Re: [GIT PULL] Load keys from signed PE binaries

Matthew Garrett
2013-02-28T19:53:29Z

On Thu, Feb 28, 2013 at 08:41:13PM +0100, Florian Weimer wrote:
> * Matthew Garrett:
>
> >> Would it be possible to have a signed bootloader that allows booting
> >> Win8 from within the secure environment, or it could exit the secure
> >> environment and run unsigned grub?
> >
> > What would stop the unsigned grub from installing a firmware hook that
> > lies about whether or not Secure Boot is enabled, and then booting
> > Windows?
>
> Windows would not have access to the product key because it is stored
> in a variable without EFI_VARIABLE_RUNTIME_ACCESS, so WGA and other
> checks will fail, and the user will notice.

grub's running before ExitBootServices(), because otherwise it has no
way to actually read anything off disk. Or draw to the screen. Or
receive keyboard input. So if it boots Windows, Windows is running in
exactly the environment it would expect to be in.

--
Matthew Garrett | mjg59@srcf.ucam.org