As the first step towards automated parsing, this change set replaces outdated BootGuard-related parsers with shiny new KaitaiStruct-based ones.
It also does the following:
- improves Intel FIT definitions by using the relevant specification
- adds sha1, sha384, sha512 and sm3 digest implementations
- updates LZMA SDK to v22.01
- moves GUIDs out of include files to prevent multiple instantiations
- enforces C++11
- adds Kaitai-based parsers for Intel FIT, BootGuard v1 and BootGuard v2 structures
- makes many small refactorings here, there and everywhere
1. Fixes#158, UEFITool and UEFIFind failed to lookup pattern crossing header/body boundary
2. Fixes#159, filter out more symbols in fileanems, which are prohibited by different filesystems
3. Add more known file GUIDs
4. Add basic support for FMP images
5. Fix unaligned read in uint24ToUint32
6. Fix compilation with latest cmake requiring directory path
+ FFSv3 support with large files and large sections
+ proper names for Flash Descriptor v2 regions (#89)
+ better alignment calculations (#96)
+ improved NVRAM parser
+ post IBB hash support for Boot Guard
+ bugfixes
+ companion tool updated
- added UEFIDump tool, which is now Windows-only UEFIExtract with some
limitations, made as PoC for non-Qt engine usage
- ensured that Qt classes will be used, if available
- checked build of UT and UE
- porting of UEFIFind to non-Qt engine TBD
Thanks to lordkag for #41:
- improved parsing of Intel flash descriptor
- improved detection of Tiano/EFI 1.1 compression type
- added 2 UEFI capsule GUIDs used by Lenovo
- solved potential crash on very low memory available
- UEFIExtract and UEFIFind update to include the latest parser changes
- new ffsParser is done, supports FFSv3, non-UEFI data everywhere, fixed
files, offsets for uncompressed data and many other things
- command-line utilities are removed until the end of new engine's
development
- Intel signed section identified as EFI_FIRMWARE_CONTENTS_SIGNED GUIDed
section
- solved a bug with no element for "Non-UEFI data inside pad-file"
message
- HP postcode section renamed to Insyde postcode (found in non-HP
images)
- various small fixes
- this is the latest release without FFSv3 support, which requires
massive refactoring round and can possibly last long
- major refactoring round done
- added replace actions for volumes
- added better Intel signature handling
- added support for unsigned Aptio capsules
- more GUIDs added to known-GUIDs database
- more information about PE and TE sections
- shown information about item full size
- hexadecimal numbers format changed from 0xAB to ABh
- AppleCRC renamed to ZVCRC because it seems not Apple-specific feature
after all
