[uefi] factorize SkuSiPolicy.p7b copying code and apply it for Windows To Go

* Also don't forget to credit the original authors of the PowerShell gist we derived our code from!
This commit is contained in:
Pete Batard 2023-06-19 00:04:08 +02:00
parent 7eb9a6f16b
commit c59e9209eb
No known key found for this signature in database
GPG key ID: 38E0CF5E69EDD671
6 changed files with 40 additions and 17 deletions

View file

@ -1908,19 +1908,8 @@ DWORD WINAPI FormatThread(void* param)
FormatStatus = ERROR_SEVERITY_ERROR|FAC(FACILITY_STORAGE)|APPERR(ERROR_CANT_PATCH);
}
}
} else if ((target_type == TT_UEFI) && IS_WINDOWS_1X(img_report) && pe256ssp_size > 0) {
// Copy this system's SkuSiPolicy.p7b to the target drive so that UEFI bootloaders
// revoked by Windows through WDAC policy do get flagged as revoked.
char src[MAX_PATH], dst[MAX_PATH];
struct __stat64 stat64 = { 0 };
static_sprintf(src, "%s\\SecureBootUpdates\\SKUSiPolicy.p7b", system_dir);
static_sprintf(dst, "%s\\efi\\microsoft\\boot\\SKUSiPolicy.p7b", drive_name);
if ((_stat64U(dst, &stat64) != 0) && (_stat64U(src, &stat64) == 0)) {
uprintf("Copying: %s (%s) (from %s)", dst, SizeToHumanReadable(stat64.st_size, FALSE, FALSE), src);
if (!CopyFileU(src, dst, TRUE))
uprintf(" Error writing file: %s", WindowsErrorString());
}
}
CopySKUSiPolicy(drive_name);
if ( (target_type == TT_BIOS) && HAS_WINPE(img_report) ) {
// Apply WinPE fixup
if (!SetupWinPE(drive_name[0]))