pspreverse / psptool

Display, extract, and manipulate PSP firmware inside UEFI images

PSPTool

PSPTool is a Swiss Army knife for dealing with firmware of the AMD Secure Processor (ASP), formerly known as Platform Security Processor or PSP. It can parse, extract, and replace AMD firmware inside UEFI images as part of BIOS updates targeting AMD platforms.

It is based on reverse-engineering efforts of AMD's proprietary filesystem used to pack firmware blobs into UEFI Firmware Images. These are usually 16MB (or 8MB, or 32MB) in size and can be conveniently parsed by UEFITool. However, all binary blobs by AMD are located in padding volumes unparsable by UEFITool.

PSPTool favourably works with UEFI images as obtained through BIOS updates. If these updates are only available through Windows executables, tools like innoextract can help.

PSPTool was developed at TU Berlin in context of the following research:

• 2023, talk: Jailbreaking an Electric Vehicle in 2023 or What It Means to Hotwire Tesla's x86-Based Seat Heater
• 2023, paper: faulTPM: Exposing AMD fTPMs' Deepest Secrets
• 2021, paper: One Glitch to Rule Them All: Fault Injection Attacks Against AMD's Secure Encrypted Virtualization
• 2020, talk: All You Ever Wanted to Know about the AMD Platform Security Processor and were Afraid to Emulate
• 2019, talk: Uncover, Understand, Own - Regaining Control Over Your AMD CPU
• 2019, paper: Insecure Until Proven Updated: Analyzing AMD SEV's Remote Attestation
• 2019, talk: Dissecting the AMD Platform Security Processor

Installation

You can either install PSPTool's latest release from PyPI,

pip3 install psptool

or install it freshly off GitHub:

git clone https://github.com/PSPReverse/PSPTool
cd PSPTool
pip3 install .

If you intend to make changes to the code and would like your installation to point to the latest changes, install it editable:

pip3 install -e .

Please note that the integration tests require ROM files from a private submodule (tests/integration/fixtures). If you would like to get access to these, contact us.

CLI Usage

PSPTool offers a range of features from the command line.

Example 1: List all firmware entries of a given BIOS ROM.

$ psptool Lenovo_Thinkpad_T495_r12uj35wd.iso

Click to expand output

+-----+----------+-----------+----------+--------------------------------+
| ROM |   Addr   |    Size   |   FET    |             AGESA              |
+-----+----------+-----------+----------+--------------------------------+
|  0  | 0x24ab20 | 0x1000000 | 0x26ab20 | AGESA!V9 PicassoPI-FP5 1.0.0.3 |
+-----+----------+-----------+----------+--------------------------------+
+--+-----------+----------+------+-------+---------------------+
|  | Directory |   Addr   | Type | Magic | Secondary Directory |
+--+-----------+----------+------+-------+---------------------+
|  |     0     | 0x28bb20 | PSP  |  $PSP |       0x138000      |
+--+-----------+----------+------+-------+---------------------+
+--+---+-------+----------+---------+---------------------------------+----------+------------+----------------------------+
|  |   | Entry |  Address |    Size |                            Type | Magic/ID |    Version |                       Info |
+--+---+-------+----------+---------+---------------------------------+----------+------------+----------------------------+
|  |   |     0 | 0x28bf20 |   0x240 |              AMD_PUBLIC_KEY~0x0 |     60BB |          1 |                            |
|  |   |     1 | 0x382f20 |  0xc300 |          PSP_FW_BOOT_LOADER~0x1 |     $PS1 |   0.8.2.59 |  verified(60BB), encrypted |
|  |   |     2 | 0x28c220 |  0xb300 | PSP_FW_RECOVERY_BOOT_LOADER~0x3 |     $PS1 |   0.8.2.59 |  verified(60BB), encrypted |
|  |   |     3 | 0x297520 | 0x22770 |                           0x208 |          |    0.0.0.0 | compressed, verified(60BB) |
|  |   |     4 | 0x2b9d20 |  0x71b0 |                           0x212 |          |    0.0.0.0 | compressed, verified(60BB) |
|  |   |     5 | 0x2c0f20 | 0x20830 |       PSP_SMU_FN_FIRMWARE~0x108 |          |    0.0.0.0 | compressed, verified(60BB) |
|  |   |     6 | 0x2e1820 |  0x5010 |        !SMU_OFF_CHIP_FW_3~0x112 |          |    0.0.0.0 | compressed, verified(60BB) |
|  |   |     7 | 0x2e6920 |    0x10 |               WRAPPED_IKEK~0x21 |          |            |                            |
|  |   |     8 | 0x2e6b20 |  0x1000 |               TOKEN_UNLOCK~0x22 |          |            |                            |
|  |   |     9 | 0x2e7b20 |  0x1860 |                           0x224 |     $PS1 |   A.2.3.27 |  verified(60BB), encrypted |
|  |   |    10 | 0x2e9420 |  0x1760 |                           0x124 |     $PS1 |   A.2.3.1A |  verified(60BB), encrypted |
|  |   |    11 | 0x2eac20 |   0xdd0 |                       ABL0~0x30 |     AW0B | 18.12.10.0 | compressed, verified(60BB) |
|  |   |    12 | 0x2eba20 |  0xcbb0 |                       ABL1~0x31 |     AW1B | 18.12.10.0 | compressed, verified(60BB) |
|  |   |    13 | 0x2f8620 |  0x8dc0 |                       ABL2~0x32 |     AW2B | 18.12.10.0 | compressed, verified(60BB) |
|  |   |    14 | 0x301420 |  0xbb90 |                       ABL3~0x33 |     AW3B | 18.12.10.0 | compressed, verified(60BB) |
|  |   |    15 | 0x30d020 |  0xcca0 |                       ABL4~0x34 |     AW4B | 18.12.10.0 | compressed, verified(60BB) |
|  |   |    16 | 0x319d20 |  0xc910 |                       ABL5~0x35 |     AW5B | 18.12.10.0 | compressed, verified(60BB) |
|  |   |    17 | 0x326720 |  0x9ef0 |                       ABL6~0x36 |     AW6B | 18.12.10.0 | compressed, verified(60BB) |
|  |   |    18 | 0x330620 |  0xc710 |                       ABL7~0x37 |     AW7B | 18.12.10.0 | compressed, verified(60BB) |
|  |   |    19 | 0x382b20 |   0x400 |   !PL2_SECONDARY_DIRECTORY~0x40 |          |            |                            |
+--+---+-------+----------+---------+---------------------------------+----------+------------+----------------------------+


+--+-----------+----------+-----------+-------+---------------------+
|  | Directory |   Addr   |    Type   | Magic | Secondary Directory |
+--+-----------+----------+-----------+-------+---------------------+
|  |     1     | 0x382b20 | secondary |  $PL2 |          --         |
+--+-----------+----------+-----------+-------+---------------------+
+--+---+-------+----------+----------+-----------------------------+----------+------------+----------------------------+
|  |   | Entry |  Address |     Size |                        Type | Magic/ID |    Version |                       Info |
+--+---+-------+----------+----------+-----------------------------+----------+------------+----------------------------+
|  |   |     0 | 0x382f20 |   0xc300 |      PSP_FW_BOOT_LOADER~0x1 |     $PS1 |   0.8.2.59 |  verified(60BB), encrypted |
|  |   |     1 | 0x38f220 |    0x240 |          AMD_PUBLIC_KEY~0x0 |     60BB |          1 |                            |
|  |   |     2 | 0x38f520 |   0xf300 |       PSP_FW_TRUSTED_OS~0x2 |     $PS1 |   0.8.2.59 |  verified(60BB), encrypted |
|  |   |     3 | 0x26bb20 |  0x20000 |             PSP_NV_DATA~0x4 |          |            |                            |
|  |   |     4 | 0x39e820 |  0x22770 |                       0x208 |          |    0.0.0.0 | compressed, verified(60BB) |
|  |   |     5 | 0x3c1020 |    0x340 |      SEC_DBG_PUBLIC_KEY~0x9 |     ED22 |          1 |             verified(60BB) |
|  |   |     6 | 0x24ab21 |      0x0 |      SOFT_FUSE_CHAIN_01~0xb |          |            |                            |
|  |   |     7 | 0x3c1420 |  0x11a50 | PSP_BOOT_TIME_TRUSTLETS~0xc |     $PS1 |    0.7.0.1 | compressed, verified(60BB) |
|  |   |     8 | 0x3d2f20 |   0x71b0 |                       0x212 |          |    0.0.0.0 | compressed, verified(60BB) |
|  |   |     9 | 0x3da120 |   0x1930 |           DEBUG_UNLOCK~0x13 |     $PS1 |   0.8.2.59 | compressed, verified(60BB) |
|  |   |    10 | 0x3dbb20 |     0x10 |           WRAPPED_IKEK~0x21 |          |            |                            |
|  |   |    11 | 0x3dcb20 |   0x1000 |           TOKEN_UNLOCK~0x22 |          |            |                            |
|  |   |    12 | 0x3ddb20 |   0x1860 |                       0x224 |     $PS1 |   A.2.3.27 |  verified(60BB), encrypted |
|  |   |    13 | 0x3df420 |   0x1760 |                       0x124 |     $PS1 |   A.2.3.1A |  verified(60BB), encrypted |
|  |   |    14 | 0x3e0c20 |   0x23e4 |                       0x225 |          |    4.2.1.1 |          inline_keys(76E9) |
|  |   |    15 | 0x3e3020 |   0x3b00 |                       0x125 |          |    3.2.2.1 |          inline_keys(76E9) |
|  |   |    16 | 0x3e6b20 |  0x18790 |         DRIVER_ENTRIES~0x28 |     $PS1 |   0.8.2.59 |  verified(60BB), encrypted |
|  |   |    17 | 0x3ff320 | 0x16e988 |                        0x29 |          |   1.20.8.1 |                     no_key |
|  |   |    18 | 0x56dd20 |   0x3100 |            S0I3_DRIVER~0x2d |     $PS1 |    0.7.0.1 |             verified(60BB) |
|  |   |    19 | 0x570e20 |    0xdd0 |                   ABL0~0x30 |     AW0B | 18.12.10.0 | compressed, verified(60BB) |
|  |   |    20 | 0x571c20 |   0xcbb0 |                   ABL1~0x31 |     AW1B | 18.12.10.0 | compressed, verified(60BB) |
|  |   |    21 | 0x57e820 |   0x8dc0 |                   ABL2~0x32 |     AW2B | 18.12.10.0 | compressed, verified(60BB) |
|  |   |    22 | 0x587620 |   0xbb90 |                   ABL3~0x33 |     AW3B | 18.12.10.0 | compressed, verified(60BB) |
|  |   |    23 | 0x593220 |   0xcca0 |                   ABL4~0x34 |     AW4B | 18.12.10.0 | compressed, verified(60BB) |
|  |   |    24 | 0x59ff20 |   0xc910 |                   ABL5~0x35 |     AW5B | 18.12.10.0 | compressed, verified(60BB) |
|  |   |    25 | 0x5ac920 |   0x9ef0 |                   ABL6~0x36 |     AW6B | 18.12.10.0 | compressed, verified(60BB) |
|  |   |    26 | 0x5b6820 |   0xc710 |                   ABL7~0x37 |     AW7B | 18.12.10.0 | compressed, verified(60BB) |
|  |   |    27 | 0x5c3020 |  0x20830 |   PSP_SMU_FN_FIRMWARE~0x108 |          |    0.0.0.0 | compressed, verified(60BB) |
|  |   |    28 | 0x5e3920 |   0x5010 |    !SMU_OFF_CHIP_FW_3~0x112 |          |    0.0.0.0 | compressed, verified(60BB) |
+--+---+-------+----------+----------+-----------------------------+----------+------------+----------------------------+


+--+-----------+----------+------+-------+---------------------+
|  | Directory |   Addr   | Type | Magic | Secondary Directory |
+--+-----------+----------+------+-------+---------------------+
|  |     2     | 0x34eb20 | BIOS |  $BHD |       0x3ef000      |
+--+-----------+----------+------+-------+---------------------+
+--+---+-------+-----------+---------+-------------------------------+----------+-----------+----------------------------+
|  |   | Entry |   Address |    Size |                          Type | Magic/ID |   Version |                       Info |
+--+---+-------+-----------+---------+-------------------------------+----------+-----------+----------------------------+
|  |   |     0 |  0x34ef20 |   0x340 |           BIOS_PUBLIC_KEY~0x5 |     3FC7 |         1 |             verified(60BB) |
|  |   |     1 |  0x34fb20 |  0x2000 |                   FW_IMC~0x60 |          |           |                            |
|  |   |     2 |  0x351b20 |  0x2000 |                      0x100060 |          |           |                            |
|  |   |     3 |  0x353b20 |  0x2000 |                      0x200060 |          |           |                            |
|  |   |     4 |  0x355b20 |  0x2000 |                      0x300060 |          |           |                            |
|  |   |     5 |  0x357b20 |  0x2000 |                      0x400060 |          |           |                            |
|  |   |     6 |  0x359b20 |  0x2000 |                      0x500060 |          |           |                            |
|  |   |     7 |  0x35bb20 |  0x2000 |                      0x600060 |          |           |                            |
|  |   |     8 |  0x35db20 |  0x2000 |                      0x700060 |          |           |                            |
|  |   |     9 |  0x35fb20 |  0x2000 |                          0x68 |          |           |                            |
|  |   |    10 |  0x361b20 |  0x2000 |                      0x100068 |          |           |                            |
|  |   |    11 |  0x363b20 |  0x2000 |                      0x200068 |          |           |                            |
|  |   |    12 |  0x365b20 |  0x2000 |                      0x300068 |          |           |                            |
|  |   |    13 |  0x367b20 |  0x2000 |                      0x400068 |          |           |                            |
|  |   |    14 |  0x369b20 |  0x2000 |                      0x500068 |          |           |                            |
|  |   |    15 |  0x36bb20 |  0x2000 |                      0x600068 |          |           |                            |
|  |   |    16 |  0x36db20 |  0x2000 |                      0x700068 |          |           |                            |
|  |   |    17 |  0x24ab20 |     0x0 |                   FW_GEC~0x61 |          |           |                            |
|  |   |    18 | 0x117ab20 | 0xd0000 |                          BIOS |          |           |                            |
|  |   |    19 |  0x36fb20 |  0x3c40 |                      0x100064 |     0x05 | 0.0.A1.41 | compressed, verified(60BB) |
|  |   |    20 |  0x373820 |   0x330 |                      0x100065 |     0x05 | 0.0.A1.41 | compressed, verified(60BB) |
|  |   |    21 |  0x373c20 |  0x4610 |                      0x400064 |     0x05 | 0.0.A1.41 | compressed, verified(60BB) |
|  |   |    22 |  0x378320 |   0x320 |                      0x400065 |     0x05 | 0.0.A1.41 | compressed, verified(60BB) |
|  |   |    23 |  0x378720 |  0x4830 |                     0x1100064 |     0x05 |  0.0.18.5 | compressed, verified(60BB) |
|  |   |    24 |  0x37d020 |   0x370 |                     0x1100065 |     0x05 |  0.0.18.5 | compressed, verified(60BB) |
|  |   |    25 |  0x37d420 |  0x47a0 |                     0x1400064 |     0x05 |  0.0.18.5 | compressed, verified(60BB) |
|  |   |    26 |  0x381c20 |   0x340 |                     0x1400065 |     0x05 |  0.0.18.5 | compressed, verified(60BB) |
|  |   |    27 |  0x639b20 |   0x400 | !BL2_SECONDARY_DIRECTORY~0x70 |          |           |                            |
+--+---+-------+-----------+---------+-------------------------------+----------+-----------+----------------------------+


+--+-----------+----------+-----------+-------+---------------------+
|  | Directory |   Addr   |    Type   | Magic | Secondary Directory |
+--+-----------+----------+-----------+-------+---------------------+
|  |     3     | 0x639b20 | secondary |  $BL2 |          --         |
+--+-----------+----------+-----------+-------+---------------------+
+--+---+-------+-----------+---------+---------------------+----------+-----------+----------------------------+
|  |   | Entry |   Address |    Size |                Type | Magic/ID |   Version |                       Info |
+--+---+-------+-----------+---------+---------------------+----------+-----------+----------------------------+
|  |   |     0 |  0x639f20 |   0x340 | BIOS_PUBLIC_KEY~0x5 |     3FC7 |         1 |             verified(60BB) |
|  |   |     1 |  0x63ab20 |  0x2000 |         FW_IMC~0x60 |          |           |                            |
|  |   |     2 |  0x63cb20 |  0x2000 |            0x100060 |          |           |                            |
|  |   |     3 |  0x63eb20 |  0x2000 |            0x200060 |          |           |                            |
|  |   |     4 |  0x640b20 |  0x2000 |            0x300060 |          |           |                            |
|  |   |     5 |  0x642b20 |  0x2000 |            0x400060 |          |           |                            |
|  |   |     6 |  0x644b20 |  0x2000 |            0x500060 |          |           |                            |
|  |   |     7 |  0x646b20 |  0x2000 |            0x600060 |          |           |                            |
|  |   |     8 |  0x648b20 |  0x2000 |            0x700060 |          |           |                            |
|  |   |     9 |  0x64ab20 |  0x2000 |                0x68 |          |           |                            |
|  |   |    10 |  0x64cb20 |  0x2000 |            0x100068 |          |           |                            |
|  |   |    11 |  0x64eb20 |  0x2000 |            0x200068 |          |           |                            |
|  |   |    12 |  0x650b20 |  0x2000 |            0x300068 |          |           |                            |
|  |   |    13 |  0x652b20 |  0x2000 |            0x400068 |          |           |                            |
|  |   |    14 |  0x654b20 |  0x2000 |            0x500068 |          |           |                            |
|  |   |    15 |  0x656b20 |  0x2000 |            0x600068 |          |           |                            |
|  |   |    16 |  0x658b20 |  0x2000 |            0x700068 |          |           |                            |
|  |   |    17 |  0x24ab20 |     0x0 |         FW_GEC~0x61 |          |           |                            |
|  |   |    18 | 0x117ab20 | 0xd0000 |                BIOS |          |           |                            |
|  |   |    19 |  0x65ab20 | 0x10000 |     FW_INVALID~0x63 |          |           |                            |
|  |   |    20 |  0x66ab20 |  0x3c40 |            0x100064 |     0x05 | 0.0.A1.41 | compressed, verified(60BB) |
|  |   |    21 |  0x66e820 |   0x330 |            0x100065 |     0x05 | 0.0.A1.41 | compressed, verified(60BB) |
|  |   |    22 |  0x66ec20 |  0x4610 |            0x400064 |     0x05 | 0.0.A1.41 | compressed, verified(60BB) |
|  |   |    23 |  0x673320 |   0x320 |            0x400065 |     0x05 | 0.0.A1.41 | compressed, verified(60BB) |
|  |   |    24 |  0x673720 |  0x4830 |           0x1100064 |     0x05 |  0.0.18.5 | compressed, verified(60BB) |
|  |   |    25 |  0x678020 |   0x370 |           0x1100065 |     0x05 |  0.0.18.5 | compressed, verified(60BB) |
|  |   |    26 |  0x678420 |  0x47a0 |           0x1400064 |     0x05 |  0.0.18.5 | compressed, verified(60BB) |
|  |   |    27 |  0x67cc20 |   0x340 |           0x1400065 |     0x05 |  0.0.18.5 | compressed, verified(60BB) |
|  |   |    28 |  0x67d020 |   0xc80 |                0x66 |          |           |                            |
|  |   |    29 |  0x67dd20 |   0xc80 |            0x100066 |          |           |                            |
|  |   |    30 |  0x67ea20 |   0xc80 |            0x200066 |          |           |                            |
|  |   |    31 |  0x67f720 |   0x560 |                0x6a |          |   0.0.0.0 |          inline_keys(76E9) |
+--+---+-------+-----------+---------+---------------------+----------+-----------+----------------------------+

Example 2: Extract all unique firmware entries from a given BIOS ROM, uncompress compressed entries and convert public keys into PEM format.

