Port MokManager to Linux Foundation loader UI code

This is the first stage of porting the MokManager UI to the UI code used
by the Linux Foundation UEFI loader.

13 files changed, 1259 insertions, 0 deletions

diff --git a/include/PeImage.h b/include/PeImage.h
new file mode 100644
index 00000000..ec134047
--- /dev/null
+++ b/include/PeImage.h
@@ -0,0 +1,787 @@
+/** @file

+  EFI image format for PE32, PE32+ and TE. Please note some data structures are 

+  different for PE32 and PE32+. EFI_IMAGE_NT_HEADERS32 is for PE32 and 

+  EFI_IMAGE_NT_HEADERS64 is for PE32+. 

+

+  This file is coded to the Visual Studio, Microsoft Portable Executable and 

+  Common Object File Format Specification, Revision 8.0 - May 16, 2006. 

+  This file also includes some definitions in PI Specification, Revision 1.0.

+

+Copyright (c) 2006 - 2010, Intel Corporation. All rights reserved.<BR>

+Portions copyright (c) 2008 - 2009, Apple Inc. All rights reserved.<BR>

+This program and the accompanying materials                          

+are licensed and made available under the terms and conditions of the BSD License         

+which accompanies this distribution.  The full text of the license may be found at        

+http://opensource.org/licenses/bsd-license.php.                                           

+

+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,                     

+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.             

+

+**/

+

+#ifndef __PE_IMAGE_H__

+#define __PE_IMAGE_H__

+

+#include <wincert.h>

+

+#define SIGNATURE_16(A, B)        ((A) | (B << 8))

+#define SIGNATURE_32(A, B, C, D)  (SIGNATURE_16 (A, B) | (SIGNATURE_16 (C, D) << 16))

+#define SIGNATURE_64(A, B, C, D, E, F, G, H) \

+	(SIGNATURE_32 (A, B, C, D) | ((UINT64) (SIGNATURE_32 (E, F, G, H)) << 32))

+

+#define ALIGN_VALUE(Value, Alignment) ((Value) + (((Alignment) - (Value)) & ((Alignment) - 1)))

+#define ALIGN_POINTER(Pointer, Alignment) ((VOID *) (ALIGN_VALUE ((UINTN)(Pointer), (Alignment))))

+

+//

+// PE32+ Subsystem type for EFI images

+//

+#define EFI_IMAGE_SUBSYSTEM_EFI_APPLICATION         10

+#define EFI_IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER 11

+#define EFI_IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER      12

+#define EFI_IMAGE_SUBSYSTEM_SAL_RUNTIME_DRIVER      13 ///< defined PI Specification, 1.0

+

+

+//

+// PE32+ Machine type for EFI images

+//

+#define IMAGE_FILE_MACHINE_I386            0x014c

+#define IMAGE_FILE_MACHINE_IA64            0x0200

+#define IMAGE_FILE_MACHINE_EBC             0x0EBC

+#define IMAGE_FILE_MACHINE_X64             0x8664

+#define IMAGE_FILE_MACHINE_ARMTHUMB_MIXED  0x01c2

+

+//

+// EXE file formats

+//

+#define EFI_IMAGE_DOS_SIGNATURE     SIGNATURE_16('M', 'Z')

+#define EFI_IMAGE_OS2_SIGNATURE     SIGNATURE_16('N', 'E')

+#define EFI_IMAGE_OS2_SIGNATURE_LE  SIGNATURE_16('L', 'E')

+#define EFI_IMAGE_NT_SIGNATURE      SIGNATURE_32('P', 'E', '\0', '\0')

+

+///

+/// PE images can start with an optional DOS header, so if an image is run

+/// under DOS it can print an error message.

+///

+typedef struct {

+  UINT16  e_magic;    ///< Magic number.

+  UINT16  e_cblp;     ///< Bytes on last page of file.

+  UINT16  e_cp;       ///< Pages in file.

+  UINT16  e_crlc;     ///< Relocations.

+  UINT16  e_cparhdr;  ///< Size of header in paragraphs.

+  UINT16  e_minalloc; ///< Minimum extra paragraphs needed.

+  UINT16  e_maxalloc; ///< Maximum extra paragraphs needed.

+  UINT16  e_ss;       ///< Initial (relative) SS value.

+  UINT16  e_sp;       ///< Initial SP value.

+  UINT16  e_csum;     ///< Checksum.

+  UINT16  e_ip;       ///< Initial IP value.

+  UINT16  e_cs;       ///< Initial (relative) CS value.

+  UINT16  e_lfarlc;   ///< File address of relocation table.

+  UINT16  e_ovno;     ///< Overlay number.

+  UINT16  e_res[4];   ///< Reserved words.

+  UINT16  e_oemid;    ///< OEM identifier (for e_oeminfo).

+  UINT16  e_oeminfo;  ///< OEM information; e_oemid specific.

+  UINT16  e_res2[10]; ///< Reserved words.

+  UINT32  e_lfanew;   ///< File address of new exe header.

+} EFI_IMAGE_DOS_HEADER;

+

+///

+/// COFF File Header (Object and Image).

+///

+typedef struct {

+  UINT16  Machine;

+  UINT16  NumberOfSections;

+  UINT32  TimeDateStamp;

+  UINT32  PointerToSymbolTable;

+  UINT32  NumberOfSymbols;

+  UINT16  SizeOfOptionalHeader;

+  UINT16  Characteristics;

+} EFI_IMAGE_FILE_HEADER;

+

+///

+/// Size of EFI_IMAGE_FILE_HEADER.

+///

+#define EFI_IMAGE_SIZEOF_FILE_HEADER        20

+

+//

+// Characteristics

+//

+#define EFI_IMAGE_FILE_RELOCS_STRIPPED      (1 << 0)     ///< 0x0001  Relocation info stripped from file.

