Page 1 of 1

[solved] How to get a string from an element of data type unicode in a structure

Posted: Sat Jan 06, 2024 7:05 am
by Zero Ray
Hello everyone!
I've tried enumerating the UEFI startup entries with the following code:

Code: Select all

EnableExplicit

Structure BootOrder Align #PB_Structure_AlignC
  BootOrderList.w[128]
EndStructure

Structure _EFI_LOAD_OPTION Align #PB_Structure_AlignC
  Attributes.l
  FilePathListLength.w
  Description.u[256]
EndStructure

Prototype.l ProtoGetFirmwareEnvironmentVariableEx(Name.p-unicode, GUID.p-unicode, Buffer.l, Size.l, Attrib.l)

Define BootOrder.BootOrder
Define EFILoadOption._EFI_LOAD_OPTION
Define GetFirmwareEnvironmentVariableEx.ProtoGetFirmwareEnvironmentVariableEx
Define Attrib.l
Define BootOrderSize.i
Define tmp.b
Define i.i
Define BootSequence$

If OpenLibrary(0, "Kernel32.dll")
  GetFirmwareEnvironmentVariableEx = GetFunction(0, "GetFirmwareEnvironmentVariableExW")
EndIf

RtlAdjustPrivilege_(22, 1, 0, @tmp)
BootOrderSize = GetFirmwareEnvironmentVariableEx("BootOrder", "{8BE4DF61-93CA-11D2-AA0D-00E098032B8C}", @BootOrder, SizeOf(BootOrder), @Attrib)
If BootOrderSize
  For i = 0 To BootOrderSize/SizeOf(word)-1
    BootSequence$ = "Boot" + RSet(Hex(BootOrder\BootOrderList[i], #PB_Long), 4, "0")
    GetFirmwareEnvironmentVariableEx(BootSequence$, "{8BE4DF61-93CA-11D2-AA0D-00E098032B8C}", @EFILoadOption, SizeOf(EFILoadOption), @Attrib)
    Debug BootSequence$ + ": " + PeekS(@EFILoadOption\Description)
  Next
EndIf
RtlAdjustPrivilege_(22, 0, 0, @tmp)
However, I don't know how to get the string from EFILoadOption\Description

Re: How to get a string from an element of data type unicode in a structure

Posted: Sat Jan 06, 2024 7:27 am
by skywalk
PeekS()
And you can use the memory viewer to verify it is actually filled.

Re: How to get a string from an element of data type unicode in a structure

Posted: Sat Jan 06, 2024 10:32 am
by infratec
I would use:

Code: Select all

PeekS(@EFILoadOption\Description[0])

Re: How to get a string from an element of data type unicode in a structure

Posted: Sat Jan 06, 2024 11:14 am
by Zero Ray
infratec wrote: Sat Jan 06, 2024 10:32 am I would use:

Code: Select all

PeekS(@EFILoadOption\Description[0])
Solved! Thanks for your help!

Re: How to get a string from an element of data type unicode in a structure

Posted: Sat Jan 06, 2024 11:34 am
by Fred
For this case, you can also use fixed strings to use it directly:

Code: Select all

Structure BootOrder Align #PB_Structure_AlignC
  BootOrderList.s{128}
EndStructure

Re: How to get a string from an element of data type unicode in a structure

Posted: Sat Jan 06, 2024 12:16 pm
by infratec
If the returned string is unicode ...

else you need the PeekS() solution.

Re: How to get a string from an element of data type unicode in a structure

Posted: Sat Jan 06, 2024 12:17 pm
by Zero Ray
Fred wrote: Sat Jan 06, 2024 11:34 am For this case, you can also use fixed strings to use it directly:

Code: Select all

Structure BootOrder Align #PB_Structure_AlignC
  BootOrderList.s{128}
EndStructure
Can you give a full example? Thanks,

Re: How to get a string from an element of data type unicode in a structure

Posted: Sat Jan 06, 2024 12:42 pm
by mk-soft
Is used as a normal string.
But don't know what the API call looks like. Please provide a description

Code: Select all

Structure BootOrder Align #PB_Structure_AlignC
  BootOrderList.s{128}
EndStructure

Define api_dummy.BootOrder

api_dummy\BootOrderList = "xyz"

r1.s = api_dummy\BootOrderList
Debug r1

Re: How to get a string from an element of data type unicode in a structure

Posted: Sat Jan 06, 2024 1:06 pm
by Zero Ray
mk-soft wrote: Sat Jan 06, 2024 12:42 pm Is used as a normal string.
But don't know what the API call looks like. Please provide a description

Code: Select all

Structure BootOrder Align #PB_Structure_AlignC
  BootOrderList.s{128}
EndStructure

Define api_dummy.BootOrder

api_dummy\BootOrderList = "xyz"

r1.s = api_dummy\BootOrderList
Debug r1
https://uefi.org/specs/UEFI/2.10/03_Boo ... rogramming

Re: How to get a string from an element of data type unicode in a structure

Posted: Sat Jan 06, 2024 3:02 pm
by Olli
Fred wrote: Sat Jan 06, 2024 11:34 am For this case, you can also use fixed strings to use it directly:

Code: Select all

Structure BootOrder Align #PB_Structure_AlignC
  BootOrderList.s{128}
EndStructure
We maybe could nest it.

Code: Select all

Structure _EFI_LOAD_OPTION Align #PB_Structure_AlignC
  Attributes.l
  FilePathListLength.w
  StructureUnion
    Description.u[256]
    BootOrderList.s{512}
  EndStructureUnion
EndStructure