chipsec integrity check

--===============7159543792620709993==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

I have been using chipsec as an integrity verification tool.  I know its no=
t how it was intended to be used, but I'm not aware of any other tools that=
 will do the kind of deep dive into BIOS and UEFI that chipsec does.  In th=
eory any malware should leave some type of traces that would show up as cha=
nges in chipsec results.  The problem is that ordinary use may also make so=
me changes, and I am having a hard time determining what types of changes s=
hould be expected from ordinary use.  I would appreciate any advice.

I have written some test scripts below:

#!/bin/bash
OUTPUT=3D/root/verify_certs.log
chipsec_util uefi var-read db d719b2cb-3d3a-4596-a3bc-dad00e67656f db.bin >=
> db.ascii
diff db.bin ./current/db.bin >> $OUTPUT
hexdump db.bin | diff - ./current/db.hex >> $OUTPUT
rm db.bin
rm db.ascii

#!/bin/bash
OUTPUT=3D/root/verify_efivars.log
chipsec_util uefi var-list
for x in `cat dir2`
do
sha256sum $x >> shasums.1
done
cat shasums.1 | sed s/\\/root\\/efi_variables.dir\\///g |  awk '{ print $2 =
, $1 }' | sort > shasums.tmp
rm shasums.1
diff shasums shasums.tmp >> $OUTPUT
diff efi_variables.lst ./current/efi_variables.lst >> $OUTPUT

#!/bin/bash
OUTPUT=3D/root/verify_chipsec
cd tmp
chipsec_util acpi list > acpi_list
chipsec_util acpi table APIC > acpi_table_APIC
chipsec_util acpi table BATB > acpi_table_BATB
chipsec_util acpi table BGRT > acpi_table_BGRT
chipsec_util acpi table CRAT > acpi_table_CRAT
chipsec_util acpi table DSDT > acpi_table_DSDT
chipsec_util acpi table FACP > acpi_table_FACP
chipsec_util acpi table FPDT > acpi_table_FPDT
chipsec_util acpi table HPET > acpi_table_HPET
chipsec_util acpi table MCFG > acpi_table_MCFG
chipsec_util acpi table MSDM > acpi_table_MSDM
chipsec_util acpi table SBST > acpi_table_SBST
chipsec_util acpi table SSDT > acpi_table_SSDT
chipsec_util acpi table TCPA > acpi_table_TCPA
chipsec_util acpi table TPM2 > acpi_table_TPM2
chipsec_util acpi table UEFI > acpi_table_UEFI
chipsec_util acpi table VFCT > acpi_table_VFCT
chipsec_util acpi table XSDT > acpi_table_XSDT
chipsec_util cmos dump > cmos_dump
chipsec_util ec dump > ec_dump
chipsec_util gdt > gdt
chipsec_util io list > io_list
chipsec_util iommu config GFXVTD > iommu_config_GFXVTD
chipsec_util iommu config VTD > iommu_config_VTD
chipsec_util iommu list > iommu_list
chipsec_util iommu status GFXVTD > iommu_status_GFXVTD
chipsec_util iommu status VTD > iommu_status_VTD
chipsec_util mmcfg > mmcfg
chipsec_util mmio dump DMIBAR > mmio_dump_DMIBAR
chipsec_util mmio dump GFXVTBAR > mmio_dump_GFXVTBAR
chipsec_util mmio dump GMADR > mmio_dump_GMADR
chipsec_util mmio dump GTTMMADR > mmio_dump_GTTMMADR
chipsec_util mmio dump HDABAR > mmio_dump_HDABAR
chipsec_util mmio dump HDBAR > mmio_dump_HDBAR
chipsec_util mmio dump MCHBAR > mmio_dump_MCHBAR
chipsec_util mmio dump MMCFG > mmio_dump_MMCFG
chipsec_util mmio dump PXPEPBAR > mmio_dump_PXPEPBAR
chipsec_util mmio dump RCBA > mmio_dump_RCBA
chipsec_util mmio dump RCBA_RTC > mmio_dump_RCBA_RTC
chipsec_util mmio dump SPIBAR > mmio_dump_SPIBAR
chipsec_util mmio dump VTBAR > mmio_dump_VTBAR
chipsec_util mmio list > mmio_list
chipsec_util pci dump > pci_dump
chipsec_util pci enumerate > pci_enumerate
chipsec_util pci xrom > pci_xrom
chipsec_util platform > chipsec_platform
chipsec_util spi info > spi_info
chipsec_util ucode id > ucode_id
for x in `cat testfiles`
do
echo -e "#####  $x  #####\\n" >> $OUTPUT
diff $x /root/current/$x >> $OUTPUT
grep -v elapsed $OUTPUT > $OUTPUT.log
rm $OUTPUT
done

The output log files are here:
https://pastebin.com/wV4wdPeW
https://pastebin.com/nBa3BwLb

Sent with [ProtonMail](https://protonmail.com) Secure Email.

