catm: Make sure we close all open protocols on exit.
This commit is contained in:
parent
3528be5b2b
commit
74a5685102
|
@ -9,7 +9,7 @@ DEFINE add_rsp, 4883C4
|
||||||
DEFINE call E8
|
DEFINE call E8
|
||||||
DEFINE call_[rcx+BYTE] FF51
|
DEFINE call_[rcx+BYTE] FF51
|
||||||
DEFINE call_[r14+BYTE] 41FF56
|
DEFINE call_[r14+BYTE] 41FF56
|
||||||
DEFINE call_[r14+QWORD] 41FF96
|
DEFINE call_[r14+DWORD] 41FF96
|
||||||
DEFINE cmp_al, 3C
|
DEFINE cmp_al, 3C
|
||||||
DEFINE cmp_rax, 483D
|
DEFINE cmp_rax, 483D
|
||||||
DEFINE cmp_rbx,rdx 4839D3
|
DEFINE cmp_rbx,rdx 4839D3
|
||||||
|
@ -17,31 +17,33 @@ DEFINE cmp_r8, 4983F8
|
||||||
DEFINE je 74
|
DEFINE je 74
|
||||||
DEFINE jmp EB
|
DEFINE jmp EB
|
||||||
DEFINE jne 75
|
DEFINE jne 75
|
||||||
|
DEFINE lea_rdx,[rip+DWORD] 488D15
|
||||||
DEFINE mov_rdx, 48C7C2
|
DEFINE mov_rdx, 48C7C2
|
||||||
DEFINE mov_rax,rdi 4889C7
|
DEFINE mov_rax,rdi 4889C7
|
||||||
DEFINE mov_rbx,rax 4889C3
|
DEFINE mov_rbx,rax 4889C3
|
||||||
|
DEFINE mov_rcx,rax 4889C1
|
||||||
DEFINE mov_rcx,rbx 4889D9
|
DEFINE mov_rcx,rbx 4889D9
|
||||||
|
DEFINE mov_rcx,r12 4C89E1
|
||||||
DEFINE mov_rcx,r13 4C89E9
|
DEFINE mov_rcx,r13 4C89E9
|
||||||
DEFINE mov_rcx,r15 4C89F9
|
DEFINE mov_rcx,r15 4C89F9
|
||||||
DEFINE mov_rdx,rax 4889C2
|
DEFINE mov_rdx,rax 4889C2
|
||||||
DEFINE mov_rdx,rbx 4889DA
|
DEFINE mov_rdx,rbx 4889DA
|
||||||
DEFINE mov_rdx,rsp 4889E2
|
DEFINE mov_rdx,rsp 4889E2
|
||||||
DEFINE mov_rbp,rsp 4889E5
|
|
||||||
DEFINE mov_rsp,rbp 4889EC
|
|
||||||
DEFINE mov_r8,rbx 4989D8
|
DEFINE mov_r8,rbx 4989D8
|
||||||
DEFINE mov_r8,rsp 4989E0
|
DEFINE mov_r8,rsp 4989E0
|
||||||
DEFINE mov_r9,r15 4D89F9
|
DEFINE mov_r8,r12 4D89E0
|
||||||
|
DEFINE mov_r9,r12 4D89E1
|
||||||
|
DEFINE mov_r12,rcx 4989CC
|
||||||
DEFINE mov_r13,rsi 4989F5
|
DEFINE mov_r13,rsi 4989F5
|
||||||
DEFINE mov_r15,rcx 4989CF
|
|
||||||
DEFINE mov_al,[rbx] 8A03
|
DEFINE mov_al,[rbx] 8A03
|
||||||
DEFINE mov_rax,[rsp+BYTE] 488B4424
|
DEFINE mov_rax,[rsp+BYTE] 488B4424
|
||||||
DEFINE mov_rbx,[rdi+BYTE] 488B5F
|
DEFINE mov_rbx,[rdi+BYTE] 488B5F
|
||||||
DEFINE mov_rcx,[rdi+BYTE] 488B4F
|
DEFINE mov_rcx,[rdi+BYTE] 488B4F
|
||||||
DEFINE mov_rcx,[rsp+BYTE] 488B4C24
|
DEFINE mov_rcx,[rsp+BYTE] 488B4C24
|
||||||
DEFINE mov_r14,[rdx+BYTE] 4C8B72
|
DEFINE mov_r14,[rdx+BYTE] 4C8B72
|
||||||
DEFINE mov_rcx,[rip+QWORD] 488B0D
|
DEFINE mov_rcx,[rip+DWORD] 488B0D
|
||||||
DEFINE mov_rdx,[rip+QWORD] 488B15
|
DEFINE mov_[rip+DWORD],rax 488905
|
||||||
DEFINE mov_[rip+QWORD],rax 488905
|
DEFINE mov_[rip+DWORD],rcx 48890D
|
||||||
DEFINE mov_[rbx], C603
|
DEFINE mov_[rbx], C603
|
||||||
DEFINE pop_rax 58
|
DEFINE pop_rax 58
|
||||||
DEFINE pop_rcx 59
|
DEFINE pop_rcx 59
|
||||||
|
@ -57,48 +59,29 @@ DEFINE ret C3
|
||||||
DEFINE ror_r9 49D1C9
|
DEFINE ror_r9 49D1C9
|
||||||
DEFINE sub_rbx, 4883EB
|
DEFINE sub_rbx, 4883EB
|
||||||
DEFINE sub_rsp, 4883EC
|
DEFINE sub_rsp, 4883EC
|
||||||
DEFINE test_eax,eax 85C0
|
|
||||||
DEFINE xor_eax,eax 31C0
|
DEFINE xor_eax,eax 31C0
|
||||||
|
DEFINE test_eax,eax 85C0
|
||||||
|
DEFINE xor_r9,r9 4D31C9
|
||||||
|
|
||||||
# efi_main(void *image_handle, struct efi_system_table *system)
|
# efi_main(void *image_handle, struct efi_system_table *system)
|
||||||
:_start
|
:_start
|
||||||
|
mov_r12,rcx # save image_handle
|
||||||
mov_rbp,rsp # save stack pointer
|
|
||||||
mov_r15,rcx # save image_handle
|
|
||||||
mov_r14,[rdx+BYTE] !96 # system->boot
|
