linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: <Mario.Limonciello@dell.com>
To: <pali.rohar@gmail.com>
Cc: <dvhart@infradead.org>, <rjw@rjwysocki.net>,
	<luto@amacapital.net>, <len.brown@intel.com>,
	<corentin.chary@gmail.com>, <luto@kernel.org>,
	<andriy.shevchenko@linux.intel.com>,
	<linux-kernel@vger.kernel.org>,
	<platform-driver-x86@vger.kernel.org>, <linux-pm@vger.kernel.org>
Subject: RE: RFC: WMI Enhancements
Date: Mon, 8 May 2017 21:18:11 +0000	[thread overview]
Message-ID: <77e4e46f58354e10874ed0515f514fc2@ausx13mpc120.AMER.DELL.COM> (raw)
In-Reply-To: <201705082259.51850@pali>

> -----Original Message-----
> From: Pali Rohár [mailto:pali.rohar@gmail.com]
> Sent: Monday, May 8, 2017 4:00 PM
> To: Limonciello, Mario <Mario_Limonciello@Dell.com>
> Cc: dvhart@infradead.org; rjw@rjwysocki.net; luto@amacapital.net;
> len.brown@intel.com; corentin.chary@gmail.com; luto@kernel.org;
> andriy.shevchenko@linux.intel.com; linux-kernel@vger.kernel.org; platform-
> driver-x86@vger.kernel.org; linux-pm@vger.kernel.org
> Subject: Re: RFC: WMI Enhancements
> 
> On Monday 08 May 2017 21:21:45 Mario.Limonciello@dell.com wrote:
> > > -----Original Message-----
> > > From: Pali Rohár [mailto:pali.rohar@gmail.com]
> > > Sent: Monday, May 8, 2017 12:18 PM
> > > To: Limonciello, Mario <Mario_Limonciello@Dell.com>
> > > Cc: dvhart@infradead.org; rjw@rjwysocki.net; luto@amacapital.net;
> > > len.brown@intel.com; corentin.chary@gmail.com; luto@kernel.org;
> > > andriy.shevchenko@linux.intel.com; linux-kernel@vger.kernel.org;
> > > platform- driver-x86@vger.kernel.org; linux-pm@vger.kernel.org
> > > Subject: Re: RFC: WMI Enhancements
> > >
> > > On Friday 05 May 2017 23:55:46 Mario.Limonciello@dell.com wrote:
> > > > Unfortunately the MOF data that comes out of wmi-mof is so called
> > > > "Binary MOF" which has been pre-compiled to an intermediate
> > > > format with mofcomp.exe on Windows. The format of binary MOF is
> > > > not documented and the only known way to get text mof back out
> > > > is by using mofcomp.exe with some esoteric arguments.
> > > >
> > > > mofcomp.exe -MOF:recovered.mof -MFL:ms_409.mof -Amendment:MS_409
> > > > binary_mof_file
> > >
> > > Looks like that binary MOF file has "well-known" file extension
> > > .bmf. File itself starts with magic hader "FOMB" which is in
> > > reverse BMOF (binary mof). But I was not able to find any
> > > specification nor any other details. As this binary format is
> > > dated back to Win9x I guess data would compressed by some old MS
> > > compression algorithm (CAB?).
> >
> > Actually comparing a couple of binary MOF files the first 8 look like
> > the header to me.
> >
> > 0x46, 0x4f, 0x4d, 0x42, 0x01, 0x00, 0x00, 0x00
> >
> > On a compiled Dell binary MOF the next are:
> >
> > 0xed, 0x04, 0x00, 0x00,
> >
> > This looks like the size of the remaining data after taking out 16
> > for the headers 4ed = 1261
> > Total size is 1277
> >
> > 0xd8, 0x15, 0x00, 0x00
> > Maybe a checksum?
> >
> > But that first 16 bytes does look like the header structure to me.
> 
> Good catch! Your observation for first 12 bytes passes also for my
> checks.
> 
> Next 4 bytes (after possible checksum) at 0x10 are always same:
> 0x44 0x53 0x00 0x01.
> 
> And I guess this should be compression header. In time of Win9x
> Microsoft had own non-standard compression for disks called DoubleSpace.
> IIRC it was some modification of LZ77 algorithm. And 0x44 0x53 0x00 0x01
> is DS01. Maybe it is really DoubleSpace compression used for binary MOF?
> 
> I'm going to find specification of that old compression algorithm...
> 
44 53 looks promising to be quantum compression.
https://en.wikipedia.org/wiki/Quantum_compression

That’s also what 'file' magic detects from it too.
$ file mof.stripped 
mof.stripped: Quantum archive data

> > > Moreover via tool wmiofck.exe it is possible to generate header
> > > file for
> > >
> > > WMI driver from binary mof file:
> > >   wmiofck.exe -hfile.h -m -u file.bmf
> > >
> > > And what is interesting that in this file are also comments which
> > > looks like comes from that binary mof file.
> >
> > Ah interesting.  The "comments" that come out of that are actually
> > what's mapped to the "Description" field in the WMI repository when
> > the binary MOF is loaded.
> >
> > They are not the developer comments that were placed in the original
> > MOF data.  I would suppose those are lost when compiling to binary
> > MOF.
> 
> Hm.. right they are present in decompiled MOF file in Description field.
> 
> > > When I looked into output from mofcomp.exe with above args, that
> > > MOF output did not contain comments, so looks like we still can
> > > miss something.
> > >
> > > See: http://blog.nietrzeba.pl/2011/12/mof-decompilation.html
> >
> > Actually I see wmimofck output to be missing some important bits.
> > For example on a Dell system You'll get a class BFn declared from
> > mofcomp output, but nothing from wmimofck output.
> >
> > The most important thing that you're really getting out of this MOF
> > is the size, structure and format of the buffer that you would be
> > sending to ASL.
> >
> > Back to the point we were discussing of a potential filter, the
> > information in the MOF could possibly be very useful to declaring
> > what is going into the filter.
> 
> In that header file generated by wmiofck.exe I see definitions for BFn.
There is a definition but it's missing the format of the argument from
what I can tell.

