302 lines
19 KiB
JavaScript
302 lines
19 KiB
JavaScript
/*
|
||
Copyright 2020-2021 Intel Corporation
|
||
|
||
Licensed under the Apache License, Version 2.0 (the "License");
|
||
you may not use this file except in compliance with the License.
|
||
You may obtain a copy of the License at
|
||
|
||
http://www.apache.org/licenses/LICENSE-2.0
|
||
|
||
Unless required by applicable law or agreed to in writing, software
|
||
distributed under the License is distributed on an "AS IS" BASIS,
|
||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||
See the License for the specific language governing permissions and
|
||
limitations under the License.
|
||
*/
|
||
|
||
/**
|
||
* @description Intel(R) AMT Setup.bin Parser
|
||
* @author Ylian Saint-Hilaire
|
||
* @version v0.1.0
|
||
*/
|
||
|
||
var CreateAmtSetupBinStack = function () {
|
||
var o = {};
|
||
|
||
// Intel(R) AMT Setup.bin GUID's
|
||
var AmtSetupBinSetupGuids = [
|
||
'\xb5\x16\xfb\x71\x87\xcb\xf9\x4a\xb4\x41\xca\x7b\x38\x35\x78\xf9', // Version 1
|
||
'\x96\xb2\x81\x58\xcf\x6b\x72\x4c\x8b\x91\xa1\x5e\x51\x2e\x99\xc4', // Version 2
|
||
'\xa7\xf7\xf6\xc6\x89\xc4\xf6\x47\x93\xed\xe2\xe5\x02\x0d\xa5\x1d', // Version 3
|
||
'\xaa\xa9\x34\x52\xe1\x29\xa9\x44\x8d\x4d\x08\x1c\x07\xb9\x63\x53' // Version 4
|
||
];
|
||
|
||
// Notes about version 2 of setup.bin:
|
||
// - Default "admin" must be followed by a new MEBx password
|
||
// - ME_VARIABLE_IDENTIFIER_MANAGEABILITY_FEATURE_SELECTION may not appear after any CM settings
|
||
// - CM_VARIABLE_IDENTIFIER_USER_DEFINED_CERT_ADD must be preceded by setting CM_VARIABLE_IDENTIFIER_USER_DEFINED_CERTS_CONFIG to (TODO!)
|
||
|
||
// General notes:
|
||
// - Setup.bin should always start with "CurrentMEBx Pwd", "newMebx Pwd", "manageability selection" (if present).
|
||
|
||
// Intel(R) AMT variable identifiers
|
||
// Type: 0 = Binar Stringy, 1 = Char, 2 = Short, 3 = Int
|
||
var AmtSetupBinVarIds =
|
||
{
|
||
1: {
|
||
1: [0, "Current MEBx Password"],
|
||
2: [0, "New MEBx Password"],
|
||
3: [1, "Manageability Feature Selection",
|
||
{ 0: "None", 1: "Intel AMT" }],
|
||
4: [1, "Firmware Local Update", // 0 = Disabled, 1 = Enabled, 2 = Password Protected
|
||
{ 0: "Disabled", 1: "Enabled", 2: "Password Protected" }],
|
||
5: [1, "Firmware Update Qualifier", // 0 = Always, 1 = Never, 2 = Restricted
|
||
{ 0: "Always", 1: "Never", 2: "Restricted" }],
|
||
6: [4, "Power Package"] // GUID Length (16 bytes), Intel AMT version 2.1, 3 and 4
|
||
},
|
||
2: {
|
||
1: [0, "Provisioning Preshared Key ID (PID)"],
|
||
2: [0, "Provisioning Preshared Key (PPS)"],
|
||
3: [0, "PKI DNS Suffix"], // 255 bytes max length
|
||
4: [0, "Configuration Server FQDN"], // 255 bytes max length
|
||
5: [1, "Remote Configuration Enabled (RCFG)", // 0 = Off, 1 = On
|
||
{ 0: "Off", 1: "On" }],
|
||
6: [1, "Pre-Installed Certificates Enabled", // 0 = Off, 1 = On
|
||
{ 0: "Off", 1: "On" }],
|
||
7: [1, "User Defined Certificate Configuration", // 0 = Disabled, 1 = Enabled, 2 = Delete
|
||
{ 0: "Disabled", 1: "Enabled", 2: "Delete" }],
|
||
8: [0, "User Defined Certificate Addition"], // 1 byte hash algo, 20 to 48 bytes hash, 1 byte name length, up to 32 bytes friendly name, 1 = SHA1 (20 bytes), 2 = SHA256 (32 bytes), 3 = SHA384 (48 bytes). Algo 2 & 3 are for version 3 and up.