mov_r14,[rdx+BYTE] !96 # system->boot
|
||||||
|
|
||||||
# Open Loaded Image protocol
|
# Open Loaded Image protocol
|
||||||
push_rax # allocate stack for image
|
mov_r9,r12 # arg4 = image_handle
|
||||||
mov_r8,rsp # arg3 = &image
|
lea_rdx,[rip+DWORD] %LOADED_IMAGE_PROTOCOL # guid = &LOADED_IMAGE_PROTOCOL
|
||||||
mov_rdx,[rip+QWORD] %LOADED_IMAGE_PROTOCOL_8 # EFI_LOADED_IMAGE_PROTOCOL_GUID (last 64 bits)
|
mov_rcx,r12 # arg1 = image_handle
|
||||||
push_rdx # push last 64 bits onto stack
|
call %open_protocol # open protocol
|
||||||
mov_rdx,[rip+QWORD] %LOADED_IMAGE_PROTOCOL # EFI_LOADED_IMAGE_PROTOCOL_GUID (first 64 bits)
|
|
||||||
push_rdx # push first 64 bits onto stack
|
|
||||||
mov_rdx,rsp # arg2 = &guid
|
|
||||||
push !1 # arg6 = EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL
|
|
||||||
push !0 # arg5 = NULL
|
|
||||||
mov_r9,r15 # arg4 = image_handle
|
|
||||||
mov_rcx,r15 # arg1 = image_handle
|
|
||||||
sub_rsp, !32 # allocate shadow stack space for UEFI function
|
|
||||||
call_[r14+QWORD] %280 # system->boot->open_protocol(image_handle, &guid, &image, image_handle, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL)
|
|
||||||
mov_rax,[rsp+BYTE] !64 # get_image
|
|
||||||
mov_rax,rdi # save image
|
mov_rax,rdi # save image
|
||||||
|
|
||||||
# Get root file system
|
# Get root file system
|
||||||
push_rax # allocate stack for rootfs
|
mov_r9,r12 # arg4 = image_handle
|
||||||
mov_r8,rsp # arg3 = &rootfs
|
lea_rdx,[rip+DWORD] %SIMPLE_FS_PROTOCOL # guid = &SIMPLE_FS_PROTOCOL
|
||||||
mov_rdx,[rip+QWORD] %SIMPLE_FS_PROTOCOL_8 # EFI_SIMPLE_FILE_SYSTEM_PROTOCOL_GUID (last 64 bits)
|
|
||||||
push_rdx # push last 64 bits onto stack
|
|
||||||
mov_rdx,[rip+QWORD] %SIMPLE_FS_PROTOCOL # EFI_SIMPLE_FILE_SYSTEM_PROTOCOL_GUID (first 64 bits)
|
|
||||||
push_rdx # push first 64 bits onto stack
|
|
||||||
mov_rdx,rsp # arg2 = &guid
|
|
||||||
push !1 # arg6 = EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL
|
|
||||||
push !0 # arg5 = NULL
|
|
||||||
mov_r9,r15 # arg4 = image_handle
|
|
||||||
mov_rcx,[rdi+BYTE] !24 # arg1 = root_device = image->device
|
mov_rcx,[rdi+BYTE] !24 # arg1 = root_device = image->device
|
||||||
sub_rsp, !32 # allocate shadow stack space for UEFI function
|
mov_[rip+DWORD],rcx %root_device # save root_device
|
||||||
call_[r14+QWORD] %280 # system->boot->open_protocol(root_device, &guid, &rootfs, image_handle, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL)
|
call %open_protocol # open protocol
|
||||||
mov_rcx,[rsp+BYTE] !64 # get rootfs
|
mov_rcx,rax # get rootfs
|
||||||
|
|
||||||
# Get root directory
|
# Get root directory
|
||||||
push_rdx # allocate stack for rootdir
|
push_rdx # allocate stack for rootdir
|
||||||
|
@ -109,7 +92,7 @@ DEFINE xor_eax,eax 31C0
|
||||||
pop_rax # deallocate stack
|
pop_rax # deallocate stack
|
||||||
pop_rax # deallocate stack
|
pop_rax # deallocate stack
|
||||||
pop_rax # get rootdir
|
pop_rax # get rootdir
|
||||||
mov_[rip+QWORD],rax %rootdir # save rootdir
|
mov_[rip+DWORD],rax %rootdir # save rootdir
|
||||||
|
|
||||||
# Push command line arguments onto stack
|
# Push command line arguments onto stack
|
||||||
mov_rbx,[rdi+BYTE] !56 # options = image->load_options
|
mov_rbx,[rdi+BYTE] !56 # options = image->load_options
|
||||||
|
@ -138,7 +121,7 @@ DEFINE xor_eax,eax 31C0
|
||||||
push !7 # to get 0x8000000000000003 we set the rightmost 3 bits
|
push !7 # to get 0x8000000000000003 we set the rightmost 3 bits