$ psptool -Xunk ASUS_PRIME-A320M-A-ASUS-4801.CAP

Click to expand output

-rw-r--r--  1 cwerling  wheel   1.0K Nov 16 10:03 !BL2_SECONDARY_DIRECTORY~0x70
-rw-r--r--  1 cwerling  wheel   4.0K Nov 16 10:03 !FW_PSP_SMUSCS_2~0x15f
-rw-r--r--  1 cwerling  wheel   1.0K Nov 16 10:03 !PL2_SECONDARY_DIRECTORY~0x40
-rw-r--r--  1 cwerling  wheel   256B Nov 16 10:03 !PSP_MCLF_TRUSTLETS~0x14_0.0.0.0
-rw-r--r--  1 cwerling  wheel   256K Nov 16 10:03 !SMU_OFF_CHIP_FW_3~0x112_0.0.0.0
-rw-r--r--  1 cwerling  wheel   256K Nov 16 10:03 !SMU_OFF_CHIP_FW_3~0x112_0.2B.15.0
-rw-r--r--  1 cwerling  wheel    24K Nov 16 10:03 0x100064_0.0.A1.41
-rw-r--r--  1 cwerling  wheel    12K Nov 16 10:03 0x100065_0.0.A1.41
-rw-r--r--  1 cwerling  wheel   3.1K Nov 16 10:03 0x100066
-rw-r--r--  1 cwerling  wheel    32K Nov 16 10:03 0x1100064_0.0.10.1
-rw-r--r--  1 cwerling  wheel    32K Nov 16 10:03 0x1100064_0.0.18.5
-rw-r--r--  1 cwerling  wheel    16K Nov 16 10:03 0x1100065_0.0.10.1
-rw-r--r--  1 cwerling  wheel    16K Nov 16 10:03 0x1100065_0.0.18.5
-rw-r--r--  1 cwerling  wheel   5.6K Nov 16 10:03 0x124_A.2.3.1A
-rw-r--r--  1 cwerling  wheel    15K Nov 16 10:03 0x125_3.2.2.1
-rw-r--r--  1 cwerling  wheel    32K Nov 16 10:03 0x1400064_0.0.10.1
-rw-r--r--  1 cwerling  wheel    32K Nov 16 10:03 0x1400064_0.0.18.5
-rw-r--r--  1 cwerling  wheel    16K Nov 16 10:03 0x1400065_0.0.10.1
-rw-r--r--  1 cwerling  wheel    16K Nov 16 10:03 0x1400065_0.0.18.5
-rw-r--r--  1 cwerling  wheel   8.0K Nov 16 10:03 0x200060
-rw-r--r--  1 cwerling  wheel   3.1K Nov 16 10:03 0x200066
-rw-r--r--  1 cwerling  wheel   8.0K Nov 16 10:03 0x200068
-rw-r--r--  1 cwerling  wheel   256K Nov 16 10:03 0x208_0.0.0.0
-rw-r--r--  1 cwerling  wheel   256K Nov 16 10:03 0x212_0.0.0.0
-rw-r--r--  1 cwerling  wheel   5.8K Nov 16 10:03 0x224_A.2.3.27
-rw-r--r--  1 cwerling  wheel   8.7K Nov 16 10:03 0x225_4.2.1.1
-rw-r--r--  1 cwerling  wheel   256K Nov 16 10:03 0x2a_0.2E.16.0
-rw-r--r--  1 cwerling  wheel   3.1K Nov 16 10:03 0x300066
-rw-r--r--  1 cwerling  wheel    24K Nov 16 10:03 0x400064_0.0.A1.41
-rw-r--r--  1 cwerling  wheel    12K Nov 16 10:03 0x400065_0.0.A1.41
-rw-r--r--  1 cwerling  wheel   3.1K Nov 16 10:03 0x400066
-rw-r--r--  1 cwerling  wheel   3.1K Nov 16 10:03 0x500066
-rw-r--r--  1 cwerling  wheel   3.1K Nov 16 10:03 0x66
-rw-r--r--  1 cwerling  wheel   4.0K Nov 16 10:03 0x67
-rw-r--r--  1 cwerling  wheel   8.0K Nov 16 10:03 0x68
-rw-r--r--  1 cwerling  wheel   1.1K Nov 16 10:03 0x6a_0.0.0.0
-rw-r--r--  1 cwerling  wheel   520B Nov 16 10:03 0x800068
-rw-r--r--  1 cwerling  wheel   416B Nov 16 10:03 ABL0~0x30_0.0.0.0
-rw-r--r--  1 cwerling  wheel   4.5K Nov 16 10:03 ABL0~0x30_18.12.12.30
-rw-r--r--  1 cwerling  wheel   4.5K Nov 16 10:03 ABL0~0x30_19.1.14.0
-rw-r--r--  1 cwerling  wheel    84K Nov 16 10:03 ABL1~0x31_18.12.12.30
-rw-r--r--  1 cwerling  wheel    90K Nov 16 10:03 ABL1~0x31_19.1.14.0
-rw-r--r--  1 cwerling  wheel    95K Nov 16 10:03 ABL2~0x32_18.12.12.30
-rw-r--r--  1 cwerling  wheel   101K Nov 16 10:03 ABL2~0x32_19.1.14.0
-rw-r--r--  1 cwerling  wheel    75K Nov 16 10:03 ABL3~0x33_18.12.12.30
-rw-r--r--  1 cwerling  wheel    81K Nov 16 10:03 ABL3~0x33_19.1.14.0
-rw-r--r--  1 cwerling  wheel    79K Nov 16 10:03 ABL4~0x34_18.12.12.30
-rw-r--r--  1 cwerling  wheel    99K Nov 16 10:03 ABL4~0x34_19.1.14.0
-rw-r--r--  1 cwerling  wheel   101K Nov 16 10:03 ABL5~0x35_18.12.12.30
-rw-r--r--  1 cwerling  wheel    88K Nov 16 10:03 ABL5~0x35_19.1.14.0
-rw-r--r--  1 cwerling  wheel    76K Nov 16 10:03 ABL6~0x36_18.12.12.30
-rw-r--r--  1 cwerling  wheel    69K Nov 16 10:03 ABL6~0x36_19.1.14.0
-rw-r--r--  1 cwerling  wheel    98K Nov 16 10:03 ABL7~0x37_19.1.14.0
-rw-r--r--  1 cwerling  wheel   451B Nov 16 10:03 AMD_PUBLIC_KEY~0x0
-rw-r--r--  1 cwerling  wheel   1.9M Nov 16 10:03 BIOS
-rw-r--r--  1 cwerling  wheel   4.0K Nov 16 10:03 BIOS_RTM_FIRMWARE~0x6
-rw-r--r--  1 cwerling  wheel   7.9K Nov 16 10:03 DEBUG_UNLOCK~0x13_0.8.0.5E
-rw-r--r--  1 cwerling  wheel   8.0K Nov 16 10:03 DEBUG_UNLOCK~0x13_0.9.0.6B
-rw-r--r--  1 cwerling  wheel   8.8K Nov 16 10:03 DEBUG_UNLOCK~0x13_0.D.0.1A
-rw-r--r--  1 cwerling  wheel    98K Nov 16 10:03 DRIVER_ENTRIES~0x28_0.8.0.5E
-rw-r--r--  1 cwerling  wheel    82K Nov 16 10:03 DRIVER_ENTRIES~0x28_0.D.0.1A
-rw-r--r--  1 cwerling  wheel     0B Nov 16 10:03 FW_GEC~0x61
-rw-r--r--  1 cwerling  wheel   8.0K Nov 16 10:03 FW_IMC~0x60
-rw-r--r--  1 cwerling  wheel   160K Nov 16 10:03 FW_INVALID~0x63
-rw-r--r--  1 cwerling  wheel   4.0K Nov 16 10:03 FW_PSP_SMUSCS~0x5f
-rw-r--r--  1 cwerling  wheel   8.5K Nov 16 10:03 MP2_FW~0x25_3.18.0.1
-rw-r--r--  1 cwerling  wheel   800B Nov 16 10:03 OEM_PSP_FW_PUBLIC_KEY~0xa
-rw-r--r--  1 cwerling  wheel   256B Nov 16 10:03 PSP_AGESA_RESUME_FW~0x10_0.5.0.3E
-rw-r--r--  1 cwerling  wheel   451B Nov 16 10:03 PSP_BOOT_TIME_TRUSTLETS_KEY~0xd
-rw-r--r--  1 cwerling  wheel   256B Nov 16 10:03 PSP_BOOT_TIME_TRUSTLETS~0xc_0.0.0.0
-rw-r--r--  1 cwerling  wheel   112K Nov 16 10:03 PSP_BOOT_TIME_TRUSTLETS~0xc_0.7.0.1
-rw-r--r--  1 cwerling  wheel   256B Nov 16 10:03 PSP_FW_BOOT_LOADER~0x1_0.5.0.45
-rw-r--r--  1 cwerling  wheel    49K Nov 16 10:03 PSP_FW_BOOT_LOADER~0x1_0.8.0.5E
-rw-r--r--  1 cwerling  wheel    41K Nov 16 10:03 PSP_FW_BOOT_LOADER~0x1_0.9.0.6B
-rw-r--r--  1 cwerling  wheel    55K Nov 16 10:03 PSP_FW_BOOT_LOADER~0x1_0.D.0.1A
-rw-r--r--  1 cwerling  wheel   256B Nov 16 10:03 PSP_FW_RECOVERY_BOOT_LOADER~0x3_0.5.0.45
-rw-r--r--  1 cwerling  wheel    45K Nov 16 10:03 PSP_FW_RECOVERY_BOOT_LOADER~0x3_0.8.0.5E
-rw-r--r--  1 cwerling  wheel    41K Nov 16 10:03 PSP_FW_RECOVERY_BOOT_LOADER~0x3_FF.9.0.6A
-rw-r--r--  1 cwerling  wheel   256B Nov 16 10:03 PSP_FW_TRUSTED_OS~0x2_0.5.0.45
-rw-r--r--  1 cwerling  wheel    61K Nov 16 10:03 PSP_FW_TRUSTED_OS~0x2_0.8.0.5E
-rw-r--r--  1 cwerling  wheel   264K Nov 16 10:03 PSP_FW_TRUSTED_OS~0x2_0.9.0.6B
-rw-r--r--  1 cwerling  wheel    60K Nov 16 10:03 PSP_FW_TRUSTED_OS~0x2_0.D.0.1A
-rw-r--r--  1 cwerling  wheel   128K Nov 16 10:03 PSP_NV_DATA~0x4
-rw-r--r--  1 cwerling  wheel    12K Nov 16 10:03 PSP_S3_NV_DATA~0x1a
-rw-r--r--  1 cwerling  wheel   256B Nov 16 10:03 PSP_SMU_FN_FIRMWARE~0x108_0.0.0.0
-rw-r--r--  1 cwerling  wheel   256K Nov 16 10:03 PSP_SMU_FN_FIRMWARE~0x108_0.2B.15.0
-rw-r--r--  1 cwerling  wheel   800B Nov 16 10:03 SEC_DBG_PUBLIC_KEY~0x9
-rw-r--r--  1 cwerling  wheel    14K Nov 16 10:03 SEC_GASKET~0x24_11.3.0.8
-rw-r--r--  1 cwerling  wheel   6.7K Nov 16 10:03 SEC_GASKET~0x24_13.2.0.9
-rw-r--r--  1 cwerling  wheel   5.8K Nov 16 10:03 SEC_GASKET~0x24_A.2.3.27
-rw-r--r--  1 cwerling  wheel   256B Nov 16 10:03 SMU_OFFCHIP_FW~0x8_0.0.0.0
-rw-r--r--  1 cwerling  wheel   256K Nov 16 10:03 SMU_OFFCHIP_FW~0x8_0.19.54.0
-rw-r--r--  1 cwerling  wheel   256K Nov 16 10:03 SMU_OFFCHIP_FW~0x8_0.2E.16.0
-rw-r--r--  1 cwerling  wheel   256K Nov 16 10:03 SMU_OFF_CHIP_FW_2~0x12_0.0.0.0
-rw-r--r--  1 cwerling  wheel   256K Nov 16 10:03 SMU_OFF_CHIP_FW_2~0x12_0.19.54.0
-rw-r--r--  1 cwerling  wheel   256K Nov 16 10:03 SMU_OFF_CHIP_FW_2~0x12_0.2E.16.0
-rw-r--r--  1 cwerling  wheel     0B Nov 16 10:03 SOFT_FUSE_CHAIN_01~0xb
-rw-r--r--  1 cwerling  wheel   4.0K Nov 16 10:03 TOKEN_UNLOCK~0x22
-rw-r--r--  1 cwerling  wheel    16B Nov 16 10:03 WRAPPED_IKEK~0x21

Example 3: Extract the firmware entry from a given BIOS ROM at directory index 1 entry index 8 (PSP_BOOT_TIME_TRUSTLETS) and show strings of length 10.