|
||
10: [1, "SOL/IDER Redirection Configuration", {
|
||
0: "None", 1: "SOL only - User/Pass Disabled", 2: "IDER only - User/Pass Disabled", 3: "SOL+IDER - User/Pass Disabled",
|
||
4: "None - User/Pass Enabled", 5: "SOL only - User/Pass Enabled", 6: "IDER only - User/Pass Enabled", 7: "SOL+IDER - User/Pass Enabled"
|
||
}],
|
||
11: [0, "Hostname"], // 63 bytes max length
|
||
12: [0, "Domain Name"], // 255 bytes max length
|
||
13: [1, "DHCP", { 1: "Disabled", 2: "Enabled" }],
|
||
14: [1, "Secure Firmware Update (SFWU)", // 0 = Disabled, 1 = Enabled
|
||
{ 0: "Disabled", 1: "Enabled" }],
|
||
15: [0, "ITO"],
|
||
16: [1, "Provisioning Mode (PM)", // 1 = Enterprise, 2 = Small Buisness (SMB)
|
||
{ 0: "Enterprise", 1: "Small Buisness" }],
|
||
17: [0, "Provisioning Server Address"],
|
||
18: [2, "Provision Server Port Number (PSPO)"],
|
||
19: [0, "Static IPv4 Parameters"],
|
||
20: [0, "VLAN"],
|
||
21: [0, "PASS Policy Flag"],
|
||
22: [0, "IPv6"], // Length is 204 bytes old format, 84 bytes new format, Version 3+ only
|
||
23: [1, "Shared/Dedicated FQDN", // 0 = Dedicated, 1 = Shared. This option is valid only if configuring the hostname as well
|
||
{ 0: "Dedicated", 1: "Shared" }],
|
||
24: [1, "Dynamic DNS Update", // 0 = Disabled, 1 = Enabled
|
||
{ 0: "Disabled", 1: "Enabled" }],
|
||
25: [1, "Remote Desktop (KVM) State", // 0 = Disabled, 1 = Enabled
|
||
{ 0: "Disabled", 1: "Enabled" }],
|
||
26: [1, "Opt-in User Consent Option", // 0 = Disabled, 1 = KVM, 0xFF = ALL
|
||
{ 0: "Disabled", 1: "KVM", 255: "All" }],
|
||
27: [1, "Opt-in Remote IT Consent Policy", // 0 = Disabled, 1 = Enabled. Allows user consent to be configured remotely.
|
||
{ 0: "Disabled", 1: "Enabled" }],
|
||
28: [1, "ME Provision Halt Active", // 0 = Stop, 1 = Start. The "ME provisioning Halt/Activate" command must appear in the file only after "PKIDNSSuffix", "ConfigServerFQDN" and "Provisioning Server Address"
|
||
{ 0: "Stop", 1: "Start" }],
|
||
29: [1, "Manual Setup and Configuration", // 0 = Automated, 1 = Manual
|
||
{ 0: "Automated", 1: "Manual" }],
|
||
30: [3, "Support Channel Identifier"], // 4 bytes length. Support channel identifier (valid values: 1-65535)
|
||
31: [0, "Support Channel Description"], // 60 bytes max. Friendly name used to describe the party representedby the support channel identifier.
|
||
32: [0, "Service Account Number"], // 32 bytes max. Unique string identifier given to the end user by the service provider.
