Method and device for analyzing firmware file of platform security processor

Abstract

The invention provides a platform security processor firmware file analysis method and device. The method comprises the following steps: acquiring UEFI firmware of equipment under an AMD processor architecture; obtaining a PSP firmware directory table from the UEFI firmware based on the embedded firmware structure; scanning the UEFI firmware according to the PSP firmware directory table so as to obtain the complete PSP firmware; traversing all entries in the PSP firmware, if the type of the current entry is a code, analyzing header information of the current entry, and storing the analyzed header information in a code partition directory table data structure; analyzing module information of all binary file modules under the current entry; wherein the module information of each binary module comprises an index and an offset of the module; positioning the current binary file module needing to be analyzed according to the index and the offset of the binary file module; analyzing the current binary file module, and storing an analysis result into a module file; and extracting all the storage information, and summarizing and integrating to generate an analysis report.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, specifically to the field of firmware reverse analysis and security technology, and in particular to a method and device for parsing a platform security processor firmware file. Background Art

[0002] With the development of trusted computing technology, the CPU in the X86 platform has multiple embedded microcontrollers in addition to the x86 core, among which security coprocessors are increasingly used. At present, most modern microprocessors contain such processors, such as Intel's ME (Management Engine), AMD's PSP (Platform Security Processor), Apple's T2 processor, etc. These processors are generally used for system initialization or to assist the main operating system in performing various management tasks such as power management during runtime. In addition, they also act as TPM (Trusted Platform Module) to provide a trusted execution environment or act as a system trust anchor. However, the structure of these coprocessors and the firmware they run are not open to the public.

[0003] AMD PSP has been integrated into all AMD processors and APUs (Accelerated Processing Units) since 2013. In addition to being used for system initialization or assisting the main operating system in performing various management tasks (such as power management) at runtime, PSP also provides a trusted execution environment and acts as a trust anchor for the system. However, the structure of PSP and the firmware it runs are also not open to the public, which makes its internal operations and security mechanisms unknown to the outside world.

[0004] According to relevant research, PSP also has extensive access rights and powerful functions. Although AMD officially claims that these functions are for enhancing system management and security, its powerful permissions and opaque operation methods have also raised many security and privacy concerns. For example, security researchers have discovered multiple vulnerabilities affecting AMD PSP, which could be exploited to access sensitive data.

[0005] A typical example is the vulnerability discovered by security researcher Kyriakos Economou, which allows attackers to exploit information disclosure and memory leak vulnerabilities to obtain NTLM hashes in registry key mappings, or other data that helps bypass exploit mitigation measures, such as kernel address space layout randomization (KASLR). In addition, there are researchers who attacked the PSP in AMD Zen 2 and Zen 3 CPUs through voltage fault injection to obtain key derivation secrets stored in the TPM, which makes it possible to crack BitLocker full disk encryption.

[0006] In general, although AMD PSP plays an important role in system management and security, its opaque operation and potential security risks have also aroused widespread concern. With the in-depth research, we hope to further reveal the internal mechanism of PSP and improve its security and transparency. Summary of the invention

[0007] Aiming at the opaque operation mode and potential safety risks of AMD PSP, in order to further understand the internal mechanism of PSP and improve its security and transparency, the present invention provides a PSP firmware file parsing method and device, which adopts a firmware parsing method based on structured feature information to extract the hierarchical structure and file composition of PSP firmware, and a decompression algorithm based on zlib algorithm to decompress the coprocessor firmware module, and finally completes the information extraction and parsing of the AMD PSP firmware file through AES decryption processing.

[0008] In a first aspect, the present invention provides a platform security processor firmware file parsing method, characterized by comprising: Step 1: Get the UEFI firmware of the device under AMD processor architecture; Step 2: Obtain a PSP firmware catalog table from the UEFI firmware based on an embedded firmware structure; Step 3: Scan the UEFI firmware according to the PSP firmware catalog table to obtain a complete PSP firmware; Step 4: traverse all entries in the PSP firmware, if the type of the current entry is code, execute step 5; otherwise, traverse the next entry; Step 5: Parse the header information of the current entry and store the parsed header information into the code partition directory table data structure; Step 6: Parse the module information of all binary file modules under the current entry; wherein the module information of each binary module includes the index and offset of the module; Step 7: Locate the current binary file module that needs to be parsed based on the index and offset of the binary file module; Step 8: Parse the current binary file module and store the parsing result in the module file; Step 9: Extract all stored information and summarize it to generate an analysis report.