--===============7159543792620709993==
Content-Type: text/html
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.html"

PGRpdj5JIGhhdmUgYmVlbiB1c2luZyBjaGlwc2VjIGFzIGFuIGludGVncml0eSB2ZXJpZmljYXRp
b24gdG9vbC4mbmJzcDsgSSBrbm93IGl0cyBub3QgaG93IGl0IHdhcyBpbnRlbmRlZCB0byBiZSB1
c2VkLCBidXQgSSdtIG5vdCBhd2FyZSBvZiBhbnkgb3RoZXIgdG9vbHMgdGhhdCB3aWxsIGRvIHRo
ZSBraW5kIG9mIGRlZXAgZGl2ZSBpbnRvIEJJT1MgYW5kIFVFRkkgdGhhdCBjaGlwc2VjIGRvZXMu
Jm5ic3A7IEluIHRoZW9yeSBhbnkgbWFsd2FyZSBzaG91bGQgbGVhdmUgc29tZSB0eXBlIG9mIHRy
YWNlcyB0aGF0IHdvdWxkIHNob3cgdXAgYXMgY2hhbmdlcyBpbiBjaGlwc2VjIHJlc3VsdHMuJm5i
c3A7IFRoZSBwcm9ibGVtIGlzIHRoYXQgb3JkaW5hcnkgdXNlIG1heSBhbHNvIG1ha2Ugc29tZSBj
aGFuZ2VzLCBhbmQgSSBhbSBoYXZpbmcgYSBoYXJkIHRpbWUgZGV0ZXJtaW5pbmcgd2hhdCB0eXBl
cyBvZiBjaGFuZ2VzIHNob3VsZCBiZSBleHBlY3RlZCBmcm9tIG9yZGluYXJ5IHVzZS4mbmJzcDsg
SSB3b3VsZCBhcHByZWNpYXRlIGFueSBhZHZpY2UuPGJyPjwvZGl2PjxkaXY+PGJyPjwvZGl2Pjxk
aXY+SSBoYXZlIHdyaXR0ZW4gc29tZSB0ZXN0IHNjcmlwdHMgYmVsb3c6PGJyPjwvZGl2PjxkaXY+
PGJyPjwvZGl2PjxkaXY+IyEvYmluL2Jhc2g8YnI+PC9kaXY+PGRpdj5PVVRQVVQ9L3Jvb3QvdmVy
aWZ5X2NlcnRzLmxvZzxicj48L2Rpdj48ZGl2PmNoaXBzZWNfdXRpbCB1ZWZpIHZhci1yZWFkIGRi
IGQ3MTliMmNiLTNkM2EtNDU5Ni1hM2JjLWRhZDAwZTY3NjU2ZiBkYi5iaW4gJmd0OyZndDsgZGIu
YXNjaWk8YnI+PC9kaXY+PGRpdj5kaWZmIGRiLmJpbiAuL2N1cnJlbnQvZGIuYmluICZndDsmZ3Q7
ICRPVVRQVVQ8YnI+PC9kaXY+PGRpdj5oZXhkdW1wIGRiLmJpbiB8IGRpZmYgLSAuL2N1cnJlbnQv
ZGIuaGV4ICZndDsmZ3Q7ICRPVVRQVVQ8YnI+PC9kaXY+PGRpdj5ybSBkYi5iaW48YnI+PC9kaXY+
PGRpdj5ybSBkYi5hc2NpaTxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48
ZGl2PiMhL2Jpbi9iYXNoPGJyPjwvZGl2PjxkaXY+T1VUUFVUPS9yb290L3ZlcmlmeV9lZml2YXJz
LmxvZzxicj48L2Rpdj48ZGl2PmNoaXBzZWNfdXRpbCB1ZWZpIHZhci1saXN0PGJyPjwvZGl2Pjxk
aXY+Zm9yIHggaW4gYGNhdCBkaXIyYDxicj48L2Rpdj48ZGl2PmRvPGJyPjwvZGl2PjxkaXY+c2hh
MjU2c3VtICR4ICZndDsmZ3Q7IHNoYXN1bXMuMTxicj48L2Rpdj48ZGl2PmRvbmU8YnI+PC9kaXY+
PGRpdj5jYXQgc2hhc3Vtcy4xIHwgc2VkIHMvXFwvcm9vdFxcL2VmaV92YXJpYWJsZXMuZGlyXFwv
