks through directories and what not.

It appears that the Intel data structures are quite different between versions of... main processors, ME, idk? Before parsing anything specific, version detection would be necessary.
I'll take another look at MEAnalyzer and dive deeper into the current Fiano and CSS code. What I've written in previous comments tells me that either the current code is buggy or just doesn't handle the many different versions, and I have no idea what the best approach is yet since it's quite a lot to digest (mentally) and the code is all I can look at. Hints would be very welcome... 😕

orangecms · 2024-09-24T23:38:33Z

Just found a PDF among the tons of documents I have collected:
firmware-interface-table-bios-specification-r1p2p1.pdf - hope that helps to some degree

Signed-off-by: Daniel Maslowski <[email protected]>

orangecms force-pushed the analyze-commands branch from a939d3f to 2d5c7fc Compare January 10, 2022 15:27

orangecms force-pushed the analyze-commands branch from 2d5c7fc to 239087c Compare January 10, 2022 15:39

orangecms changed the base branch from master to main September 8, 2022 13:03

orangecms force-pushed the analyze-commands branch 2 times, most recently from 678af06 to bdc82a8 Compare May 13, 2023 13:30

orangecms mentioned this pull request Sep 16, 2024

Intel metadata command #399

Draft

orangecms force-pushed the analyze-commands branch from bdc82a8 to a1dab0a Compare September 22, 2024 16:36

orangecms added the help wanted Extra attention is needed label Sep 25, 2024

orangecms force-pushed the analyze-commands branch 2 times, most recently from 4b8e847 to 4da704f Compare September 29, 2024 16:21

orangecms added 2 commits October 15, 2024 18:03

WIP intelana

35db70b

Signed-off-by: Daniel Maslowski <[email protected]>

WIP amdana

4838954

Signed-off-by: Daniel Maslowski <[email protected]>

orangecms force-pushed the analyze-commands branch from 4da704f to 4838954 Compare October 15, 2024 16:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

AMD + Intel analyze commands #351

AMD + Intel analyze commands #351

orangecms commented Jan 9, 2022

codecov-commenter commented Jan 10, 2022

orangecms commented Sep 22, 2024

orangecms commented Sep 24, 2024 •

edited

Loading

orangecms commented Sep 24, 2024 •

edited

Loading

orangecms commented Sep 24, 2024

orangecms commented Sep 24, 2024

orangecms commented Sep 24, 2024

orangecms commented Sep 24, 2024

AMD + Intel analyze commands #351

Are you sure you want to change the base?

AMD + Intel analyze commands #351

Conversation

orangecms commented Jan 9, 2022

codecov-commenter commented Jan 10, 2022

Codecov Report

orangecms commented Sep 22, 2024

orangecms commented Sep 24, 2024 • edited Loading

orangecms commented Sep 24, 2024 • edited Loading

orangecms commented Sep 24, 2024

orangecms commented Sep 24, 2024

orangecms commented Sep 24, 2024

orangecms commented Sep 24, 2024

orangecms commented Sep 24, 2024 •

edited

Loading

orangecms commented Sep 24, 2024 •

edited

Loading