[0009] Furthermore, step 2 specifically includes: Step 2.1: Traverse all possible offset addresses of the embedded firmware structure, and check whether the first four bytes at the current offset address match the start mark of the embedded firmware structure. If they match, the current offset address is the offset address of the embedded firmware structure, and the traversal ends; otherwise, check the next offset address; Step 2.2: Locate the pointer position of the PSP firmware directory table according to the offset address of the embedded firmware structure; Step 2.3: Locate the PSP firmware directory table according to the pointer position of the PSP firmware directory table.

[0010] Furthermore, step 3 specifically includes: Step 3.1: Parse the PSP firmware directory table to obtain the total number of entries and entry information of each entry; the entry information includes the type, address and size of the entry; Step 3.2: Obtain a BIOS directory structure from the UEFI firmware, and parse the BIOS directory structure to obtain a BIOS directory header and a BIOS directory entry; Step 3.3: Read the BIOS key in sequence according to the address sequence of the BIOS directory header and the BIOS directory entry, and use the corresponding BIOS key to perform RTM signature verification on the entry information of the corresponding entry in the PSP firmware directory table. If the verification is successful, extract the binary file module under the entry. Otherwise, continue to verify the next entry until all entries are verified; Step 3.4: Store the extracted binary file modules in the same folder according to the order of the entries in the PSP firmware directory table to obtain the complete PSP firmware.

[0011] Furthermore, step 8 specifically includes: Step 8.1: Determine the compression algorithm type of the current binary file module. If it is Zlib compression, use the Zlib decompression algorithm to decompress the current binary file module, save the decompression result as a module file, and jump to step 8.4; if it is not compressed, execute step 8.2; Step 8.2: Determine the encryption algorithm type of the current binary file module. If it is AES encryption, use the AES decryption algorithm to decrypt the current binary file module, save the decryption result as a module file, and jump to step 8.4; if it is not encrypted, jump to step 8.3; Step 8.3: directly store the current binary file module as a module file; Step 8.4: Determine whether the current binary file module is the last binary file module. If not, read the index, offset and size of the next binary file module and jump to step 7; if yes, execute step 9.

[0012] Furthermore, in step 8.1, the compression algorithm type of the current binary file module is determined, specifically including: Read the compression algorithm field value of the current binary file module, and match the compression algorithm field value with the predefined zlib header identifier. If the match is successful, it means that the compression algorithm of the current entry is Zlib compression; if the compression algorithm field value is None, there is no compression.

[0013] In a second aspect, the present invention provides a platform security processor firmware file parsing device, comprising: A firmware acquisition unit, used to acquire UEFI firmware of a device under an AMD processor architecture; A firmware extraction unit, configured to obtain a PSP firmware directory table from the UEFI firmware based on an embedded firmware structure, and to scan the UEFI firmware according to the PSP firmware directory table to obtain a complete PSP firmware; The firmware parsing unit is used to traverse all entries in the PSP firmware, and when the type of the current entry is code, perform the following process: parse the header information of the current entry, and store the parsed header information in the code partition directory table data structure; parse the module information of all binary file modules under the current entry; wherein the module information of each binary module includes the index and offset of the module; locate the current binary file module to be parsed according to the index and offset of the binary file module; parse the current binary file module, and store the parsing result in the module file; The analysis report generation unit is used to extract all the stored information and summarize and integrate them to generate an analysis report.

[0014] Furthermore, the firmware parsing unit includes a decompression module and a decryption module; correspondingly, the current binary file module is parsed, and the parsing result is stored in the module file, specifically including: The decompression module is used to determine the compression algorithm type of the current binary file module. If it is Zlib compression, the Zlib decompression algorithm is used to decompress the current binary file module and store the decompression result as a module file. If it is not compressed, the current binary file module is output to the decryption module; The decryption module is used to determine the encryption algorithm type of the current binary file module. If it is AES encryption, the AES decryption algorithm is used to decrypt the current binary file module and the decryption result is stored as a module file. If it is not encrypted, the current binary file module is directly stored as a module file.

