Under the hood - isbootsecure.exe

[coffeeprogrammer]

I had some extra time, so I decided to see if I could help myself understand some of how the new isbootsecure works. I used the command line utility dumpbin like this:

dumpbin isbootsecure.exe /imports

I think the imports is just telling what libraries are being imported from Windows.

This is the output:

Microsoft (R) COFF/PE Dumper Version 14.16.27051.0
Copyright (C) Microsoft Corporation. All rights reserved.


Dump of file isbootsecure.exe

File Type: EXECUTABLE IMAGE

Section contains the following imports:

USER32.dll
402078 Import Address Table
4027A4 Import Name Table
0 time date stamp
0 Index of first forwarder reference

309 wvsprintfA
307 wsprintfA

KERNEL32.dll
40202C Import Address Table
402758 Import Name Table
0 time date stamp
0 Index of first forwarder reference

1F6 GetModuleHandleA
211 GetNumberOfConsoleInputEvents
220 GetProcAddress
23B GetStdHandle
1E6 GetLastError
28C GlobalFree
4B5 lstrlenA
35D ReadConsoleInputA
3C1 SetConsoleTitleA
48D WriteFile
1DA GetFirmwareEnvironmentVariableA
1A9 GetCurrentProcess
16F GetCommandLineA
110 FileTimeToSystemTime
104 ExitProcess
78 CreateFileA
43 CloseHandle
285 GlobalAlloc

ADVAPI32.dll
402000 Import Address Table
40272C Import Name Table
0 time date stamp
0 Index of first forwarder reference

190 LookupPrivilegeValueA
1F1 OpenProcessToken
1E AdjustTokenPrivileges

CRYPT32.dll
402010 Import Address Table
40273C Import Name Table
0 time date stamp
0 Index of first forwarder reference

E2 CryptVerifyMessageSignature
1C CertCreateCertificateContext
3F CertFreeCertificateContext
52 CertNameToStrA

CRYPTUI.dll
402024 Import Address Table
402750 Import Name Table
0 time date stamp
0 Index of first forwarder reference

11 CryptUIDlgViewContext

Summary

1000 .data
1000 .rdata
1000 .rsrc
1000 .text



Just judging by the output my guess is that GetFirmwareEnvironmentVariableA function is the one doing some of the important work. I tried opening the file with Steve Miller's dependency walker, but it was like it was locking up.

 

[coffeeprogrammer]

I guess a follow up question would be, if a person wanted to write a os with its own bootloader, but did not want to sign that boot loader, they would have to turn off secure boot for UEFI? I think when secure boot was new there was some unhappy people because Microsoft was largely responsible for what boot keys where placed in firmware, meaning they could block Linux distro from secure boot they wanted to. For utilities like Image for Linux or SR, I think they would either need to get those signed or not use secure boot. I am wounder what file is actual loaded by UEFI on a Windows installations? Is it on drive C:\ ??

 

[PHolder]

what file is actual loaded by UEFI on a Windows installations?

How are the initial boot files found in UEFI

I was curious and poking around my Windows 8 system. Per Wikipedia's entry on UEFI Boot loaders can also be automatically detected by the UEFI firmware, to enable booting from removable devices...

superuser.com

 

[coffeeprogrammer]

So with SN985 Steve’s point is always where security problems can occur. I think the point of SN985 is that if a firmware that allows bad keys is in place then a user might be infected without being noticed. I have been pretty clear that I will never rely on Microsoft or their services to security my own pc’s in my house. That said, just because you have a bad firmware you could just be aware of it and that it could be a problem. It’s like have a car where you can unlock the doors with a key fob, that signal can be cloned and could be a problem. I am aware of that with my car and I am not going to do anything about it. That is basically what I am doing when I am disabling updates. I future news sources, including SN, I am entrusted in if these secure boot firmwares with bad keys have been used to load undesirable code into systems?