mirror of
https://github.com/chipsec/chipsec
synced 2026-06-08 13:31:00 +00:00
CHIPSEC
ac2ca7264f
UEFI shell. 2. Decompression of images in SPI flash parsing is only supported in Windows. 3. UEFI - Support for IA32 and i586 (Quark) 4. Added capability to use modules from an arbitrary path with the -I / --import command line option 5. Module functionality encapsulated in class inheriting BaseModule 6. Fixed loading platform specific configuration 7. Fixed issue with modules which run on multiple logical CPUs hanging on Bay Trail (Windows/Linux). The issue still exist when running from UEFI shell 8. Added template for a module - module_template.py 9. Added options to flush log files 10. Added ability to define custom platforms Driver changes: 1. Windows - Added IOCTL_ALLOC_PHYSMEM to allocate physical memory buffer 2. Linux - Fix wrpci defect
99 lines
4.2 KiB
Python
99 lines
4.2 KiB
Python
#CHIPSEC: Platform Security Assessment Framework
|
|
#Copyright (c) 2010-2014, Intel Corporation
|
|
#
|
|
#This program is free software; you can redistribute it and/or
|
|
#modify it under the terms of the GNU General Public License
|
|
#as published by the Free Software Foundation; Version 2.
|
|
#
|
|
#This program is distributed in the hope that it will be useful,
|
|
#but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
#MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
#GNU General Public License for more details.
|
|
#
|
|
#You should have received a copy of the GNU General Public License
|
|
#along with this program; if not, write to the Free Software
|
|
#Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
#
|
|
#Contact information:
|
|
#chipsec@intel.com
|
|
#
|
|
|
|
|
|
|
|
## \addtogroup modules
|
|
# __chipsec/modules/common/bios_kbrd_buffer.py__ - checks for BIOS/HDD password exposure thorugh BIOS keyboard buffer
|
|
#
|
|
|
|
## \file
|
|
# checks for exposure of pre-boot passwords (BIOS/HDD/pre-bot authentication SW) in the BIOS keyboard buffer
|
|
#
|
|
# __chipsec/modules/common/bios_kbrd_buffer.py__
|
|
# This vulnerability is disclosed by Jonathan Brossard in
|
|
# 'Bypassing pre-boot authentication passwords by instrumenting the BIOS keyboard buffer'
|
|
#
|
|
|
|
|
|
|
|
|
|
from chipsec.hal.mmio import *
|
|
from chipsec.hal.spi import *
|
|
from chipsec.module_common import *
|
|
|
|
TAGS = [MTAG_BIOS]
|
|
|
|
COMMON_FILL_PTRN = "".join( ['%c' % chr(x + 0x1E) for x in range(32)] )
|
|
|
|
|
|
class bios_kbrd_buffer(BaseModule):
|
|
def __init__(self):
|
|
BaseModule.__init__(self)
|
|
|
|
def check_BIOS_keyboard_buffer(self):
|
|
self.logger.start_test( "Pre-boot Passwords in the BIOS Keyboard Buffer" )
|
|
|
|
bios_kbrd_buf_clear = 0
|
|
|
|
kbrd_buf_head = self.cs.mem.read_physical_mem_dword( 0x41A ) & 0x000000FF
|
|
kbrd_buf_tail = self.cs.mem.read_physical_mem_dword( 0x41C ) & 0x000000FF
|
|
self.logger.log( "[*] Keyboard buffer head pointer = 0x%X (at 0x41A), tail pointer = 0x%X (at 0x41C)" % (kbrd_buf_head,kbrd_buf_tail) )
|
|
bios_kbrd_buf = self.cs.mem.read_physical_mem( 0x41E, 32 )
|
|
self.logger.log( "[*] Keyboard buffer contents (at 0x41E):" )
|
|
print_buffer( bios_kbrd_buf )
|
|
|
|
#try:
|
|
#s = struct.unpack( '32c', bios_kbrd_buf.raw )
|
|
s = struct.unpack( '32c', bios_kbrd_buf )
|
|
#except:
|
|
# self.logger.error( 'Cannot convert buffer to char sequence' )
|
|
# return -1
|
|
|
|
has_contents = False
|
|
|
|
if COMMON_FILL_PTRN == bios_kbrd_buf:
|
|
self.logger.log_passed_check( "Keyboard buffer is filled with common fill pattern" )
|
|
return ModuleResult.PASSED
|
|
|
|
for x in range(32):
|
|
if ( chr(0) != s[x] and chr(0x20) != s[x] ):
|
|
has_contents = True
|
|
break
|
|
|
|
if (0x1E < kbrd_buf_tail) and (kbrd_buf_tail <= 0x1E+32):
|
|
#has_contents = True
|
|
self.logger.log_bad( "Keyboard buffer tail points inside the buffer (= 0x%X)" % kbrd_buf_tail )
|
|
self.logger.log( " It may potentially expose lengths of pre-boot passwords. Was your password %d characters long?" % ((kbrd_buf_tail+2 - 0x1E)/2) )
|
|
|
|
self.logger.log( "[*] Checking contents of the keyboard buffer..\n" )
|
|
|
|
if has_contents: self.logger.log_warn_check( "Keyboard buffer is not empty. The test cannot determine conclusively if it contains pre-boot passwords.\n The contents might have not been cleared by pre-boot firmware or overwritten with garbage.\n Visually inspect the contents of keyboard buffer for pre-boot passwords (BIOS, HDD, full-disk encryption)." )
|
|
else: self.logger.log_passed_check( "Keyboard buffer looks empty. Pre-boot passwords don't seem to be exposed" )
|
|
|
|
return (ModuleResult.WARNING if has_contents else ModuleResult.PASSED)
|
|
|
|
# --------------------------------------------------------------------------
|
|
# run( module_argv )
|
|
# Required function: run here all tests from this module
|
|
# --------------------------------------------------------------------------
|
|
def run( self, module_argv ):
|
|
return self.check_BIOS_keyboard_buffer()
|