[0015] In a third aspect, the present invention provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect when executing the program.

[0016] In a fourth aspect, a non-transitory computer-readable storage medium stores a computer program thereon, wherein the computer program, when executed by a processor, implements the method described in the first aspect.

[0017] Beneficial effects of the present invention: The platform security processor firmware file parsing method and device proposed in the present invention, a PSP firmware directory table positioning method based on the embedded firmware structure EFS, a data decompression algorithm based on ZLIB and a data decryption algorithm based on AES, are suitable for restoring binary code files in the latest version of AMD PSP firmware, can automatically extract and parse the PSP firmware modules in the AMD PSP firmware, compose and restore the file contents corresponding to each compression module and encryption module, and provide important support for further reverse analysis and simulation. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A flowchart of a platform security processor firmware file parsing method provided by an embodiment of the present invention; Figure 2 A schematic diagram of a process for obtaining a PSP firmware directory table provided by an embodiment of the present invention; Figure 3 A schematic diagram of a process for extracting complete PSP firmware provided by an embodiment of the present invention; Figure 4 A schematic diagram of the parsing process of a binary file module provided in an embodiment of the present invention; Figure 5 A schematic diagram of the structure of a platform security processor firmware file parsing device provided by an embodiment of the present invention; Figure 6 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution in the embodiment of the present invention will be clearly described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] Before parsing the PSP firmware file, you need to obtain the corresponding firmware. Similar to Intel CSME (Intel Converged Security and Management Engine), the complete PSP firmware is stored in two parts, one part is located inside the PSP chip, called on-chip ROM, and the other part is located in the SPIFlash chip, called off-chipBootloader. This invention only analyzes the PSP firmware located in the Flash chip.

[0021] like Figure 1 As shown, an embodiment of the present invention provides a platform security processor firmware file parsing method, comprising the following steps: S101: Get the UEFI firmware of the device under the AMD processor architecture; S102: Obtaining a PSP firmware catalog table from the UEFI firmware based on an embedded firmware structure (EFS); S103: Scan the UEFI firmware according to the PSP firmware catalog table to obtain a complete PSP firmware; S104: traverse all entries in the PSP firmware, and if the type of the current entry is code, execute step S105; otherwise, traverse the next entry; S105: parsing the header information of the current entry, and storing the parsed header information into the code partition directory table data structure; S106: parsing module information of all binary file modules under the current entry; wherein the module information of each binary module includes an index and an offset of the module; S107: Locate the current binary file module that needs to be parsed according to the index and offset of the binary file module; S108: Parse the current binary file module and store the parsing result in the module file; S109: extract all stored information and summarize and integrate them to generate an analysis report.

[0022] Specifically, the parsing report can display the processing status of each binary file module, including the results of decompression and decryption, the status of signature verification, etc., to ensure the integrity and security of the PSP firmware.

[0023] The embodiment of the present invention provides a platform security processor firmware file parsing method, which adopts a firmware parsing method based on embedded structural feature information to achieve the extraction of the hierarchical structure and file composition of the PSP firmware.

[0024] In one embodiment, Figure 2 As shown, the process of obtaining the PSP firmware directory table from the UEFI firmware based on the embedded firmware structure specifically includes: S1021: traverse all possible offset addresses of the embedded firmware structure, and check whether the first four bytes at the current offset address match the start mark of the embedded firmware structure. If they match, the current offset address is the offset address of the embedded firmware structure, and the traversal ends; otherwise, check the next offset address.

[0025] Specifically, relative to the position 0x0 of the UEFI firmware (the starting position), traverse the six possible offset addresses of EFS: 0xfffa0000, 0xfff20000, 0xffe20000, 0xffc20000, 0xff820000, 0xff020000. For example, starting from the first offset address 0xfffa0000, check the first four bytes at the offset address. If the byte content is "0x55AA55AA" (the start mark of EFS), it is determined that EFS is found and the search ends; if the byte content is not "0x55AA55AA", check the next offset address 0xfff20000; and so on, until EFS is found.

