Skip to main content

Loading the code workspace…

LC

Understand UEFI Secure Boot and Chain of Trust

medium6/8

Explore the CMOS and RTC: Read System Clock with BIOS INT 0x1A Understand the Initial RAM Filesystem (initramfs)

Language

Compiler

2.0s Limit 256MB

Submit and pass all tests to enable saving to GitHub.

Implementation

Simulate Secure Boot verification in C.

Requirements:

Define signature database structure (db, dbx)
Implement verify_signature(file_hash, signer_name)
Implement is_revoked(signer_name) checking dbx
Implement secure_boot_verify(file_path) chain
Show trust chain: firmware -> bootloader -> kernel
Show what happens when signature is invalid
Show what happens when signer is revoked
Print database contents
Simulate enrolling a custom key

Test:

Show valid signature accepted
Show invalid signature rejected
Show revoked signer blocked
Show trust chain validated
Show custom key enrolled

Why This Matters

The db/dbx/KEK/PK chain you're modeling is exactly what let CVE-2020-10713 ('BootHole') bypass Secure Boot through a buffer overflow in GRUB2's config parsing, forcing every major Linux distro to rotate their Microsoft-signed shim. Understanding revocation via dbx is also why a perfectly valid Ubuntu ISO can suddenly fail to boot after a firmware update pushes a new blocklist.

Hints

0 / 3 revealed

Validation Suite

main.c

Workspace 1.0

← Explore the CMOS and RTC: Read System Clock with BIOS INT 0x1AUnderstand the Initial RAM Filesystem (initramfs) →