|
||
33: [0, "Enrollement Passcode"], // 32 bytes max
|
||
34: [3, "Service Type"], // 4 bytes length. 1 = Reactive, 2 = Proactive, 4 = One Time Session
|
||
35: [0, "Service Provider Identifier"] // GUID Length (16 bytes)
|
||
}
|
||
}
|
||
|
||
|
||
// Parse the Setup.bin file
|
||
o.AmtSetupBinCreate = function (version, flags) {
|
||
var obj = {};
|
||
obj.fileType = version;
|
||
obj.recordChunkCount = 1; // TODO
|
||
obj.recordHeaderByteCount = 46;
|
||
obj.recordNumber = 0;
|
||
obj.majorVersion = version;
|
||
obj.minorVersion = 0;
|
||
obj.flags = flags;
|
||
obj.dataRecordsConsumed = 0;
|
||
obj.dataRecordChunkCount = 1; // TODO
|
||
obj.records = [];
|
||
return obj;
|
||
}
|
||
|
||
|
||
// Parse the Setup.bin file
|
||
o.AmtSetupBinDecode = function (file) {
|
||
|
||
// Format of the setup file header:
|
||
// FileTypeUUID(16) - uniquely identifies the file type. This identifier will remain valid and constant across all versions of the file type.
|
||
// RecordChunkCount(2) - indicates the number of 512-byte chunks occupied by this record, including all header, body, and reserved fields.
|
||
// RecordHeaderBytes(2) - indicates the length of the record header in bytes.
|
||
// RecordNumber(4) - uniquely identifies the record among all records in the file. The field contains a non-negative ordinal value. The value of this field is always zero in the Local Provisioning File Header Record.
|
||
// MajorVersion(1) - identifies the major version of the file format specification. This is a positive integer that is greater than or equal to 1. The Major Version number is incremented to indicate that changes have been introduced that will cause code written against a lower Major Version number to fail.
|
||
// MinorVersion(1) - identifies the minor version of the file format specification. This is an integer that is greater than or equal to 0. The Minor Version number is incremented to indicate that changes have been introduced that will not cause code written against the same Major Version and a lower Minor Version number to fail. The purpose of this behavior is to allow a single local provisioning file to be used for multiple generations of Intel<65> AMT platform.
|
||
// DataRecordCount(4) - indicates the total number of data records written in the file when it was created.
|
||
// DataRecordsConsumed(4) - is a counter value that begins at 0 and is incremented by 1 by each platform BIOS when it consumes a data record from the file. This value is used to determine the offset of the next data record in the file.
|
||
// DataRecordChunkCount(2) - contains the number of 512-byte chunks in each data record. All data records are the same length.
|
||
// ModuleList - contains a list of module identifiers. A module<6C>s identifier appears in the list if and only if the data records contain entries for that module. Each module identifier is two bytes in length. The list is terminated by an identifier value of 0.
|
||
|
||
var obj = {}, UUID = file.substring(0, 16);
|
||
obj.fileType = 0;
|
||
for (var i in AmtSetupBinSetupGuids) { if (UUID == AmtSetupBinSetupGuids[i]) obj.fileType = (+i + 1); }
|
||
if (obj.fileType == 0) return; // Bad header
|
||
obj.recordChunkCount = ReadShortX(file, 16);
|
||
obj.recordHeaderByteCount = ReadShortX(file, 18);
|
||
obj.recordNumber = ReadIntX(file, 20);
|
||
obj.majorVersion = file.charCodeAt(24);
|
||
obj.minorVersion = file.charCodeAt(25);
|
||
obj.flags = ReadShortX(file, 26); // Flags: 1 = Do not consume records
|
||
var dataRecordCount = ReadIntX(file, 28);
|
||
obj.dataRecordsConsumed = ReadIntX(file, 32);
|
||
obj.dataRecordChunkCount = ReadShortX(file, 36);
|
||
obj.records = [];
|
||
|
||
var ptr = 512;
|
||
while (ptr + 512 <= file.length) {
|
||
|
||
// Format of a data record header:
|
||
// RecordTypeIdentifier(4) - identifies the type of record (in this case a data record). Record Identifiers: Invalid - 0, Data Record - 1
|
||
// RecordFlags(4) - contains a set of bit flags that characterize the record.
|
||
// RecordChunkCount(2) - contains the number of 512-byte chunks occupied by the record including all header, body, and reserved fields.
|
||
// RecordHeaderByteCount(2) - indicates the length of the record header in bytes.
|
||
// RecordNumber(4) - uniquely identifies the record among all records in the file, including invalid as well as valid records. The identifier is a non-negative integer.