[0026] S1022: Locate the pointer position of the PSP firmware directory table according to the offset address of the embedded firmware structure; Specifically, add 0x14 to the EFS offset address to locate the PSP firmware directory table pointer position, and then read out 4 bytes backward to obtain the PSP firmware directory table pointer, that is, the offset address where the PSP firmware directory table is located.

[0027] S1023: Locate the PSP firmware directory table according to the pointer position of the PSP firmware directory table.

[0028] Specifically, the jmp instruction is executed according to the value of the PSP firmware directory table pointer to enter the PSP firmware directory table part. Then, the construction of the PSP firmware directory table is completed through the following process: first, the directory header of the PSP firmware directory table is scanned (in order, it is a 4-byte magic number $PSP, a 4-byte checksum part, a 4-byte total number of entries, and a 4-byte reserved word), and then each entry of the PSP firmware directory table is scanned. Each entry contains an entry type and address (in order, it is 4 bytes of type information, 4 bytes of size information, and 8 bytes of address or value information). Therefore, according to the total number of entries, each entry of the PSP firmware directory table can be sequentially scanned and read with 16 bytes as the length of one entry. The above scanning results are stored in a text file in JSON format to complete the establishment of the PSP firmware directory table.

[0029] In one embodiment, Figure 3 As shown, the process of scanning the UEFI firmware according to the PSP firmware catalog table to obtain the complete PSP firmware specifically includes: S1031: Parse the PSP firmware directory table to obtain the total number of entries and entry information of each entry; the entry information includes the type, address and size of the entry; in order to facilitate subsequent operations, the extracted entry information can be stored in a python dictionary.

[0030] S1032: Obtain a BIOS directory structure from the UEFI firmware, and parse the BIOS directory structure to obtain a BIOS directory header and a BIOS directory entry; Specifically, scan the AMD UEFI firmware, jump to the BIOS directory at offset 0x18, read 40 bytes backward, and obtain the BIOS directory structure. The BIOS directory structure includes the first 16 bytes of the directory header (containing a 4-byte magic number $BHD, a 4-byte checksum part, a 4-byte total number of entries, and a 4-byte reserved word) and the last 24 bytes of the directory entry (4-byte type information, 4-byte size information, 8-byte source address information, and 8-byte destination address information).

[0031] S1033: Read the BIOS key in sequence according to the address sequence of the BIOS directory header and the BIOS directory entry, use the corresponding BIOS key, and combine the entry information stored in the python dictionary to perform RTM (Real-Time Messaging) signature verification on the entry information of the corresponding entry in the PSP firmware directory table, if the verification is successful, extract the binary file module (including APCB) under the entry, otherwise, continue to verify the next entry until all entries are verified; Specifically, in the process of extracting the binary file module under the entry, the attributes of the file module can be determined at the same time, such as whether it belongs to PSP boot program, AMD public key signature, SMU firmware, PSP NVRAM, etc. The so-called APCB refers to AGESA PSP Customization Block, that is, AGESA PSP common block.

[0032] S1034: The extracted binary file modules are stored in the same folder according to the sequence of the entries in the PSP firmware directory table, thus obtaining the complete PSP firmware.

[0033] In one embodiment, Figure 4 As shown, the process of parsing the current binary file module and storing the parsing result in the module file specifically includes: S1081: Determine the compression algorithm type of the current binary file module. If it is Zlib compression, use the Zlib decompression algorithm to decompress the current binary file module, save the decompression result as a module file, and jump to step S1084; if it is not compressed, execute step S1082; Specifically, determining the compression algorithm type of the current binary file module includes: reading the compression algorithm field value of the current binary file module, matching the compression algorithm field value with a predefined zlib header identifier, if the match is successful, it indicates that the compression algorithm of the current entry is Zlib compression; if the compression algorithm field value is None, there is no compression.

[0034] Among them, the predefined zlib header identifiers include best compression (b'\x78\xda'), default compression (b'\x78\x9c'), compression (b'\x78\x5e'), and no compression (b'\x78\x01').

