From: "Petr Beneš" <w1benny@gmail.com>
To: xen-devel@lists.xenproject.org
Cc: "Petr Beneš" <w1benny@gmail.com>,
"Anthony PERARD" <anthony.perard@vates.tech>,
"Jan Beulich" <jbeulich@suse.com>,
"Andrew Cooper" <andrew.cooper3@citrix.com>,
"Roger Pau Monné" <roger.pau@citrix.com>
Subject: [PATCH v3 0/3] hvmloader: add new SMBIOS tables (7,8,9,26,27,28)
Date: Tue, 29 Jul 2025 21:25:03 +0000 [thread overview]
Message-ID: <cover.1753823663.git.w1benny@gmail.com> (raw)
From: Petr Beneš <w1benny@gmail.com>
Changes since v2:
- Added sizeof_field and offsetofend macros to common-macros.h.
- Used offsetofend macro everywhere to make semantically sense.
- Added BUILD_BUG_ON to ensure offsets are correct based on the SMBIOS
specification (with explanation in the comments).
- Fixed commit message of the second patch to mention the new smbios_pt_copy
function.
- Fixed nits (empty lines, misplaced *).
- Retained the original comment "Only present when passed in" + added it to
the new tables where applicable.
- Replaced hardcoded offset for chassis_handle in smbios_type_2_init.
Changes since v1:
- Swapped the order of S-o-b in the last commit message.
Resubmitting patch from Anton Belousov and addressing review comments
from Jan: https://old-list-archives.xen.org/archives/html/xen-devel/2022-01/msg00725.html
Original message:
> SMBIOS tables like 7,8,9,26,27,28 are neccessary to prevent sandbox detection
> by malware using WMI-queries. New tables can be mapped to memory from binary
> file specified in "smbios_firmware" parameter of domain configuration.
> If particular table is absent in binary file, then it will not be mapped to
> memory. This method works for Windows domains as tables 7,8,9,26,27,28 are not
> critical for OS boot and runtime. Also if "smbios_firmware" parameter is not
> provided, these tables will be skipped in write_smbios_tables function.
Further explanation:
Some malware samples are known to check presence of various hardware components
(like CPU fan, CPU temperature sensor, etc.) by WMI queries. If these components
are not present, then malware can assume that it is running in a sandbox and
will not execute its payload.
This patch will allow security researchers to create a custom SMBIOS
firmware binary file that contains these tables.
Petr Beneš (3):
tools: add sizeof_field and offsetofend macros
hvmloader: fix SMBIOS table length checks
hvmloader: add new SMBIOS tables (7, 8, 9, 26, 27, 28)
tools/firmware/hvmloader/smbios.c | 290 ++++++++++++++++++------
tools/firmware/hvmloader/smbios_types.h | 109 +++++++--
tools/include/xen-tools/common-macros.h | 5 +
3 files changed, 317 insertions(+), 87 deletions(-)
--
2.34.1
next reply other threads:[~2025-07-29 21:25 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-29 21:25 Petr Beneš [this message]
2025-07-29 21:25 ` [PATCH v3 1/3] tools: add sizeof_field and offsetofend macros Petr Beneš
2025-07-30 7:55 ` Jan Beulich
2025-07-29 21:25 ` [PATCH v3 2/3] hvmloader: fix SMBIOS table length checks Petr Beneš
2025-07-29 21:25 ` [PATCH v3 3/3] hvmloader: add new SMBIOS tables (7, 8, 9, 26, 27, 28) Petr Beneš
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1753823663.git.w1benny@gmail.com \
--to=w1benny@gmail.com \
--cc=andrew.cooper3@citrix.com \
--cc=anthony.perard@vates.tech \
--cc=jbeulich@suse.com \
--cc=roger.pau@citrix.com \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.