A basic "dbx" UEFI variable parser to dump blacklisted UEFI bootloader hashes

dbxhashoutput.csv

dbxparser.ps1

function Get-SecureBootUEFIDBXHash {
<#
.SYNOPSIS

Dumps SHA256 hashes of blacklisted UEFI bootloaders from the 'dbx' UEFI variable.

.DESCRIPTION

Author: Matthew Graeber (@mattifestation)
License: BSD 3-Clause

.PARAMETER DBXVariable

Specifies a UEFI variable, an instance of which is returned by calling the Get-SecureBootUEFI cmdlet.

.PARAMETER DBXBytes

Specifies a byte array consisting of the 'dbx' UEFI vairable contents.

.EXAMPLE

Get-SecureBootUEFI -Name dbx | Get-SecureBootUEFIDBXHash

.EXAMPLE

$DBXBytes = [IO.File]::ReadAllBytes('C:\Temp\dbx.bin')

Get-SecureBootUEFIDBXHash -DBXBytes $DBXBytes

.INPUTS

Microsoft.SecureBoot.Commands.UEFIEnvironmentVariable

Accepts the output of `Get-SecureBootUEFI -Name dbx` over the pipeline.

.OUTPUTS

UEFIDBXHash

Outputs a custom object consisting of banned SHA256 hashes and the respective "owner" of each hash. "77fa9abd-0359-4d32-bd60-28f4e78f784b" refers to Microsoft as the owner.
#>

    param (
        [Parameter(Mandatory, ValueFromPipeline, ParameterSetName = 'UEFIVariable')]
        [PSTypeName('Microsoft.SecureBoot.Commands.UEFIEnvironmentVariable')]
        [ValidateScript({ $_.Name -eq 'dbx' })]
        $DBXVariable,

        [Parameter(Mandatory, ParameterSetName = 'ByteArray')]
        [Byte[]]
        [ValidateNotNullOrEmpty()]
        $DBXBytes
    )

    # This obviously needs to be extended to support all possible EFI_SIGNATURE_LIST.SignatureTypes
    # Only supporting EFI_CERT_SHA256_GUID for dbx is sufficient for this PoC though.
    $SignatureTypeMapping = @{
        'c1c41626-504c-4092-aca9-41f936934328' = 'EFI_CERT_SHA256_GUID'
        'A5C059A1-94E4-4AA7-87B5-AB155C2BF072' = 'EFI_CERT_X509_GUID'
    }

    $Bytes = $null

    if ($DBXVariable) {
        $Bytes = $DBXVariable.Bytes
    } else {
        $Bytes = $DBXBytes
    }

    $MemoryStream = New-Object -TypeName IO.MemoryStream -ArgumentList @(,$Bytes)
    $BinaryReader = New-Object -TypeName IO.BinaryReader -ArgumentList $MemoryStream, ([Text.Encoding]::Unicode)

    while ($BinaryReader.PeekChar() -ne -1) {
        $SignatureType = [Guid][Byte[]] $BinaryReader.ReadBytes(16)
        $SignatureName = $SignatureTypeMapping["$SignatureType"]

        switch ($SignatureName) {
            'EFI_CERT_SHA256_GUID' {
                $SignatureListSize = $BinaryReader.ReadUInt32()

                # This should always be zero
                $SignatureHeaderSize = $BinaryReader.ReadUInt32()

                # This should always be 0x30 for EFI_CERT_SHA256_GUID
                #   SignatureOwner GUID + 0x20 byte SHA256 hash
                $SignatureSize = $BinaryReader.ReadUInt32()

                # 0x1C is the size of the EFI_SIGNATURE_LIST header
                $EFISignatureDataCount = ($SignatureListSize - 0x1C) / $SignatureSize

                for ($i = 0; $i -lt $EFISignatureDataCount; $i++) {
                    $EFISignatureData = $BinaryReader.ReadBytes($SignatureSize)

                    $SignatureOwner = [Guid][Byte[]] $EFISignatureData[0..0x0F]
                    $Hash = ([Byte[]] $EFISignatureData[0x10..0x2F] | ForEach-Object { $_.ToString('X2') }) -join ''

                    [PSCustomObject] @{
                        PSTypeName = 'UEFIDBXHash'
                        SignatureOwner = $SignatureOwner
                        SHA256Hash = $Hash
                    }
                }
            }
        }
    }
}