[0035] During the actual decompression process, if an exception is encountered, such as decompression failure or data format error, an error will be reported and a corresponding exception message will be generated. Then, the binary file module that encountered the exception will be stored in the corresponding data structure, and the current decompression process will be ended, and the decompression of the next binary file module will continue.

[0036] Furthermore, when extracting the module information of the binary file module, the size of the module can also be extracted. Thus, the module content can be accurately extracted according to the module offset and size, thereby decompressing and subsequently decrypting the extracted module content.

[0037] S1082: Determine the encryption algorithm type of the current binary file module. If it is AES encryption, use the AES decryption algorithm to decrypt the current binary file module, save the decryption result as a module file, and jump to step S1084; if it is not encrypted, jump to step S1083; Specifically, the process of decrypting the current binary file module using the AES decryption algorithm includes the following steps: determining the offset and size of the current binary file module; reading the header information of the current binary file module, extracting the encrypted data, key and IV; storing the extracted encrypted data and key in a buffer, preparing for the decryption operation; extracting the embedded key unwrapped_ikek, and decrypting the above key using the AES-128 ECB mode; initializing the AES-128 CBC decryptor using the decrypted key and the extracted IV; decrypting the encrypted data, if successful, obtaining the decrypted data and storing it in a corresponding data structure; if unsuccessful, reporting an error, generating a corresponding exception message, and then storing the binary file module that encountered the exception in the corresponding data structure, and ending the current decryption process, and continuing the decryption of the next binary file module.

[0038] S1083: directly store the current binary file module as a module file; S1084: Determine whether the current binary file module is the last binary file module. If not, read the index, offset and size of the next binary file module and jump to step S107; if yes, execute step S109.

[0039] The platform security processor firmware file parsing method proposed in the present invention adopts the PSP firmware directory table positioning method based on EFS, the data decompression algorithm based on ZLIB and the data decryption algorithm based on AES, which is suitable for the restoration of binary files in the latest version of AMD PSP firmware. It can automatically extract and parse the PSP firmware modules in the AMD PSP firmware, compose and restore the file contents corresponding to each compression module and encryption module, and provide important support for further reverse analysis and simulation.

[0040] like Figure 5 As shown, an embodiment of the present invention provides a platform security processor firmware file parsing device, including: a firmware acquisition unit, a firmware extraction unit, a firmware parsing unit and a parsing report generating unit.

[0041] Among them, the firmware acquisition unit is used to obtain the UEFI firmware of the device under the AMD processor architecture; the firmware extraction unit is used to obtain the PSP firmware directory table from the UEFI firmware based on the embedded firmware structure, and scan the UEFI firmware according to the PSP firmware directory table to obtain the complete PSP firmware; the firmware parsing unit is used to traverse all entries in the PSP firmware, and when the type of the current entry is code, perform the following process: parse the header information of the current entry, and store the parsed header information in the code partition directory table data structure; parse the module information of all binary file modules under the current entry; wherein the module information of each binary module includes the index and offset of the module; locate the current binary file module that needs to be parsed according to the index and offset of the binary file module; parse the current binary file module, and store the parsing result in the module file; the parsing report generation unit is used to extract all stored information and summarize and integrate it to generate a parsing report.

[0042] Furthermore, the firmware parsing unit includes a decompression module and a decryption module; correspondingly, the current binary file module is parsed, and the parsing result is stored in a module file, specifically including: the decompression module is used to determine the compression algorithm type of the current binary file module. If it is Zlib compression, the Zlib decompression algorithm is used to decompress the current binary file module, and the decompression result is stored as a module file. If it is not compressed, the current binary file module is output to the decryption module; the decryption module is used to determine the encryption algorithm type of the current binary file module. If it is AES encryption, the AES decryption algorithm is used to decrypt the current binary file module, and the decryption result is stored as a module file. If it is not encrypted, the current binary file module is directly stored as a module file.

[0043] It should be noted that the platform security processor firmware file parsing device provided in the embodiment of the present invention is to implement the above method. Its specific functions can be referred to the above method embodiments, which will not be repeated here.

