Skip to content

Conversation

@melvyn2
Copy link

@melvyn2 melvyn2 commented Jan 5, 2026

I copied the way gzip/zlib compression was handled for brotli, including vendoring of code. Some capsule files fail to decompress but those also fail on the reference edk2 tools.

@NikolajSchlej
Copy link
Collaborator

We delayed adding Brotli because there are zero UEFI images with Brotli sections found in the wild so far. Do you happen to have found some?

@melvyn2
Copy link
Author

melvyn2 commented Jan 5, 2026

Here's a BIOS region where many of the interesting bits are in a Brotli compressed section: https://github.com/user-attachments/files/24413229/Region_BIOS_BIOS_region.rgn.zip (same dump as #453)

Here is the corresponding capsule file: P16ALY.zip
I am still investigating how to transform the strange brotli section data in the capsule into valid brotli data.

@melvyn2
Copy link
Author

melvyn2 commented Jan 5, 2026

For this capsule specifically, there are 5 blobs of 0x524 bytes inserted into the brotli compressed data at a regular interval. These blobs have a consistent header (03 00 00 00 05 00 00 00 ...) and footer but I can't identify them. Once those blobs are removed (but while keeping the brotli section length the same, i.e. taking data from the padding following it), it decompresses normally to the same data.

I have no clue what this is but maybe this can help someone else deal with them.

Edit: These blobs are actually distributed throughout the entire file and so don't have anything to do with this decompressor specifically. They can be removed with a command like the following:

perl -0777 -pe 's/\x03\x00\x00\x00\x05\x00\x00\x00.{384}\x01\x00\x01\x00.{384}(\x02\x00\x00\x00.*?\x00\x00\x00\x00\xFF\x00\x00\x00\x00\x00\x00\x00)?//sg' P15ALY.CAP > P15ALY.MOD.CAP

The "cleaned" file then works fine with this PR and also works with the Boot Guard parser.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants