Translate

Image of Beginning Google Maps API 3
Image of Operating System Concepts
Image of Advanced Programming in the UNIX Environment, Second Edition (Addison-Wesley Professional Computing Series)
Image of Modern Operating Systems (3rd Edition)

List EFI Configuration Table Entries

Now that UDK2015 is released, I decided to upgrade my UEFI development environment to that release. While testing the release, I realized that I had never written a UEFI shell utility to list the EFI configuration table entries and so decided to quickly develop a prototype of such a utility.

Here is the source code for the utility:

//
//  Copyright (c) 2015  Finnbarr P. Murphy.   All rights reserved.
//
//  Display EFI Configuration Table entries 
//
//  License: BSD License
//

#include <Uefi.h>
#include <Library/UefiLib.h>
#include <Library/ShellCEntryLib.h>
#include <Library/ShellLib.h>
#include <Library/BaseMemoryLib.h>
#include <Library/UefiBootServicesTableLib.h>

#include <Protocol/EfiShell.h>
#include <Protocol/LoadedImage.h>


// first 8 per UEFI Specification 2.5
#define EFI_ACPI_20_TABLE_GUID  \
   {0x8868e871, 0xe4f1, 0x11d3, {0xbc,0x22,0x00,0x80,0xc7,0x3c,0x88,0x81}}
#define ACPI_TABLE_GUID \
   {0xeb9d2d30, 0x2d88, 0x11d3, {0x9a,0x16,0x00,0x90,0x27,0x3f,0xc1,0x4d}}
#define SAL_SYSTEM_TABLE_GUID \
   {0xeb9d2d32, 0x2d88, 0x11d3, {0x9a,0x16,0x00,0x90,0x27,0x3f,0xc1,0x4d}}
#define SMBIOS_TABLE_GUID \
   {0xeb9d2d31, 0x2d88, 0x11d3, {0x9a,0x16,0x00,0x90,0x27,0x3f,0xc1,0x4d}}
#define SMBIOS3_TABLE_GUID \
   {0xf2fd1544, 0x9794, 0x4a2c, {0x99,0x2e,0xe5,0xbb,0xcf,0x20,0xe3,0x94}}
#define MPS_TABLE_GUID \
   {0xeb9d2d2f, 0x2d88, 0x11d3, {0x9a,0x16,0x00,0x90,0x27,0x3f,0xc1,0x4d}}
#define EFI_PROPERTIES_TABLE_GUID \
   {0x880aaca3, 0x4adc, 0x4a04, {0x90,0x79,0xb7,0x47,0x34,0x8,0x25,0xe5}}
#define EFI_SYSTEM_RESOURCES_TABLE_GUID \
   {0xb122a263, 0x3661, 0x4f68, {0x99,0x29,0x78,0xf8,0xb0,0xd6,0x21,0x80}}
#define EFI_SECTION_TIANO_COMPRESS_GUID \
   {0xa31280ad, 0x481e, 0x41b6, {0x95,0xe8,0x12,0x7f,0x4c,0x98,0x47,0x79}}
#define EFI_SECTION_LZMA_COMPRESS_GUID  \
   {0xee4e5898, 0x3914, 0x4259, {0x9d,0x6e,0xdc,0x7b,0xd7,0x94,0x03,0xcf}}
#define EFI_DXE_SERVICES_TABLE_GUID \
   {0x5ad34ba, 0x6f02, 0x4214, {0x95,0x2e,0x4d,0xa0,0x39,0x8e,0x2b,0xb9}}
#define EFI_HOB_LIST_GUID \
   {0x7739f24c, 0x93d7, 0x11d4, {0x9a,0x3a,0x00,0x90,0x27,0x3f,0xc1,0x4d}}
#define MEMORY_TYPE_INFORMATION_GUID \
   {0x4c19049f, 0x4137, 0x4dd3, {0x9c,0x10,0x8b,0x97,0xa8,0x3f,0xfd,0xfa}}

static EFI_GUID Guid1  = EFI_ACPI_20_TABLE_GUID;
static EFI_GUID Guid2  = ACPI_TABLE_GUID;
static EFI_GUID Guid3  = SAL_SYSTEM_TABLE_GUID;
static EFI_GUID Guid4  = SMBIOS_TABLE_GUID;
static EFI_GUID Guid5  = SMBIOS3_TABLE_GUID;
static EFI_GUID Guid6  = MPS_TABLE_GUID;
static EFI_GUID Guid7  = EFI_PROPERTIES_TABLE_GUID;
static EFI_GUID Guid8  = EFI_SYSTEM_RESOURCES_TABLE_GUID;
static EFI_GUID Guid9  = EFI_SECTION_TIANO_COMPRESS_GUID;
static EFI_GUID Guid10 = EFI_SECTION_LZMA_COMPRESS_GUID;
static EFI_GUID Guid11 = EFI_DXE_SERVICES_TABLE_GUID;
static EFI_GUID Guid12 = EFI_HOB_LIST_GUID;
static EFI_GUID Guid13 = MEMORY_TYPE_INFORMATION_GUID;

static struct {
    EFI_GUID  *Guid;
    CHAR16    *GuidStr;
} KnownGuids[] = {
    { &Guid1,  L"ACPI 2.0 table" },
    { &Guid2,  L"ACPI 1.0 table" },
    { &Guid3,  L"SAL system table" },
    { &Guid4,  L"SMBIOS table" },
    { &Guid5,  L"SMBIOS 3 table" },
    { &Guid6,  L"MPS table" },
    { &Guid7,  L"EFI properties table" },
    { &Guid8,  L"ESRT table" },
    { &Guid9,  L"Tiano compress" },
    { &Guid10, L"LZMA compress" },
    { &Guid11, L"DXE services" },
    { &Guid12, L"HOB list" },
    { &Guid13, L"Memory type information" },
    { NULL }
};