Ly9nIHwmbmJzcDsgYXdrICd7IHByaW50ICQyICwgJDEgfScgfCBzb3J0ICZndDsgc2hhc3Vtcy50
bXA8YnI+PC9kaXY+PGRpdj5ybSBzaGFzdW1zLjE8YnI+PC9kaXY+PGRpdj5kaWZmIHNoYXN1bXMg
c2hhc3Vtcy50bXAgJmd0OyZndDsgJE9VVFBVVDxicj48L2Rpdj48ZGl2PmRpZmYgZWZpX3Zhcmlh
Ymxlcy5sc3QgLi9jdXJyZW50L2VmaV92YXJpYWJsZXMubHN0ICZndDsmZ3Q7ICRPVVRQVVQ8YnI+
PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj4jIS9iaW4vYmFzaDxicj48
L2Rpdj48ZGl2Pk9VVFBVVD0vcm9vdC92ZXJpZnlfY2hpcHNlYzxicj48L2Rpdj48ZGl2PmNkIHRt
cDxicj48L2Rpdj48ZGl2PmNoaXBzZWNfdXRpbCBhY3BpIGxpc3QgJmd0OyBhY3BpX2xpc3Q8YnI+
PC9kaXY+PGRpdj5jaGlwc2VjX3V0aWwgYWNwaSB0YWJsZSBBUElDICZndDsgYWNwaV90YWJsZV9B
UElDPGJyPjwvZGl2PjxkaXY+Y2hpcHNlY191dGlsIGFjcGkgdGFibGUgQkFUQiAmZ3Q7IGFjcGlf
dGFibGVfQkFUQjxicj48L2Rpdj48ZGl2PmNoaXBzZWNfdXRpbCBhY3BpIHRhYmxlIEJHUlQgJmd0
OyBhY3BpX3RhYmxlX0JHUlQ8YnI+PC9kaXY+PGRpdj5jaGlwc2VjX3V0aWwgYWNwaSB0YWJsZSBD
UkFUICZndDsgYWNwaV90YWJsZV9DUkFUPGJyPjwvZGl2PjxkaXY+Y2hpcHNlY191dGlsIGFjcGkg
dGFibGUgRFNEVCAmZ3Q7IGFjcGlfdGFibGVfRFNEVDxicj48L2Rpdj48ZGl2PmNoaXBzZWNfdXRp
bCBhY3BpIHRhYmxlIEZBQ1AgJmd0OyBhY3BpX3RhYmxlX0ZBQ1A8YnI+PC9kaXY+PGRpdj5jaGlw
c2VjX3V0aWwgYWNwaSB0YWJsZSBGUERUICZndDsgYWNwaV90YWJsZV9GUERUPGJyPjwvZGl2Pjxk
aXY+Y2hpcHNlY191dGlsIGFjcGkgdGFibGUgSFBFVCAmZ3Q7IGFjcGlfdGFibGVfSFBFVDxicj48
L2Rpdj48ZGl2PmNoaXBzZWNfdXRpbCBhY3BpIHRhYmxlIE1DRkcgJmd0OyBhY3BpX3RhYmxlX01D
Rkc8YnI+PC9kaXY+PGRpdj5jaGlwc2VjX3V0aWwgYWNwaSB0YWJsZSBNU0RNICZndDsgYWNwaV90
YWJsZV9NU0RNPGJyPjwvZGl2PjxkaXY+Y2hpcHNlY191dGlsIGFjcGkgdGFibGUgU0JTVCAmZ3Q7
IGFjcGlfdGFibGVfU0JTVDxicj48L2Rpdj48ZGl2PmNoaXBzZWNfdXRpbCBhY3BpIHRhYmxlIFNT
RFQgJmd0OyBhY3BpX3RhYmxlX1NTRFQ8YnI+PC9kaXY+PGRpdj5jaGlwc2VjX3V0aWwgYWNwaSB0
YWJsZSBUQ1BBICZndDsgYWNwaV90YWJsZV9UQ1BBPGJyPjwvZGl2PjxkaXY+Y2hpcHNlY191dGls
IGFjcGkgdGFibGUgVFBNMiAmZ3Q7IGFjcGlfdGFibGVfVFBNMjxicj48L2Rpdj48ZGl2PmNoaXBz
ZWNfdXRpbCBhY3BpIHRhYmxlIFVFRkkgJmd0OyBhY3BpX3RhYmxlX1VFRkk8YnI+PC9kaXY+PGRp
