UEFI.Secure.Boot客制化方案一_Windows环境

先通过 Windows SDK 安装相关工具。

备份 UEFI Secure Boot 原有的证书。

Get-SecureBootUEFI –Name PK –OutputFilePath PK.old.esl
Get-SecureBootUEFI –Name KEK –OutputFilePath KEK.old.esl
Get-SecureBootUEFI –Name db –OutputFilePath db.old.esl
Get-SecureBootUEFI –Name dbx –OutputFilePath dbx.old.esl

生成自签名证书。

makecert –n "CN=Custom PK" –a sha256 –r –sv PK.pvk PK.cer
makecert –n "CN=Custom KEK" –a sha256 –r –sv KEK.pvk KEK.cer
makecert –n "CN=Custom DSK1" –a sha256 –r –sv DSK1.pvk DSK1.cer

pvk2pfx –pvk PK.pvk –spc PK.cer –pfx PK.pfx –f
pvk2pfx –pvk KEK.pvk –spc KEK.cer –pfx KEK.pfx –f
pvk2pfx –pvk DSK1.pvk –spc DSK1.cer –pfx DSK1.pfx –f

给二进制文件签名。

移除原有签名：
signtool remove /s shimx64.efi
新增签名：
signtool sign /f DSK1.pfx /fd sha256 shimx64.efi

计算和保存文件哈希值。

get-filehash –algorithm SHA256 helloworld.efi | select –ExpandProperty hash > helloworld.txt

$hashString = get-filehash –algorithm SHA256 helloworld.efi | select –ExpandProperty hash

$hashBytes = [byte[]]::new($hashString.length / 2)

For($i=0; $i –lt $hashString.length; $i+=2) { $hashBytes[$i/2] = [convert]::ToByte($hashString.Substring($i, 2), 16) }

$hashBytes | set-content helloworld.hsh –encoding byte

创建 ESL 文件，需要自定义 8-4-4-4-12 的 ID 。

$dbobject = ( Format-SecureBootUEFI –Name db –SignatureOwner 00000000-0000-
0000-0000-000000000000 –Time 2018-01-01-T01:01:01Z –CertificateFilePath
dsk1.crt –FormatWithCert –SignableFilePath db.esl )

$KEKobject = ( Format-SecureBootUEFI –Name KEK –SignatureOwner 00000000-
0000-0000-0000-000000000000 –Time 2018-01-01-T01:01:01Z –
CertificateFilePath KEK.crt –FormatWithCert –SignableFilePath KEK.esl )

$PKobject = ( Format-SecureBootUEFI –Name PK –SignatureOwner 00000000-0000-
0000-0000-000000000000 –Time 2018-01-01-T01:01:01Z –CertificateFilePath
PK.crt –FormatWithCert –SignableFilePath PK.esl )

$dbhashobj = ( Format-SecureBootUEFI –Name db –SignatureOwner 00000000-
0000-0000-0000-000000000000 –Time 2018-01-01-T01:01:01Z –ContentFilePath
helloworld.hsh –Algorithm sha256 –SignableFilePath dbhash.esl )

ESL 转换为 AUTH。

signtool sign /fd sha256 /p7 .\ /p7co 1.2.840.113549.1.7.1 /p7ce db.auth /a
/f .\KEK.pfx /p password db.esl

signtool sign /fd sha256 /p7 .\ /p7co 1.2.840.113549.1.7.1 /p7ce
dbhash.auth /a /f .\KEK.pfx /p password dbhash.esl

signtool sign /fd sha256 /p7 .\ /p7co 1.2.840.113549.1.7.1 /p7ce KEK.auth
/a /f .\PK.pfx /p password KEK.esl

signtool sign /fd sha256 /p7 .\ /p7co 1.2.840.113549.1.7.1 /p7ce PK.auth /a
/f .\PK.pfx /p password PK.esl

cp PK.esl PKnoauth.auth

导入证书。

$dbobject | Set-SecurebootUEFI –SignedFilePath db.auth
$dbhash | Set-SecurebootUEFI –SignedFilePath dbhash.auth -AppendWrite
$KEKobject | Set-SecurebootUEFI –SignedFilePath KEK.auth
$PKobject | Set-SecurebootUEFI –SignedFilePath PK.auth