In any case, this will be tangential to this discussion, but useful for
reverse engineering the binary mof format.

  reply	other threads:[~2017-05-08 21:18 UTC|newest]

Thread overview: 76+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-04-12 23:08 RFC: WMI Enhancements Darren Hart
2017-04-13  7:32 ` Michał Kępień
2017-04-13 13:29   ` Mario.Limonciello
2017-04-13 13:51     ` Pali Rohár
2017-04-13 15:34       ` Andy Lutomirski
2017-04-13 15:40         ` Mario.Limonciello
2017-04-13 16:06           ` Darren Hart
2017-04-13 15:40       ` Mario.Limonciello
2017-04-18  7:36         ` Andy Shevchenko
2017-04-18 14:08           ` Mario.Limonciello
2017-04-13 15:32   ` Andy Lutomirski
2017-04-13 15:39     ` Pali Rohár
2017-04-13 15:44       ` Andy Lutomirski
2017-04-13 16:09         ` Darren Hart
2017-04-13 15:55     ` Mario.Limonciello
2017-04-13 15:57       ` Andy Lutomirski
2017-04-13 16:54         ` Mario.Limonciello
2017-04-13 17:06           ` Darren Hart
2017-04-13 17:39             ` Mario.Limonciello
2017-04-13 17:44               ` Andy Lutomirski
2017-04-13 17:49                 ` Mario.Limonciello
2017-04-18  7:54               ` Pali Rohár
2017-04-18 16:56                 ` Darren Hart
2017-04-18 19:28                   ` Pali Rohár
2017-04-13 17:02       ` Darren Hart
2017-04-13 17:32         ` Andy Lutomirski
2017-04-13 17:45           ` Mario.Limonciello
2017-04-13 16:08     ` Darren Hart
2017-04-13  7:33 ` Pali Rohár
2017-04-13 16:56   ` Darren Hart
2017-04-13 20:38     ` Mario.Limonciello
2017-04-13 23:51       ` Darren Hart
2017-04-14 17:42         ` Mario.Limonciello
2017-04-14 18:27           ` Darren Hart
2017-04-14 19:04             ` Mario.Limonciello
2017-04-14 22:45 ` Rafael J. Wysocki
2017-04-14 23:05   ` Darren Hart
2017-04-17 22:03     ` Andy Lutomirski
2017-04-17 23:10       ` Darren Hart
2017-04-18 13:07         ` Rafael J. Wysocki
2017-04-18 16:33           ` Darren Hart
2017-04-18 19:28             ` Pali Rohár
2017-04-18 22:49               ` Darren Hart
2017-04-19  7:52                 ` Pali Rohár
2017-04-19 16:29                   ` Mario.Limonciello
2017-04-19 16:54                     ` Pali Rohár
2017-04-19 17:24                       ` Mario.Limonciello
2017-04-20 13:14                         ` Pali Rohár
2017-04-20 20:44                           ` Darren Hart
2017-05-05 21:55                             ` Mario.Limonciello
2017-05-05 23:44                               ` Darren Hart
2017-05-06  0:51                                 ` Mario.Limonciello
2017-05-06  1:25                                   ` Andy Lutomirski
2017-05-08 15:29                                     ` Darren Hart
2017-05-08 15:36                                       ` Mario.Limonciello
2017-05-08 15:47                                         ` Darren Hart
2017-05-08 16:00                                           ` Mario.Limonciello
2017-05-08 16:04                                           ` Andy Shevchenko
     [not found]                                             ` <CAOg5c--wkQgvsmhTynAKyG9iWaHjRWC5Z+MXzVJVw66vxSz4Zw@mail.gmail.com>
2017-05-08 18:26                                               ` Mario.Limonciello
2017-05-08 19:09                                                 ` Darren Hart
2017-05-08 19:11                                                   ` Mario.Limonciello
2017-05-08 17:17                               ` Pali Rohár
2017-05-08 19:21                                 ` Mario.Limonciello
2017-05-08 20:59                                   ` Pali Rohár
2017-05-08 21:18                                     ` Mario.Limonciello [this message]
2017-05-08 22:17                                       ` Pali Rohár
2017-05-09  1:10                                         ` Mario.Limonciello
2017-05-09  7:29                                           ` Pali Rohár
2017-05-09 18:10                                             ` Mario.Limonciello
2017-05-09 19:04                                               ` Andy Shevchenko
2017-05-09 19:16                                                 ` Mario.Limonciello
2017-05-09 19:26                                                   ` Andy Shevchenko
2017-05-09 22:38                                                     ` Pali Rohár
2017-05-09 19:19                                                 ` Pali Rohár
2017-04-20 14:17                       ` Christoph Hellwig
2017-04-18 21:14             ` Rafael J. Wysocki

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=77e4e46f58354e10874ed0515f514fc2@ausx13mpc120.AMER.DELL.COM \
    --to=mario.limonciello@dell.com \
    --cc=andriy.shevchenko@linux.intel.com \
    --cc=corentin.chary@gmail.com \
    --cc=dvhart@infradead.org \
    --cc=len.brown@intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-pm@vger.kernel.org \
    --cc=luto@amacapital.net \
    --cc=luto@kernel.org \
    --cc=pali.rohar@gmail.com \
    --cc=platform-driver-x86@vger.kernel.org \
    --cc=rjw@rjwysocki.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).