[solved] How to get a string from an element of data type unicode in a structure

[Zero Ray]

Hello everyone!
I've tried enumerating the UEFI startup entries with the following code:

Code: Select all

EnableExplicit

Structure BootOrder Align #PB_Structure_AlignC
  BootOrderList.w[128]
EndStructure

Structure _EFI_LOAD_OPTION Align #PB_Structure_AlignC
  Attributes.l
  FilePathListLength.w
  Description.u[256]
EndStructure

Prototype.l ProtoGetFirmwareEnvironmentVariableEx(Name.p-unicode, GUID.p-unicode, Buffer.l, Size.l, Attrib.l)

Define BootOrder.BootOrder
Define EFILoadOption._EFI_LOAD_OPTION
Define GetFirmwareEnvironmentVariableEx.ProtoGetFirmwareEnvironmentVariableEx
Define Attrib.l
Define BootOrderSize.i
Define tmp.b
Define i.i
Define BootSequence$

If OpenLibrary(0, "Kernel32.dll")
  GetFirmwareEnvironmentVariableEx = GetFunction(0, "GetFirmwareEnvironmentVariableExW")
EndIf

RtlAdjustPrivilege_(22, 1, 0, @tmp)
BootOrderSize = GetFirmwareEnvironmentVariableEx("BootOrder", "{8BE4DF61-93CA-11D2-AA0D-00E098032B8C}", @BootOrder, SizeOf(BootOrder), @Attrib)
If BootOrderSize
  For i = 0 To BootOrderSize/SizeOf(word)-1
    BootSequence$ = "Boot" + RSet(Hex(BootOrder\BootOrderList[i], #PB_Long), 4, "0")
    GetFirmwareEnvironmentVariableEx(BootSequence$, "{8BE4DF61-93CA-11D2-AA0D-00E098032B8C}", @EFILoadOption, SizeOf(EFILoadOption), @Attrib)
    Debug BootSequence$ + ": " + PeekS(@EFILoadOption\Description)
  Next
EndIf
RtlAdjustPrivilege_(22, 0, 0, @tmp)

However, I don't know how to get the string from EFILoadOption\Description

[skywalk]

PeekS()
And you can use the memory viewer to verify it is actually filled.

[infratec]

I would use:

Code: Select all

PeekS(@EFILoadOption\Description[0])

[Zero Ray]

I would use:

Code: Select all

PeekS(@EFILoadOption\Description[0])

Solved! Thanks for your help!

[Fred]

For this case, you can also use fixed strings to use it directly:

Code: Select all

Structure BootOrder Align #PB_Structure_AlignC
  BootOrderList.s{128}
EndStructure

[infratec]

If the returned string is unicode ...

else you need the PeekS() solution.

[Zero Ray]

For this case, you can also use fixed strings to use it directly:

Code: Select all

Structure BootOrder Align #PB_Structure_AlignC
  BootOrderList.s{128}
EndStructure

Can you give a full example? Thanks,

[mk-soft]

Is used as a normal string.
But don't know what the API call looks like. Please provide a description

Code: Select all

Structure BootOrder Align #PB_Structure_AlignC
  BootOrderList.s{128}
EndStructure

Define api_dummy.BootOrder

api_dummy\BootOrderList = "xyz"

r1.s = api_dummy\BootOrderList
Debug r1

[Zero Ray]

Is used as a normal string.
But don't know what the API call looks like. Please provide a description

Code: Select all

Structure BootOrder Align #PB_Structure_AlignC
  BootOrderList.s{128}
EndStructure

Define api_dummy.BootOrder

api_dummy\BootOrderList = "xyz"

r1.s = api_dummy\BootOrderList
Debug r1

https://uefi.org/specs/UEFI/2.10/03_Boo ... rogramming

[Olli]

For this case, you can also use fixed strings to use it directly:

Code: Select all

Structure BootOrder Align #PB_Structure_AlignC
  BootOrderList.s{128}
EndStructure

We maybe could nest it.

Code: Select all

Structure _EFI_LOAD_OPTION Align #PB_Structure_AlignC
  Attributes.l
  FilePathListLength.w
  StructureUnion
    Description.u[256]
    BootOrderList.s{512}
  EndStructureUnion
EndStructure