static void
Usage(void)
{
    Print(L"Usage: listect [-v|--verbose]\n");
}


INTN
EFIAPI
ShellAppMain(UINTN Argc, CHAR16 **Argv)
{
    EFI_CONFIGURATION_TABLE *ect = gST->ConfigurationTable;
    int Verbose = 0;

    if (Argc == 2) {
        if (!StrCmp(Argv[1], L"--verbose") ||
            !StrCmp(Argv[1], L"-v")) {
            Verbose = 1;
        }
        if (!StrCmp(Argv[1], L"--help") ||
            !StrCmp(Argv[1], L"-h") ||
            !StrCmp(Argv[1], L"-?")) {
            Usage();
            return EFI_SUCCESS;
        }
    }

    for (int i = 0; i < gST->NumberOfTableEntries; i++) {
        Print(L"%03d  %g", i, ect->VendorGuid);
        if (Verbose) {
            for (int j=0; KnownGuids[j].Guid; j++) {
                if (!CompareMem(&ect->VendorGuid, KnownGuids[j].Guid, sizeof(Guid1))) {
                    Print(L"  %s", KnownGuids[j].GuidStr);
                    break;
                }
            }
        }
        Print(L"\n");
        ect++;
    }

    return EFI_SUCCESS;
}


There is nothing unusual in the source code other than the use of a small hardwired list of GUIDS with brief descriptions. For this utility to be useful in an actual forensics setting, it would be better if the utility referenced an externally supplied GUID list. If I have time, I will enhance the utility to read such an external file in a future post.

Here is the build .INF file for the utility. Note it has only been build on an Intel x64 platform (Fedora 22).

[Defines]
  INF_VERSION                    = 0x00010006
  BASE_NAME                      = listect 
  FILE_GUID                      = 4ea87c51-7395-4ccd-0355-747010f3ce51
  MODULE_TYPE                    = UEFI_APPLICATION
  VERSION_STRING                 = 0.1
  ENTRY_POINT                    = ShellCEntryLib
  VALID_ARCHITECTURES            = X64

[Sources]
  listect.c

[Packages]
  MdePkg/MdePkg.dec
  ShellPkg/ShellPkg.dec


[LibraryClasses]
  ShellCEntryLib
  ShellLib
  BaseLib
  BaseMemoryLib
  UefiLib

[Protocols]

[BuildOptions]

[Pcd]


Note you will have to modify the source code if you wish to build the utility in a GNU EFI environment and provide your own Makefile.

Here is sample output for a Lenovo T450:

fs0> listect -h
Usage: listect [-v|--verbose]

fs0> listect
000  A31280AD-481E-41B6-95E8-127F4C984779
001  EE4E5898-3914-4259-9D6E-DC7BD79403CF
002  05AD34BA-6F02-4214-952E-4DA0398E2BB9
003  7739F24C-93D7-11D4-9A3A-0090273FC14D
004  4C19049F-4137-4DD3-9C10-8B97A83FFDFA
005  49152E77-1ADA-4764-B7A2-7AFEFED95E8B
006  EB9D2D30-2D88-11D3-9A16-0090273FC14D
007  8868E871-E4F1-11D3-BC22-0080C73C8881
008  7E791691-5752-4392-B888-EFF9C74F5D77
009  EB9D2D31-2D88-11D3-9A16-0090273FC14D
010  B122A263-3661-4F68-9929-78F8B0D62180

fs0> listect -v
000  A31280AD-481E-41B6-95E8-127F4C984779  Tiano compress
001  EE4E5898-3914-4259-9D6E-DC7BD79403CF  LZMA compress
002  05AD34BA-6F02-4214-952E-4DA0398E2BB9  DXE services
003  7739F24C-93D7-11D4-9A3A-0090273FC14D  HOB list
004  4C19049F-4137-4DD3-9C10-8B97A83FFDFA  Memory type information
005  49152E77-1ADA-4764-B7A2-7AFEFED95E8B
006  EB9D2D30-2D88-11D3-9A16-0090273FC14D  ACPI 1.0 table
007  8868E871-E4F1-11D3-BC22-0080C73C8881  ACPI 2.0 table
008  7E791691-5752-4392-B888-EFF9C74F5D77
009  EB9D2D31-2D88-11D3-9A16-0090273FC14D  SMBIOS table
010  B122A263-3661-4F68-9929-78F8B0D62180  ESRT table


For some reason Lenovo is exposing the older Tiano compression and ACPI 1.0 protocols.

Here is the output when invoked from the EFI shell in VMware Workstation 10:

000  EE4E5898-3914-4259-9D6E-DC7BD79403CF  LZMA compress
001  05AD34BA-6F02-4214-952E-4DA0398E2BB9  DXE services
002  7739F24C-93D7-11D4-9A3A-0090273FC14D  HOB list
003  4C19049F-4137-4DD3-9C10-8B97A83FFDFA  Memory type information
004  49152E77-1ADA-4764-B7A2-7AFEFED95E8B
005  EB9D2D31-2D88-11D3-9A16-0090273FC14D  SMBIOS table
006  8868E871-E4F1-11D3-BC22-0080C73C8881  ACPI 2.0 table


As you can see, this firmware does not yet support the EFI System Resources Table (ESRT). It has the same mysterious GUID, 49152E77-1ADA-4764-B7A2-7AFEFED95E8B, as the Lenovo firmware. If anybody knows what protocol this GUID exposes, please email me.

Enjoy!

P.S Jessica Gomez emailed me in December 2016 to inform me that my mysterious GUID was defined in the EDK2 EdkCompatibilityPkg as EFI_DEBUG_IMAGE_INFO_TABLE_GUID. Thanks Jessica!

Comments are closed.