|
||
|
||
var r = {};
|
||
r.typeIdentifier = ReadIntX(file, ptr);
|
||
r.flags = ReadIntX(file, ptr + 4); // Flags: 1 = Valid, 2 = Scrambled
|
||
r.chunkCount = ReadShortX(file, ptr + 8);
|
||
r.headerByteCount = ReadShortX(file, ptr + 10);
|
||
r.number = ReadIntX(file, ptr + 12);
|
||
r.variables = [];
|
||
|
||
var ptr2 = 0, recbin = file.substring(ptr + 24, ptr + 512);
|
||
if ((r.flags & 2) != 0) { recbin = AmtSetupBinDescrambleRecordData(recbin); } // De-Scramble the record
|
||
while (1) {
|
||
|
||
// Format of a data record entry:
|
||
// ModuleIdentifier(2) - identifies the target ME module for the entry.
|
||
// VariableIdentifier(2) - an enumeration value that identifies the variable. Variable identifiers are unique to each ModuleIdentifier.
|
||
// VariableLength(2) - is the length of the variable value in bytes.
|
||
// VariableValue - is the value to be assigned to the variable.
|
||
|
||
var v = {};
|
||
v.moduleid = ReadShortX(recbin, ptr2);
|
||
v.varid = ReadShortX(recbin, ptr2 + 2);
|
||
if (v.moduleid == 0 || v.varid == 0) break;
|
||
if (AmtSetupBinVarIds[v.moduleid][v.varid]) {
|
||
v.length = ReadShortX(recbin, ptr2 + 4);
|
||
v.type = AmtSetupBinVarIds[v.moduleid][v.varid][0];
|
||
v.desc = AmtSetupBinVarIds[v.moduleid][v.varid][1];
|
||
v.value = recbin.substring(ptr2 + 8, ptr2 + 8 + v.length);
|
||
if (v.type == 1 && v.length == 1) v.value = v.value.charCodeAt(0); // 1 byte number
|
||
else if (v.type == 2 && v.length == 2) v.value = ReadShortX(v.value, 0); // 2 byte number
|
||
else if (v.type == 3 && v.length == 4) v.value = ReadIntX(v.value, 0); // 4 byte number
|
||
else if (v.type == 4) v.value = guidToStr(rstr2hex(v.value)); // GUID
|
||
r.variables.push(v);
|
||
}
|
||
ptr2 += (8 + (Math.floor((v.length + 3) / 4) * 4));
|
||
}
|
||
|
||
// Sort the variables
|
||
r.variables.sort(AmtSetupBinVariableCompare);
|
||
|
||
obj.records.push(r);
|
||
ptr += 512;
|
||
}
|
||
|
||
if (dataRecordCount != obj.records.length) return; // Mismatch record count
|
||
return obj;
|
||
}
|
||
|
||
// Construct a Setup.bin file
|
||
o.AmtSetupBinEncode = function (obj) {
|
||
if (obj.fileType < 1 && obj.fileType > AmtSetupBinSetupGuids.length) return null;
|
||
var out = [], r = AmtSetupBinSetupGuids[obj.fileType - 1], reccount = 0;
|
||
r += ShortToStrX(obj.recordChunkCount);
|
||
r += ShortToStrX(obj.recordHeaderByteCount);
|
||
r += IntToStrX(obj.recordNumber);
|
||
r += String.fromCharCode(obj.majorVersion, obj.minorVersion);
|
||
r += ShortToStrX(obj.flags); // Flags: 1 = Do not consume records
|
||
r += IntToStrX(obj.records.length);
|
||
r += IntToStrX(obj.dataRecordsConsumed);
|
||
r += ShortToStrX(obj.dataRecordChunkCount);
|
||
while (r.length < 512) { r += '\0'; } // Pad the header
|
||
out.push(r);
|
||
|
||
// Write each record
|
||
for (var i in obj.records) {
|
||
var r2 = '', rec = obj.records[i];
|
||
r2 += IntToStrX(rec.typeIdentifier);
|
||
r2 += IntToStrX(rec.flags);
|
||
r2 += IntToStrX(0); // Reserved
|
||
r2 += IntToStrX(0); // Reserved
|
||
r2 += ShortToStrX(1); // rec.chunkCount
|
||
r2 += ShortToStrX(24); // rec.headerByteCount
|
||
r2 += IntToStrX(++reccount);