$ psptool -X -d 1 -e 8 MSI_X399_E7B92AMS.130 | strings -n 10

Click to expand output

AMD_TL_UTIL: Hashing the message: %p
AMD_TL_UTIL: ProcessCmd_Hash(), UTIL_ERR_INVALID_BUFFER, exit
RSA: Calling tlApiRandomGenerateData
RSA: Calling DbgUnlockRsaKeyGen
RSA: Done Calling DbgUnlockRsaKeyGen
DbgUnlockRsaKeyGen failed
AMD_TL_UTIL: Deriving AES key
AMD_TL_UTIL: ProcessCmd_Hmac(), UTIL_ERR_INVALID_BUFFER, exit
AMD_TL_UTIL: Deriving HMAC key
HMAC Signature Key for PSP Data saved in DRAM
AMD_TL_UTIL: Computing HMAC of payload
AMD_TL_UTIL: running
AMD_TL_UTIL: invalid TCI
TCI buffer: %p
TCI buffer length: %p
sizeof(tciMessage_t): %p
AMD_TL_UTIL: waiting for notification
RSA: Calling generateKeyPair and RSA signing
RSA: Calling DbgUnlockKeyVerfiy
AMD_TL_UTIL: Unknown command ID %d, ignore
AMD_TL_UTIL: notify TLC
 h(`ahi`!h
crAmd_ModExp aA failed, status = 0x%x
crAmd_ModExp aB failed status = 0x%x
crAmd_ModExp failed ret=0x%08x, exit
Not Composite
Subtract failed
GDB failed
RSAPrime value of total iteration j = %d
tlApiCipherInit failed with ret=0x%97X, exit
tlApiCipherUpdate failed with ret=0x%08X
tlApiCipherDoFinal failed with ret=0x%08X
Done Generating starting prime
Calling GetRsaPrime
DOne GetRsaPrime
Value of P
Value of Q
Value of Modulus ((0x%04X)):
Value of PrivateExponent (0x%04X):
PRF_HASH_OTP starting
crAmd_MessageDigestInitHwKey failed ret=0x%08x, exit
tlApiMessageDigestDoFinal failed ret=0x%08x, exit
RSA: Signing data
RSA: tlApiSignatureInit failed with ret=%x
Signature:
RSA: signature data length: %d
RSA: Verifying data
RSA: tlApiSignatureVerify failed with ret=%x
Rsa: tlApiSignatureVerify validity = %x
AMD_TL_UTIL: ProcessCmd_Hash(), tlApiMessageDigestInit ret=0x%08X, exit
AMD_TL_UTIL: processCmdSha256(), tlApiMessageDigestDoFinal ret=0x%08X, exit
AMD_TL_UTIL: processCmd_Hmac(), crAmd_CipherInitWithHwKey ret=0x%08X, exit
AMD_TL_UTIL: processCmd_Hmac(), tlApiCipherDoFinal ret=0x%08X, exit
AMD_TL_UTIL: ProcessCmd_Hmac(), tlApiSignatureInit ret=0x%08X, exit
AMD_TL_UTIL: ProcessCmd_Hmac(), tlApiSignatureSign ret=0x%08X, exit
RSA: Init data for signing with TLAPI_SIG_RSA_SHA256_PSS type signature
RSA: Init data for verifying with TLAPI_SIG_RSA_SHA256_PSS type signature
!F(F0"r120
dAd8k:F02@
 h(`ahi`!h
ph,Fh`xhqh
 pG00pG\0pG
 VLWM ```(`h`0
 NL(`h`0`p`
#HpG"HD0pG!H"0pG
 h8C `*F1F F
!%*.59WWWWWWI9?DW
"qEGvxJJEEENPR
EZ]_b]dh__jl
ProcessCmd_TpmManufacture
UnwrapDataFromNwd
WrapDataForNwd
ReadNvRecord
ReadNvRecordMustSucceed
WriteNvRecord
ReadNvRecordOnInit
AmdNv_Init
AmdNv_Commit
2L_plat__GetEntropy
_plat__NVEnable
_plat__NvMemoryRead
_plat__NvMemoryWrite
_plat__NvMemoryClear
_plat__NvMemoryMove
This is not really a unique value. A real unique value should be generated by the platform.
TPM2_ContextLoad
TPM2_ContextSave
ComputeContextProtectionKey
TPM2_EvictControl
TPM2_FlushContext
TPM2_Import
TPM2_Rewrap
TPM2_PolicyTicket
PolicyContextUpdate
PolicySptCheckCondition
TPM2_HierarchyChangeAuth
TPM2_HierarchyControl
TPM2_SetPrimaryPolicy
TPM2_NV_Extend
TPM2_Create
TPM2_CreateLoaded
SchemeChecks
SensitiveToPrivate
PrivateToSensitive
SensitiveToDuplicate
DuplicateToSensitive
SecretToCredential
TPM2_Shutdown
TPM2_Startup
Amd_Sha1Start
Amd_Sha256Start
Amd_Sha384Start
Amd_Sha512Start
Amd_ShaUpdate
Amd_ShaFinal
BnFromBytes
BnPointTo2B
CarryResolve
BnUnsignedCmp
BnShiftRight
C_2_2_ECDH
CryptEcc2PhaseKeyExchange
CryptEccGetParameter
CryptEccIsPointOnCurve
CryptEccGenerateKey
BnSignEcdsa
CryptEccSign
CryptEccValidateSignature
CryptEccCommitCompute
CryptHashCopyState
CryptDigestUpdate
CryptHashEnd
CryptDigestUpdate2B
CryptHmacEnd
MillerRabin
BnGeneratePrimeForRSA
PrimeSieve
PrimeSelectWithSieve
DRBG_GetEntropy
DRBG_Update
DRBG_Reseed
DRBG_SelfTest
DRBG_InstantiateSeeded
DRBG_Generate
DRBG_Instantiate
CryptRandMinMax
OaepEncode
OaepDecode
RSASSA_Decode
CryptRsaDecrypt
CryptRsaSign
CryptRsaValidateSignature
CryptRsaGenerateKey
CryptIncrementalSelfTest
CryptSymmetricEncrypt
CryptSymmetricDecrypt
CryptXORObfuscation
CryptSecretEncrypt
CryptSecretDecrypt
CryptParameterEncryption
CryptParameterDecryption
CryptCreateObject
CryptGetSignHashAlg
ParseHandleBuffer
CommandDispatcher
ExecuteCommand
IncrementLockout
IsAuthValueAvailable
CheckAuthSession
ParseSessionBuffer
UpdateAuditDigest
BuildResponseSession
HierarchyGetProof
HierarchyGetPrimarySeed
HierarchyIsEnabled
NvWriteNvListEnd
NvRamGetIndex
NvDeleteRAM
NvReadNvIndexInfo
NvGetIndexData
NvWriteIndexData
NvFlushHierarchy
NvCapGetPersistent
NvCapGetIndex
NvUpdatePersistent
ObjectIsSequence
HandleToObject
GetQualifiedName
FlushObject
ObjectFlushHierarchy
ObjectCapGetLoaded
GetSavedPcrPointer
GetPcrPointer
PCRChanged
PCRComputeCurrentDigest
PCRAllocate
PCRCapGetHandles
SessionIsLoaded
SessionIsSaved
SessionGet
ContextIdSessionCreate
SessionCreate
SessionContextSave
SessionContextLoad
SessionFlush
SessionResetPolicyData
SessionCapGetLoaded
SessionCapGetSaved
TimeClockUpdate
TimeSetAdjustRate
GetClosestCommandIndex
EntityGetLoadStatus
EntityGetAuthValue
EntityGetAuthPolicy
EntityGetHierarchy
Primary Object Creation
ECDAA Commit
PermanentCapGetHandles
PermanentHandleGetPolicy
MemoryGetActionInputBuffer
MemoryGetActionOutputBuffer
LocalityGetAttributes
UINT8_Marshal
UINT16_Marshal
UINT32_Marshal
UINT64_Marshal
BYTE_Array_Marshal
MemoryCopy2B
MemoryConcat2B
UnmarshalFail

Example 4: Visualize the certificate chain of all firmware elements:

$ psptool -t Lenovo_Thinkpad_T495_r12uj35wd.iso

Click to expand output

AMD
 +-PubkeyEntity(60BB, @38f224)
 | PubkeyEntity(60BB, @28bf24)
 | +-SignedEntity(@5e3920:5010) (verified=True)
 | +-SignedEntity(@673720:4830) (verified=True)
 | +-SignedEntity(@57e820:8dc0) (verified=True)
 | +-SignedEntity(@2f8620:8dc0) (verified=True)
 | +-SignedEntity(@2b9d20:71b0) (verified=True)
 | +-SignedEntity(@34ef20:340) (verified=True)
 | | +-PubkeyEntity(3FC7, @34ef24)
 | | | PubkeyEntity(3FC7, @639f24)
 | +-SignedEntity(@39e820:22770) (verified=True)
 | +-SignedEntity(@37d420:47a0) (verified=True)
 | +-SignedEntity(@678020:370) (verified=True)
 | +-SignedEntity(@3c1020:340) (verified=True)
 | | +-PubkeyEntity(ED22, @3c1024)
 | +-SignedEntity(@587620:bb90) (verified=True)
 | +-SignedEntity(@301420:bb90) (verified=True)
 | +-SignedEntity(@2c0f20:20830) (verified=True)
 | +-SignedEntity(@36fb20:3c40) (verified=True)
 | +-SignedEntity(@381c20:340) (verified=True)
 | +-SignedEntity(@3e6b20:18790) (verified=True)
 | +-SignedEntity(@678420:47a0) (verified=True)
 | +-SignedEntity(@3c1420:11a50) (verified=True)
 | +-SignedEntity(@593220:cca0) (verified=True)
 | +-SignedEntity(@639f20:340) (verified=True)
 | | +-PubkeyEntity(3FC7, @34ef24)
 | | | PubkeyEntity(3FC7, @639f24)
 | +-SignedEntity(@30d020:cca0) (verified=True)
 | +-SignedEntity(@2e1820:5010) (verified=True)
 | +-SignedEntity(@373820:330) (verified=True)
 | +-SignedEntity(@67cc20:340) (verified=True)
 | +-SignedEntity(@3d2f20:71b0) (verified=True)
 | +-SignedEntity(@59ff20:c910) (verified=True)
 | +-SignedEntity(@66ab20:3c40) (verified=True)
 | +-SignedEntity(@319d20:c910) (verified=True)
 | +-SignedEntity(@2e7b20:1860) (verified=True)
 | +-SignedEntity(@373c20:4610) (verified=True)
 | +-SignedEntity(@3e2cc4:340) (verified=True)
 | | +-PubkeyEntity(76E9, @3e67e4)
 | | | PubkeyEntity(76E9, @67f944)
 | | | PubkeyEntity(76E9, @3e2cc8)
 | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | | +-PubkeyEntity(76E9, @3e67e4)
 | | | | | PubkeyEntity(76E9, @67f944)
 | | | | | PubkeyEntity(76E9, @3e2cc8)
 | | | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | | | | | | +-PubkeyEntity(76E9, @3e67e4)
 | | | | | | | PubkeyEntity(76E9, @67f944)
 | | | | | | | PubkeyEntity(76E9, @3e2cc8)
 | | | | | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | | | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | | | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | | | | +-PubkeyEntity(76E9, @3e67e4)
 | | | | | PubkeyEntity(76E9, @67f944)
 | | | | | PubkeyEntity(76E9, @3e2cc8)
 | | | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | | | | +-PubkeyEntity(76E9, @3e67e4)
 | | | | | | | PubkeyEntity(76E9, @67f944)
 | | | | | | | PubkeyEntity(76E9, @3e2cc8)
 | | | | | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | | | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | | | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | | | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | +-SignedEntity(@56dd20:3100) (verified=True)
 | +-SignedEntity(@3da120:1930) (verified=True)
 | +-SignedEntity(@5ac920:9ef0) (verified=True)
 | +-SignedEntity(@66e820:330) (verified=True)
 | +-SignedEntity(@382f20:c300) (verified=True)
 | +-SignedEntity(@326720:9ef0) (verified=True)
 | +-SignedEntity(@2e9420:1760) (verified=True)
 | +-SignedEntity(@378320:320) (verified=True)
 | +-SignedEntity(@3e67e0:340) (verified=True)
 | | +-PubkeyEntity(76E9, @3e67e4)
 | | | PubkeyEntity(76E9, @67f944)
 | | | PubkeyEntity(76E9, @3e2cc8)
 | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | | +-PubkeyEntity(76E9, @3e67e4)
 | | | | | PubkeyEntity(76E9, @67f944)
 | | | | | PubkeyEntity(76E9, @3e2cc8)
 | | | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | | | | +-PubkeyEntity(76E9, @3e67e4)
 | | | | | | | PubkeyEntity(76E9, @67f944)
 | | | | | | | PubkeyEntity(76E9, @3e2cc8)
 | | | | | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | | | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | | | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | | | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | | +-PubkeyEntity(76E9, @3e67e4)
 | | | | | PubkeyEntity(76E9, @67f944)
 | | | | | PubkeyEntity(76E9, @3e2cc8)
 | | | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | | | | +-PubkeyEntity(76E9, @3e67e4)
 | | | | | | | PubkeyEntity(76E9, @67f944)
 | | | | | | | PubkeyEntity(76E9, @3e2cc8)
 | | | | | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | | | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | | | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | | | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | +-SignedEntity(@67f940:340) (verified=True)
 | | +-PubkeyEntity(76E9, @3e67e4)
 | | | PubkeyEntity(76E9, @67f944)
 | | | PubkeyEntity(76E9, @3e2cc8)
 | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | | +-PubkeyEntity(76E9, @3e67e4)
 | | | | | PubkeyEntity(76E9, @67f944)
 | | | | | PubkeyEntity(76E9, @3e2cc8)
 | | | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | | | | | | +-PubkeyEntity(76E9, @3e67e4)
 | | | | | | | PubkeyEntity(76E9, @67f944)
 | | | | | | | PubkeyEntity(76E9, @3e2cc8)
 | | | | | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | | | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | | | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | | | | +-PubkeyEntity(76E9, @3e67e4)
 | | | | | PubkeyEntity(76E9, @67f944)
 | | | | | PubkeyEntity(76E9, @3e2cc8)
 | | | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | | | | +-PubkeyEntity(76E9, @3e67e4)
 | | | | | | | PubkeyEntity(76E9, @67f944)
 | | | | | | | PubkeyEntity(76E9, @3e2cc8)
 | | | | | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | | | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | | | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | | | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | +-SignedEntity(@570e20:dd0) (verified=True)
 | +-SignedEntity(@3ddb20:1860) (verified=True)
 | +-SignedEntity(@5b6820:c710) (verified=True)
 | +-SignedEntity(@66ec20:4610) (verified=True)
 | +-SignedEntity(@28c220:b300) (verified=True)
 | +-SignedEntity(@330620:c710) (verified=True)
 | +-SignedEntity(@2eac20:dd0) (verified=True)
 | +-SignedEntity(@378720:4830) (verified=True)
 | +-SignedEntity(@38f520:f300) (verified=True)
 | +-SignedEntity(@571c20:cbb0) (verified=True)
 | +-SignedEntity(@3df420:1760) (verified=True)
 | +-SignedEntity(@5c3020:20830) (verified=True)
 | +-SignedEntity(@673320:320) (verified=True)
 | +-SignedEntity(@297520:22770) (verified=True)
 | +-SignedEntity(@2eba20:cbb0) (verified=True)
 | +-SignedEntity(@37d020:370) (verified=True)
 +-PubkeyEntity(76E9, @3e67e4)
 | PubkeyEntity(76E9, @67f944)
 | PubkeyEntity(76E9, @3e2cc8)
 | +-SignedEntity(@67f720:560) (verified=False)
 | | +-PubkeyEntity(76E9, @3e67e4)
 | | | PubkeyEntity(76E9, @67f944)
 | | | PubkeyEntity(76E9, @3e2cc8)
 | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | | +-PubkeyEntity(76E9, @3e67e4)
 | | | | | PubkeyEntity(76E9, @67f944)
 | | | | | PubkeyEntity(76E9, @3e2cc8)
 | | | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | +-PubkeyEntity(76E9, @3e67e4)
 | | | PubkeyEntity(76E9, @67f944)
 | | | PubkeyEntity(76E9, @3e2cc8)
 | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | | +-PubkeyEntity(76E9, @3e67e4)
 | | | | | PubkeyEntity(76E9, @67f944)
 | | | | | PubkeyEntity(76E9, @3e2cc8)
 | | | | | +-SignedEntity(@67f720:560) (verified=False)
 | | | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | | | +-SignedEntity(@3e0c20:23e4) (verified=False)
 | | | +-SignedEntity(@3e3020:3b00) (verified=False)
 | +-SignedEntity(@3e3020:3b00) (verified=False)

General usage:

usage: psptool [-V | -E | -X | -R] [file]

Display, extract, and manipulate AMD PSP firmware inside BIOS ROMs.

positional arguments:
  file                 Binary file to be parsed for PSP firmware

optional arguments:
  -V, --version
  -E, --entries        Default: Parse and display PSP firmware entries.
                       [-n] [-j] [-t]
                       
                       -n:      list unique entries only ordered by their offset
                       -j:      output in JSON format instead of tables
                       -t:      print tree of all signed entities and their certifying keys
                       
  -X, --extract-entry  Extract one or more PSP firmware entries.
                       [[-r idx] -d idx [-e idx]] [-n] [-u] [-c] [-k] [-o outfile]
                       
                       -r idx:  specifies rom_index (default: 0)
                       -d idx:  specifies directory_index (default: all directories)
                       -e idx:  specifies entry_index (default: all entries)
                       -n:      skip duplicate entries and extract unique entries only
                       -u:      uncompress compressed entries
                       -c:      try to decrypt entries
                       -k:      convert pubkeys into PEM format
                       -o file: specifies outfile/outdir (default: stdout/{file}_extracted)
                       
  -R, --replace-entry  Copy a new entry (including header and signature) into the
                       ROM file and update metadata accordingly.
                       [-r idx] -d idx -e idx -s subfile -o outfile [-p file-stub] [-a pass]
                       
                       -r idx:  specifies rom_index (default: 0)
                       -d idx:  specifies directory_index
                       -e idx:  specifies entry_index
                       -s file: specifies subfile (i.e. the new entry contents)
                       -o file: specifies outfile
                       -p file: specifies file-stub (e.g. 'keys/id') for the re-signing keys
                       -a pass: specifies password for the re-signing keys

Python Usage

PSPTool can be used as a Python module, e.g. in an interactive IPython session:

> from psptool import PSPTool
> psp = PSPTool.from_file('original_bios.bin')
> psp.blob.roms[0]
[Directory(address=0x77000, type=PSP_NEW, count=16),
 Directory(address=0x149000, type=secondary, count=20),
 Directory(address=0x117000, type=BHD, count=14),
 Directory(address=0x249000, type=secondary, count=17)]
> psp.ls_dir(0)
+---+-------+----------+---------+------+-----------------------------+-------+------------+-----------------------+
|   | Entry |  Address |    Size | Type |                   Type Name | Magic |    Version |             Signed by |
+---+-------+----------+---------+------+-----------------------------+-------+------------+-----------------------+
|   |     0 |  0x77400 |   0x240 |  0x0 |              AMD_PUBLIC_KEY |       |            |                       |
|   |     1 | 0x149400 | 0x10000 |  0x1 |          PSP_FW_BOOT_LOADER |  $PS1 |   0.7.0.52 |        AMD_PUBLIC_KEY |
|   |     2 |  0x77700 |  0xcf40 |  0x3 | PSP_FW_RECOVERY_BOOT_LOADER |  $PS1 |  FF.7.0.51 |        AMD_PUBLIC_KEY |
|   |     3 |  0x84700 | 0x1e550 |  0x8 |              SMU_OFFCHIP_FW |  SMUR |  4.19.64.0 |        AMD_PUBLIC_KEY |
|   |     4 |  0xa2d00 |   0x340 |  0xa |       OEM_PSP_FW_PUBLIC_KEY |       |            |                       |
|   |     5 |  0xa3100 |  0x3eb0 | 0x12 |           SMU_OFF_CHIP_FW_2 |  SMUR |  4.19.64.0 |        AMD_PUBLIC_KEY |
|   |     6 |  0xa7000 |    0x10 | 0x21 |                             |       |            |                       |
|   |     7 |  0xa7100 |   0xcc0 | 0x24 |                             |  $PS1 |   12.2.0.9 |        AMD_PUBLIC_KEY |
|   |     8 |  0xa7e00 |   0xc20 | 0x30 |                             |  0BAR | 17.9.18.12 | OEM_PSP_FW_PUBLIC_KEY |
|   |     9 |  0xa8b00 |  0xbc50 | 0x31 |          0x31~ABL_ARM_CODE~ |  AR1B | 17.9.18.12 | OEM_PSP_FW_PUBLIC_KEY |
|   |    10 |  0xb4800 |  0xb5c0 | 0x32 |                             |  AR2B | 17.9.18.12 | OEM_PSP_FW_PUBLIC_KEY |
|   |    11 |  0xbfe00 |  0xdb00 | 0x33 |                             |  AR3B | 17.9.18.12 | OEM_PSP_FW_PUBLIC_KEY |
|   |    12 |  0xcd900 |  0xefd0 | 0x34 |                             |  AR4B | 17.9.18.12 | OEM_PSP_FW_PUBLIC_KEY |
|   |    13 |  0xdc900 |  0xf020 | 0x35 |                             |  AR5B | 17.9.18.12 | OEM_PSP_FW_PUBLIC_KEY |
|   |    14 |  0xeba00 |  0xbd60 | 0x36 |                             |  AR6B | 17.9.18.12 | OEM_PSP_FW_PUBLIC_KEY |
|   |    15 | 0x149000 |   0x400 | 0x40 |    !PL2_SECONDARY_DIRECTORY |       |            |                       |
+---+-------+----------+---------+------+-----------------------------+-------+------------+-----------------------+
> psp.blob.roms[0].directories[0].entries[0]
PubkeyEntry(type=0x0, address=0x77400, size=0x240, len(references)=1)
> psp.blob.directories[0].entries[0].get_bytes()
b'\x01\x00\x00\x00\x1b\xb9\x87\xc3YIF\x06\xb1t\x94V\x01\xc9\xea[\x1b\xb9\x87\xc3YIF\x06\xb1t\x94V\x01\xc9\xea[\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x08\x00\x00\x01\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
[...]
> my_stuff = [...]
> psp.blob.roms[0].directories[0].entries[1].move_buffer(0x60000, 0x1000)
> psp.blob.roms[0].set_bytes(0x60000, 0x1000, my_stuff)
> psp.to_file('my_modified_bios.bin')

psptool's Issues

Limited APU support (summary is partially broken + cannot replace module)

I am attempting to replace modules in an APU BIOS and facing some issues:

• Some warnings about sha256 that cannot be verified
• a lot of "veri-failed" and "sha256_inconsistent", whereas the BIOS is the vendor one, so we can expect the checksums to be ok
• replacing SMU Part 1 fails with Python error (trying to replace SMU Part 2 seems to work) - note: I am updating with a larger SMU file, extracted with -ukc parameters from another BIOS)

I guess most of the work was done on normal CPU and not APU so maybe there is some subtle differences, I am attaching 3 BIOS files (all Zen3 Renoir 5825U) for reference (outputs provided are for the file CWWK_CW56-58-0.22).

5825U Renoir APU BIOS.zip

Basic output:

Warning: Could not verify sha256 checksum for HeaderEntry(type=0x45, address=0x185400, size=0x1b70, len(references)=1)
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x45, address=0x546000, size=0x1b70, len(references)=1)
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x24, address=0x2af000, size=0x2eb0, len(references)=1)
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x45, address=0x2b1f00, size=0x1b70, len(references)=1)
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x24, address=0x6a0000, size=0x2eb0, len(references)=1)
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x45, address=0x766800, size=0x1b70, len(references)=1)
Warning: Couldn't parse plain entry: 0x62
Warning: Entry of Directory(address=0x215000, type=BIOS, magic=b'$BHD', count=10) at 0xd02000 cannot be parsed
Warning: Couldn't parse plain entry: 0x62
Warning: Entry of Directory(address=0x5f8000, type=secondary, magic=b'$BL2', count=14) at 0xd02000 cannot be parsed
Warning: Couldn't parse entry at: 0x21000. Type: 0x6d. Size 0x40000
Warning: Couldn't parse entry at: 0x61000. Type: 0x6d. Size 0x10000
Warning: Couldn't parse plain entry: 0x62
Warning: Entry of Directory(address=0x3b0000, type=BIOS, magic=b'$BHD', count=10) at 0xd02000 cannot be parsed
Warning: Couldn't parse plain entry: 0x62
Warning: Entry of Directory(address=0x813000, type=secondary, magic=b'$BL2', count=15) at 0xd02000 cannot be parsed
Warning: Couldn't parse entry at: 0x21000. Type: 0x6d. Size 0x40000
Warning: Couldn't parse entry at: 0x61000. Type: 0x6d. Size 0x10000
Warning: Empty FET entry at ROM address 0x0
Warning: Empty FET entry at ROM address 0x5500
+-----+------+-----------+---------+---------------+
| ROM | Addr |    Size   |   FET   |     AGESA     |
+-----+------+-----------+---------+---------------+
|  0  | 0x0  | 0x1000000 | 0x20000 | AGESA_UNKNOWN |
+-----+------+-----------+---------+---------------+
+--+-----------+---------+------+------------+-------+---------------------+
|  | Directory |   Addr  | Type | Generation | Magic | Secondary Directory |
+--+-----------+---------+------+------------+-------+---------------------+
|  |     0     | 0xd2000 | PSP  |   Zen 3    |  $PSP |       0x408000      |
+--+-----------+---------+------+------------+-------+---------------------+
+--+---+-------+----------+---------+---------------------------------+----------+-----------+------------------------------------------+
|  |   | Entry |  Address |    Size |                            Type | Magic/ID |   Version |                                     Info |
+--+---+-------+----------+---------+---------------------------------+----------+-----------+------------------------------------------+
|  |   |     0 |  0xd2400 |   0x440 |              AMD_PUBLIC_KEY~0x0 |     6C9E |         1 |                            AMD_CODE_SIGN |
|  |   |     1 | 0x408400 | 0x10880 |          PSP_FW_BOOT_LOADER~0x1 |     $PS1 | 0.11.2.7B |                verified(6C9E), sha256_ok |
|  |   |     2 |  0xd2900 |  0xe5c0 | PSP_FW_RECOVERY_BOOT_LOADER~0x3 |     $PS1 | 0.11.2.7B |                verified(6C9E), sha256_ok |
|  |   |     3 |  0xe0f00 | 0x21100 |              SMU_OFFCHIP_FW~0x8 |     $PS1 | 0.40.3F.0 | compressed, veri-failed(96A0), sha256_ok |
|  |   |     4 |      0x1 |     0x0 |          SOFT_FUSE_CHAIN_01~0xb |          |           |                                          |
|  |   |     5 | 0x102000 | 0x11a40 |          SMU_OFF_CHIP_FW_2~0x12 |     $PS1 | 0.40.3F.0 | compressed, veri-failed(96A0), sha256_ok |
|  |   |     6 | 0x113b00 |    0x10 |               WRAPPED_IKEK~0x21 |          |           |                                          |
|  |   |     7 | 0x114000 |  0x1000 |               TOKEN_UNLOCK~0x22 |          |           |                                          |
|  |   |     8 | 0x115000 |  0x2e80 |                 SEC_GASKET~0x24 |     $PS1 | B.10.0.20 |                verified(3005), sha256_ok |
|  |   |     9 | 0x117f00 |   0x290 |                       ABL0~0x30 |          |   0.0.0.0 |                verified(259C), sha256_ok |
|  |   |    10 | 0x17e100 |  0x1900 |               KEY_DATABASE~0x50 |     $PS1 |         1 |                verified(6C9E), sha256_ok |
|  |   |    11 | 0x17fa00 |  0x5940 |              VBIOS_PRELOAD~0x3c |     $PS1 | 11.A.0.1D |                           verified(DE39) |
|  |   |    12 | 0x185400 |  0x1b70 |        TOS_SECURITY_POLICY~0x45 |     $PS1 | B.10.1.20 |      verified(3005), sha256_inconsistent |
|  |   |    13 | 0x408000 |   0x400 |   !PL2_SECONDARY_DIRECTORY~0x40 |          |           |                                          |
+--+---+-------+----------+---------+---------------------------------+----------+-----------+------------------------------------------+


+--+-----------+----------+-----------+------------+-------+---------------------+
|  | Directory |   Addr   |    Type   | Generation | Magic | Secondary Directory |
+--+-----------+----------+-----------+------------+-------+---------------------+
|  |     1     | 0x408000 | secondary |   Zen 3    |  $PL2 |                     |
+--+-----------+----------+-----------+------------+-------+---------------------+
+--+---+-------+----------+---------+-----------------------------+----------+------------+------------------------------------------+
|  |   | Entry |  Address |    Size |                        Type | Magic/ID |    Version |                                     Info |
+--+---+-------+----------+---------+-----------------------------+----------+------------+------------------------------------------+
|  |   |     0 | 0x408400 | 0x10880 |      PSP_FW_BOOT_LOADER~0x1 |     $PS1 |  0.11.2.7B |                verified(6C9E), sha256_ok |
|  |   |     1 | 0x418d00 |   0x440 |          AMD_PUBLIC_KEY~0x0 |     6C9E |          1 |                            AMD_CODE_SIGN |
|  |   |     2 | 0x419200 | 0x16370 |       PSP_FW_TRUSTED_OS~0x2 |     $PS1 |  0.11.2.7B |                verified(24C6), sha256_ok |
|  |   |     3 |  0x71000 | 0x20000 |             PSP_NV_DATA~0x4 |          |            |                                          |
|  |   |     4 | 0x42f600 | 0x21100 |          SMU_OFFCHIP_FW~0x8 |     $PS1 |  0.40.3F.0 | compressed, veri-failed(96A0), sha256_ok |
|  |   |     5 | 0x450700 |   0x440 |      SEC_DBG_PUBLIC_KEY~0x9 |     10AC |          1 |     verified(6C9E), unknown_key_usage(3) |
|  |   |     6 |      0x1 |     0x0 |      SOFT_FUSE_CHAIN_01~0xb |          |            |                                          |
|  |   |     7 | 0x450c00 | 0x20100 | PSP_BOOT_TIME_TRUSTLETS~0xc |     $PS1 |   3.54.0.5 |                           verified(CC7D) |
|  |   |     8 | 0x470d00 | 0x11a40 |      SMU_OFF_CHIP_FW_2~0x12 |     $PS1 |  0.40.3F.0 | compressed, veri-failed(96A0), sha256_ok |
|  |   |     9 | 0x482800 |  0x2100 |           DEBUG_UNLOCK~0x13 |     $PS1 |  0.11.2.7B |                verified(B034), sha256_ok |
|  |   |    10 | 0x484900 |   0x670 |     HARDWARE_IP_CONFIG~0x20 |     $PS1 |    0.0.0.1 |                verified(118D), sha256_ok |
|  |   |    11 | 0x485000 |    0x10 |           WRAPPED_IKEK~0x21 |          |            |                                          |
|  |   |    12 | 0x486000 |  0x1000 |           TOKEN_UNLOCK~0x22 |          |            |                                          |
|  |   |    13 | 0x487000 |  0x2e80 |             SEC_GASKET~0x24 |     $PS1 |  B.10.0.20 |                verified(3005), sha256_ok |
|  |   |    14 | 0x489f00 | 0x2fb36 |                 MP2_FW~0x25 |          |   7.0.8.13 |                verified(C04C), sha256_ok |
|  |   |    15 | 0x4b9b00 | 0x1d770 |         DRIVER_ENTRIES~0x28 |     $PS1 |  0.11.2.7B |                verified(24C6), sha256_ok |
|  |   |    16 | 0x4d7300 |  0x3100 |              KVM_IMAGE~0x29 |     $PS1 | 1C.8.60.70 |                verified(CC7D), sha256_ok |
|  |   |    17 | 0x4d7300 |  0x3100 |            S0I3_DRIVER~0x2d |     $PS1 | 1C.8.60.70 |                verified(CC7D), sha256_ok |
|  |   |    18 | 0x4da400 |   0x290 |                   ABL0~0x30 |          |    0.0.0.0 |                verified(259C), sha256_ok |
|  |   |    19 | 0x540600 |  0x5940 |          VBIOS_PRELOAD~0x3c |     $PS1 |  11.A.0.1D |                           verified(DE39) |
|  |   |    20 | 0x546000 |  0x1b70 |    TOS_SECURITY_POLICY~0x45 |     $PS1 |  B.10.1.20 |      verified(3005), sha256_inconsistent |
|  |   |    21 | 0x547c00 |   0x210 |             FW_INVALID~0x44 |     $PS1 |    0.0.0.1 |                verified(ADC2), sha256_ok |
|  |   |    22 | 0x54e300 |  0x4100 |                DRTM_TA~0x47 |     $PS1 |  4.11.0.2F |                           verified(61CE) |
|  |   |    23 | 0x552400 |  0x1900 |           KEY_DATABASE~0x50 |     $PS1 |          1 |                verified(6C9E), sha256_ok |
|  |   |    24 | 0x553d00 |  0x12c0 |         TOS_PUBLIC_KEY~0x51 |     $PS1 |          1 |                verified(6C9E), sha256_ok |
|  |   |    25 | 0x555000 |  0x5b70 |                        0x58 |     $PS1 |    0.0.0.0 |                           verified(EBDF) |
|  |   |    26 | 0x55ac00 |   0xb20 |                   WMOS~0x5c |     $PS1 |  0.19.50.1 |                verified(8A19), sha256_ok |
|  |   |    27 | 0x55b800 |   0x220 |                        0x59 |     $PS1 |    0.0.0.0 |                           verified(EBDF) |
|  |   |    28 |  0x91000 | 0x40000 |              PSP_NVRAM~0x54 |          |            |                                          |
+--+---+-------+----------+---------+-----------------------------+----------+------------+------------------------------------------+


+--+-----------+----------+------+------------+-------+---------------------+
|  | Directory |   Addr   | Type | Generation | Magic | Secondary Directory |
+--+-----------+----------+------+------------+-------+---------------------+
|  |     2     | 0x26d000 | PSP  |   Zen 3    |  $PSP |       0x623000      |
+--+-----------+----------+------+------------+-------+---------------------+
+--+---+-------+----------+---------+---------------------------------+----------+-----------+------------------------------------------+
|  |   | Entry |  Address |    Size |                            Type | Magic/ID |   Version |                                     Info |
+--+---+-------+----------+---------+---------------------------------+----------+-----------+------------------------------------------+
|  |   |     0 | 0x26d400 |   0x440 |              AMD_PUBLIC_KEY~0x0 |     144E |         1 |                            AMD_CODE_SIGN |
|  |   |     1 | 0x623400 | 0x10880 |          PSP_FW_BOOT_LOADER~0x1 |     $PS1 | 0.11.2.7B |                verified(144E), sha256_ok |
|  |   |     2 | 0x26d900 |  0xe5c0 | PSP_FW_RECOVERY_BOOT_LOADER~0x3 |     $PS1 | 0.11.2.7B |                verified(144E), sha256_ok |
|  |   |     3 | 0x27bf00 | 0x20fb0 |              SMU_OFFCHIP_FW~0x8 |     $PS1 | 0.37.5B.0 | compressed, veri-failed(2C92), sha256_ok |
|  |   |     4 |      0x1 |     0x0 |          SOFT_FUSE_CHAIN_01~0xb |          |           |                                          |
|  |   |     5 | 0x29cf00 | 0x10070 |          SMU_OFF_CHIP_FW_2~0x12 |     $PS1 | 0.37.5B.0 | compressed, veri-failed(2C92), sha256_ok |
|  |   |     6 | 0x2ad000 |    0x10 |               WRAPPED_IKEK~0x21 |          |           |                                          |
|  |   |     7 | 0x2ae000 |  0x1000 |               TOKEN_UNLOCK~0x22 |          |           |                                          |
|  |   |     8 | 0x2af000 |  0x2eb0 |                 SEC_GASKET~0x24 |     $PS1 |  B.9.0.85 |      verified(BCC5), sha256_inconsistent |
|  |   |     9 | 0x2b1f00 |  0x1b70 |        TOS_SECURITY_POLICY~0x45 |     $PS1 |  B.9.1.85 |      verified(BCC5), sha256_inconsistent |
|  |   |    10 | 0x2b3b00 |   0x290 |                       ABL0~0x30 |          |   0.0.0.0 |                verified(CF65), sha256_ok |
|  |   |    11 | 0x323800 |  0x5940 |              VBIOS_PRELOAD~0x3c |     $PS1 | 11.A.0.1D |                           verified(2FCA) |
|  |   |    12 | 0x329200 |  0x1900 |               KEY_DATABASE~0x50 |     $PS1 |         1 |                verified(144E), sha256_ok |
|  |   |    13 | 0x623000 |   0x400 |   !PL2_SECONDARY_DIRECTORY~0x40 |          |           |                                          |
+--+---+-------+----------+---------+---------------------------------+----------+-----------+------------------------------------------+


