diff --git a/eventlog.py b/eventlog.py index f36c98e..0c88c89 100644 --- a/eventlog.py +++ b/eventlog.py @@ -285,3 +285,45 @@ def validate (self): for evt in self: if not evt.validate(): return False return True + + +def get_digests (evlog: EventLog, evtype: str, **kwargs) -> list: + + assert evtype in Event.__members__ + + algid=kwargs.get('hash_algid',None) + if algid: + assert algid in EfiEventDigest.hashalgmap + + pcr=kwargs.get('pcr_index',None) + + digest_list=[] + + for ev in evlog: + if Event(ev.evtype).name == evtype: + if pcr: + if ev.evpcr != pcr: continue + if algid: + digest=ev.digests[algid].toJson() + digest_list.append(digest['Digest']) + else: + for v in ev.digests.values(): + digest_list.append(v.toJson()) + + return digest_list + +def match_digest (evlog: EventLog, evtype: str, algid: int, digest: str, **kwargs) -> bool: + + assert evtype in Event.__members__ + assert algid in EfiEventDigest.hashalgmap + + pcr=kwargs.get('pcr_index',None) + + for ev in evlog: + if pcr: + if ev.evpcr != pcr: continue + if algid: + dg=ev.digests[algid].toJson() + if dg['Digest'] == digest: + return True + return False diff --git a/match_digest.py b/match_digest.py new file mode 100755 index 0000000..72626c3 --- /dev/null +++ b/match_digest.py @@ -0,0 +1,76 @@ +#!/usr/bin/env python3 + +import eventlog +import argparse + +def parser_main(): + parser = argparse.ArgumentParser( + description="List/Match the digest[s]" + ) + parser.add_argument( + "-f", + "--file", + help="measured boot log binary file", + ) + parser.add_argument( + "-d", + "--digest", + help="digest value", + ) + parser.add_argument( + "-e", + "--event", + help="event type", + ) + parser.add_argument( + "-a", + "--algid", + default="11", + help="algorithm id", + ) + parser.add_argument( + "-p", + "--pcr", + help="pcr index", + ) + return parser + +def main(): + p = parser_main() + args = p.parse_args() + + assert (args.file),"file is required" + assert (args.event),"event type is required" + + with open (args.file, 'rb') as f: + buffer = f.read() + + if args.event not in eventlog.Event.__members__: + print('Invalid event type') + return + + algid = int(args.algid) + if algid not in eventlog.EfiEventDigest.hashalgmap: + print ('Invalid hash algorithm id.') + return + + log=eventlog.EventLog(buffer, len(buffer)) + + if not args.digest: + if args.pcr: + dg_list = eventlog.get_digests(log, args.event, hash_algid=algid, pcr_index=int(args.pcr)) + else: + dg_list = eventlog.get_digests(log, args.event, hash_algid=algid) + print(dg_list) + else: + if args.pcr: + matched = eventlog.match_digest(log, args.event, algid, args.digest, pcr_index=int(args.pcr)) + else: + matched = eventlog.match_digest(log, args.event, algid, args.digest, algid) + if matched: + print('Digest matched!') + else: + print('Digest does not match!') + +if __name__ == "__main__": + main()