From 4e2dd42eec8c6d15d06ae8be80377645369abb3c Mon Sep 17 00:00:00 2001 From: Assaf Carlsbad Date: Sat, 27 Feb 2021 21:25:16 +0200 Subject: [PATCH] Try to modify other variables as well. --- chipsec/modules/common/uefi/access_uefispec.py | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/chipsec/modules/common/uefi/access_uefispec.py b/chipsec/modules/common/uefi/access_uefispec.py index 5ef611bd..67363221 100644 --- a/chipsec/modules/common/uefi/access_uefispec.py +++ b/chipsec/modules/common/uefi/access_uefispec.py @@ -136,6 +136,7 @@ class access_uefispec(BaseModule): uefispec_concern = [] ro_concern = [] + rw_variables = [] self.logger.log('[*] Testing UEFI variables ..') for name in vars.keys(): @@ -164,12 +165,15 @@ class access_uefispec(BaseModule): if do_modify: #self.logger.log('uefispec_ro_vars') + self.logger.log("[*] Testing modification of {} ..".format(name)) if name in self.uefispec_ro_vars: - self.logger.log("[*] Testing modification of {} ..".format(name)) if self.can_modify(name, guid, data): ro_concern.append(name) self.logger.log_bad("Variable {} should be read only.".format(name)) res = ModuleResult.FAILED + else: + if self.can_modify(name, guid, data): + rw_variables.append(name) if uefispec_concern: self.logger.log('') @@ -184,6 +188,12 @@ class access_uefispec(BaseModule): for name in ro_concern: self.logger.log(' {}'.format(name)) + if rw_variables: + self.logger.log('') + self.logger.log_unknown('Variables that are read-write (manual investigation is required):') + for name in rw_variables: + self.logger.log(' {}'.format(name)) + self.logger.log('') if ModuleResult.PASSED == res: self.logger.log_passed_check( 'All checked EFI variables are protected according to spec.' )