|
||||||
pop_r9 # and then do right rotation by 1
|
pop_r9 # and then do right rotation by 1
|
||||||
ror_r9 # arg4 = EFI_FILE_MODE_CREATE| EFI_FILE_MODE_WRITE | EFI_FILE_MODE_READ
|
ror_r9 # arg4 = EFI_FILE_MODE_CREATE| EFI_FILE_MODE_WRITE | EFI_FILE_MODE_READ
|
||||||
mov_rcx,[rip+QWORD] %rootdir # arg1 = rootdir
|
mov_rcx,[rip+DWORD] %rootdir # arg1 = rootdir
|
||||||
sub_rsp, !32 # allocate shadow stack space for UEFI function
|
sub_rsp, !32 # allocate shadow stack space for UEFI function
|
||||||
call_[rcx+BYTE] !8 # rootdir->open()
|
call_[rcx+BYTE] !8 # rootdir->open()
|
||||||
add_rsp, !40 # deallocate stack
|
add_rsp, !40 # deallocate stack
|
||||||
|
@ -178,14 +161,23 @@ DEFINE xor_eax,eax 31C0
|
||||||
mov_rcx,r15 # Get output file
|
mov_rcx,r15 # Get output file
|
||||||
call %close_file # close it
|
call %close_file # close it
|
||||||
|
|
||||||
mov_rcx,[rip+QWORD] %rootdir # Get rootdir
|
mov_rcx,[rip+DWORD] %rootdir # Get rootdir
|
||||||
call %rootdir # close it
|
call %close_file # close it
|
||||||
|
|
||||||
mov_rcx,rbx # Get buffer
|
mov_rcx,rbx # Get buffer
|
||||||
call %free_pool # release it
|
call %free_pool # release it
|
||||||
xor_eax,eax # Exit code 0
|
xor_eax,eax # Exit code 0
|
||||||
|
|
||||||
mov_rsp,rbp # restore stack
|
mov_r8,r12 # arg3 = image_handle
|
||||||
|
lea_rdx,[rip+DWORD] %SIMPLE_FS_PROTOCOL # EFI_SIMPLE_FILE_SYSTEM_PROTOCOL_GUID
|
||||||
|
mov_rcx,[rip+DWORD] %root_device # arg1 = root_device
|
||||||
|
call %close_protocol # close protocol
|
||||||
|
|
||||||
|
mov_r8,r12 # arg3 = image_handle
|
||||||
|
lea_rdx,[rip+DWORD] %LOADED_IMAGE_PROTOCOL # EFI_LOADED_IMAGE_PROTOCOL_GUID
|
||||||
|
mov_rcx,r12 # arg1 = image_handle
|
||||||
|
call %close_protocol # close protocol
|
||||||
|
|
||||||
ret # return to UEFI
|
ret # return to UEFI
|
||||||
|
|
||||||
# r8: input file name
|
# r8: input file name
|
||||||
|
@ -197,7 +189,7 @@ DEFINE xor_eax,eax 31C0
|
||||||
push !1 # arg5 = EFI_FILE_READ_ONLY
|
push !1 # arg5 = EFI_FILE_READ_ONLY
|
||||||
push !1 # prepare to set arg4 to EFI_FILE_MODE_READ
|
push !1 # prepare to set arg4 to EFI_FILE_MODE_READ
|
||||||
pop_r9 # arg4 = EFI_FILE_MODE_READ
|
pop_r9 # arg4 = EFI_FILE_MODE_READ
|
||||||
mov_rcx,[rip+QWORD] %rootdir # arg1 = rootdir
|
mov_rcx,[rip+DWORD] %rootdir # arg1 = rootdir
|
||||||
sub_rsp, !32 # allocate shadow stack space for UEFI function
|
sub_rsp, !32 # allocate shadow stack space for UEFI function
|
||||||
call_[rcx+BYTE] !8 # rootdir->open()
|
call_[rcx+BYTE] !8 # rootdir->open()
|
||||||
add_rsp, !40 # deallocate stack
|
add_rsp, !40 # deallocate stack
|
||||||
|
@ -211,6 +203,31 @@ DEFINE xor_eax,eax 31C0
|
||||||
pop_rax # deallocate stack
|
pop_rax # deallocate stack
|
||||||
ret
|
ret
|
||||||
|
|
||||||
|
# rcx: handle
|
||||||
|
# rdx: &guid
|
||||||
|
# r9: agent_handle
|
||||||
|
# returns interface
|
||||||
|
:open_protocol
|
||||||
|
push_rax # allocate stack for interface
|
||||||
|
mov_r8,rsp # arg3 = &interface
|
||||||
|
push !1 # arg6 = EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL
|
||||||
|
push !0 # arg5 = NULL
|
||||||
|
sub_rsp, !32 # allocate shadow stack space for UEFI function
|
||||||
|
call_[r14+DWORD] %280 # system->boot->open_protocol(handle, &guid, &interface, agent_handle, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL)
|
||||||
|
add_rsp, !48 # deallocate stack
|
||||||
|
pop_rax # get image
|
