1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
#include "bootmgr.h"
#include "efi_helper.h"
#include "common/io.h"
#include "common/windows/nt.h"
#include <ntstatus.h>
#include <windows.h>
const char* enablePrivilege(const wchar_t* privilege) {
FF_AUTO_CLOSE_FD HANDLE token = NULL;
if (!NT_SUCCESS(NtOpenProcessToken(NtCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &token))) {
return "NtOpenProcessToken() failed";
}
TOKEN_PRIVILEGES tp = {
.PrivilegeCount = 1,
.Privileges = {
(LUID_AND_ATTRIBUTES) { .Attributes = SE_PRIVILEGE_ENABLED } },
};
if (!LookupPrivilegeValueW(NULL, privilege, &tp.Privileges[0].Luid)) {
return "LookupPrivilegeValue() failed";
}
NTSTATUS status = NtAdjustPrivilegesToken(token, false, &tp, sizeof(tp), NULL, NULL);
if (!NT_SUCCESS(status)) {
return "NtAdjustPrivilegesToken() failed";
}
if (status == STATUS_NOT_ALL_ASSIGNED) {
return "The token does not have the specified privilege; try sudo please";
}
return NULL;
}
const char* ffDetectBootmgr(FFBootmgrResult* result) {
const char* err = enablePrivilege(L"SeSystemEnvironmentPrivilege");
if (err != NULL) {
return err;
}
GUID efiGlobalGuid;
if (!NT_SUCCESS(RtlGUIDFromString(&(UNICODE_STRING) RTL_CONSTANT_STRING(L"{" FF_EFI_GLOBAL_GUID L"}"), &efiGlobalGuid))) {
return "RtlGUIDFromString() failed";
}
ULONG size = sizeof(result->order);
if (!NT_SUCCESS(NtQuerySystemEnvironmentValueEx(&(UNICODE_STRING) RTL_CONSTANT_STRING(L"BootCurrent"), &efiGlobalGuid, &result->order, &size, NULL))) {
return "NtQuerySystemEnvironmentValueEx(BootCurrent) failed";
}
if (size != sizeof(result->order)) {
return "NtQuerySystemEnvironmentValueEx(BootCurrent) returned unexpected size";
}
uint8_t buffer[2048];
wchar_t key[9];
swprintf(key, ARRAY_SIZE(key), L"Boot%04X", result->order);
size = sizeof(buffer);
if (!NT_SUCCESS(NtQuerySystemEnvironmentValueEx(&(UNICODE_STRING) RTL_CONSTANT_STRING(key), &efiGlobalGuid, buffer, &size, NULL))) {
return "NtQuerySystemEnvironmentValueEx(Boot####) failed";
}
if (size < sizeof(FFEfiLoadOption) || size == ARRAY_SIZE(buffer)) {
return "NtQuerySystemEnvironmentValueEx(Boot####) returned unexpected size";
}
ffEfiFillLoadOption((FFEfiLoadOption*) buffer, result);
SYSTEM_SECUREBOOT_INFORMATION ssi;
if (NT_SUCCESS(NtQuerySystemInformation(SystemSecureBootInformation, &ssi, sizeof(ssi), NULL))) {
result->secureBoot = ssi.SecureBootEnabled;
}
return NULL;
}
|
