diff --git a/patterns/uefi_boot_entry.hexpat b/patterns/uefi_boot_entry.hexpat new file mode 100644 index 0000000..b6c4b1a --- /dev/null +++ b/patterns/uefi_boot_entry.hexpat @@ -0,0 +1,74 @@ +// subsections in this pattern refer to subsections in the +// UEFI Specification Release 2.10 from Aug 29 2022 + +#pragma author iTrooz +#pragma description UEFI Boot Entry (Load option) + +#include +#include + +// subsection 10.3.5.1 +struct HARD_DRIVE { + u32 partitionNumber; + u64 partitionStart; + u64 partitionSize; + type::GUID partitionSig; + u8 format; + u8 sigType; +}; + +// subsection 10.3.5.4 +struct FILE_PATH { + char16 path[]; +}; + +// subsection 10.3.1 +enum MEDIA_DEVICE_PATH_SUBTYPE : u8 { + HARD_DRIVE = 0x01, + FILE_PATH = 0x04, +}; + +enum DEVICE_PATH_TYPE : u8 { + MEDIA_DEVICE_PATH = 0x04, +}; + +// subsection 10.2 +// EFI_DEVICE_PATH_PROTOCOL +struct DEVICE_PATH { + u8 type; + u8 subtype; + // length of this DEVICE_PATH structure + u16 length; + // the size of the data is the size of the structure minus the fields we know. + // not always used + u16 dataSize = length-1-1-2; + + match (type, subtype) { + (DEVICE_PATH_TYPE::MEDIA_DEVICE_PATH, MEDIA_DEVICE_PATH_SUBTYPE::HARD_DRIVE): HARD_DRIVE data; + (DEVICE_PATH_TYPE::MEDIA_DEVICE_PATH, MEDIA_DEVICE_PATH_SUBTYPE::FILE_PATH): FILE_PATH data; + (_, _): u8 data[dataSize]; + } +}; + +// subsections 3.1.3 +// EFI_LOAD_OPTION +struct LOAD_OPTION { + u32 attributes; + // length of the filePathList data + u16 filePathLength; + char16 description[]; + + u64 startOffset = $; + DEVICE_PATH filePathList[while($ - startOffset < filePathLength)]; + u8 optionalData; +}; + +// on Linux, variables are found in /sys/firmware/efi/efivars, +// and will be prefixed by their attributes +struct EFI_VAR { + u32 attributes; + LOAD_OPTION loadOption; +}; + + +EFI_VAR data @0x0; diff --git a/tests/patterns/test_data/uefi_boot_entry.hexpat.bin b/tests/patterns/test_data/uefi_boot_entry.hexpat.bin new file mode 100644 index 0000000..794b0c4 Binary files /dev/null and b/tests/patterns/test_data/uefi_boot_entry.hexpat.bin differ