hi garlin, could you share the latest version of BlockedOrNot.ps1?
Why don't directly embed it into your zip folder?
Hi Garlin, can you explain in simple terms the meaning of "FileRule"?
What does mean in the end a different SVN from the current one?
When I was writing the older builds of
Check_UEFI-CA2023.ps1, I realized that SkuSiPolicy's frequent updates (several times a year?) was going to force users to pay more attention. Unfortunately, unlike the boot manager it's a real pain to figure out if your winload.efi is banned or not.
For the boot manager (or boot file), the check is fairly straightforward. You extract the file's signing cert and compare it against Windows UEFI CA 2023. Next, you extract the file's SVN and compare it against the DBX's highest known version.
But the SkuSiPolicy contains a set of File Rules, which define a set of allow and disallow rules based on the file version. What we care about is the osloader.exe (winload.efi) rules which
block specific ranges of file versions. You can run any winload.efi,
except for versions falling into these blocked ranges. Using this method, MS can ban all the older versions of winload.efi for W10, W11, etc.
SVN applies to the boot manager
File Rules apply to the winload.efi
Both security mechanisms can run in parallel, are unrelated to each other.
Code:
PS C:\Users\GARLIN\Downloads> .\BlockedOrNot.ps1 -verbose
Windows 11 25H2 (26200.9168)
VBS: OFF
Policy File: "\\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b" is NOT ENFORCED
Version: 3.0.0.16
RULE ID MinimumVersion MaximumVersion
------- -------------- --------------
FILEATTRIB_F_0042 0.0 14393.9309
FILEATTRIB_F_0044 14400.0 17763.8979 <-- ban any winload.efi which is between 14400.0 and 17763.8979
FILEATTRIB_F_0040 18000.0 19041.7519
FILEATTRIB_F_0049 19100.0 20348.5359
FILEATTRIB_F_0047 20400.0 22621.7349
FILEATTRIB_F_0041 23000.0 26100.8835
FILEATTRIB_F_0043 26100.32000 26100.33099
FILEATTRIB_F_0048 26172.0 26172.33099
FILEATTRIB_F_0046 27000.0 28000.2489
FILEATTRIB_F_0045 29426.0 65535.65535 <-- 65536.65536 is "infinity" or the highest possible version
VolumeName Filename FileVersion Status
---------- -------- ----------- ------
CCCOMA_X64FRE_EN-US_DV9 E:\sources\boot.wim 19041.2965 FLAGGED BY 'FILEATTRIB_F_0040' <-- 19041.2965 is less than 19041.7519
C:\Windows\System32\winload.efi 26100.9168 ALLOWED
\harddisk0\partition5\Recovery\WindowsRE\Winre.wim 26100.9168 ALLOWED
NEW VOLUME D:\sources\boot.wim 22621.1702 FLAGGED BY 'FILEATTRIB_F_0047'
MACRIUM_PE F:\sources\boot.wim 22621.1702 FLAGGED BY 'FILEATTRIB_F_0047'
Why don't I include
BlockedOrNot.ps1 in the normal ZIP?
Because it started life as a testbed, to try different ideas without having to worry about breaking the normal scripts. I posted the original version on a VIP thread in order to limit the feedback (because it was an early and broken script). Most of core functions have been copied into Check_BootMedia.ps1.
The major difference is BlockedOrNot.ps1 was designed to check a multi-boot setup. So it's very nosy and checks all of your disks and Recovery partitions looking for winload.efi candidates. BlockedOrNot.ps1 might get cleaned up and get a proper release. But the end goal was always to add SkuSiPolicy compliance checking to boot media.
