Newer
Older
AMI-Aptio-BIOS-Reversed / SecFlashUpdDXE / SecFlashUpdDXE.md
@Ajax Dong Ajax Dong 2 days ago 7 KB Init

SecFlashUpdDXE

Function Table

Address Name Description
FlashReadyToLockCallback
IsHobGuidMatch
ReadUnaligned64
DebugPrint
AssertHandler
DebugGetLevel
ParseInteger
UnicodeSPrint
ModuleEntryPoint
SecFlashUpdDriverInit
SecFlashUpdRegisterCallbacks
UnicodeVSPrint
Module Global Variables
GUID Definitions (Protocols, Events, Variables)
AMI Flash Update Protocol GUID: {0x974231D5, 0xED4B, 0x44D1, {0x88, 0x70, 0xCE, 0x51, 0x5C, 0xC1, 0x4D, 0x68}}
Capsule Update Data Variable GUID: {0x711C703F, 0xC285, 0x4B10, {0xA3, 0xB0, 0x36, 0xEC, 0xBD, 0x3C, 0x8B, 0xE2}}
DXE SMM Ready To Lock Protocol GUID: {0x49D34AE7, 0x9454, 0x4551, {0x8F, 0x71, 0x46, 0x7D, 0x8C, 0x0E, 0x4E, 0xF5}}
Event Ready To Boot Group GUID: {0x60FF8964, 0xE906, 0x41D0, {0xAF, 0xED, 0xF2, 0x41, 0xE9, 0x74, 0xE0, 0x8E}}
Forward Declarations
Helper Functions
Check if HOB list has already been located
if (gHobList != NULL) {
Default to NULL
gHobList = NULL;
Iterate through configuration table entries to find the HOB list GUID
HobCount = gST->NumberOfTableEntries;
Found the HOB list; extract its GUID and table pointer
HOB list not found in configuration table assertion
DEBUG ((EFI_D_ERROR, "\nASSERT_EFI_ERROR (Status = %r)\n", EFI_NOT_FOUND));
Read the two 8-byte halves of the reference HOB GUID
GuidFirstHalf = ReadUnaligned64 (&HOB_LIST_GUID);
Read the two 8-byte halves from the candidate HOB entry
EntryFirstHalf = ReadUnaligned64 (HobEntry);
Match if both halves are equal
return (GuidFirstHalf == EntryFirstHalf) &&
Debug / Formatting Helpers
Forward to the UEFI debug print routine stored in the DebugLib protocol
Allocate a small buffer to check heap availability
UINTN BufferSize = gBS->GetFreePoolSize ();
Heap not yet available; return NULL
return NULL;
Check for warning codes
if ((Status & 0x2000000000000000LL) != 0) {
Check for error codes
if (Status >= 0) {
if ((UINTN)Status > 4) {
Negative status values
Index = (UINT8)(Status & 0x1FFFFFFFFFFFFFFFLL);
Interrupt pending / high severity errors
if (Index >= 3) {
Extended error codes
if (Index > 2) {
if (Index > 0x1E) {
Determine absolute value
if (Signed && Base == 10) {
Convert digits in reverse order
while (AbsValue > 0) {
Add negative sign for base-10 signed negative values
if (Base == 10 && Value < 0 && Signed) {
Skip leading whitespace (space = 0x0020, tab = 0x0009)
while *(String == L' ' String == L'\t') {*
Handle sign
if (*String == L'-') {
Parse digits
CONST CHAR16 *ParsePtr = String;
Handle hex digits (a-f or A-F) but for base=10 parsing
we stop at non-decimal
if (Base != 10) {
Base 10 only accepts digits 0-9
if (Char >= 10) {
Check for overflow (32-bit boundary)
if (Sign == 1) {
Core Driver Functions
Initialize UEFI boot services table pointers from the system table
Status = SecFlashUpdDriverInit (ImageHandle);
Create ReadyToBoot event and register Flash Ready To Lock callback
Status = SecFlashUpdRegisterCallbacks (ImageHandle, SystemTable);
Save the image handle and system table
gImageHandle = ImageHandle;
Extract BootServices and RuntimeServices from the system table
BootServices = gST->BootServices;
Initialize the HOB list pointer
GetHobList ();
Create event in the ReadyToBoot event group
Status = gBS->CreateEvent (
Install the DXE SMM Ready To Lock protocol
Status = gBS->InstallProtocolInterface (
Create the ReadyToBoot group event. The event will fire the
FlashReadyToLockCallback at TPL_CALLBACK when the group is signaled.
Ensure the Runtime Services pointer is valid
RtServices = gRT;
Debug trace
DEBUG ((EFI_D_INFO, "\nSecure Fl Upd:\nFlash_Ready_To_Lock callback\n"));
Check if the AmiFlashUpd variable exists (signals that an update
has been staged)
DataSize = sizeof (UINT64);
AmiFlashUpd variable found close it (we're done reading)
Search for CapsuleUpdateData variables
First try "CapsuleUpdateData", then "CapsuleUpdateData0", "CapsuleUpdateData1", ...
CapsuleIndex = 0;
Found a valid capsule update data variable! Check if the
descriptor size matches the expected size stored in
CapsuleBlockDesc + 8.
UINT64 ExpectedSize = (UINT64 )((UINTN)&CapsuleBlockDesc + 8);
Descriptor matches close the variable and proceed
Install the DXE SMM Ready To Lock protocol to signal that flash
should now be locked for write protection
Close the event so this callback doesn't fire again
Unicode Formatted Print (vsnprintf for CHAR16)
Ordinary character copy to output
if (Remaining <= 1) {
Process format specifier
Check for "%%" (literal percent)
if (*Fmt == L'%') {
Parse width and padding
Parse '*' width from argument
if (Fmt == L'') {
Parse numeric width
CONST CHAR16 *WidthStart = Fmt;
Check for 'l' prefix (long/64-bit)
LongArg = FALSE;
Process the conversion specifier
switch (*Fmt) {
Wide string argument
StrPtr = VA_ARG (VaList, CHAR16 *);
Narrow (CHAR8) string argument, zero-extended to CHAR16
NarrowStr = VA_ARG (VaList, CHAR8 *);
Character argument
if (Remaining <= 1) goto Overflow;
Signed decimal integer
if (LongArg) {
Apply padding
StrLen = AsciiStrLen (NarrowBuf);
Hexadecimal (unsigned)
if **(LongArg Fmt == L'p') {*
Output digits, applying uppercase conversion for %X
EFI_STATUS to string
ValueToString ((INT64)StatusValue, NarrowBuf, 16, FALSE);
GUID to string (%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x)
Data1 GuidBytes[1] = (GuidData[1] & 0xFFFF); // Data2
Data3 GuidBytes[3] = ((UINT8 )GuidData + 8); // Data4[0]
Unknown format specifier - copy literal

Generated by HR650X BIOS Decompilation Project