Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Explore QubesOS AEM usb boot #502

Open
tlaurion opened this issue Dec 28, 2018 · 10 comments
Open

Explore QubesOS AEM usb boot #502

tlaurion opened this issue Dec 28, 2018 · 10 comments

Comments

@tlaurion
Copy link
Collaborator

tlaurion commented Dec 28, 2018

Would be nice if AntiEvilMaid could be supported from Heads, so S3 suspend and integrity validation would be implemented in QubesOS.

Requires:

@tlaurion
Copy link
Collaborator Author

It would complement Heads with memory measurements within QubesOS. Not sure if it would work with coreboot though, since latest AEM requires TXT. Will give it a try. Goal of it would be to boot from USB AEM disk from Heads.

@tlaurion
Copy link
Collaborator Author

from @zaolin :

Blobs of the original fw needs to be extracted. So searching with Uefitool might work for retrieving the ACM. I can help with that

@tlaurion
Copy link
Collaborator Author

see This WiP branch. Unfortunately, I do not know how to extract what would be required so that SINIT would be functional.

@zaolin : ping! :)

@tlaurion
Copy link
Collaborator Author

@zaolin updated:

with TXT enabled stripping ME won't work
use UEFI tool and text search with unicode enabled for "ACM" then extract the body

You should be able to extract the BIOS ACM from thinkpad vendor firmware
acminfo of tboot tools gives you the output if chipset_acm_type equals BIOS and if the acm is valid

SINIT ACM != BIOS ACM

@zaolin
Copy link
Contributor

zaolin commented Feb 4, 2019

Stripped ME seems to work with TXT. We double checked that.

@tlaurion
Copy link
Collaborator Author

tlaurion commented Feb 8, 2019

#307 would be linked indirectly to this.

@tlaurion
Copy link
Collaborator Author

@zaolin how you made it?

@tlaurion
Copy link
Collaborator Author

Update from @zaolin: Waiting from Intel approval.

@zaolin
Copy link
Contributor

zaolin commented Mar 27, 2019

Estimation in man-days: 15 PD

@tlaurion
Copy link
Collaborator Author

tlaurion commented Jul 1, 2022

Well, #1172 provides TXT required ACM and SINIT blobs, years later. Where to go next?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants