Re: chipsec-1.5.0 in EFI Shell

--===============2598413961517078252==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

Did you follow the instructions from https://github.com/chipsec/chipsec/wik=
i/Creating-a-Bootable-USB-drive-with-UEFI-Shell?  They should have enough i=
nformation to help out.  It sounds like UEFI SHELL is not the problem in th=
is case.  Can you elaborate on the python that you are using.  There is a p=
ython.efi module within the chipsec_uefi zipfile.  Python has been modified=
 to include some chipsec specific commands with chipsec.  There are steps t=
o reproduce the build, however I'm not sure that they work with the latest =
EDK and you may need to build from an older version.  To my knowledge the c=
ode within chipsec is still compatible with python2 at this point and you s=
hould be able to use 1.5.0.  If you can run chipsec with the debug flag and=
 let us know where it is failing that would help.

Thanks,
Brent

-----Original Message-----
From: Blibbet <[email protected]> =

Sent: Thursday, May 28, 2020 2:55 PM
To: Vorname Nachname <[email protected]>
Cc: chipsec(a)lists.01.org
Subject: [chipsec] Re: chipsec-1.5.0 in EFI Shell

What UEFI Shell are you using? "EFI Shell" may mean an ancient one. I think=
 I recall some thread where someone was trying to get CHIPSEC running using=
 an old (1.x?) OEM's shell (Apple?), and they had to provide their own inst=
ead. There is an older and a newer UEFI Shell.

You should also include info about other Python code you were able to succe=
ssfully run in this EFI Shell. Maybe CHIPSEC is not the issue, the issue is=
 your EFI Shell and Python.

Instead of building your own UEFI Python, what happens when you use the CHI=
PSEC instructions and use their supplied python.efi? Wasn't there some spec=
ial CHIPSEC-centric options needed to build Python with? If so, that should=
 be clarified better in build docs.

(Granted, it sucks having a security tool ship a pre-compiled Python binary=
 in their source tree, built in an unknown manner, with no checksums, and n=
o reproducable builds, and have the tool rely on this for determining platf=
orm security. But that's another issue...)

Intel has abandoned CPython V2 for UEFI patch, and is instead is working on=
 MicroPython for UEFI (which has some Python V3 support). Though Python V2 =
is deprecated and most of world has moved to Python V3, CHIPSEC team is sti=
ll using/bundling CPython V2, and hasn't switched over to using/relying-on/=
bundling MicroPython for UEFI.

FWIW, I rarely see replies from the team for support questions on this mail=
ing list nor the Google Groups lists. It I was looking for a reply, I'd fil=
e a Github issue (and include more info), or use Twitter.

You might want to clarify that you're trying to run this on an Intel system=
, not another ISA (like AMD or ARM or RISC-V), as that'd also not work.

HTH,
Lee

On 5/28/20 7:36 AM, Vorname Nachname wrote:
> Hello,
>
> I tried to run chipsec-1.5.0 in EFI Shell without operating system but =

> unfortunately it doesn't run in the EFI Shell. I ran these commands:
>
> Shell> fs0:
> FS0:\> python -^# chipsec_main.py -m debugenabled
>
> This results in a traceback with the last file chipsec/defines.py =

> called function get_version().
>
> OSError: [Errno 22] Invalud argument: 'FS0:FS0:chipsec'
>
> After that I compiled python 2.7.2 and python 2.7.10 from edk2 package =

> version edk2-stable201903. This is the last package version with =

> pyhton inside. With this version of pyhton I received another error =

> message with the last line:
>
> ImportError: No module named expat; use SimpleXMLTreeBuilder instead.
>
> What is the best way to start the latest version of chipsec in the EFI =

> Shell? What version of EFI Shell and pyhton is required?
>
> best wishes
> Philipp
>
>
> _______________________________________________
> chipsec mailing list -- chipsec(a)lists.01.org To unsubscribe send an =

> email to chipsec-leave(a)lists.01.org
_______________________________________________
chipsec mailing list -- chipsec(a)lists.01.org To unsubscribe send an email=
 to chipsec-leave(a)lists.01.org
--===============2598413961517078252==--