||||||
|
ret
|
||||||
|
|
||||||
|
# rcx: handle
|
||||||
|
# rdx: &guid
|
||||||
|
# r8: agent_handle
|
||||||
|
:close_protocol
|
||||||
|
xor_r9,r9 # arg4 = NULL
|
||||||
|
sub_rsp, !32 # allocate shadow stack space for UEFI function
|
||||||
|
call_[r14+DWORD] %288 # system->boot->close_protocol(handle, &guid, agent_handle, 0)
|
||||||
|
add_rsp, !32 # deallocate stack
|
||||||
|
ret
|
||||||
|
|
||||||
# rdx: number of bytes to allocate
|
# rdx: number of bytes to allocate
|
||||||
# r14: system->boot
|
# r14: system->boot
|
||||||
# returns pointer in rax
|
# returns pointer in rax
|
||||||
|
@ -269,17 +286,18 @@ DEFINE xor_eax,eax 31C0
|
||||||
%0x5b1b31a1
|
%0x5b1b31a1
|
||||||
@0x9562
|
@0x9562
|
||||||
@0x11d2
|
@0x11d2
|
||||||
:LOADED_IMAGE_PROTOCOL_8
|
|
||||||
!0x8e !0x3f !0 !0xa0 !0xc9 !0x69 !0x72 !0x3b
|
!0x8e !0x3f !0 !0xa0 !0xc9 !0x69 !0x72 !0x3b
|
||||||
|
|
||||||
:SIMPLE_FS_PROTOCOL
|
:SIMPLE_FS_PROTOCOL
|
||||||
%0x0964e5b22
|
%0x0964e5b22
|
||||||
@0x6459
|
@0x6459
|
||||||
@0x11d2
|
@0x11d2
|
||||||
:SIMPLE_FS_PROTOCOL_8
|
|
||||||
!0x8e !0x39 !0 !0xa0 !0xc9 !0x69 !0x72 !0x3b
|
!0x8e !0x39 !0 !0xa0 !0xc9 !0x69 !0x72 !0x3b
|
||||||
|
|
||||||
:rootdir
|
:rootdir
|
||||||
%0 %0
|
%0 %0
|
||||||
|
|
||||||
|
:root_device
|
||||||
|
%0 %0
|
||||||
|
|
||||||
:PE32_end
|
:PE32_end
|
||||||
|
|
|
@ -9,42 +9,23 @@
|
||||||
|
|
||||||
# efi_main(void *image_handle, struct efi_system_table *system)
|
# efi_main(void *image_handle, struct efi_system_table *system)
|
||||||
_start:
|
_start:
|
||||||
mov rbp, rsp # save stack pointer
|
mov r12, rcx # save image_handle
|
||||||
mov r15, rcx # save image_handle
|
|
||||||
mov r14, [rdx+96] # system->boot
|
mov r14, [rdx+96] # system->boot
|
||||||
|
|
||||||
# Open Loaded Image protocol
|
# Open Loaded Image protocol
|
||||||
push rax # allocate stack for image
|
mov r9, r12 # arg4 = image_handle
|
||||||
mov r8, rsp # arg3 = &image
|
lea rdx, [rip+LOADED_IMAGE_PROTOCOL] # guid = &LOADED_IMAGE_PROTOCOL
|
||||||
mov rdx, [rip+LOADED_IMAGE_PROTOCOL+8] # EFI_LOADED_IMAGE_PROTOCOL_GUID (last 64 bits)
|
mov rcx, r12 # arg1 = image_handle
|
||||||
push rdx # push last 64 bits onto stack
|
call open_protocol # open protocol
|
||||||
mov rdx, [rip+LOADED_IMAGE_PROTOCOL] # EFI_LOADED_IMAGE_PROTOCOL_GUID (first 64 bits)
|
|
||||||
push rdx # push first 64 bits onto stack
|
|
||||||
mov rdx, rsp # arg2 = &guid
|
|
||||||
push 1 # arg6 = EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL
|
|
||||||
push 0 # arg5 = NULL
|
|
||||||
mov r9, r15 # arg4 = image_handle
|
|
||||||
mov rcx, r15 # arg1 = image_handle
|
|
||||||
sub rsp, 32 # allocate shadow stack space for UEFI function
|
|
||||||
call [r14+280] # system->boot->open_protocol(image_handle, &guid, &image, image_handle, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL)
|
|
||||||
mov rax, [rsp+64] # get image
|
|
||||||
mov rdi, rax # save image
|
mov rdi, rax # save image
|
||||||
|
|
||||||
# Get root file system
|
# Get root file system
|
||||||
push rax # allocate stack for rootfs
|
mov r9, r12 # arg4 = image_handle
|
||||||
mov r8, rsp # arg3 = &rootfs
|
lea rdx, [rip+SIMPLE_FS_PROTOCOL] # guid = &SIMPLE_FS_PROTOCOL
|
||||||
mov rdx, [rip+SIMPLE_FS_PROTOCOL+8] # EFI_SIMPLE_FILE_SYSTEM_PROTOCOL_GUID (last 64 bits)
|
|
||||||
push rdx # push last 64 bits onto stack
|
|
||||||
mov rdx, [rip+SIMPLE_FS_PROTOCOL] # EFI_SIMPLE_FILE_SYSTEM_PROTOCOL_GUID (first 64 bits)
