All about Programming

Windows Driver로 ACPI Table에서 iBFT 정보를 찾는 방법

민토즈 2020. 12. 31. 14:52
300x250

How to retrieve iBFT Information on UEFI System using Windows Driver.

 

Windows Driver로 ACPI Table에서 iBFT 정보를 얻는 방법에 대한 설명입니다. 

 

docs.microsoft.com/en-us/windows-hardware/drivers/ddi/aux_klib/nf-aux_klib-auxklibgetsystemfirmwaretable

 

AuxKlibGetSystemFirmwareTable function (aux_klib.h) - Windows drivers

The AuxKlibGetSystemFirmwareTable routine retrieves the specified firmware table from the firmware table provider.

docs.microsoft.com

NTSTATUS

AuxKlibGetSystemFirmwareTable( ULONG FirmwareTableProviderSignature,

                                              ULONG FirmwareTableID,

                                              PVOID FirmwareTableBuffer,

                                              ULONG BufferLength,

                                              PULONG ReturnLength );

 

BufferLength = 0;

ReturnLength = 0;

 

// FirmwareTableID 'iBFT'를 입력으로 넣을 때는 'TFBi'로 입력한다.

status = AuxKlibGetSystemFirmwareTable('ACPI', 'TFBi', NULL, BufferLength, &ReturnLength);

if(status == STATUS_BUFFER_TOO_SMALL && ReturnLength > 0)

{

   FirmwareTableBuffer = ExAllocatePool(NonPagedPool, ReturnLength);

   if(FirmwareTableBuffer == NULL)

   {

      return STATUS_INSUFFICIENT_RESOURCES;

   }

   

   RtlZeroMemory(FirmwareTableBuffer, ReturnLength);

   status = AuxKlibGetSystemFirmwareTable('ACPI', 'TFBi', FirmwareTableBuffer, ReturnLength, &ReturnLength);

   if(NT_SUCCESS(status))

   {

      // parsing the ibft information

      // ibft table을 windbg나 dump해서 확인

   }

   ExFreePool(FirmwreTableBuffer);

}

300x250