Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

I just can’t believe that there isn’t a program or script to give you information of how many bits you have left in nvram on each sector. I think you can find ranges in hex but not in bits. I’ve been searching hard on that but still nothing. Even searched hard if there was a way to expand the memory where efi is stored. That why I asked about a Sony uefi/bios update program, if I had even the first or second bios update program, if there was a way to have that expand the nvram sector and able to insert MS 2023 certs? See where I’m going with this? But I don’t know exactly how a bios update expands memory to their update file size. The one I have here is 5.6mb exe file.

Banjoman301 said:

From what I've read, the only manual BIOS options for that machine are turn Secure Boot on or off, and clear and reset factory keys.

I had a fairly locked down BIOS (Insyde) on a Toshiba laptop that I had to set up a supervisor password for, in order to put it in setup mode.

Click to expand...

Thank you. I have a supervisor password on it and still those 2 options. It’s a very strong laptop for how old it is. Never has any issues with whatever I throw at it. Never gets slower. I kind of think it would take the 2023 certs but I’m just looking for more odds that I won’t have any issues. I still open to all ideas. I don’t want to give up on this matter or my laptop.
Thank you again

Run in an elevated PowerShell prompt to see if the 2023 cert is on your system....

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

If it returns "True", it's there.

Sony Vaio sve said:

I just can’t believe that there isn’t a program or script to give you information of how many bits you have left in nvram on each sector. I think you can find ranges in hex but not in bits. I’ve been searching hard on that but still nothing. Even searched hard if there was a way to expand the memory where efi is stored. That why I asked about a Sony uefi/bios update program, if I had even the first or second bios update program, if there was a way to have that expand the nvram sector and able to insert MS 2023 certs? See where I’m going with this? But I don’t know exactly how a bios update expands memory to their update file size. The one I have here is 5.6mb exe file.

Click to expand...

The problem is two-fold.

From Linux or a bootable EFI shell, you can guess at the total NVRAM bytes consumed, but that's an incomplete picture. The danger of bricking comes from earlier presumptions of how much space was needed to store Secure Boot variables. Of which, the DBX has the biggest cost in bytes.

Either you're in danger of running out of total bytes or there's an artificial cap on Secure Boot variable sizes.

Some BIOS implementations want to reserve roughly 51% or more free space in order to "defrag" or consolidate stored data in contiguous blocks. If you make changes, like deleting old data entries, those can't be cleaned up right away. In order to enforce consistency, new data must be copied into place first (and confirmed) before the old data is released. Just in case something interrupts the update process and leaves inconsistent data behind.

Other BIOS implementations misjudged the max space which can be assigned to Secure Boot variables. So you can't look at the free memory space as one unified pool which can be freely redistributed to any purpose. There could be more general memory available, but it's not usable for Secure Boot.

Banjoman301 said:

Run in an elevated PowerShell prompt to see if the 2023 cert is on your system....

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'

If it returns "True", it's there.

Click to expand...

This is a common misconception about the certs. You can load the DB with CA 2023 certs, without actually deploying the KEK CA 2023.

KEK CA 2023 is the underpinning of this whole exercise. Without it, UEFI CA 2023 certs are useless. And without validating the CA 2023 certs, you can't revoke CA 2011 certs, since CA 2023 isn't fully trusted. This one reason was my prime motivation for writing the scripts.

Many users have followed this advice (which is based on an incomplete understanding of certs), and believed they're done. The two common KEK delivery methods for a vendor are to include a properly signed KEK in a BIOS update (best solution), or provide a signed file to MS which can be applied to the DB without a BIOS image (next best solution).

In cases where the vendor doesn't comply, manual update is the last resort.

If you only apply the base certs (replacement PK, KEK CA 2011, KEK CA 2023, UEFI CA 2011 & CA 2023 DB), it's possible to get partial benefits for security. You can continue to use newer signed boot files, but cannot block known Black Lotus exploits.

Banjoman301 said:

From what I've read, the only manual BIOS options for that machine are turn Secure Boot on or off, and clear and reset factory keys.

I had a fairly locked down BIOS (Insyde) on a Toshiba laptop that I had to set up a supervisor password for, in order to put it in setup mode.

Click to expand...

If you're allowed to clear factory keys, you may want to try that.

When the update script is run from Windows, it will detect you're in factory mode and download the Windows OEM set of certs provided by MS to OEM's. This will install and grant UEFI CA 2023 status. The update will never auto-revoke, so you can be assured it won't do it unless you provide the -Revoke option.

Assuming it works, you can go ahead and disable the Secure Boot task since most of its functions can be taken over by the update script. Including if you need to push a new set of Windows boot files after a recent Monthly Update.

I realize it doesn't mean they're done, but that the cert is in the OS metadata.

I wouldn't suggest manual install for the poster, since we don't know the risks for a failed install attempt.

garlin said:

If you're allowed to clear factory keys, you may want to try that.

Click to expand...

I updated to the 2023 certs several months ago.

I was telling the poster my experience with a locked down BIOS on an unsupported machine.