|
|
||||||
push rdx # push first 64 bits onto stack
|
|
||||||
mov rdx, rsp # arg2 = &guid
|
|
||||||
push 1 # arg6 = EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL
|
|
||||||
push 0 # arg5 = NULL
|
|
||||||
mov r9, r15 # arg4 = image_handle
|
|
||||||
mov rcx, [rdi+24] # arg1 = root_device = image->device
|
mov rcx, [rdi+24] # arg1 = root_device = image->device
|
||||||
sub rsp, 32 # allocate shadow stack space for UEFI function
|
mov [rip+root_device], rcx # save root_device
|
||||||
call [r14+280] # system->boot->open_protocol(root_device, &guid, &rootfs, image_handle, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL)
|
call open_protocol # open protocol
|
||||||
mov rcx, [rsp+64] # get rootfs
|
mov rcx, rax # get rootfs
|
||||||
|
|
||||||
push rdx # allocate stack for rootdir
|
push rdx # allocate stack for rootdir
|
||||||
mov rdx, rsp # arg2 = &rootdir
|
mov rdx, rsp # arg2 = &rootdir
|
||||||
|
@ -130,7 +111,16 @@ done:
|
||||||
call free_pool # release it
|
call free_pool # release it
|
||||||
xor eax, eax # Exit code 0
|
xor eax, eax # Exit code 0
|
||||||
|
|
||||||
mov rsp, rbp # restore stack pointer
|
mov r8, r12 # arg3 = image_handle
|
||||||
|
lea rdx, [rip+SIMPLE_FS_PROTOCOL] # EFI_SIMPLE_FILE_SYSTEM_PROTOCOL_GUID
|
||||||
|
mov rcx, [rip+root_device] # arg1 = root_device
|
||||||
|
call close_protocol # close protocol
|
||||||
|
|
||||||
|
mov r8, r12 # arg3 = image_handle
|
||||||
|
lea rdx, [rip+LOADED_IMAGE_PROTOCOL] # EFI_LOADED_IMAGE_PROTOCOL_GUID
|
||||||
|
mov rcx, r12 # arg1 = image_handle
|
||||||
|
call close_protocol # close protocol
|
||||||
|
|
||||||
ret # return to UEFI
|
ret # return to UEFI
|
||||||
|
|
||||||
# r8: input file name
|
# r8: input file name
|
||||||
|
@ -156,6 +146,32 @@ close_file:
|
||||||
pop rax # deallocate stack
|
pop rax # deallocate stack
|
||||||
ret
|
ret
|
||||||
|
|
||||||
|
# rcx: handle
|
||||||
|
# rdx: &guid
|
||||||
|
# r9: agent_handle
|
||||||
|
# returns interface
|
||||||
|
open_protocol:
|
||||||
|
push rax # allocate stack for interface
|
||||||
|
mov r8, rsp # arg3 = &interface
|
||||||
|
push 1 # arg6 = EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL
|
||||||
|
push 0 # arg5 = NULL
|
||||||
|
sub rsp, 32 # allocate shadow stack space for UEFI function
|
||||||
|
call [r14+280] # system->boot->open_protocol(handle, &guid, &interface, agent_handle, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL)
|
||||||
|
add rsp, 48 # deallocate stack
|
||||||
|
pop rax # get image
|
||||||
|
ret
|
||||||
|
|
||||||
|
# rcx: handle
|
||||||
|
# rdx: &guid
|
||||||
|
# r8: agent_handle
|
||||||
|
close_protocol:
|
||||||
|
xor r9, r9 # arg4 = NULL
|
||||||
|
sub rsp, 32 # allocate shadow stack space for UEFI function
|
||||||
|
call [r14+288] # system->boot->close_protocol(handle, &guid, agent_handle, 0)
|
||||||
|
add rsp, 32 # deallocate stack
|
||||||
|
ret
|
||||||
|
|
||||||
|
|
||||||
# rdx: number of bytes to allocate
|
# rdx: number of bytes to allocate
|
||||||
# r14: system->boot
|
# r14: system->boot
|
||||||
# returns pointer in rax
|
# returns pointer in rax
|
||||||
|
@ -225,3 +241,6 @@ SIMPLE_FS_PROTOCOL:
|
||||||
|
|
||||||
rootdir:
|
rootdir:
|
||||||
.long 0, 0
|
.long 0, 0
|
||||||
|
|
||||||
|
root_device:
|
||||||
|
.long 0, 0
|
||||||
|
|
|
@ -137,42 +137,23 @@ F0 00 # SizeOfOptionalHeader
|
||||||
# efi_main(void *image_handle, struct efi_system_table *system)
|
