2) Fixed QHexView misalignment in Windows and macOS.
3) Added some more analysis to raw files and sections: raw files can (or can not) contain sections, raw sections can contain NVAR storage or PE/TE.
4) Improved CPU base address detection and propagation.
5) Improved FIT recognition.
7) ME region not displayed if it is in unknown format, fixed this because we still want to operate with it.
8) Small changes to Flash Descriptor parsing to get more cases for valid "Intel image". To get rid of cases when "Intel image" is already in tree but with parse error because of which "UEFI image" appears.
9) Added parsing of individual UEFI-files (these can be trimmed from UEFI-volume), displaying it as "UEFI volume part".
10) Added possibility to view/save contents of elements "Free volume space", "Free space" and such, because these can be non-empty.
11) Added info about blocks number and block size (with preliminary and stupid validity check) to volume info.
12) Added storage in settings of the following paths: open image file, save image file, open GUIDs file.
13) Added last opened files list.
14) Added permanent opened file name string to the end of the status bar.
15) Added opened file changes tracking: if the file was modified in other program while it is opened in UEFITool, there are 3 ways to act: a) ignore changes (but mark file path displayed in the status bar with italic font); b) ask user to reopen or ignore (if ignore, mark as in a); c) auto reopen changed file in UEFITool. If changes were in some way ignored, file path displayed in the right of the status bar will be marked with italic font and then become clickable: on click request to reopen appears again.
16) Switched to offset/size instead of byte array storing in each tree item.
17) For clarity - added icons to key tree items (compressed and with contents, contents now must be in root item only).
18) For usability - added expanding tree on open image (to depth level 1) and by menu command (expand all).
As the first step towards automated parsing, this change set replaces outdated BootGuard-related parsers with shiny new KaitaiStruct-based ones.
It also does the following:
- improves Intel FIT definitions by using the relevant specification
- adds sha1, sha384, sha512 and sm3 digest implementations
- updates LZMA SDK to v22.01
- moves GUIDs out of include files to prevent multiple instantiations
- enforces C++11
- adds Kaitai-based parsers for Intel FIT, BootGuard v1 and BootGuard v2 structures
- makes many small refactorings here, there and everywhere
+ FFSv3 support with large files and large sections
+ proper names for Flash Descriptor v2 regions (#89)
+ better alignment calculations (#96)
+ improved NVRAM parser
+ post IBB hash support for Boot Guard
+ bugfixes
+ companion tool updated
- human readable JEDEC ID
- NVRAM parser separated from FFS parser
- added support for LZMAF86 sections
- solved a bug with parsing of VSS variables with invalid sizes
- added wrappers over Qt classes for seamless replacement if Qt is not available
- added bstrlib as submodule
- only UEFIExtract works with this changes for now, others will followa bit later
- thanks to NVAR extended headers, item tails are back
- fixed a bug with "Extract uncompressed" producing incorrect results
for multiple sections
- fixed detection and parsing of NVRAM external defaults file
- fixed "Extract as is" on NVAR entries not including extended header
- small bugfixes and refactorings
- added support for all Phoenix SCT stuff from NVRAM volume: Intel
microcodes, CMDB block, SLIC pubkey/marker.
- added support for EVSA extended variables (bigger than 0xFFFF)
- better EVSA parsing (invalid data vars are shown now)
- FlashMap entries now have human-readable types
- various small fixes and refactorings
- added UI for VSS storage operations
- changed VSS storage/vars parsing order
- solved problems with GUIDs as filenames
- Fsys, _FDC and other NVRAM formats TBD
- added FfsBuilder code and UI, but reconstruction routines for volumes,
files and sections are still not ready
- FfsOps moved to common
- QVector and QPair aren't used anymore, replaces with std::vector and
std::pair
- common classes are now independent from QObject
- next step is to replace QString with CBString from bstrlib
Thanks to lordkag for #41:
- improved parsing of Intel flash descriptor
- improved detection of Tiano/EFI 1.1 compression type
- added 2 UEFI capsule GUIDs used by Lenovo
- solved potential crash on very low memory available
- UEFIExtract and UEFIFind update to include the latest parser changes
- added detection of VTF inside volume's non-UEFI data
- corrected ImageSize information for EFI capsule
- *.scap is added to the list of known Image file extensions
- all FIT candidates in a tree item are checked for being referenced
from the last VTF now
- added sanity checks during volume header parsing
- corrected various small FIT issues
- corrected bogus "unaligned volume" messages during capsule files
parsing
- solved a bug in offset calculation for Intel images inside a capsule
- fitParser code cleanup
- hopefully the last commit to this tree, time to start another branch
and rewrite the whole thing once again
