{"action":"created","issue":{"url":"https://api.github.com/repos/LongSoft/UEFITool/issues/32","labels_url":"https://api.github.com/repos/LongSoft/UEFITool/issues/32/labels{/name}","comments_url":"https://api.github.com/repos/LongSoft/UEFITool/issues/32/comments","events_url":"https://api.github.com/repos/LongSoft/UEFITool/issues/32/events","html_url":"https://github.com/LongSoft/UEFITool/issues/32","id":104970581,"number":32,"title":"FIT and Descriptor","user":{"login":"lordkag","id":14131308,"avatar_url":"https://avatars.githubusercontent.com/u/14131308?v=3","gravatar_id":"","url":"https://api.github.com/users/lordkag","html_url":"https://github.com/lordkag","followers_url":"https://api.github.com/users/lordkag/followers","following_url":"https://api.github.com/users/lordkag/following{/other_user}","gists_url":"https://api.github.com/users/lordkag/gists{/gist_id}","starred_url":"https://api.github.com/users/lordkag/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lordkag/subscriptions","organizations_url":"https://api.github.com/users/lordkag/orgs","repos_url":"https://api.github.com/users/lordkag/repos","events_url":"https://api.github.com/users/lordkag/events{/privacy}","received_events_url":"https://api.github.com/users/lordkag/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-09-04T21:09:28Z","updated_at":"2015-09-07T21:17:46Z","closed_at":null,"body":"You can't get away from me, human! One robot order coming up:\r\n- how is the FIT table searched in a file? Do you use the pointer from VTF, plain search or something else? Take this [Dell file] (http://www.dell.com/support/home/bg/en/bgdhs1/Drivers/DriversDetails?driverId=MFDH6) and prepare for a journey. Extract the hdr with PhoenixTool or [this script] (http://forums.mydigitallife.info/threads/44785-I-present-you-a-tool-to-decompress-Dell-UEFI-BIOS). Once you get the HDR, look into Extractor > \"file dellhdr\" to unpack this HDR into components. The UEFI firmware should be the one ending with .rom, also [uploaded here] (https://www.mediafire.com/?d06zelpc586aro1). This is still not the final image, it is a multi-volume image similar to Intel .bio files, but at least it can be opened by UEFITool. Version 0.30.0 shows no FIT table, but there is one at offset 1C0100, present in the same GUID B52282EE-9B66-44B9-B1CF-7E5040F787C1 that seems to be used just for this purpose, as seen in other images from different OEMs. I don't expect you to bend over for every pack OEMs imagine, but I would like to know if I should report FIT related bugs for every image that can be parsed or just for normal Intel images.\r\n\r\n- Take this file > ftp://ftp.supermicro.nl/Firmware/Switch/MBM-GEM-001/Release-1441-1/SageBios_painted_gorge.linux_payload_51.rom < (link not processed by GitHub). Again a strangely packed image. It has Intel regions, but the BIOS region is formed from LARCHIVE sections. Each this section is formed as: signature LARCHIVE + 4 bytes body size + 4 bytes unknown (type of section?) + 4 bytes reserved + 4 bytes header size + x bytes section name + y 00/FF bytes to fill the header -> all fields in big endian. Obviously, this image can't be parsed by UEFITool and no one expects it to be parsed. But it shows an interesting effect: the first _FVH signature confuses UEFITool, which in turn misses the second and valid _FVH. Is there no way to ignore false positives? For instance, I would very much doubt we will find a volume with a size to fill FvLength or to replace the reserved bytes or to have a strange revision.\r\n\r\n- Have you noticed the new structure for Skylake descriptor? If there are no public datasheets and you have the NDA heavy breathing over your head, you can check [this commit] (http://review.coreboot.org/gitweb?p=coreboot.git;a=commit;h=1f7fd720c81755144423f2d4062c39cc651adc0a). You can also consult with Plutomaniac, he did some work on his own for MEA -> region locks in Skylake. As a side note, I see some bogus regions in both Skylake and old descriptor. Coreboot mentions 9 regions (including Descriptor), but the map has 9 regions (without descriptor); the old descriptor mentions 2-4 regions, but the map can sometimes have 6 regions. The extra regions are disabled by default, but why are they present in the first place?"},"comment":{"url":"https://api.github.com/repos/LongSoft/UEFITool/issues/comments/138378776","html_url":"https://github.com/LongSoft/UEFITool/issues/32#issuecomment-138378776","issue_url":"https://api.github.com/repos/LongSoft/UEFITool/issues/32","id":138378776,"user":{"login":"lordkag","id":14131308,"avatar_url":"https://avatars.githubusercontent.com/u/14131308?v=3","gravatar_id":"","url":"https://api.github.com/users/lordkag","html_url":"https://github.com/lordkag","followers_url":"https://api.github.com/users/lordkag/followers","following_url":"https://api.github.com/users/lordkag/following{/other_user}","gists_url":"https://api.github.com/users/lordkag/gists{/gist_id}","starred_url":"https://api.github.com/users/lordkag/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lordkag/subscriptions","organizations_url":"https://api.github.com/users/lordkag/orgs","repos_url":"https://api.github.com/users/lordkag/repos","events_url":"https://api.github.com/users/lordkag/events{/privacy}","received_events_url":"https://api.github.com/users/lordkag/received_events","type":"User","site_admin":false},"created_at":"2015-09-07T21:17:46Z","updated_at":"2015-09-07T21:17:46Z","body":"There is something I forgot to explicitly mention in the first message. It was Plutomaniac who first observed this new descriptor and gave me the hint. I don't remember if I read that commit before or after his message, but I wouldn't have paid much attention without his poke. I hope he hasn't read this report, or I will be receiving an invitation to a tournament pretty soon. After reading some... newspapers, I have some observations about descriptor implementation in UEFITool:\r\n\r\n- Shouldn't FLASH_DESCRIPTOR_OEM_SECTION_SIZE be 256 or 0x100 ?\r\n- I believe FLMAP0 should be as bellow\r\n[...]\r\nUINT32 RegionBase : 8;\r\nUINT32 NumberOfRegions: 3; // Reserved in new descriptor\r\nUINT32 : 5;\r\n\r\n- FLMAP2 as bellow\r\n[...]\r\nUINT32 ProcStrapsBase : 8;\r\nUINT32 NumberOfProcStraps : 8;  // One-based number of  [...]\r\nUINT32 : 8;\r\nUINT32 NumberOfRegInit : 8; // One-based number of register initialization entries.\r\n\r\n- I see misspelled ReadClockFreqency and FastReadFreqency. I'm not that obsessed, but it might make a difference if you plan on using them later.\r\n\r\n- FlashWriteFrequency and FlashReadStatusFrequency should switch the order.\r\n\r\n- FLASH_DESCRIPTOR_REGION_SECTION is not entirely right. Descriptor base is 0x00 and size is 0x1000, so it would appear as 0000 + 0000 in Region section. This means that FLASH_DESCRIPTOR_REGION_SECTION begins at Desc_Base + 0x40 (Intel recommended), the region number is 0 based (Intel labelling) and it is as following: Desc + BIOS + ME + GbE + PDR + Reserved1 + Reserved2 in old descriptor, Desc + BIOS + ME + GbE + PDR + Reserved1 + Reserved2 + Reserved3 + EC + Reserved4 in new descriptor.\r\n\r\nIf you want to read the same... newspaper, you can contact Plutomaniac. \r\n"}}