+--+-----------+----------+-----------+------------+-------+---------------------+
|  | Directory |   Addr   |    Type   | Generation | Magic | Secondary Directory |
+--+-----------+----------+-----------+------------+-------+---------------------+
|  |     3     | 0x623000 | secondary |   Zen 3    |  $PL2 |                     |
+--+-----------+----------+-----------+------------+-------+---------------------+
+--+---+-------+----------+---------+-----------------------------+----------+------------+------------------------------------------+
|  |   | Entry |  Address |    Size |                        Type | Magic/ID |    Version |                                     Info |
+--+---+-------+----------+---------+-----------------------------+----------+------------+------------------------------------------+
|  |   |     0 | 0x623400 | 0x10880 |      PSP_FW_BOOT_LOADER~0x1 |     $PS1 |  0.11.2.7B |                verified(144E), sha256_ok |
|  |   |     1 | 0x633d00 |   0x440 |          AMD_PUBLIC_KEY~0x0 |     144E |          1 |                            AMD_CODE_SIGN |
|  |   |     2 | 0x634200 | 0x16370 |       PSP_FW_TRUSTED_OS~0x2 |     $PS1 |  0.11.2.7B |                verified(D945), sha256_ok |
|  |   |     3 |  0x71000 | 0x20000 |             PSP_NV_DATA~0x4 |          |            |                                          |
|  |   |     4 | 0x64a600 | 0x20fb0 |          SMU_OFFCHIP_FW~0x8 |     $PS1 |  0.37.5B.0 | compressed, veri-failed(2C92), sha256_ok |
|  |   |     5 | 0x66b600 |   0x440 |      SEC_DBG_PUBLIC_KEY~0x9 |     0475 |          1 |     verified(144E), unknown_key_usage(3) |
|  |   |     6 |      0x1 |     0x0 |      SOFT_FUSE_CHAIN_01~0xb |          |            |                                          |
|  |   |     7 | 0x66bb00 | 0x20100 | PSP_BOOT_TIME_TRUSTLETS~0xc |     $PS1 |   3.54.0.5 |                           verified(CC7D) |
|  |   |     8 | 0x68bc00 | 0x10070 |      SMU_OFF_CHIP_FW_2~0x12 |     $PS1 |  0.37.5B.0 | compressed, veri-failed(2C92), sha256_ok |
|  |   |     9 | 0x69bd00 |  0x2100 |           DEBUG_UNLOCK~0x13 |     $PS1 |  0.11.2.7B |                verified(11F8), sha256_ok |
|  |   |    10 | 0x69de00 |   0x664 |     HARDWARE_IP_CONFIG~0x20 |          |    0.0.0.0 |                           verified(76AC) |
|  |   |    11 | 0x69e500 |    0x10 |           WRAPPED_IKEK~0x21 |          |            |                                          |
|  |   |    12 | 0x69f000 |  0x1000 |           TOKEN_UNLOCK~0x22 |          |            |                                          |
|  |   |    13 | 0x6a0000 |  0x2eb0 |             SEC_GASKET~0x24 |     $PS1 |   B.9.0.85 |      verified(BCC5), sha256_inconsistent |
|  |   |    14 | 0x6a2f00 | 0x2d815 |                 MP2_FW~0x25 |          |    7.0.7.4 |                verified(7C83), sha256_ok |
|  |   |    15 | 0x6d0800 | 0x1d770 |         DRIVER_ENTRIES~0x28 |     $PS1 |  0.11.2.7B |                verified(D945), sha256_ok |
|  |   |    16 | 0x6ee000 |  0x3100 |              KVM_IMAGE~0x29 |     $PS1 | 8.17.30.30 |                verified(CC7D), sha256_ok |
|  |   |    17 | 0x6ee000 |  0x3100 |            S0I3_DRIVER~0x2d |     $PS1 | 8.17.30.30 |                verified(CC7D), sha256_ok |
|  |   |    18 | 0x6f1100 |   0x290 |                   ABL0~0x30 |          |    0.0.0.0 |                verified(CF65), sha256_ok |
|  |   |    19 | 0x760e00 |  0x5940 |          VBIOS_PRELOAD~0x3c |     $PS1 |  11.A.0.1D |                           verified(2FCA) |
|  |   |    20 | 0x766800 |  0x1b70 |    TOS_SECURITY_POLICY~0x45 |     $PS1 |   B.9.1.85 |      verified(BCC5), sha256_inconsistent |
|  |   |    21 | 0x768400 |   0x210 |             FW_INVALID~0x44 |     $PS1 |    0.0.0.0 |                           verified(462E) |
|  |   |    22 | 0x76eb00 |  0x1900 |           KEY_DATABASE~0x50 |     $PS1 |          1 |                verified(144E), sha256_ok |
|  |   |    23 | 0x770400 |  0x1070 |         TOS_PUBLIC_KEY~0x51 |     $PS1 |          1 |                verified(144E), sha256_ok |
|  |   |    24 | 0x771500 |  0x5b70 |                        0x58 |     $PS1 |    0.0.0.0 |                           verified(EBDF) |
|  |   |    25 | 0x777100 |   0x220 |                        0x59 |     $PS1 |    0.0.0.0 |                           verified(EBDF) |
|  |   |    26 | 0x777400 |   0xb20 |                   WMOS~0x5c |     $PS1 |  0.17.60.1 |                verified(8A19), sha256_ok |
|  |   |    27 | 0x778000 |  0x4100 |                DRTM_TA~0x47 |     $PS1 |  4.11.0.2F |                           verified(61CE) |
|  |   |    28 |  0x91000 | 0x40000 |              PSP_NVRAM~0x54 |          |            |                                          |
+--+---+-------+----------+---------+-----------------------------+----------+------------+------------------------------------------+


+--+-----------+----------+------+------------+-------+---------------------+
|  | Directory |   Addr   | Type | Generation | Magic | Secondary Directory |
+--+-----------+----------+------+------------+-------+---------------------+
|  |     4     | 0x215000 | BIOS |   Zen 3    |  $BHD |       0x5f8000      |
+--+-----------+----------+------+------------+-------+---------------------+
+--+---+-------+----------+--------+-------------------------------+----------+----------+------------------------------------------+
|  |   | Entry |  Address |   Size |                          Type | Magic/ID |  Version |                                     Info |
+--+---+-------+----------+--------+-------------------------------+----------+----------+------------------------------------------+
|  |   |     0 | 0x216000 | 0x4000 |                     APCB~0x60 |          |          |                                          |
|  |   |     1 | 0x21a000 | 0x4000 |                APCB_COPY~0x68 |          |          |                                          |
|  |   |     2 | 0x21e000 | 0x4000 |                APCB_COPY~0x68 |          |          |                                          |
|  |   |     3 |      0x0 |    0x0 |                     APOB~0x61 |          |          |                                          |
|  |   |     4 | 0x222000 | 0x4890 |                 PMU_CODE~0x64 |     0x05 | 0.0.10.1 | compressed, veri-failed(4F75), sha256_ok |
|  |   |     5 | 0x226900 |  0x360 |                 PMU_DATA~0x65 |     0x05 | 0.0.10.1 | compressed, veri-failed(4F75), sha256_ok |
|  |   |     6 | 0x226d00 | 0x4ae0 |                 PMU_CODE~0x64 |     0x05 | 0.0.10.1 | compressed, veri-failed(4F75), sha256_ok |
|  |   |     7 | 0x22b800 |  0x340 |                 PMU_DATA~0x65 |     0x05 | 0.0.10.1 | compressed, veri-failed(4F75), sha256_ok |
|  |   |     8 | 0x5f8000 |  0x400 | !BL2_SECONDARY_DIRECTORY~0x70 |          |          |                                          |
+--+---+-------+----------+--------+-------------------------------+----------+----------+------------------------------------------+


+--+-----------+----------+-----------+------------+-------+---------------------+
|  | Directory |   Addr   |    Type   | Generation | Magic | Secondary Directory |
+--+-----------+----------+-----------+------------+-------+---------------------+
|  |     5     | 0x5f8000 | secondary |   Zen 3    |  $BL2 |                     |
+--+-----------+----------+-----------+------------+-------+---------------------+
+--+---+-------+----------+---------+----------------------+----------+----------+------------------------------------------+
|  |   | Entry |  Address |    Size |                 Type | Magic/ID |  Version |                                     Info |
+--+---+-------+----------+---------+----------------------+----------+----------+------------------------------------------+
|  |   |     0 | 0x5f9000 |  0x4000 |            APCB~0x60 |          |          |                                          |
|  |   |     1 | 0x5fd000 |  0x4000 |       APCB_COPY~0x68 |          |          |                                          |
|  |   |     2 | 0x601000 |  0x4000 |       APCB_COPY~0x68 |          |          |                                          |
|  |   |     3 |      0x0 |     0x0 |            APOB~0x61 |          |          |                                          |
|  |   |     4 | 0x605000 | 0x10000 |    APOB_NV_COPY~0x63 |          |          |                                          |
|  |   |     5 | 0x615000 |  0x4890 |        PMU_CODE~0x64 |     0x05 | 0.0.10.1 | compressed, veri-failed(4F75), sha256_ok |
|  |   |     6 | 0x619900 |   0x360 |        PMU_DATA~0x65 |     0x05 | 0.0.10.1 | compressed, veri-failed(4F75), sha256_ok |
|  |   |     7 | 0x619d00 |  0x4ae0 |        PMU_CODE~0x64 |     0x05 | 0.0.10.1 | compressed, veri-failed(4F75), sha256_ok |
|  |   |     8 | 0x61e800 |   0x340 |        PMU_DATA~0x65 |     0x05 | 0.0.10.1 | compressed, veri-failed(4F75), sha256_ok |
|  |   |     9 | 0x61ec00 |  0x15c0 | MICROCODE_PATCH~0x66 |          |          |                                          |
|  |   |    10 | 0x620200 |   0x248 |      MP2_FW_CFG~0x6a |          |  0.0.0.0 |                verified(C04C), sha256_ok |
|  |   |    11 |  0x21000 | 0x40000 |                 0x6d |          |          |                                          |
|  |   |    12 |  0x61000 | 0x10000 |                 0x6d |          |          |                                          |
+--+---+-------+----------+---------+----------------------+----------+----------+------------------------------------------+


+--+-----------+----------+------+------------+-------+---------------------+
|  | Directory |   Addr   | Type | Generation | Magic | Secondary Directory |
+--+-----------+----------+------+------------+-------+---------------------+
|  |     6     | 0x3b0000 | BIOS |   Zen 3    |  $BHD |       0x813000      |
+--+-----------+----------+------+------------+-------+---------------------+
+--+---+-------+----------+--------+-------------------------------+----------+----------+-------------------------------+
|  |   | Entry |  Address |   Size |                          Type | Magic/ID |  Version |                          Info |
+--+---+-------+----------+--------+-------------------------------+----------+----------+-------------------------------+
|  |   |     0 | 0x3b1000 | 0x2000 |                     APCB~0x60 |          |          |                               |
|  |   |     1 | 0x3b3000 | 0x2000 |                APCB_COPY~0x68 |          |          |                               |
|  |   |     2 | 0x3b5000 | 0x2000 |                APCB_COPY~0x68 |          |          |                               |
|  |   |     3 |      0x0 |    0x0 |                     APOB~0x61 |          |          |                               |
|  |   |     4 | 0x3b7000 | 0x4890 |                 PMU_CODE~0x64 |     0x05 | 0.0.10.1 | compressed, veri-failed(38D0) |
|  |   |     5 | 0x3bb900 |  0x360 |                 PMU_DATA~0x65 |     0x05 | 0.0.10.1 | compressed, veri-failed(38D0) |
|  |   |     6 | 0x3bbd00 | 0x4ae0 |                 PMU_CODE~0x64 |     0x05 | 0.0.10.1 | compressed, veri-failed(38D0) |
|  |   |     7 | 0x3c0800 |  0x340 |                 PMU_DATA~0x65 |     0x05 | 0.0.10.1 | compressed, veri-failed(38D0) |
|  |   |     8 | 0x813000 |  0x400 | !BL2_SECONDARY_DIRECTORY~0x70 |          |          |                               |
+--+---+-------+----------+--------+-------------------------------+----------+----------+-------------------------------+


+--+-----------+----------+-----------+------------+-------+---------------------+
|  | Directory |   Addr   |    Type   | Generation | Magic | Secondary Directory |
+--+-----------+----------+-----------+------------+-------+---------------------+
|  |     7     | 0x813000 | secondary |   Zen 3    |  $BL2 |                     |
+--+-----------+----------+-----------+------------+-------+---------------------+
+--+---+-------+----------+---------+----------------------+----------+----------+-------------------------------+
|  |   | Entry |  Address |    Size |                 Type | Magic/ID |  Version |                          Info |
+--+---+-------+----------+---------+----------------------+----------+----------+-------------------------------+
|  |   |     0 | 0x814000 |  0x2000 |            APCB~0x60 |          |          |                               |
|  |   |     1 | 0x816000 |  0x2000 |       APCB_COPY~0x68 |          |          |                               |
|  |   |     2 | 0x818000 |  0x2000 |       APCB_COPY~0x68 |          |          |                               |
|  |   |     3 |      0x0 |     0x0 |            APOB~0x61 |          |          |                               |
|  |   |     4 | 0x81a000 | 0x10000 |    APOB_NV_COPY~0x63 |          |          |                               |
|  |   |     5 | 0x82a000 |  0x4890 |        PMU_CODE~0x64 |     0x05 | 0.0.10.1 | compressed, veri-failed(38D0) |
|  |   |     6 | 0x82e900 |   0x360 |        PMU_DATA~0x65 |     0x05 | 0.0.10.1 | compressed, veri-failed(38D0) |
|  |   |     7 | 0x82ed00 |  0x4ae0 |        PMU_CODE~0x64 |     0x05 | 0.0.10.1 | compressed, veri-failed(38D0) |
|  |   |     8 | 0x833800 |   0x340 |        PMU_DATA~0x65 |     0x05 | 0.0.10.1 | compressed, veri-failed(38D0) |
|  |   |     9 | 0x833c00 |   0xc80 | MICROCODE_PATCH~0x66 |          |          |                               |
|  |   |    10 | 0x834900 |   0xc80 | MICROCODE_PATCH~0x66 |          |          |                               |
|  |   |    11 | 0x835600 |   0x248 |      MP2_FW_CFG~0x6a |          |  7.0.0.5 |     verified(7C83), sha256_ok |
|  |   |    12 |  0x21000 | 0x40000 |                 0x6d |          |          |                               |
|  |   |    13 |  0x61000 | 0x10000 |                 0x6d |          |          |                               |
+--+---+-------+----------+---------+----------------------+----------+----------+-------------------------------+

Output of replacement of SMU Part 1:

Warning: Could not verify sha256 checksum for HeaderEntry(type=0x45, address=0x185400, size=0x1b70, len(references)=1)
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x45, address=0x546000, size=0x1b70, len(references)=1)
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x24, address=0x2af000, size=0x2eb0, len(references)=1)
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x45, address=0x2b1f00, size=0x1b70, len(references)=1)
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x24, address=0x6a0000, size=0x2eb0, len(references)=1)
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x45, address=0x766800, size=0x1b70, len(references)=1)
Warning: Couldn't parse plain entry: 0x62
Warning: Entry of Directory(address=0x215000, type=BIOS, magic=b'$BHD', count=10) at 0xd02000 cannot be parsed
Warning: Couldn't parse plain entry: 0x62
Warning: Entry of Directory(address=0x5f8000, type=secondary, magic=b'$BL2', count=14) at 0xd02000 cannot be parsed
Warning: Couldn't parse entry at: 0x21000. Type: 0x6d. Size 0x40000
Warning: Couldn't parse entry at: 0x61000. Type: 0x6d. Size 0x10000
Warning: Couldn't parse plain entry: 0x62
Warning: Entry of Directory(address=0x3b0000, type=BIOS, magic=b'$BHD', count=10) at 0xd02000 cannot be parsed
Warning: Couldn't parse plain entry: 0x62
Warning: Entry of Directory(address=0x813000, type=secondary, magic=b'$BL2', count=15) at 0xd02000 cannot be parsed
Warning: Couldn't parse entry at: 0x21000. Type: 0x6d. Size 0x40000
Warning: Couldn't parse entry at: 0x61000. Type: 0x6d. Size 0x10000
Warning: Empty FET entry at ROM address 0x0
Warning: Empty FET entry at ROM address 0x5500
Replacing PubkeyEntity(96A0, @17ede0)
Resigning SignedEntity(@42f600:40100) (HeaderEntry(type=0x8, address=0x42f600, size=0x40100, len(references)=1))
    Checking sha256 checksum of HeaderEntry(type=0x8, address=0x42f600, size=0x40100, len(references)=1)
        Need to rehash
        Done
Resigning SignedEntity(@102000:11a40) (HeaderEntry(type=0x12, address=0x102000, size=0x11a40, len(references)=1))
    Checking sha256 checksum of HeaderEntry(type=0x12, address=0x102000, size=0x11a40, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@e0f00:21100) (HeaderEntry(type=0x8, address=0xe0f00, size=0x21100, len(references)=1))
    Checking sha256 checksum of HeaderEntry(type=0x8, address=0xe0f00, size=0x21100, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@470d00:11a40) (HeaderEntry(type=0x12, address=0x470d00, size=0x11a40, len(references)=1))
    Checking sha256 checksum of HeaderEntry(type=0x12, address=0x470d00, size=0x11a40, len(references)=1)
        sha256 still valid!
Replacing PubkeyEntity(6C9E, @d2404)
Resigning SignedEntity(@d2900:e5c0) (HeaderEntry(type=0x3, address=0xd2900, size=0xe5c0, len(references)=1))
    Checking sha256 checksum of HeaderEntry(type=0x3, address=0xd2900, size=0xe5c0, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@17e100:1900) (KeyStoreEntry(type=0x50, address=0x17e100, size=0x1900, len(references)=1))
    Checking sha256 checksum of KeyStoreEntry(type=0x50, address=0x17e100, size=0x1900, len(references)=1)
        Need to rehash
        Done
Resigning SignedEntity(@408400:10880) (HeaderEntry(type=0x1, address=0x408400, size=0x10880, len(references)=2))
    Checking sha256 checksum of HeaderEntry(type=0x1, address=0x408400, size=0x10880, len(references)=2)
        sha256 still valid!
Resigning SignedEntity(@552400:1900) (KeyStoreEntry(type=0x50, address=0x552400, size=0x1900, len(references)=1))
    Checking sha256 checksum of KeyStoreEntry(type=0x50, address=0x552400, size=0x1900, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@450700:440) (PubkeyEntry(type=0x9, address=0x450700, size=0x440, len(references)=1))
Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "C:\Users\protoxis\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\Scripts\psptool.exe\__main__.py", line 7, in <module>
  File "C:\Users\protoxis\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages\psptool\__main__.py", line 193, in main
    entry.signed_entity.resign_and_replace(privkeys=privkeys, recursive=True)
  File "C:\Users\protoxis\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages\psptool\cert_tree.py", line 122, in resign_and_replace
    pk.replace_and_resign(privkeys, recursive=recursive)
  File "C:\Users\protoxis\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages\psptool\cert_tree.py", line 250, in replace_and_resign
    se.resign_and_replace(privkeys=privkeys, recursive=True)
  File "C:\Users\protoxis\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages\psptool\cert_tree.py", line 122, in resign_and_replace
    pk.replace_and_resign(privkeys, recursive=recursive)
  File "C:\Users\protoxis\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages\psptool\cert_tree.py", line 238, in replace_and_resign
    se.resign_only(privkey)
  File "C:\Users\protoxis\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages\psptool\cert_tree.py", line 111, in resign_only
    signature = privkey.sign_blob(self.entry.get_signed_bytes())
                                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\protoxis\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages\psptool\entry.py", line 751, in get_signed_bytes
    return self.get_bytes(0, self.buffer_size - self.signature_size)
                                                ^^^^^^^^^^^^^^^^^^^
  File "C:\Users\protoxis\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages\psptool\entry.py", line 732, in signature_size
    return self.buffer_size - self.HEADER_LEN - self.pubexp_size - self.modulus_size
                                                ^^^^^^^^^^^^^^^^
  File "C:\Users\protoxis\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.12_qbz5n2kfra8p0\LocalCache\local-packages\Python312\site-packages\psptool\entry.py", line 722, in pubexp_size
    assert self.pubexp_bits & 0x3 == 0
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError

Output of replacement of SMU Part 2:

Warning: Could not verify sha256 checksum for HeaderEntry(type=0x45, address=0x185400, size=0x1b70, len(references)=1)
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x45, address=0x546000, size=0x1b70, len(references)=1)
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x24, address=0x2af000, size=0x2eb0, len(references)=1)
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x45, address=0x2b1f00, size=0x1b70, len(references)=1)
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x24, address=0x6a0000, size=0x2eb0, len(references)=1)
Warning: Could not verify sha256 checksum for HeaderEntry(type=0x45, address=0x766800, size=0x1b70, len(references)=1)
Warning: Couldn't parse plain entry: 0x62
Warning: Entry of Directory(address=0x215000, type=BIOS, magic=b'$BHD', count=10) at 0xd02000 cannot be parsed
Warning: Couldn't parse plain entry: 0x62
Warning: Entry of Directory(address=0x5f8000, type=secondary, magic=b'$BL2', count=14) at 0xd02000 cannot be parsed
Warning: Couldn't parse entry at: 0x21000. Type: 0x6d. Size 0x40000
Warning: Couldn't parse entry at: 0x61000. Type: 0x6d. Size 0x10000
Warning: Couldn't parse plain entry: 0x62
Warning: Entry of Directory(address=0x3b0000, type=BIOS, magic=b'$BHD', count=10) at 0xd02000 cannot be parsed
Warning: Couldn't parse plain entry: 0x62
Warning: Entry of Directory(address=0x813000, type=secondary, magic=b'$BL2', count=15) at 0xd02000 cannot be parsed
Warning: Couldn't parse entry at: 0x21000. Type: 0x6d. Size 0x40000
Warning: Couldn't parse entry at: 0x61000. Type: 0x6d. Size 0x10000
Warning: Empty FET entry at ROM address 0x0
Warning: Empty FET entry at ROM address 0x5500
Replacing PubkeyEntity(96A0, @17ede0)
Resigning SignedEntity(@42f600:21100) (HeaderEntry(type=0x8, address=0x42f600, size=0x21100, len(references)=1))
    Checking sha256 checksum of HeaderEntry(type=0x8, address=0x42f600, size=0x21100, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@102000:11a40) (HeaderEntry(type=0x12, address=0x102000, size=0x11a40, len(references)=1))
    Checking sha256 checksum of HeaderEntry(type=0x12, address=0x102000, size=0x11a40, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@e0f00:21100) (HeaderEntry(type=0x8, address=0xe0f00, size=0x21100, len(references)=1))
    Checking sha256 checksum of HeaderEntry(type=0x8, address=0xe0f00, size=0x21100, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@470d00:40100) (HeaderEntry(type=0x12, address=0x470d00, size=0x40100, len(references)=1))
    Checking sha256 checksum of HeaderEntry(type=0x12, address=0x470d00, size=0x40100, len(references)=1)
        Need to rehash
        Done
Replacing PubkeyEntity(6C9E, @d2404)
Resigning SignedEntity(@d2900:e5c0) (HeaderEntry(type=0x3, address=0xd2900, size=0xe5c0, len(references)=1))
    Checking sha256 checksum of HeaderEntry(type=0x3, address=0xd2900, size=0xe5c0, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@17e100:1900) (KeyStoreEntry(type=0x50, address=0x17e100, size=0x1900, len(references)=1))
    Checking sha256 checksum of KeyStoreEntry(type=0x50, address=0x17e100, size=0x1900, len(references)=1)
        Need to rehash
        Done
Resigning SignedEntity(@408400:10880) (HeaderEntry(type=0x1, address=0x408400, size=0x10880, len(references)=2))
    Checking sha256 checksum of HeaderEntry(type=0x1, address=0x408400, size=0x10880, len(references)=2)
        sha256 still valid!
Resigning SignedEntity(@552400:1900) (KeyStoreEntry(type=0x50, address=0x552400, size=0x1900, len(references)=1))
    Checking sha256 checksum of KeyStoreEntry(type=0x50, address=0x552400, size=0x1900, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@450700:440) (PubkeyEntry(type=0x9, address=0x450700, size=0x440, len(references)=1))
Resigning SignedEntity(@553d00:12c0) (KeyStoreEntry(type=0x51, address=0x553d00, size=0x12c0, len(references)=1))
    Checking sha256 checksum of KeyStoreEntry(type=0x51, address=0x553d00, size=0x12c0, len(references)=1)
        sha256 still valid!
Replacing PubkeyEntity(6C9E, @418d04)
Resigning SignedEntity(@d2900:e5c0) (HeaderEntry(type=0x3, address=0xd2900, size=0xe5c0, len(references)=1))
    Checking sha256 checksum of HeaderEntry(type=0x3, address=0xd2900, size=0xe5c0, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@17e100:1900) (KeyStoreEntry(type=0x50, address=0x17e100, size=0x1900, len(references)=1))
    Checking sha256 checksum of KeyStoreEntry(type=0x50, address=0x17e100, size=0x1900, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@408400:10880) (HeaderEntry(type=0x1, address=0x408400, size=0x10880, len(references)=2))
    Checking sha256 checksum of HeaderEntry(type=0x1, address=0x408400, size=0x10880, len(references)=2)
        sha256 still valid!
Resigning SignedEntity(@552400:1900) (KeyStoreEntry(type=0x50, address=0x552400, size=0x1900, len(references)=1))
    Checking sha256 checksum of KeyStoreEntry(type=0x50, address=0x552400, size=0x1900, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@450700:440) (PubkeyEntry(type=0x9, address=0x450700, size=0x440, len(references)=1))
Resigning SignedEntity(@553d00:12c0) (KeyStoreEntry(type=0x51, address=0x553d00, size=0x12c0, len(references)=1))
    Checking sha256 checksum of KeyStoreEntry(type=0x51, address=0x553d00, size=0x12c0, len(references)=1)
        sha256 still valid!
Replacing PubkeyEntity(96A0, @5530e0)
Resigning SignedEntity(@42f600:21100) (HeaderEntry(type=0x8, address=0x42f600, size=0x21100, len(references)=1))
    Checking sha256 checksum of HeaderEntry(type=0x8, address=0x42f600, size=0x21100, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@102000:11a40) (HeaderEntry(type=0x12, address=0x102000, size=0x11a40, len(references)=1))
    Checking sha256 checksum of HeaderEntry(type=0x12, address=0x102000, size=0x11a40, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@e0f00:21100) (HeaderEntry(type=0x8, address=0xe0f00, size=0x21100, len(references)=1))
    Checking sha256 checksum of HeaderEntry(type=0x8, address=0xe0f00, size=0x21100, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@470d00:40100) (HeaderEntry(type=0x12, address=0x470d00, size=0x40100, len(references)=1))
    Checking sha256 checksum of HeaderEntry(type=0x12, address=0x470d00, size=0x40100, len(references)=1)
        sha256 still valid!
Replacing PubkeyEntity(6C9E, @d2404)
Resigning SignedEntity(@d2900:e5c0) (HeaderEntry(type=0x3, address=0xd2900, size=0xe5c0, len(references)=1))
    Checking sha256 checksum of HeaderEntry(type=0x3, address=0xd2900, size=0xe5c0, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@17e100:1900) (KeyStoreEntry(type=0x50, address=0x17e100, size=0x1900, len(references)=1))
    Checking sha256 checksum of KeyStoreEntry(type=0x50, address=0x17e100, size=0x1900, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@408400:10880) (HeaderEntry(type=0x1, address=0x408400, size=0x10880, len(references)=2))
    Checking sha256 checksum of HeaderEntry(type=0x1, address=0x408400, size=0x10880, len(references)=2)
        sha256 still valid!
Resigning SignedEntity(@552400:1900) (KeyStoreEntry(type=0x50, address=0x552400, size=0x1900, len(references)=1))
    Checking sha256 checksum of KeyStoreEntry(type=0x50, address=0x552400, size=0x1900, len(references)=1)
        Need to rehash
        Done
Resigning SignedEntity(@450700:440) (PubkeyEntry(type=0x9, address=0x450700, size=0x440, len(references)=1))
Resigning SignedEntity(@553d00:12c0) (KeyStoreEntry(type=0x51, address=0x553d00, size=0x12c0, len(references)=1))
    Checking sha256 checksum of KeyStoreEntry(type=0x51, address=0x553d00, size=0x12c0, len(references)=1)
        sha256 still valid!
Replacing PubkeyEntity(6C9E, @418d04)
Resigning SignedEntity(@d2900:e5c0) (HeaderEntry(type=0x3, address=0xd2900, size=0xe5c0, len(references)=1))
    Checking sha256 checksum of HeaderEntry(type=0x3, address=0xd2900, size=0xe5c0, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@17e100:1900) (KeyStoreEntry(type=0x50, address=0x17e100, size=0x1900, len(references)=1))
    Checking sha256 checksum of KeyStoreEntry(type=0x50, address=0x17e100, size=0x1900, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@408400:10880) (HeaderEntry(type=0x1, address=0x408400, size=0x10880, len(references)=2))
    Checking sha256 checksum of HeaderEntry(type=0x1, address=0x408400, size=0x10880, len(references)=2)
        sha256 still valid!
Resigning SignedEntity(@552400:1900) (KeyStoreEntry(type=0x50, address=0x552400, size=0x1900, len(references)=1))
    Checking sha256 checksum of KeyStoreEntry(type=0x50, address=0x552400, size=0x1900, len(references)=1)
        sha256 still valid!
Resigning SignedEntity(@450700:440) (PubkeyEntry(type=0x9, address=0x450700, size=0x440, len(references)=1))
Resigning SignedEntity(@553d00:12c0) (KeyStoreEntry(type=0x51, address=0x553d00, size=0x12c0, len(references)=1))
    Checking sha256 checksum of KeyStoreEntry(type=0x51, address=0x553d00, size=0x12c0, len(references)=1)
        sha256 still valid!

Implement a psp_cleaner method

Just as https://github.com/corna/me_cleaner exists for Intel CPU ME neutralization, it would be amazing to have the same for AMD CPUs.

Even with factory UEFI/bios, such a thing would put many people's minds at ease, and give a more secure and affordable solution to using heavily crippled Intel CPUs (zombieload, spectre, meltdown).

I also would bet that the coreboot developers would be interested since some AMD machines are supported, and this kind of tool would probably get more ports for more AMD machines....likewise, I wonder if Purism could be compelled to start producing AMD based laptops since Intel is less than stellar on chip security as well.

Could this be used as me_cleaner for AMD PSP?

Hi there, and also thanks for your helpful research. All my computers at home are Pre-IME Intel computers and Other Skylake+ Systems sanitized with corna's intel me_cleaner. I have a system based on Gigabyte's B550 Aorus V2 Elite. Board Revision V1.2, PSPTool output is attached, i ran it on my currently installed BIOS Image. I wonder (as this is a question not an issue) if this tool can be used to produce a sanitized BIOS that i could install via SPI/SOIC Clip (As Quick Flash check would probably fail)? I would be extremely happy and willing to pay a coffee if one of you could guide me in the right direction. Cheers! (Also including my Firmware directly from Gigabyte i ran the tool on and that my machine is running.
PSPTool-Output.txt

B550AEV2.zip

Z13 bios can't be parsed

when trying to take from lenovo website the z13 bios update images the PSPTool can't parse those images,
also i think it will be needed to add new parsing since this image should also contain the Pluton FW of Microsoft

"zlib.error: Error -5 while decompressing data: incomplete or truncated stream" from specific BIOS

I was checking out your tool and trying it on all the previous versions of my motherboard's BIOS, and I got an error for one specific version:

$ psptool -Xunk PRIME-B450-PLUS-ASUS-0809.CAP
Traceback (most recent call last):
  File "/usr/local/bin/psptool", line 11, in <module>
    load_entry_point('psptool==2.0', 'console_scripts', 'psptool')()
  File "/usr/local/lib/python3.6/dist-packages/psptool-2.0-py3.6.egg/psptool/__main__.py", line 119, in main
  File "/usr/local/lib/python3.6/dist-packages/psptool-2.0-py3.6.egg/psptool/entry.py", line 308, in get_decompressed
  File "/usr/local/lib/python3.6/dist-packages/psptool-2.0-py3.6.egg/psptool/entry.py", line 314, in get_decompressed_body
  File "/usr/local/lib/python3.6/dist-packages/psptool-2.0-py3.6.egg/psptool/utils.py", line 190, in zlib_decompress
zlib.error: Error -5 while decompressing data: incomplete or truncated stream

The BIOS download page is here
https://www.asus.com/us/Motherboards/PRIME-B450-PLUS/HelpDesk_BIOS/
And the particular file is here:
https://dlcdnets.asus.com/pub/ASUS/mb/SocketAM4/PRIME_B450-PLUS/PRIME-B450-PLUS-ASUS-0809.zip

I tried re-downloading and extracting, and the .CAP binaries matched, so I don't think it is a corrupt download.

VPS providers who have used this?

Any idea if any VPS providers have used this? Those of us with cloud instances would certainly feel better about their security from within the same datacenter with these patches on our AMD systems.

Add more known entry types

see https://github.com/system76/romulan/blob/main/src/amd/directory/psp.rs#L67

both romulus and PSPTool have entry types that the respective other tool doesn't list yet

Question, regarding psp,

Is there going to be a psp cleaner in the future, for amd processors?

Like there is for intel?

I was curious, I don't need anything mega new, but I would like to be able to see the network stack disabled similar to how it is on intel processors 3rd gen and up via me cleaner.

I am very curious in fact how close you guys are to that/or other people being close to such a goal.

Failing Parse on MSI MPG X670E Carbon

Attempting to parse the latest BIOS for the MSI MPG X670E Carbon appears to be failing.