# efi_main(void *image_handle, struct efi_system_table *system)
|
||||||
:_start
|
:_start
|
||||||
|
|
||||||
4889E5 ; mov_rbp,rsp # save stack pointer
|
4989CC ; mov_r12,rcx # save image_handle
|
||||||
4989CF ; mov_r15,rcx # save image_handle
|
|
||||||
4C8B72 60 ; mov_r14,[rdx+BYTE] !96 # system->boot
|
4C8B72 60 ; mov_r14,[rdx+BYTE] !96 # system->boot
|
||||||
|
|
||||||
# Open Loaded Image protocol
|
# Open Loaded Image protocol
|
||||||
50 ; push_rax # allocate stack for image
|
4D89E1 ; mov_r9,r12 # arg4 = image_handle
|
||||||
4989E0 ; mov_r8,rsp # arg3 = &image
|
488D15 %LOADED_IMAGE_PROTOCOL ; lea_rdx,[rip+DWORD] %LOADED_IMAGE_PROTOCOL # guid = &LOADED_IMAGE_PROTOCOL
|
||||||
488B15 %LOADED_IMAGE_PROTOCOL_8 ; mov_rdx,[rip+QWORD] %LOADED_IMAGE_PROTOCOL_8 # EFI_LOADED_IMAGE_PROTOCOL_GUID (last 64 bits)
|
4C89E1 ; mov_rcx,r12 # arg1 = image_handle
|
||||||
52 ; push_rdx # push last 64 bits onto stack
|
E8 %open_protocol ; call %open_protocol # open protocol
|
||||||
488B15 %LOADED_IMAGE_PROTOCOL ; mov_rdx,[rip+QWORD] %LOADED_IMAGE_PROTOCOL # EFI_LOADED_IMAGE_PROTOCOL_GUID (first 64 bits)
|
|
||||||
52 ; push_rdx # push first 64 bits onto stack
|
|
||||||
4889E2 ; mov_rdx,rsp # arg2 = &guid
|
|
||||||
6A 01 ; push !1 # arg6 = EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL
|
|
||||||
6A 00 ; push !0 # arg5 = NULL
|
|
||||||
4D89F9 ; mov_r9,r15 # arg4 = image_handle
|
|
||||||
4C89F9 ; mov_rcx,r15 # arg1 = image_handle
|
|
||||||
4883EC 20 ; sub_rsp, !32 # allocate shadow stack space for UEFI function
|
|
||||||
41FF96 18010000 ; call_[r14+QWORD] %280 # system->boot->open_protocol(image_handle, &guid, &image, image_handle, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL)
|
|
||||||
488B4424 40 ; mov_rax,[rsp+BYTE] !64 # get_image
|
|
||||||
4889C7 ; mov_rax,rdi # save image
|
4889C7 ; mov_rax,rdi # save image
|
||||||
|
|
||||||
# Get root file system
|
# Get root file system
|
||||||
50 ; push_rax # allocate stack for rootfs
|
4D89E1 ; mov_r9,r12 # arg4 = image_handle
|
||||||
4989E0 ; mov_r8,rsp # arg3 = &rootfs
|
488D15 %SIMPLE_FS_PROTOCOL ; lea_rdx,[rip+DWORD] %SIMPLE_FS_PROTOCOL # guid = &SIMPLE_FS_PROTOCOL
|
||||||
488B15 %SIMPLE_FS_PROTOCOL_8 ; mov_rdx,[rip+QWORD] %SIMPLE_FS_PROTOCOL_8 # EFI_SIMPLE_FILE_SYSTEM_PROTOCOL_GUID (last 64 bits)
|
|
||||||
52 ; push_rdx # push last 64 bits onto stack
|
|
||||||
488B15 %SIMPLE_FS_PROTOCOL ; mov_rdx,[rip+QWORD] %SIMPLE_FS_PROTOCOL # EFI_SIMPLE_FILE_SYSTEM_PROTOCOL_GUID (first 64 bits)
|
|
||||||
52 ; push_rdx # push first 64 bits onto stack
|
|
||||||
4889E2 ; mov_rdx,rsp # arg2 = &guid
|
|
||||||
6A 01 ; push !1 # arg6 = EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL
|
|
||||||
6A 00 ; push !0 # arg5 = NULL
|
|
||||||
4D89F9 ; mov_r9,r15 # arg4 = image_handle
|
|
||||||
488B4F 18 ; mov_rcx,[rdi+BYTE] !24 # arg1 = root_device = image->device
|
488B4F 18 ; mov_rcx,[rdi+BYTE] !24 # arg1 = root_device = image->device
|
||||||
4883EC 20 ; sub_rsp, !32 # allocate shadow stack space for UEFI function
|
48890D %root_device ; mov_[rip+DWORD],rcx %root_device # save root_device
|
||||||
41FF96 18010000 ; call_[r14+QWORD] %280 # system->boot->open_protocol(root_device, &guid, &rootfs, image_handle, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL)
|
E8 %open_protocol ; call %open_protocol # open protocol
|
||||||
488B4C24 40 ; mov_rcx,[rsp+BYTE] !64 # get rootfs
|
4889C1 ; mov_rcx,rax # get rootfs
|
||||||
|
|
