admin/chipsec-chipsec
1
0
Fork 0
mirror of https://github.com/chipsec/chipsec synced 2026-06-08 13:31:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Better remap.py logic if not reading REMAP registers properly

Browse Source
This commit is contained in:
Aaron Frinzell
2021-12-03 15:45:06 -06:00
committed by BrentHoltsclaw
parent 613bd8e715
commit 8de16fcac9
1 changed files with 27 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
chipsec/modules/common/remap.py
+27 -10
View File
@@ -23,7 +23,7 @@
Check Memory Remapping Configuration
Reference:
`Preventing & Detecting Xen Hypervisor Subversions <http://www.invisiblethingslab.com/resources/bh08/part2-full.pdf>`_ by Joanna Rutkowska & Rafal Wojtczuk
`Preventing & Detecting Xen Hypervisor Subversions <http://www.invisiblethingslab.com/resources/bh08/part2-full.pdf>`_ by Joanna Rutkowska & Rafal Wojtczuk
Usage:
``chipsec_main -m common.remap``
@@ -31,7 +31,15 @@ Usage:
Example:
>>> chipsec_main.py -m common.remap
.. note:: This module will only run on Core platforms.
Registers used:
- PCI0.0.0_REMAPBASE
- PCI0.0.0_REMAPLIMIT
- PCI0.0.0_TOUUD
- PCI0.0.0_TOLUD
- PCI0.0.0_TSEGMB
.. note::
This module will only run on Core platforms.
"""
@@ -60,7 +68,7 @@ class remap(BaseModule):
return False
def check_remap_config(self):
is_warning = False
if not self.cs.is_register_defined('PCI0.0.0_REMAPBASE' ) or \
not self.cs.is_register_defined('PCI0.0.0_REMAPLIMIT') or \
not self.cs.is_register_defined('PCI0.0.0_TOUUD' ) or \
@@ -106,11 +114,15 @@ class remap(BaseModule):
remap_ok = True
self.logger.log( "[*] checking memory remap configuration.." )
if remapbase > remaplimit:
self.logger.log( "[*] Memory Remap is disabled" )
self.logger.log("[*] Checking memory remap configuration..")
if remapbase == remaplimit:
self.logger.log("[!] Memory Remap status is Unknown")
is_warning = True
elif remapbase > remaplimit:
self.logger.log("[*] Memory Remap is disabled")
else:
self.logger.log( "[*] Memory Remap is enabled" )
self.logger.log("[*] Memory Remap is enabled")
remaplimit_addr = (remaplimit|0xFFFFF)
ok = ((remaplimit_addr + 1) == touud)
remap_ok = remap_ok and ok
@@ -125,7 +137,7 @@ class remap(BaseModule):
if ok: self.logger.log_good(" All addresses are 1MB aligned")
else: self.logger.log_bad(" Not all addresses are 1MB aligned")
self.logger.log( "[*] checking if memory remap configuration is locked.." )
self.logger.log( "[*] Checking if memory remap configuration is locked.." )
ok = (0 != touud_lock) or (0 != ia_untrusted)
remap_ok = remap_ok and ok
if ok: self.logger.log_good(" TOUUD is locked")
@@ -142,8 +154,13 @@ class remap(BaseModule):
else: self.logger.log_bad(" REMAPBASE and REMAPLIMIT are not locked")
if remap_ok:
res = ModuleResult.PASSED
self.logger.log_passed("Memory Remap is configured correctly and locked")
if is_warning:
self.logger.log_warning("Most Memory Remap registers are configured correctly and locked")
self.logger.log("[!] Manual verification of REMAP BASE and LIMIT register values may be needed.")
res = ModuleResult.WARNING
else:
res = ModuleResult.PASSED
self.logger.log_passed("Memory Remap is configured correctly and locked")
else:
res = ModuleResult.FAILED
self.logger.log_failed("Memory Remap is not properly configured/locked. Remaping attack may be possible")