[0044] Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6As shown, the electronic device may include: a processor (processor) 601, a communication interface (Communications Interface) 602, a memory (memory) 603 and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604. The processor 601 can call the logic instructions in the memory 603 to execute the platform security processor firmware file parsing method, which includes: step 1: obtaining the UEFI firmware of the device under the AMD processor architecture; step 2: obtaining the PSP firmware directory table from the UEFI firmware based on the embedded firmware structure; step 3: scanning the UEFI firmware according to the PSP firmware directory table to obtain the complete PSP firmware; step 4: traversing all entries in the PSP firmware, if the type of the current entry is code, executing step 5; otherwise, traversing the next entry; step 5: parsing the header information of the current entry, and storing the parsed header information in the code partition directory table data structure; step 6: parsing the module information of all binary file modules under the current entry; wherein the module information of each binary module includes the index and offset of the module; step 7: locating the current binary file module to be parsed according to the index and offset of the binary file module; step 8: parsing the current binary file module, and storing the parsing result in the module file; step 9: extracting all stored information and summarizing and integrating it to generate a parsing report.

[0045] In addition, when the logic instructions in the above-mentioned memory 603 are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0046] The embodiment of the present invention further provides a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, when the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments, for example, including: step 1: obtaining UEFI firmware of a device under an AMD processor architecture; step 2: obtaining a PSP firmware directory table from the UEFI firmware based on an embedded firmware structure; step 3: scanning the UEFI firmware according to the PSP firmware directory table to obtain a complete PSP firmware; step 4: traversing all the PSP firmware in the PSP firmware There is an entry. If the type of the current entry is code, execute step 5; otherwise, traverse the next entry; step 5: parse the header information of the current entry, and store the parsed header information in the code partition directory table data structure; step 6: parse the module information of all binary file modules under the current entry; wherein the module information of each binary module includes the index and offset of the module; step 7: locate the current binary file module to be parsed according to the index and offset of the binary file module; step 8: parse the current binary file module, and store the parsing result in the module file; step 9: extract all stored information and summarize and integrate it to generate a parsing report.

[0047] The embodiment of the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method provided by the above-mentioned method embodiments is implemented, for example, including: step 1: obtaining UEFI firmware of a device under an AMD processor architecture; step 2: obtaining a PSP firmware directory table from the UEFI firmware based on an embedded firmware structure; step 3: scanning the UEFI firmware according to the PSP firmware directory table to obtain a complete PSP firmware; step 4: traversing all entries in the PSP firmware, if the type of the current entry is code, executing step 5; otherwise, traversing the next entry; step 5: parsing the header information of the current entry, and storing the parsed header information in a code partition directory table data structure; step 6: parsing the module information of all binary file modules under the current entry; wherein the module information of each binary module includes the index and offset of the module; step 7: locating the current binary file module to be parsed according to the index and offset of the binary file module; step 8: parsing the current binary file module, and storing the parsing result in a module file; step 9: extracting all stored information and summarizing and integrating it to generate a parsing report.

[0048] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0049] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A platform security processor firmware file parsing method, characterized in that: include: Step 1: Get the UEFI firmware of the device under AMD processor architecture; Step 2: Obtain a PSP firmware catalog table from the UEFI firmware based on an embedded firmware structure; Step 3: Scan the UEFI firmware according to the PSP firmware catalog table to obtain a complete PSP firmware; Step 4: Traverse all entries in the PSP firmware, if the type of the current entry is code, execute step 5; Otherwise, traverse the next entry; Step 5: Parse the header information of the current entry and store the parsed header information into the code partition directory table data structure; Step 6: Parse the module information of all binary file modules under the current entry; wherein the module information of each binary module includes the index and offset of the module; Step 7: Locate the current binary file module that needs to be parsed based on the index and offset of the binary file module; Step 8: Parse the current binary file module and store the parsing result in the module file; Step 9: Extract all stored information and summarize it to generate an analysis report.