|
||
|
||
// Sort the variables
|
||
rec.variables.sort(AmtSetupBinVariableCompare);
|
||
|
||
/*
|
||
// Change variable priority
|
||
AmtSetupBinMoveToTop(r.variables, 1, 3); // Manageability Feature Selection
|
||
AmtSetupBinMoveToTop(r.variables, 1, 2); // New MEBx password
|
||
AmtSetupBinMoveToTop(r.variables, 1, 1); // Current MEBx password
|
||
*/
|
||
|
||
// Write each variable
|
||
for (var j in rec.variables) {
|
||
var r3 = '', v = rec.variables[j], data = v.value;
|
||
v.type = AmtSetupBinVarIds[v.moduleid][v.varid][0]; // Set the correct type if not alreay connect
|
||
if ((v.type > 0) && (v.type < 4)) { // If this is a numeric value, encode it correctly
|
||
data = parseInt(data);
|
||
if (v.type == 1) data = String.fromCharCode(data);
|
||
if (v.type == 2) data = ShortToStrX(data);
|
||
if (v.type == 3) data = IntToStrX(data);
|
||
}
|
||
if (v.type == 4) { data = hex2rstr(guidToStr(data.split('-').join('')).split('-').join('')); }
|
||
r3 += ShortToStrX(v.moduleid); // Module Identifier
|
||
r3 += ShortToStrX(v.varid); // Variable Identifier
|
||
r3 += ShortToStrX(data.length); // Variable Length
|
||
r3 += ShortToStrX(0); // Reserved
|
||
r3 += data; // Variable Data
|
||
while (r3.length % 4 != 0) { r3 += '\0'; } // Pad the variable
|
||
r2 += r3;
|
||
}
|
||
|
||
while (r2.length < 512) { r2 += '\0'; } // Pad the record
|
||
if ((rec.flags & 2) != 0) { r2 = r2.substring(0, 24) + AmtSetupBinScrambleRecordData(r2.substring(24)); } // Scramble the record starting at byte 24, after the header
|
||
out.push(r2);
|
||
}
|
||
return out.join('');
|
||
}
|
||
|
||
// Used to sort variables
|
||
function AmtSetupBinVariableCompare(a, b) {
|
||
if (a.moduleid > b.moduleid) return 1;
|
||
if (a.moduleid < b.moduleid) return -1;
|
||
if (a.varid > b.varid) return 1;
|
||
if (a.varid < b.varid) return -1;
|
||
return 0;
|
||
}
|
||
|
||
// Scramble and un-scramble records
|
||
function AmtSetupBinScrambleRecordData(data) { var out = ''; for (var i = 0; i < data.length; i++) { out += String.fromCharCode((data.charCodeAt(i) + 17) & 0xFF); } return out; }
|
||
function AmtSetupBinDescrambleRecordData(data) { var out = ''; for (var i = 0; i < data.length; i++) { out += String.fromCharCode((data.charCodeAt(i) + 0xEF) & 0xFF); } return out; }
|
||
|
||
// Find a moduleid/varid in the variable list, if found, move it to the top
|
||
//function AmtSetupBinMoveToTop(variables, moduleid, varid) { var i = -1; for (var j in variables) { if ((variables[j].moduleid == moduleid) && (variables[j].varid == varid)) { i = j; } } if (i > 1) { ArrayElementMove(variables, i, 0); } }
|
||
|
||
function ShortToStrX(v) { return String.fromCharCode(v & 0xFF, (v >> 8) & 0xFF); };
|
||
function IntToStrX(v) { return String.fromCharCode(v & 0xFF, (v >> 8) & 0xFF, (v >> 16) & 0xFF, (v >> 24) & 0xFF); };
|
||
function ReadShortX(v, p) { return (v.charCodeAt(p + 1) << 8) + v.charCodeAt(p); };
|
||
function ReadIntX(v, p) { return (v.charCodeAt(p + 3) * 0x1000000) + (v.charCodeAt(p + 2) << 16) + (v.charCodeAt(p + 1) << 8) + v.charCodeAt(p); };
|
||
|
||
return o;
|
||
};
|
||
|
||
module.exports = CreateAmtSetupBinStack; |