Newer
Older
AMI-Aptio-BIOS-Reversed / AmiTcgNvflagSample / AmiTcgNvflagSample.md
@Ajax Dong Ajax Dong 2 days ago 5 KB Init

AmiTcgNvflagSample

Function Table

Address Name Description
ReadUnaligned64
IoRead32
CpuPause
ReadTimeStampCounter
EnableInterrupts
DisableInterrupts
GetCallerEflags
MmioWrite16
DebugPrintErrorLevel
AssertBreakpoint
MatchHobGuid
UefiBootServicesTableLibConstructor
TpmNvFlagWriteVariable
GetPersistentTpmFlags
SetPersistentTpmFlags
TpmNvFlagStub
AmiTcgNvflagSampleDriver
ModuleEntryPoint
Module Global Data
EFI_HANDLE gImageHandle = NULL;
qword_15B0 VOID *mHobList = NULL; // qword_15A8
qword_15B8 UINT64 gDebugLevel = 0; // qword_15A0
TCG Protocol GUID
EFI_GUID gEfiTcgProtocolGuid = { 0xF67D28B8, 0x1E78, 0x4C19, { 0xB8, 0x7B, 0x1A, 0x99, 0xC2, 0x40, 0x6A, 0x54 } };
TCG Configuration Protocol GUID
EFI_GUID gEfiTcgConfigProtocolGuid = { 0xD7F12B7E, 0x64B7, 0x4B0B, { 0x99, 0xBF, 0xCB, 0x7B, 0xFA, 0x8F, 0x1D, 0x8C } };
Variable GUIDs
EFI_GUID gTcgInterfaceVarGuid = { 0x94B0F9D0, 0x8B8A, 0x4F63, { 0x87, 0x0E, 0x35, 0x5D, 0xFE, 0x42, 0x26, 0x55 } }; // unk_1510
unk_14F0 EFI_GUID gTcgNvDataGuid = { 0xAB954E08, 0x6F10, 0x4C29, { 0xB5, 0xA5, 0xE8, 0x3E, 0x60, 0x5D, 0x71, 0x23 } }; // unk_14E0
PCD Token Space GUID
EFI_GUID gPcdTokenSpaceGuid = { 0x9B3ADA11, 0x5CBC, 0x4C41, { 0xA8, 0x1F, 0x0E, 0xAD, 0x64, 0x7B, 0xBE, 0x6C } };
HOB GUID for locating HOB list in configuration table
EFI_GUID gHobGuid = { 0x7739F24C, 0x93D7, 0x11D4, { 0x9A, 0x3A, 0x00, 0x90, 0x27, 0x3F, 0xC1, 0x4D } }; // unk_1520/unk_1528
EFI Driver Binding Protocol instance
unk_1500 - The driver binding protocol instance
EFI_DRIVER_BINDING_PROTOCOL mDriverBinding = {
Supported NULL, // Stop
Version NULL, // ImageHandle
DriverBindingHandle };
Forward declarations for protocol function table
off_1550 - Function table for protocol interface
off_1560 - Alternative function table for protocol interface
EFI_OPEN_PROTOCOL_INFORMATION_ENTRY mProtocolFuncTable[2];
Check error level filtering
Read CMOS index 0x4B to determine debug level
IoWrite8 **(0x70, (IoRead8 (0x70) & 0x80) 0x4B);**
Save ImageHandle and SystemTable
gImageHandle = ImageHandle;
Initialize HOB list
GetHobList ();
Initialize PCI Express base address from PCD
mPciExpressBaseAddress = ((UINT64 (*)(UINTN))GetPcdProtocol ()->GetPcdValue (PcdPciExpressBaseAddress))(5);
Enable PCI Express MMIO access
if ((INT8)((UINT8 )PciExpressLibGetPciExpressAddress (PCI_EXPRESS_LIB_ADDRESS (0, 0, 0, 0))) >= 0) {
Delay calibration: use RDTSC to calibrate a ~1ms delay
Eflags = GetCallerEflags ();
while ((((CurrentTsc + 357 - (UINTN)IoRead32 (TIMER_PORT)) & 0x800000) == 0)) {
Query the variable; create it if it doesn't exist
Status = gRT->QueryVariableInfo (VariableName, VendorGuid, 0, 0, 0);
Variable doesn't exist; attempt to create it
Status = gRT->SetVariable (VariableName, VendorGuid, Attributes, DataSize, Data);
Now write to the variable with the same data
Variable doesn't exist; create and write
Locate TCG protocol
Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, &TcgProtocol);
Read TcgInterfaceVar to check interface state
BufferSize = sizeof (TcgInterface);
Read INTERNALPERBIOSFLAGS
InternalFlagsSize = sizeof (InternalFlags);
Internal flags not found; set defaults
Set bit 4 in flags
Copy internal flags to output buffer
CopyMem (Flags, InternalFlags, 6);
Locate TCG protocols
Status = gBS->LocateProtocol (&gEfiTcgProtocolGuid, NULL, (VOID )&TcgProtocol);**
Read TcgInterfaceVar to check if TCG interface is active
TCG interface is active; write flags to INTERNALPERBIOSFLAGS
CopyMem (InternalFlags, Flags, sizeof (InternalFlags));
TcgInterface ** = 1;**
Write INTERNALPERBIOSFLAGS again with actual flags
Status = TpmNvFlagWriteVariable (
Locate TCG Config protocol
Status = gBS->LocateProtocol (&gEfiTcgConfigProtocolGuid, NULL, (VOID )&TcgConfigProtocol);**
Check TPM NV registers at physical address 0xFED40F00 for
contains 3 entries (12 bytes total, 4 bytes per entry).
for (Index = 0; Index < 0xC; Index += 4) {
Compare against known manufacturer flag table
if ((UINT16 )((UINT8 *)&ManufacturerCheckValue + Index) == TpmManufacturerId &&
Manufacturer match found; register driver binding
return gBS->InstallMultipleProtocolInterfaces (
No manufacturer match; try reading existing flags
ZeroMem (DefaultFlags, sizeof (DefaultFlags));
Failed to read flags; set defaults
Version 1, flags byte 0 = 1
Register the driver binding protocol
Initialize UEFI boot/runtime services and hardware abstraction
UefiBootServicesTableLibConstructor (ImageHandle, SystemTable);
Execute the main TCG NV flag sample logic
return AmiTcgNvflagSampleDriver (ImageHandle, SystemTable);

Generated by HR650X BIOS Decompilation Project