2. A platform security processor firmware file parsing method according to any one of claim 1, characterized in that: Step 2 specifically includes: Step 2.1: Traverse all possible offset addresses of the embedded firmware structure, and check whether the first four bytes at the current offset address match the start mark of the embedded firmware structure. If they match, the current offset address is the offset address of the embedded firmware structure, and the traversal ends; otherwise, check the next offset address; Step 2.2: Locate the pointer position of the PSP firmware directory table according to the offset address of the embedded firmware structure; Step 2.3: Locate the PSP firmware directory table according to the pointer position of the PSP firmware directory table.

3. A platform security processor firmware file parsing method according to any one of claim 1, characterized in that: Step 3 specifically includes: Step 3.1: Parse the PSP firmware directory table to obtain the total number of entries and entry information of each entry; the entry information includes the type, address and size of the entry; Step 3.2: Obtain a BIOS directory structure from the UEFI firmware, and parse the BIOS directory structure to obtain a BIOS directory header and a BIOS directory entry; Step 3.3: Read the BIOS key in sequence according to the address sequence of the BIOS directory header and the BIOS directory entry, and use the corresponding BIOS key to perform RTM signature verification on the entry information of the corresponding entry in the PSP firmware directory table. If the verification is successful, extract the binary file module under the entry. Otherwise, continue to verify the next entry until all entries are verified; Step 3.4: Store the extracted binary file modules in the same folder according to the order of the entries in the PSP firmware directory table to obtain the complete PSP firmware.

4. A platform security processor firmware file parsing method according to any one of claims 1 to 3, characterized in that: Step 8 specifically includes: Step 8.1: Determine the compression algorithm type of the current binary file module. If it is Zlib compression, use the Zlib decompression algorithm to decompress the current binary file module, save the decompression result as a module file, and jump to step 8.4; if it is not compressed, execute step 8.2; Step 8.2: Determine the encryption algorithm type of the current binary file module. If it is AES encryption, use the AES decryption algorithm to decrypt the current binary file module, save the decryption result as a module file, and jump to step 8.4; if it is not encrypted, jump to step 8.3; Step 8.3: directly store the current binary file module as a module file; Step 8.4: Determine whether the current binary file module is the last binary file module. If not, read the index, offset and size of the next binary file module and jump to step 7; if yes, execute step 9.

5. A platform security processor firmware file parsing method according to claim 4, characterized in that: In step 8.1, the compression algorithm type of the current binary file module is determined, including: Read the compression algorithm field value of the current binary file module, and match the compression algorithm field value with the predefined zlib header identifier. If the match is successful, it means that the compression algorithm of the current entry is Zlib compression; if the compression algorithm field value is None, there is no compression.

6. A platform security processor firmware file parsing device, characterized in that: include: A firmware acquisition unit, used to acquire UEFI firmware of a device under an AMD processor architecture; A firmware extraction unit, configured to obtain a PSP firmware directory table from the UEFI firmware based on an embedded firmware structure, and to scan the UEFI firmware according to the PSP firmware directory table to obtain a complete PSP firmware; The firmware parsing unit is used to traverse all entries in the PSP firmware, and when the type of the current entry is code, perform the following process: parse the header information of the current entry, and store the parsed header information in the code partition directory table data structure; parse the module information of all binary file modules under the current entry; wherein the module information of each binary module includes the index and offset of the module; locate the current binary file module to be parsed according to the index and offset of the binary file module; parse the current binary file module, and store the parsing result in the module file; The analysis report generation unit is used to extract all the stored information and summarize and integrate them to generate an analysis report.

7. A platform security processor firmware file parsing device according to claim 6, characterized in that: The firmware parsing unit includes a decompression module and a decryption module; correspondingly, the current binary file module is parsed and the parsing result is stored in the module file, specifically including: The decompression module is used to determine the compression algorithm type of the current binary file module. If it is Zlib compression, the Zlib decompression algorithm is used to decompress the current binary file module and store the decompression result as a module file. If it is not compressed, the current binary file module is output to the decryption module; The decryption module is used to determine the encryption algorithm type of the current binary file module. If it is AES encryption, the AES decryption algorithm is used to decrypt the current binary file module and the decryption result is stored as a module file. If it is not encrypted, the current binary file module is directly stored as a module file.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 5 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images