dj5jaGlwc2VjX3V0aWwgYWNwaSB0YWJsZSBWRkNUICZndDsgYWNwaV90YWJsZV9WRkNUPGJyPjwv
ZGl2PjxkaXY+Y2hpcHNlY191dGlsIGFjcGkgdGFibGUgWFNEVCAmZ3Q7IGFjcGlfdGFibGVfWFNE
VDxicj48L2Rpdj48ZGl2PmNoaXBzZWNfdXRpbCBjbW9zIGR1bXAgJmd0OyBjbW9zX2R1bXA8YnI+
PC9kaXY+PGRpdj5jaGlwc2VjX3V0aWwgZWMgZHVtcCAmZ3Q7IGVjX2R1bXA8YnI+PC9kaXY+PGRp
dj5jaGlwc2VjX3V0aWwgZ2R0ICZndDsgZ2R0PGJyPjwvZGl2PjxkaXY+Y2hpcHNlY191dGlsIGlv
IGxpc3QgJmd0OyBpb19saXN0PGJyPjwvZGl2PjxkaXY+Y2hpcHNlY191dGlsIGlvbW11IGNvbmZp
ZyBHRlhWVEQgJmd0OyBpb21tdV9jb25maWdfR0ZYVlREPGJyPjwvZGl2PjxkaXY+Y2hpcHNlY191
dGlsIGlvbW11IGNvbmZpZyBWVEQgJmd0OyBpb21tdV9jb25maWdfVlREPGJyPjwvZGl2PjxkaXY+
Y2hpcHNlY191dGlsIGlvbW11IGxpc3QgJmd0OyBpb21tdV9saXN0PGJyPjwvZGl2PjxkaXY+Y2hp
cHNlY191dGlsIGlvbW11IHN0YXR1cyBHRlhWVEQgJmd0OyBpb21tdV9zdGF0dXNfR0ZYVlREPGJy
PjwvZGl2PjxkaXY+Y2hpcHNlY191dGlsIGlvbW11IHN0YXR1cyBWVEQgJmd0OyBpb21tdV9zdGF0
dXNfVlREPGJyPjwvZGl2PjxkaXY+Y2hpcHNlY191dGlsIG1tY2ZnICZndDsgbW1jZmc8YnI+PC9k
aXY+PGRpdj5jaGlwc2VjX3V0aWwgbW1pbyBkdW1wIERNSUJBUiAmZ3Q7IG1taW9fZHVtcF9ETUlC
QVI8YnI+PC9kaXY+PGRpdj5jaGlwc2VjX3V0aWwgbW1pbyBkdW1wIEdGWFZUQkFSICZndDsgbW1p
b19kdW1wX0dGWFZUQkFSPGJyPjwvZGl2PjxkaXY+Y2hpcHNlY191dGlsIG1taW8gZHVtcCBHTUFE
UiAmZ3Q7IG1taW9fZHVtcF9HTUFEUjxicj48L2Rpdj48ZGl2PmNoaXBzZWNfdXRpbCBtbWlvIGR1
bXAgR1RUTU1BRFIgJmd0OyBtbWlvX2R1bXBfR1RUTU1BRFI8YnI+PC9kaXY+PGRpdj5jaGlwc2Vj
X3V0aWwgbW1pbyBkdW1wIEhEQUJBUiAmZ3Q7IG1taW9fZHVtcF9IREFCQVI8YnI+PC9kaXY+PGRp
dj5jaGlwc2VjX3V0aWwgbW1pbyBkdW1wIEhEQkFSICZndDsgbW1pb19kdW1wX0hEQkFSPGJyPjwv
ZGl2PjxkaXY+Y2hpcHNlY191dGlsIG1taW8gZHVtcCBNQ0hCQVIgJmd0OyBtbWlvX2R1bXBfTUNI
QkFSPGJyPjwvZGl2PjxkaXY+Y2hpcHNlY191dGlsIG1taW8gZHVtcCBNTUNGRyAmZ3Q7IG1taW9f
ZHVtcF9NTUNGRzxicj48L2Rpdj48ZGl2PmNoaXBzZWNfdXRpbCBtbWlvIGR1bXAgUFhQRVBCQVIg
Jmd0OyBtbWlvX2R1bXBfUFhQRVBCQVI8YnI+PC9kaXY+PGRpdj5jaGlwc2VjX3V0aWwgbW1pbyBk
dW1wIFJDQkEgJmd0OyBtbWlvX2R1bXBfUkNCQTxicj48L2Rpdj48ZGl2PmNoaXBzZWNfdXRpbCBt
bWlvIGR1bXAgUkNCQV9SVEMgJmd0OyBtbWlvX2R1bXBfUkNCQV9SVEM8YnI+PC9kaXY+PGRpdj5j
