I'm attempting to reproduce the cve-2022-21894 poc for educational purposes, however I'm getting stuck at the "hvloader" phase. The debugger cannot attach to the boot process.
Short description about the expected execution flow of the poc:
- the vulnerable bootmgfw.efi is executed normally
- the first BCD is parsed, leading to the execution of the legit but vulnerable "\minram\bootmgr.efi" file. this program reads the second BCD file in the same folder.
- the second BCD is parsed, leading to the execution of "\maxram\hvloader.efi".
- this "hvloader" firmware will load the "mcupdate_GenuineIntel.dll" and we can code our payload in this DLL to disable DSE, etc.
However everytime the "\maxram\hvloader.efi" file is executed, I get "0xC0000010" error. The debugger (WinDbg Preview) cannot even attach to this process so I dont know what was going on inside (it was successful at attaching to the previous "bootmgfw.efi" process).
My guess is some of the options of BCD file caused this. It's surely not secure boot because I turned it off.
I want to debug the hvloader firmware execution to understand the problem. Can you suggest me some ideas? or throw me some documents I can refer to?