||||||
# Get root directory
|
# Get root directory
|
||||||
52 ; push_rdx # allocate stack for rootdir
|
52 ; push_rdx # allocate stack for rootdir
|
||||||
|
@ -183,7 +164,7 @@ F0 00 # SizeOfOptionalHeader
|
||||||
58 ; pop_rax # deallocate stack
|
58 ; pop_rax # deallocate stack
|
||||||
58 ; pop_rax # deallocate stack
|
58 ; pop_rax # deallocate stack
|
||||||
58 ; pop_rax # get rootdir
|
58 ; pop_rax # get rootdir
|
||||||
488905 %rootdir ; mov_[rip+QWORD],rax %rootdir # save rootdir
|
488905 %rootdir ; mov_[rip+DWORD],rax %rootdir # save rootdir
|
||||||
|
|
||||||
# Push command line arguments onto stack
|
# Push command line arguments onto stack
|
||||||
488B5F 38 ; mov_rbx,[rdi+BYTE] !56 # options = image->load_options
|
488B5F 38 ; mov_rbx,[rdi+BYTE] !56 # options = image->load_options
|
||||||
|
@ -212,7 +193,7 @@ F0 00 # SizeOfOptionalHeader
|
||||||
6A 07 ; push !7 # to get 0x8000000000000003 we set the rightmost 3 bits
|
6A 07 ; push !7 # to get 0x8000000000000003 we set the rightmost 3 bits
|
||||||
4159 ; pop_r9 # and then do right rotation by 1
|
4159 ; pop_r9 # and then do right rotation by 1
|
||||||
49D1C9 ; ror_r9 # arg4 = EFI_FILE_MODE_CREATE| EFI_FILE_MODE_WRITE | EFI_FILE_MODE_READ
|
49D1C9 ; ror_r9 # arg4 = EFI_FILE_MODE_CREATE| EFI_FILE_MODE_WRITE | EFI_FILE_MODE_READ
|
||||||
488B0D %rootdir ; mov_rcx,[rip+QWORD] %rootdir # arg1 = rootdir
|
488B0D %rootdir ; mov_rcx,[rip+DWORD] %rootdir # arg1 = rootdir
|
||||||
4883EC 20 ; sub_rsp, !32 # allocate shadow stack space for UEFI function
|
4883EC 20 ; sub_rsp, !32 # allocate shadow stack space for UEFI function
|
||||||
FF51 08 ; call_[rcx+BYTE] !8 # rootdir->open()
|
FF51 08 ; call_[rcx+BYTE] !8 # rootdir->open()
|
||||||
4883C4 28 ; add_rsp, !40 # deallocate stack
|
4883C4 28 ; add_rsp, !40 # deallocate stack
|
||||||
|
@ -252,14 +233,23 @@ F0 00 # SizeOfOptionalHeader
|
||||||
4C89F9 ; mov_rcx,r15 # Get output file
|
4C89F9 ; mov_rcx,r15 # Get output file
|
||||||
E8 %close_file ; call %close_file # close it
|
E8 %close_file ; call %close_file # close it
|
||||||
|
|
||||||
488B0D %rootdir ; mov_rcx,[rip+QWORD] %rootdir # Get rootdir
|
488B0D %rootdir ; mov_rcx,[rip+DWORD] %rootdir # Get rootdir
|
||||||
E8 %close_file ; call %rootdir # close it
|
E8 %close_file ; call %close_file # close it
|
||||||
|
|
||||||
4889D9 ; mov_rcx,rbx # Get buffer
|
4889D9 ; mov_rcx,rbx # Get buffer
|
||||||
E8 %free_pool ; call %free_pool # release it
|
E8 %free_pool ; call %free_pool # release it
|
||||||
31C0 ; xor_eax,eax # Exit code 0
|
31C0 ; xor_eax,eax # Exit code 0
|
||||||
|
|
||||||
4889EC ; mov_rsp,rbp # restore stack
|
4D89E0 ; mov_r8,r12 # arg3 = image_handle
|
||||||
|
488D15 %SIMPLE_FS_PROTOCOL ; lea_rdx,[rip+DWORD] %SIMPLE_FS_PROTOCOL # EFI_SIMPLE_FILE_SYSTEM_PROTOCOL_GUID
|
||||||
|
488B0D %root_device ; mov_rcx,[rip+DWORD] %root_device # arg1 = root_device
|
||||||
|
E8 %close_protocol ; call %close_protocol # close protocol
|
||||||
|
|
||||||
|
4D89E0 ; mov_r8,r12 # arg3 = image_handle
|
||||||
|
488D15 %LOADED_IMAGE_PROTOCOL ; lea_rdx,[rip+DWORD] %LOADED_IMAGE_PROTOCOL # EFI_LOADED_IMAGE_PROTOCOL_GUID
|
||||||
|
4C89E1 ; mov_rcx,r12 # arg1 = image_handle
|
||||||
|
E8 %close_protocol ; call %close_protocol # close protocol
|
||||||
|
|
||||||
C3 ; ret # return to UEFI
|
C3 ; ret # return to UEFI
|
||||||
|
|
||||||
# r8: input file name
|
# r8: input file name
|
||||||
|
@ -271,7 +261,7 @@ F0 00 # SizeOfOptionalHeader
|
||||||
6A 01 ; push !1 # arg5 = EFI_FILE_READ_ONLY
|
6A 01 ; push !1 # arg5 = EFI_FILE_READ_ONLY
|
||||||
6A 01 ; push !1 # prepare to set arg4 to EFI_FILE_MODE_READ
|
6A 01 ; push !1 # prepare to set arg4 to EFI_FILE_MODE_READ
|
||||||
4159 ; pop_r9 # arg4 = EFI_FILE_MODE_READ
|
4159 ; pop_r9 # arg4 = EFI_FILE_MODE_READ
|
||||||
488B0D %rootdir ; mov_rcx,[rip+QWORD] %rootdir # arg1 = rootdir
|
488B0D %rootdir ; mov_rcx,[rip+DWORD] %rootdir # arg1 = rootdir
|
||||||
4883EC 20 ; sub_rsp, !32 # allocate shadow stack space for UEFI function
|
4883EC 20 ; sub_rsp, !32 # allocate shadow stack space for UEFI function
|
||||||
FF51 08 ; call_[rcx+BYTE] !8 # rootdir->open()
|
FF51 08 ; call_[rcx+BYTE] !8 # rootdir->open()
|
||||||
4883C4 28 ; add_rsp, !40 # deallocate stack
|
4883C4 28 ; add_rsp, !40 # deallocate stack
|
||||||
|
@ -285,6 +275,31 @@ F0 00 # SizeOfOptionalHeader
|
||||||
58 ; pop_rax # deallocate stack
|
58 ; pop_rax # deallocate stack
|
||||||
C3 ; ret
|
C3 ; ret
|
||||||
|
|
||||||
|
# rcx: handle
|
||||||
|
# rdx: &guid
|
||||||
|
# r9: agent_handle
|
||||||
|
# returns interface
|
||||||
|
:open_protocol
|
||||||
|
50 ; push_rax # allocate stack for interface
|
||||||
|
4989E0 ; mov_r8,rsp # arg3 = &interface
|
||||||
|
6A 01 ; push !1 # arg6 = EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL
|
||||||
|
6A 00 ; push !0 # arg5 = NULL
|
||||||
|
4883EC 20 ; sub_rsp, !32 # allocate shadow stack space for UEFI function
|
||||||
|
41FF96 18010000 ; call_[r14+DWORD] %280 # system->boot->open_protocol(handle, &guid, &interface, agent_handle, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL)
|
||||||
|
4883C4 30 ; add_rsp, !48 # deallocate stack
|
||||||
|
58 ; pop_rax # get image
|
||||||
|
C3 ; ret
|
||||||
|
|
||||||
|
# rcx: handle
|
||||||
|
# rdx: &guid
|
||||||
|
# r8: agent_handle
|
||||||
|
:close_protocol
|
||||||
|
4D31C9 ; xor_r9,r9 # arg4 = NULL
|
||||||
|
4883EC 20 ; sub_rsp, !32 # allocate shadow stack space for UEFI function
|
||||||
|
41FF96 20010000 ; call_[r14+DWORD] %288 # system->boot->close_protocol(handle, &guid, agent_handle, 0)
|
||||||
|
4883C4 20 ; add_rsp, !32 # deallocate stack
|
||||||
|
C3 ; ret
|
||||||
|
|
||||||
# rdx: number of bytes to allocate
|
# rdx: number of bytes to allocate
|
||||||
# r14: system->boot
|
# r14: system->boot
|
||||||
# returns pointer in rax
|
# returns pointer in rax
|
||||||
|
@ -343,17 +358,18 @@ F0 00 # SizeOfOptionalHeader
|
||||||
A1 31 1B 5B ; %0x5b1b31a1
|
A1 31 1B 5B ; %0x5b1b31a1
|
||||||
62 95 ; @0x9562
|
62 95 ; @0x9562
|
||||||
D2 11 ; @0x11d2
|
D2 11 ; @0x11d2
|
||||||
:LOADED_IMAGE_PROTOCOL_8
|
|
||||||
8E 3F 00 A0 C9 69 72 3B ; !0x8e !0x3f !0 !0xa0 !0xc9 !0x69 !0x72 !0x3b
|
8E 3F 00 A0 C9 69 72 3B ; !0x8e !0x3f !0 !0xa0 !0xc9 !0x69 !0x72 !0x3b
|
||||||
|
|
||||||
:SIMPLE_FS_PROTOCOL
|
:SIMPLE_FS_PROTOCOL
|
||||||
22 5B 4E 96 ; %0x0964e5b22
|
22 5B 4E 96 ; %0x0964e5b22
|
||||||
59 64 ; @0x6459
|
59 64 ; @0x6459
|
||||||
D2 11 ; @0x11d2
|
D2 11 ; @0x11d2
|
||||||
:SIMPLE_FS_PROTOCOL_8
|
|
||||||
8E 39 00 A0 C9 69 72 3B ; !0x8e !0x39 !0 !0xa0 !0xc9 !0x69 !0x72 !0x3b
|
8E 39 00 A0 C9 69 72 3B ; !0x8e !0x39 !0 !0xa0 !0xc9 !0x69 !0x72 !0x3b
|
||||||
|
|
||||||
:rootdir
|
:rootdir
|
||||||
00000000 00000000
|
00000000 00000000
|
||||||
|
|
||||||
|
:root_device
|
||||||
|
00000000 00000000
|
||||||
|
|
||||||
:PE32_end
|
:PE32_end
|
||||||
|
|
Loading…
Reference in New Issue