aGlwc2VjX3V0aWwgbW1pbyBkdW1wIFNQSUJBUiAmZ3Q7IG1taW9fZHVtcF9TUElCQVI8YnI+PC9k
aXY+PGRpdj5jaGlwc2VjX3V0aWwgbW1pbyBkdW1wIFZUQkFSICZndDsgbW1pb19kdW1wX1ZUQkFS
PGJyPjwvZGl2PjxkaXY+Y2hpcHNlY191dGlsIG1taW8gbGlzdCAmZ3Q7IG1taW9fbGlzdDxicj48
L2Rpdj48ZGl2PmNoaXBzZWNfdXRpbCBwY2kgZHVtcCAmZ3Q7IHBjaV9kdW1wPGJyPjwvZGl2Pjxk
aXY+Y2hpcHNlY191dGlsIHBjaSBlbnVtZXJhdGUgJmd0OyBwY2lfZW51bWVyYXRlPGJyPjwvZGl2
PjxkaXY+Y2hpcHNlY191dGlsIHBjaSB4cm9tICZndDsgcGNpX3hyb208YnI+PC9kaXY+PGRpdj5j
aGlwc2VjX3V0aWwgcGxhdGZvcm0gJmd0OyBjaGlwc2VjX3BsYXRmb3JtPGJyPjwvZGl2PjxkaXY+
Y2hpcHNlY191dGlsIHNwaSBpbmZvICZndDsgc3BpX2luZm88YnI+PC9kaXY+PGRpdj5jaGlwc2Vj
X3V0aWwgdWNvZGUgaWQgJmd0OyB1Y29kZV9pZDxicj48L2Rpdj48ZGl2PmZvciB4IGluIGBjYXQg
dGVzdGZpbGVzYDxicj48L2Rpdj48ZGl2PmRvPGJyPjwvZGl2PjxkaXY+ZWNobyAtZSAiIyMjIyMm
bmJzcDsgJHgmbmJzcDsgIyMjIyNcXG4iICZndDsmZ3Q7ICRPVVRQVVQ8YnI+PC9kaXY+PGRpdj5k
aWZmICR4IC9yb290L2N1cnJlbnQvJHggJmd0OyZndDsgJE9VVFBVVDxicj48L2Rpdj48ZGl2Pmdy
ZXAgLXYgZWxhcHNlZCAkT1VUUFVUICZndDsgJE9VVFBVVC5sb2c8YnI+PC9kaXY+PGRpdj5ybSAk
T1VUUFVUPGJyPjwvZGl2PjxkaXY+ZG9uZTxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2Pjxi
cj48L2Rpdj48ZGl2PlRoZSBvdXRwdXQgbG9nIGZpbGVzIGFyZSBoZXJlOjxicj48L2Rpdj48ZGl2
PjxhIGhyZWY9Imh0dHBzOi8vcGFzdGViaW4uY29tL3dWNHdkUGVXIj5odHRwczovL3Bhc3RlYmlu
LmNvbS93VjR3ZFBlVzwvYT48YnI+PC9kaXY+PGRpdj48YSBocmVmPSJodHRwczovL3Bhc3RlYmlu
LmNvbS9uQmEzQndMYiI+aHR0cHM6Ly9wYXN0ZWJpbi5jb20vbkJhM0J3TGI8L2E+PGJyPjwvZGl2
PjxkaXY+PGJyPjwvZGl2PjxkaXYgY2xhc3M9InByb3Rvbm1haWxfc2lnbmF0dXJlX2Jsb2NrIj48
ZGl2IGNsYXNzPSJwcm90b25tYWlsX3NpZ25hdHVyZV9ibG9jay11c2VyIHByb3Rvbm1haWxfc2ln
bmF0dXJlX2Jsb2NrLWVtcHR5Ij48YnI+PC9kaXY+PGRpdiBjbGFzcz0icHJvdG9ubWFpbF9zaWdu
YXR1cmVfYmxvY2stcHJvdG9uIj5TZW50IHdpdGggPGEgaHJlZj0iaHR0cHM6Ly9wcm90b25tYWls
LmNvbSI+UHJvdG9uTWFpbDwvYT4gU2VjdXJlIEVtYWlsLjxicj48L2Rpdj48L2Rpdj48ZGl2Pjxi
cj48L2Rpdj4=
--===============7159543792620709993==--