PSP Tool version: 2.7

Output:

$ psptool E7D70AMS.1E0
Warning: Skipping FET at 0x1000 due to unknown ROM alignment
Warning: Couldn't parse entry at: 0x83020. Type: 0x48. Size 0x100
Warning: Couldn't parse entry at: 0x83040. Type: 0x48. Size 0x100
Warning: Couldn't parse entry at: 0x83060. Type: 0x48. Size 0x100
Warning: Couldn't parse entry at: 0x84000. Type: 0x4a. Size 0x100
Traceback (most recent call last):
  File "/home/jgarde/.local/bin/psptool", line 8, in <module>
    sys.exit(main())
  File "/home/jgarde/.local/lib/python3.10/site-packages/psptool/__main__.py", line 105, in main
    psp = PSPTool.from_file(args.file, verbose=args.verbose)
  File "/home/jgarde/.local/lib/python3.10/site-packages/psptool/psptool.py", line 33, in from_file
    pt = PSPTool(file_bytes, verbose=verbose)
  File "/home/jgarde/.local/lib/python3.10/site-packages/psptool/psptool.py", line 41, in __init__
    self.blob = Blob(rom_bytes, len(rom_bytes), self)
  File "/home/jgarde/.local/lib/python3.10/site-packages/psptool/blob.py", line 68, in __init__
    potential_rom = Rom(self, rom_size, rom_offset, fet_offset, psptool)
  File "/home/jgarde/.local/lib/python3.10/site-packages/psptool/rom.py", line 20, in __init__
    self.fet = Fet(self, fet_offset, psptool)
  File "/home/jgarde/.local/lib/python3.10/site-packages/psptool/fet.py", line 45, in __init__
    self._parse_entry_table()
  File "/home/jgarde/.local/lib/python3.10/site-packages/psptool/fet.py", line 118, in _parse_entry_table
    self._create_directory(rom_addr, dir_magic, zen_generation='unknown')
  File "/home/jgarde/.local/lib/python3.10/site-packages/psptool/fet.py", line 89, in _create_directory
    secondary_dir = Directory(self.rom, secondary_directory_address, 'secondary', self.psptool, zen_generation)
  File "/home/jgarde/.local/lib/python3.10/site-packages/psptool/directory.py", line 67, in __init__
    self._parse_header()
  File "/home/jgarde/.local/lib/python3.10/site-packages/psptool/directory.py", line 116, in _parse_header
    self.header = NestedBuffer(
  File "/home/jgarde/.local/lib/python3.10/site-packages/psptool/utils.py", line 48, in __init__
    assert (self.buffer_size <= self.buffer_offset + self.buffer_size), \
TypeError: unsupported operand type(s) for +: 'int' and 'tuple'

current git HEAD is not picking up inline_keys from same firmware image.

Asrock X370 Killer Sli/AC, bios image X370KLA6.00
psptool 2.6, as installed via pip install psptool, picks up many instances of inline_keys
ec478c0, does not, and instead marks what 2.6 would show as either verified(xxxx)
or inline_keys(xxxx) as key_missing(xxxx).

Comparing TR vs EPYC

hello,
started looking at the UEFis of the two following boards and noticed some interesting differences that could be correlated to the platform attributes that i haven't seen discussed or visibly detected in the output of the psptool.

https://www.asrockrack.com/general/productdetail.asp?Model=X399D8A-2T#Specifications
https://www.asrockrack.com/general/productdetail.asp?Model=EPYCD8-2T#Specifications

Looking at the contained non empty paddings, both have two.
The first padding in both is filled with FF until about 20000h where the Epyc one contains the only non FF values:
aa55 aa55 0000 0000 0000 0000 0010 02ff 0000 0000 0070 07ff 0070 11ff

And the X399 has:
aa55 aa55 0000 0000 0000 0000 0010 02ff 0000 0000 0070 0aff 0070 13ff 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0070 2fff 0000 0000

With a few FFs followed by a LOT of Stuff.
Binwalk won't detect any signatures or instructions inside that first padding.

What is up with that?
The only reasonable explanation a friend and me could come up with so far is that the mentioned Bytes are some kind of Platform ID and the following data on x399 is for the Chipset.
Did i miss this in the psptool output somehow?

Proceeding with a binwalk of the second non empty padding, a
1802924 0x1B82AC CRC32 polynomial table, little endian
and on another asrock X399MT, a
1906350 0x1D16AE Unix path: /Code/AMD/platform/NVMem.c
differ from the Epyc part.

Binwalking for instructions, the second padding on both x399 contains only ARM entrys where as the Eypc contains an additional ARMBE entry.

Any ideas on what the frick is going on?
Sincerely Norman

python 3.9 :: 'Blob' object has no attribute 'dual_rom'

Hi! while trying to look into a cap file for ASUS PRIME B550-PLUS i got this:

psptool PRIME-B550-PLUS-ASUS-1216.CAP
Traceback (most recent call last):
File "/usr/local/bin/psptool", line 33, in <module>
sys.exit(load_entry_point('psptool==2.2', 'console_scripts', 'psptool')())
File "/home/adrian/.local/lib/python3.9/site-packages/psptool/__main__.py", line 80, in main
psp = PSPTool.from_file(args.file, verbose=args.verbose)
File "/home/adrian/.local/lib/python3.9/site-packages/psptool/psptool.py", line 31, in from_file
pt = PSPTool(rom_bytes, verbose=verbose)
File "/home/adrian/.local/lib/python3.9/site-packages/psptool/psptool.py", line 39, in __init__
self.blob = Blob(rom_bytes, len(rom_bytes), self)
File "/home/adrian/.local/lib/python3.9/site-packages/psptool/blob.py", line 48, in __init__
self._find_entry_table()
File "/home/adrian/.local/lib/python3.9/site-packages/psptool/blob.py", line 87, in _find_entry_table
if self.dual_rom:
AttributeError: 'Blob' object has no attribute 'dual_rom'

is anything know? or just incompatible with 3.9?
Thanks a lot for your great work!

a question about psptool/fet.py:ZEN_GENERATION_IDS

Is there any difference in psp-space between a Zen 1 and a Zen+ PSP?
I'm attempting to use the tool to dissect a vendor bios for psp parts to be
incorporated into a coreboot.rom image, in a manner similar to how intel
coreboot images incorporate the intel flash descriptor, management engine
firmware, and so forth into the final product, as my current (2700x/Zen+)
and future target (5950x/Zen 3) cpus do not have a released firmware image
in the coreboot amd_blobs repository to use.

info loss with commit/revision `e963896`

Compared to three commits prior to e963896, some information in the --json output changed; parts seem lost, others added, for example:

--- A3MSTX_3.60.psp0.json       2021-11-15 23:51:38.574662042 +0100
+++ A3MSTX_3.60.psp1.json       2021-11-15 23:51:24.877849820 +0100
@@ -8,19 +8,12 @@
       {
         "index": 0,
         "address": 692224,
-        "size": 1435262658,
+        "size": 576,
         "sectionType": "AMD_PUBLIC_KEY~0x0",
-        "magic": "",
-        "version": "0.0.0.0",
-        "info": [
-          "legacy Header"
-        ],
-        "md5": "D41D",
-        "sizes": {
-          "signed": 1435262402,
-          "uncompressed": 0,
-          "packed": 0
-        }
+        "magic": "C25D",
+        "version": "",
+        "info": [],
+        "md5": "EA44"
       },
       {
         "index": 1,
@@ -30,7 +23,8 @@
         "magic": "",
         "version": "0.5.0.45",
         "info": [
-          "legacy Header"
+          "signed(C25D)",
+          "legacy header"
         ],
         "md5": "D41D",
         "sizes": {
@@ -48,7 +42,7 @@
         "version": "0.0.0.0",
         "info": [
           "compressed",
-          "legacy Header"
+          "legacy header"
         ],
         "md5": "D41D",
         "sizes": {

in another place:

@@ -160,19 +149,12 @@
       {
         "index": 10,
         "address": 724992,
-        "size": 1435262658,
+        "size": 832,
         "sectionType": "PSP_BOOT_TIME_TRUSTLETS_KEY~0xd",
-        "magic": "",
-        "version": "0.0.0.0",
-        "info": [
-          "legacy Header"
-        ],
-        "md5": "D41D",
-        "sizes": {
-          "signed": 1435262402,
-          "uncompressed": 0,
-          "packed": 0
-        }
+        "magic": "0483",
+        "version": "",
+        "info": [],
+        "md5": "FC16"
       },
       {
         "index": 11,

and another:

@@ -757,9 +762,11 @@
         "magic": "",
         "version": "0.0.0.0",
         "info": [
-          "compressed"
+          "compressed",
+          "signed(60BB)",
+          "verified"
         ],
-        "md5": "E309",
+        "md5": "4702",
         "sizes": {
           "signed": 261888,
           "uncompressed": 261888,
@@ -774,9 +781,11 @@
         "magic": "$PS1",
         "version": "0.8.0.60",
         "info": [
-          "compressed"
+          "compressed",
+          "signed(60BB)",
+          "verified"
         ],
-        "md5": "FF4B",
+        "md5": "7950",
         "sizes": {
           "signed": 7872,
           "uncompressed": 7872,

However, the total output size got bigger (in this example, before: 76100 bytes, after: 80470 bytes).

Is that a bug fix, or is something just really weird and fishy?

Linux on PSP

Hi,
I assume you have little interest in enabling Linux to run on the PSP, but would you be open to creating documentation of the hw aspects of the arm core that could aid in that task in case someone picks it up?
I think there's a lot of potential in this, even if it's likely something noone ever envisioned.
The ideal end result would be having x86 architectural chroot, but running Linux on the PSP without caring about the x86 cores would already be a great achievement :)

PSPTool should require setuptools

Python version: 3.12.3
Installing setuptools manually fixed the issue.

Steps to reproduce:

python -m venv .venv
source .venv/bin/activate
pip install setuptools
setuptools --help

Output

Traceback (most recent call last):
  File "/run/media/stefan/02e400c2-1bdd-4d46-a0dd-044d6b4f3af4/uni/ASPFuzz/.venv/bin/psptool", line 5, in <module>
    from psptool.__main__ import main
  File "/run/media/stefan/02e400c2-1bdd-4d46-a0dd-044d6b4f3af4/uni/ASPFuzz/.venv/lib/python3.12/site-packages/psptool/__init__.py", line
19, in <module>
    import pkg_resources
ModuleNotFoundError: No module named 'pkg_resources'

OverflowError: cannot fit 'int' into an index-sized integer

So this happens when you're trying to run PSPTool on a TRX40/EPYC Rome bios.

The complete traceback:

Traceback (most recent call last):
File "C:\Users\Sebastiaan\AppData\Local\Programs\Python\Python37-32\Scripts\psptool-script.py", line 11, in
load_entry_point('psptool==2.1', 'console_scripts', 'psptool')()
File "C:\Users\Sebastiaan\AppData\Local\Programs\Python\Python37-32\lib\site-packages\psptool-2.1-py3.7.egg\psptool_main_.py", line 79, in main
File "C:\Users\Sebastiaan\AppData\Local\Programs\Python\Python37-32\lib\site-packages\psptool-2.1-py3.7.egg\psptool\psptool.py", line 30, in from_file
File "C:\Users\Sebastiaan\AppData\Local\Programs\Python\Python37-32\lib\site-packages\psptool-2.1-py3.7.egg\psptool\psptool.py", line 38, in init
File "C:\Users\Sebastiaan\AppData\Local\Programs\Python\Python37-32\lib\site-packages\psptool-2.1-py3.7.egg\psptool\blob.py", line 50, in init
File "C:\Users\Sebastiaan\AppData\Local\Programs\Python\Python37-32\lib\site-packages\psptool-2.1-py3.7.egg\psptool\blob.py", line 97, in _find_entry_table
File "C:\Users\Sebastiaan\AppData\Local\Programs\Python\Python37-32\lib\site-packages\psptool-2.1-py3.7.egg\psptool\fet.py", line 44, in init
File "C:\Users\Sebastiaan\AppData\Local\Programs\Python\Python37-32\lib\site-packages\psptool-2.1-py3.7.egg\psptool\fet.py", line 90, in _parse_entry_table
File "C:\Users\Sebastiaan\AppData\Local\Programs\Python\Python37-32\lib\site-packages\psptool-2.1-py3.7.egg\psptool\fet.py", line 71, in _create_dir
File "C:\Users\Sebastiaan\AppData\Local\Programs\Python\Python37-32\lib\site-packages\psptool-2.1-py3.7.egg\psptool\directory.py", line 67, in init
File "C:\Users\Sebastiaan\AppData\Local\Programs\Python\Python37-32\lib\site-packages\psptool-2.1-py3.7.egg\psptool\directory.py", line 145, in _parse_entries
File "C:\Users\Sebastiaan\AppData\Local\Programs\Python\Python37-32\lib\site-packages\psptool-2.1-py3.7.egg\psptool\entry.py", line 154, in from_fields
File "C:\Users\Sebastiaan\AppData\Local\Programs\Python\Python37-32\lib\site-packages\psptool-2.1-py3.7.egg\psptool\entry.py", line 177, in init
File "C:\Users\Sebastiaan\AppData\Local\Programs\Python\Python37-32\lib\site-packages\psptool-2.1-py3.7.egg\psptool\entry.py", line 334, in _parse
File "C:\Users\Sebastiaan\AppData\Local\Programs\Python\Python37-32\lib\site-packages\psptool-2.1-py3.7.egg\psptool\entry.py", line 405, in _parse_hdr
OverflowError: cannot fit 'int' into an index-sized integer

Any idea on why this might be happening?

Introduce strict mode for development and scientific work

Otherwise be more easy about certain format assertions

Install on WSL Ubuntu

Trying to run this on Windows Subsystem for Linux (WSL). Executed the following steps:

• Downloaded PSPTool zip from github
• Extracted to desktop
• Opened the Ubuntu terminal
• Executed the following commands:
  -- cd /mnt/c/users/user/desktop/psptool-master
  -- sudo python3 setup.py install

I get the following error:
Traceback (most recent call last):
File "setup.py", line 3, in
from setuptools import setup
ModuleNotFoundError: No module named 'setuptools'

Any idea why this isn't working?

error parsing T14 Gen 1 firmware

I tried to read an image for/from a Lenovo T14 Gen 1 (the AMD variant ;)).

This is what I get when trying to parse the image from an actual device:

Warning: Couldn't find corresponding key in blob for entry at: 0x4ff00. Type: SMU_OFFCHIP_FW~0x8
Warning: Couldn't find corresponding key in blob for entry at: 0x70e00. Type: SMU_OFF_CHIP_FW_2~0x12
Warning: Couldn't find corresponding key in blob for entry at: 0x81000. Type: SEC_GASKET~0x24
Warning: Couldn't find corresponding key in blob for entry at: 0x83f00. Type: ABL0~0x30
Warning: Couldn't parse pubkey entry 0x9
Warning: ERROR id is not a pubkey
Warning: Couldn't find corresponding key in blob for entry at: 0x154000. Type: PSP_FW_TRUSTED_OS~0x2
Warning: Couldn't find corresponding key in blob for entry at: 0x167400. Type: SMU_OFFCHIP_FW~0x8
Warning: Couldn't parse pubkey entry 0x9
Traceback (most recent call last):
  File "/usr/bin/psptool", line 33, in <module>
    sys.exit(load_entry_point('psptool==2.2', 'console_scripts', 'psptool')())
  File "/usr/lib/python3.9/site-packages/psptool/__main__.py", line 80, in main
    psp = PSPTool.from_file(args.file, verbose=args.verbose)
  File "/usr/lib/python3.9/site-packages/psptool/psptool.py", line 31, in from_file
    pt = PSPTool(rom_bytes, verbose=verbose)
  File "/usr/lib/python3.9/site-packages/psptool/psptool.py", line 39, in __init__
    self.blob = Blob(rom_bytes, len(rom_bytes), self)
  File "/usr/lib/python3.9/site-packages/psptool/blob.py", line 48, in __init__
    self._find_entry_table()
  File "/usr/lib/python3.9/site-packages/psptool/blob.py", line 86, in _find_entry_table
    self.fets.append(Fet(self, fet_offset, self.agesa_version))
  File "/usr/lib/python3.9/site-packages/psptool/fet.py", line 45, in __init__
    self._parse_entry_table()
  File "/usr/lib/python3.9/site-packages/psptool/fet.py", line 89, in _parse_entry_table
    self._create_dir(addr, dir_magic)
  File "/usr/lib/python3.9/site-packages/psptool/fet.py", line 72, in _create_dir
    self.directories.append(Directory(self, dir.secondary_directory_address, 'secondary', self.blob))
  File "/usr/lib/python3.9/site-packages/psptool/directory.py", line 69, in __init__
    self._parse_entries()
  File "/usr/lib/python3.9/site-packages/psptool/directory.py", line 150, in _parse_entries
    if entry == existing_entry:
  File "/usr/lib/python3.9/site-packages/psptool/entry.py", line 277, in __eq__
    return self.type == other.type and self.get_address() == other.get_address() and \
AttributeError: 'NoneType' object has no attribute 'type'

From an update image (https://pcsupport.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t14-type-20ud-20ue/downloads/driver-list/component?name=BIOS%2FUEFI):

$ psptool --json code\$GetExtractPath\$/R1BET58W/\$0AR1B00.FL1               498ms  Sat 12 Dec 2020 03:01:23 AM UTC
Warning: Couldn't find corresponding key in blob for entry at: 0x50220. Type: SMU_OFFCHIP_FW~0x8
Warning: Couldn't find corresponding key in blob for entry at: 0x71620. Type: SMU_OFF_CHIP_FW_2~0x12
Warning: Couldn't find corresponding key in blob for entry at: 0x81320. Type: SEC_GASKET~0x24
Warning: Couldn't find corresponding key in blob for entry at: 0x84220. Type: ABL0~0x30
Warning: Couldn't parse pubkey entry 0x9
Warning: ERROR id is not a pubkey
Warning: Couldn't find corresponding key in blob for entry at: 0x154420. Type: PSP_FW_TRUSTED_OS~0x2
Warning: Couldn't find corresponding key in blob for entry at: 0x168820. Type: SMU_OFFCHIP_FW~0x8
Warning: Couldn't parse pubkey entry 0x9
Traceback (most recent call last):
  File "/usr/bin/psptool", line 33, in <module>
    sys.exit(load_entry_point('psptool==2.2', 'console_scripts', 'psptool')())
  File "/usr/lib/python3.9/site-packages/psptool/__main__.py", line 80, in main
    psp = PSPTool.from_file(args.file, verbose=args.verbose)
  File "/usr/lib/python3.9/site-packages/psptool/psptool.py", line 31, in from_file
    pt = PSPTool(rom_bytes, verbose=verbose)
  File "/usr/lib/python3.9/site-packages/psptool/psptool.py", line 39, in __init__
    self.blob = Blob(rom_bytes, len(rom_bytes), self)
  File "/usr/lib/python3.9/site-packages/psptool/blob.py", line 48, in __init__
    self._find_entry_table()
  File "/usr/lib/python3.9/site-packages/psptool/blob.py", line 86, in _find_entry_table
    self.fets.append(Fet(self, fet_offset, self.agesa_version))
  File "/usr/lib/python3.9/site-packages/psptool/fet.py", line 45, in __init__
    self._parse_entry_table()
  File "/usr/lib/python3.9/site-packages/psptool/fet.py", line 89, in _parse_entry_table
    self._create_dir(addr, dir_magic)
  File "/usr/lib/python3.9/site-packages/psptool/fet.py", line 72, in _create_dir
    self.directories.append(Directory(self, dir.secondary_directory_address, 'secondary', self.blob))
  File "/usr/lib/python3.9/site-packages/psptool/directory.py", line 69, in __init__
    self._parse_entries()
  File "/usr/lib/python3.9/site-packages/psptool/directory.py", line 150, in _parse_entries
    if entry == existing_entry:
  File "/usr/lib/python3.9/site-packages/psptool/entry.py", line 277, in __eq__
    return self.type == other.type and self.get_address() == other.get_address() and \
AttributeError: 'NoneType' object has no attribute 'type'

You can extract the update image using innoextract.

