nx_efivarstore.nx

nx_efivarstore.nx -- F103e RUNG 11a: READ a UEFI authenticated variable store. The enrolment rung needs PK / KEK / db entries, which means knowing the varstore layout and the EFI GUIDs. ★★★★★★I AM NOT WRITING THOSE GUIDs FROM MEMORY. `OVMF_VARS_4M.ms.fd` ships with Microsoft's keys already enrolled -- it is a WORKED EXAMPLE OF THE EXACT FORMAT, on disk, free. So: parse it, print what is really there, and take every constant from the artifact. **THE FORMAT COMES FROM THE FILE, NOT FROM RECALL** -- the same rule that has caught me three times today when I trusted a filename over a symbol table. Layout (EDK2 VariableFormat.h), all little-endian: EFI_FIRMWARE_VOLUME_HEADER : ZeroVector[16], FileSystemGuid[16], FvLength[8], Signature "_FVH", Attributes[4], HeaderLength[2], Checksum[2], ExtHeaderOffset[2], Reserved[1], Revision[1], BlockMap... VARIABLE_STORE_HEADER : Signature GUID[16], Size[4], Format[1], State[1], Reserved[6] AUTHENTICATED_VARIABLE_HEADER (60 B) : StartId[2]=0x55AA, State[1], Reserved[1], Attributes[4], MonotonicCount[8], TimeStamp[16], PubKeyIndex[4], NameSize[4], DataSize[4], VendorGuid[16] then Name(UCS-2) then Data, each entry 4-byte aligned. Usage: nx_efivarstore dump <vars.fd> -- enumerate every variable nx_efivarstore selftest <vars.fd> -- teeth against a REAL MS-key varstore Exit: 0 GREEN | 1 RED | 3 UNPROVEN (cannot read input). license_tier: ORIGINAL