Improve deduplication of Entry objects

Unique entries in the Blob (identified by their start address and size) can be referenced by different Entry objects from different Directory objects. For the consistency of the Blob it might be beneficial to deduplicate those Entry objects in their factory methods (from_fields, from_blob)

Simple feature req: print ZEN_GENERATION_IDS hex value in table

Either in addition to or instead of. The specific id hex can let you determine more specifically which cpu
each dir table is for.

Or, barring that. Its my understanding that you're using the high bytes to determine generation, but we do know
many full IDs from the coreboot project, so something like Zen 3 (Cezanne) for the bytes 0xBC0C0140 could be useful.
Or perhaps both. 0xBC0C0140 Zen 3 (Cezanne) would be most informative.

Rework rom-size detection

Problem:

The PSP firmware filesystem is part of the UEFI image that (usually) resides on an SPI attached flash chip. Depending on the size of the flash, the AMD bootloader applies a mask to any flash address that is used in the firmware filesystem. E.g. 0x7FFFFF for 8MB flash chips and 0xFFFFFF for 16MB flash images. In order to parse the firmware entries, we need to apply the correct mask to all addresses used within the directories.

PSPTool currently allows to parse firmware images that are embedded in larger files. E.g. a UEFI flash image that is part of an ISO file. We can't determine the correct mask just based on the input file size. We need to determine the size of the UEFI image within the input file.

Solution

1. Assume a default of 16MB (most common these days) and provide an option to manually specify the UEFI image size.

See: #11

ability to extract/replace/etc type 0x62 'BIOS Binary' images.

From what I can see, psptool completely ignores these type of images.
For the longest I had no idea there was more x86 code inside of a ryzen
UEFI image.

My use case is twofold:

1. Extracting said image to determine init code from it
2. Replacing said image with serialice or a similar program for reverse engineering.

Backtrace when parsing firmware on the LVFS

I've just been notified that a specific firmware on the LVFS causes PSPTool to crash with a backtrace:

File "/home/hughsie/Code/lvfs-website/plugins/amdpsp/__init__.py", line 42, in _run_psptool_on_blob
  psp = PSPTool(md.blob, verbose=True)
File "/home/hughsie/Code/lvfs-website/env/lib/python3.7/site-packages/psptool/psptool.py", line 38, in __init__
  self.blob = Blob(rom_bytes, len(rom_bytes), self)
File "/home/hughsie/Code/lvfs-website/env/lib/python3.7/site-packages/psptool/blob.py", line 58, in __init__
  self._parse_entry_table()
File "/home/hughsie/Code/lvfs-website/env/lib/python3.7/site-packages/psptool/blob.py", line 112, in _parse_entry_table
  directory = self[address:address + 16 * 8]
File "/home/hughsie/Code/lvfs-website/env/lib/python3.7/site-packages/psptool/utils.py", line 45, in __getitem__
  new_slice = self._offset_slice(item)
File "/home/hughsie/Code/lvfs-website/env/lib/python3.7/site-packages/psptool/utils.py", line 63, in _offset_slice
  assert (old_slice.start <= self.buffer_size)

The file to reproduce this problem is inside the archive found here https://fwupd.org/downloads/ab2c51b54fb69b70000922a8b672eba6e79e36c2-Lenovo-M625Q-SystemFirmware-M1WKT30A.cab -- just download that, decompress the archive then run psptool on M1WKT30A.ROM

Unable to parse Gigabyte X570

I'm working on debugging a suspected issue with the Gigabyte X570 BIOS, but psptool seems to actually be failing to parse Gigabyte's files with Zen3 support for some reason.
The file I am working with can be downloaded directly from Gigabyte here.

Results of a quick attempt to parse:

Warning: Couldn't parse pubkey entry 0x9
Warning: ERROR id is not a pubkey
Warning: Couldn't find corresponding key in blob for entry at: 0x821100. Type: PSP_FW_TRUSTED_OS~0x2
Warning: Couldn't find corresponding key in blob for entry at: 0x835500. Type: SMU_OFFCHIP_FW~0x8
Warning: Couldn't parse pubkey entry 0x9
Traceback (most recent call last):
  File "/home/prj/bios/bin/psptool", line 8, in <module>
    sys.exit(main())
  File "/home/prj/bios/lib/python3.7/site-packages/psptool/__main__.py", line 80, in main
    psp = PSPTool.from_file(args.file, verbose=args.verbose)
  File "/home/prj/bios/lib/python3.7/site-packages/psptool/psptool.py", line 31, in from_file
    pt = PSPTool(rom_bytes, verbose=verbose)
  File "/home/prj/bios/lib/python3.7/site-packages/psptool/psptool.py", line 39, in __init__
    self.blob = Blob(rom_bytes, len(rom_bytes), self)
  File "/home/prj/bios/lib/python3.7/site-packages/psptool/blob.py", line 48, in __init__
    self._find_entry_table()
  File "/home/prj/bios/lib/python3.7/site-packages/psptool/blob.py", line 86, in _find_entry_table
    self.fets.append(Fet(self, fet_offset, self.agesa_version))
  File "/home/prj/bios/lib/python3.7/site-packages/psptool/fet.py", line 45, in __init__
    self._parse_entry_table()
  File "/home/prj/bios/lib/python3.7/site-packages/psptool/fet.py", line 89, in _parse_entry_table
    self._create_dir(addr, dir_magic)
  File "/home/prj/bios/lib/python3.7/site-packages/psptool/fet.py", line 72, in _create_dir
    self.directories.append(Directory(self, dir.secondary_directory_address, 'secondary', self.blob))
  File "/home/prj/bios/lib/python3.7/site-packages/psptool/directory.py", line 69, in __init__
    self._parse_entries()
  File "/home/prj/bios/lib/python3.7/site-packages/psptool/directory.py", line 150, in _parse_entries
    if entry == existing_entry:
  File "/home/prj/bios/lib/python3.7/site-packages/psptool/entry.py", line 276, in __eq__
    return self.type == other.type and self.get_address() == other.get_address() and \
AttributeError: 'NoneType' object has no attribute 'type'

Other tools (UBU, UEFI Explorer, etc) are able to open the file successfully and map. I suspect this may be a key blob identifier change in AGESA ComboV2 1.1.0.0.

Request: Release recent fixes to PyPi (#29 & suggested fix for #30)

Hi,

Steps:

1. "pip install psptool", then "pip install ipython".
2. Run psptool on this X470 BIOS file: https://download.gigabyte.com/FileList/BIOS/mb_bios_x470-aorus-ultra-gaming_f61.zip?v=cdfa827c3cc8778e89c60c410b5bef51

Result: I encountered the same problems as described by #30 and then #29.

If I understand correctly, #30 has a suggested fix, while #29 has a fix completed by project team. Once I manually apply these, I can succesfully read the BIOS file.

My request: Is it possible to release these 2 fixes to PyPi so they are included automatically for new users who do a simple "pip install psptool"?

Thanks for considering this.

AMD's SEV & SME

Seems like these AMD security features are great. They're only available on Ryzen "PRO" and EPYC CPUs - and I'm unsure how much of their implementation is on PROs vs the seemingly more full-featured EPYC.

Anyway, I'm curious about the pros & cons here. It doesn't seem like you can disable the PSP and still have these security features. On one hand, the PSP could be a backdoor. On the other hand, not having encrypted registers & memory can be very security-enhancing.
Thoughts? Any research in this area?
Thanks a lot!

APCB Parse

https://github.com/coreboot/coreboot/tree/master/util/amdfwtool

AMD had released a tool to assemble BIOS here, witch contains some extra sections like APCB & APOB, is it possilble to add APCB prase support to this tool?

Thanks.

Rewrite the parsers in Kaitai

Assertion error when parsing the PSP firmware structures

Parsing the ASRock 4x4 BOX firmware from: https://download.asrock.com/IPC/BIOS/4X4%20series(1.40)ROM.zip
results in assertion error:

Traceback (most recent call last):
  File "/usr/local/bin/psptool", line 11, in <module>
    load_entry_point('psptool==2.2', 'console_scripts', 'psptool')()
  File "/usr/local/lib/python3.8/site-packages/psptool-2.2-py3.8.egg/psptool/__main__.py", line 80, in main
  File "/usr/local/lib/python3.8/site-packages/psptool-2.2-py3.8.egg/psptool/psptool.py", line 31, in from_file
  File "/usr/local/lib/python3.8/site-packages/psptool-2.2-py3.8.egg/psptool/psptool.py", line 39, in __init__
  File "/usr/local/lib/python3.8/site-packages/psptool-2.2-py3.8.egg/psptool/blob.py", line 48, in __init__
  File "/usr/local/lib/python3.8/site-packages/psptool-2.2-py3.8.egg/psptool/blob.py", line 86, in _find_entry_table
  File "/usr/local/lib/python3.8/site-packages/psptool-2.2-py3.8.egg/psptool/fet.py", line 45, in __init__
  File "/usr/local/lib/python3.8/site-packages/psptool-2.2-py3.8.egg/psptool/fet.py", line 84, in _parse_entry_table
  File "/usr/local/lib/python3.8/site-packages/psptool-2.2-py3.8.egg/psptool/utils.py", line 50, in __getitem__
  File "/usr/local/lib/python3.8/site-packages/psptool-2.2-py3.8.egg/psptool/utils.py", line 68, in _offset_slice
AssertionError

psptool installed from commit 2e4ad35, python 3.8.5.

Perhaps distribute using pip

I'm tempted to start using PSPTool in the LVFS to analyse AMD binaries. If it was installable using pip it would be much easier to deploy and keep updated.

Replacing a whole PSP

So me and another guy have been testing AMD EPYC on TRX40 (with an EPYC bios) and it works. After digging into a whole bunch of research done by you guys I successfully replaced the PSP in the TRX40 bios with the EPYC PSP. But there's a catch: it detects properly in PSPTool, but it does not work on the board (post code 00). Note that both the AMD public key and OEM public key are the same in both bioses.

Are there any checksums, hashes, etc that PSPTool ignores but the actual boot procedure doesn't? Is it even possible to replace a whole PSP?

PS. This might not be the right environment to ask this question but I couldn't find any other way to contact you guys.

Move the metadata from setup.py to setup.cfg

https://github.com/gvalkov/setuptools-py2cfg can be helpful

Create coreboot fw.cfg file

For Reference use https://github.com/CE1CECL/coreboot/blob/ce1cecl/src/soc/amd/picasso/fw.cfg

PSPtool does not describe Coreboot Images

Hello,
When I try to run psptool on amdfw.rom ( or really any zen1 coreboot images eg. zork, trembyle, etc ... ), I don't seem to get any psp information. Is there a header that's throwing off the tool? Shouldn't the binaries be the same?

simplepenguin@localhost$ psptool amdfw.rom
Warning: Input  file < 16M, will assume 8M ROM ...

How to calculate Version from EntryHeader

given the four Version bytes are
"Version": [
53,
0,
5,
0
],
psptool will result 0.5.0.35 from it. Is there any reason on why to flip the last byte around?

rename main.py to __main__.py and get rid of bin - entry_points should be used instead

Multi-FET support and inline FETs

Problem

Some images contain multiple firmware entry tables (FET). We should parse them all!

Gigabyte WRX80 32MB image crashes psptool

Hello,
i noticed that this WRX80 image crashes psptool on my machine.
I'm running the AUR build and i'm not sure on what branch and commit it is build.

The Image i tried is the F2 version
and the Traceback is as follows.

$ psptool WRX80SU8-F2.BIN 
Traceback (most recent call last):
  File "/usr/bin/psptool", line 33, in <module>
    sys.exit(load_entry_point('psptool==2.2', 'console_scripts', 'psptool')())
  File "/usr/lib/python3.9/site-packages/psptool/__main__.py", line 80, in main
    psp = PSPTool.from_file(args.file, verbose=args.verbose)
  File "/usr/lib/python3.9/site-packages/psptool/psptool.py", line 31, in from_file
    pt = PSPTool(rom_bytes, verbose=verbose)
  File "/usr/lib/python3.9/site-packages/psptool/psptool.py", line 39, in __init__
    self.blob = Blob(rom_bytes, len(rom_bytes), self)
  File "/usr/lib/python3.9/site-packages/psptool/blob.py", line 48, in __init__
    self._find_entry_table()
  File "/usr/lib/python3.9/site-packages/psptool/blob.py", line 87, in _find_entry_table
    if self.dual_rom:
AttributeError: 'Blob' object has no attribute 'dual_rom'

From the words dual_rom at the end, i assume that That might be the issue because this image appears to not be two images, but one very large 32MB one.

Additionally, the $PL2 is located somewhere where masking its address with 0x00FFFFFF leads into bogus land.

I have not tried any other WRX80 images but i assume that a similar thing will happen.

Use microcode repositories?

I've been looking through ASRock UEFI A3MSTX_3.60

When comparing the output of PSPTool to the microcode entries listed in MCE, the last two entries do not show up in PSPTool.

MCE

#	CPUID	Revision	Date	Size	Offset	Last
1	00800F82	0800820C	2019-02-04	0xC80	0x4DD000	No
2	00800F12	08001230	2018-08-04	0xC80	0x4DDD00	No
3	00800F11	08001138	2019-02-04	0xC80	0x4DEA00	Yes
4	00800F10	0800100C	2017-01-31	0xC80	0x4DF700	Yes
5	00800F00	0800002A	2016-10-06	0xC80	0x4E0400	Yes
6	00810F10	08101013	2018-11-29	0xC80	0x65A500	No
7	00820F00	08200002	2018-02-14	0xC80	0x65B200	Yes
8	00810F00	08100004	2016-11-20	0xC80	0x65BF00	Yes
9	00810F80	08108002	2018-06-05	0xC80	0x65CC00	Yes
10	00810F81	08108102	2018-08-13	0xC80	0x65D900	No
11	00810F11	08101102	2018-11-06	0xC80	0x65E600	Yes
12	00660F00	06006012	2014-10-14	0xA20	0xD1A2E0	Yes
13	00660F01	0600611A	2018-01-26	0xA20	0xD1AD00	Yes

PSPTool -E -n
(end entries only)

	Entry	Address	Size	Type	Magic/ID	Version	Info
	121	0x65a500	0xc80	0x66
	122	0x65b200	0xc80	0x100066
	123	0x65bf00	0xc80	0x200066
	124	0x65cc00	0xc80	0x300066
	125	0x65d900	0xc80	0x400066
	126	0x65e600	0xc80	0x500066
	127	0x65f300	0x560	0x6a
	128	0xd00000	0x300000	0x10062
	129	0xfff000	0x1000	BIOS_RTM_FIRMWARE~0x6

Can you confirm these are getting missed by PSPTool? Have you thought about using the repository here to identify them? Maybe even identify the Type as microcode or something more clever?

JSON output support

For further processing, it would be nice to have JSON output; there could be a switch such as --json.

I am working on a web-based UI to explore UEFI images where I would love to use that output. :)