+#define EFI_IMAGE_FILE_EXECUTABLE_IMAGE     (1 << 1)     ///< 0x0002  File is executable  (i.e. no unresolved externel references).

+#define EFI_IMAGE_FILE_LINE_NUMS_STRIPPED   (1 << 2)     ///< 0x0004  Line nunbers stripped from file.

+#define EFI_IMAGE_FILE_LOCAL_SYMS_STRIPPED  (1 << 3)     ///< 0x0008  Local symbols stripped from file.

+#define EFI_IMAGE_FILE_BYTES_REVERSED_LO    (1 << 7)     ///< 0x0080  Bytes of machine word are reversed.

+#define EFI_IMAGE_FILE_32BIT_MACHINE        (1 << 8)     ///< 0x0100  32 bit word machine.

+#define EFI_IMAGE_FILE_DEBUG_STRIPPED       (1 << 9)     ///< 0x0200  Debugging info stripped from file in .DBG file.

+#define EFI_IMAGE_FILE_SYSTEM               (1 << 12)    ///< 0x1000  System File.

+#define EFI_IMAGE_FILE_DLL                  (1 << 13)    ///< 0x2000  File is a DLL.

+#define EFI_IMAGE_FILE_BYTES_REVERSED_HI    (1 << 15)    ///< 0x8000  Bytes of machine word are reversed.

+

+///

+/// Header Data Directories.

+///

+typedef struct {

+  UINT32  VirtualAddress;

+  UINT32  Size;

+} EFI_IMAGE_DATA_DIRECTORY;

+

+//

+// Directory Entries

+//

+#define EFI_IMAGE_DIRECTORY_ENTRY_EXPORT      0

+#define EFI_IMAGE_DIRECTORY_ENTRY_IMPORT      1

+#define EFI_IMAGE_DIRECTORY_ENTRY_RESOURCE    2

+#define EFI_IMAGE_DIRECTORY_ENTRY_EXCEPTION   3

+#define EFI_IMAGE_DIRECTORY_ENTRY_SECURITY    4

+#define EFI_IMAGE_DIRECTORY_ENTRY_BASERELOC   5

+#define EFI_IMAGE_DIRECTORY_ENTRY_DEBUG       6

+#define EFI_IMAGE_DIRECTORY_ENTRY_COPYRIGHT   7

+#define EFI_IMAGE_DIRECTORY_ENTRY_GLOBALPTR   8

+#define EFI_IMAGE_DIRECTORY_ENTRY_TLS         9

+#define EFI_IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10

+

+#define EFI_IMAGE_NUMBER_OF_DIRECTORY_ENTRIES 16

+

+///

+/// @attention

+/// EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC means PE32 and 

+/// EFI_IMAGE_OPTIONAL_HEADER32 must be used. The data structures only vary

+/// after NT additional fields.

+///

+#define EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b

+          

+///

+/// Optional Header Standard Fields for PE32.

+///

+typedef struct {

+  ///

+  /// Standard fields.

+  ///

+  UINT16                    Magic;

+  UINT8                     MajorLinkerVersion;

+  UINT8                     MinorLinkerVersion;

+  UINT32                    SizeOfCode;

+  UINT32                    SizeOfInitializedData;

+  UINT32                    SizeOfUninitializedData;

+  UINT32                    AddressOfEntryPoint;

+  UINT32                    BaseOfCode;

+  UINT32                    BaseOfData;  ///< PE32 contains this additional field, which is absent in PE32+.

+  ///

+  /// Optional Header Windows-Specific Fields.

+  ///

+  UINT32                    ImageBase;

+  UINT32                    SectionAlignment;

+  UINT32                    FileAlignment;

+  UINT16                    MajorOperatingSystemVersion;

+  UINT16                    MinorOperatingSystemVersion;

+  UINT16                    MajorImageVersion;

+  UINT16                    MinorImageVersion;

+  UINT16                    MajorSubsystemVersion;

+  UINT16                    MinorSubsystemVersion;

+  UINT32                    Win32VersionValue;

+  UINT32                    SizeOfImage;

+  UINT32                    SizeOfHeaders;

+  UINT32                    CheckSum;

+  UINT16                    Subsystem;

+  UINT16                    DllCharacteristics;

+  UINT32                    SizeOfStackReserve;

+  UINT32                    SizeOfStackCommit;

+  UINT32                    SizeOfHeapReserve;

+  UINT32                    SizeOfHeapCommit;

+  UINT32                    LoaderFlags;

+  UINT32                    NumberOfRvaAndSizes;

+  EFI_IMAGE_DATA_DIRECTORY  DataDirectory[EFI_IMAGE_NUMBER_OF_DIRECTORY_ENTRIES];

+} EFI_IMAGE_OPTIONAL_HEADER32;

+

+///

+/// @attention

+/// EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC means PE32+ and 

+/// EFI_IMAGE_OPTIONAL_HEADER64 must be used. The data structures only vary

+/// after NT additional fields.

+///

+#define EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b

+

+///

+/// Optional Header Standard Fields for PE32+.

+///

+typedef struct {

+  ///

+  /// Standard fields.

+  ///

+  UINT16                    Magic;

+  UINT8                     MajorLinkerVersion;

+  UINT8                     MinorLinkerVersion;

+  UINT32                    SizeOfCode;

+  UINT32                    SizeOfInitializedData;

+  UINT32                    SizeOfUninitializedData;

+  UINT32                    AddressOfEntryPoint;

+  UINT32                    BaseOfCode;

+  ///

+  /// Optional Header Windows-Specific Fields.

+  ///

+  UINT64                    ImageBase;

+  UINT32                    SectionAlignment;

+  UINT32                    FileAlignment;

+  UINT16                    MajorOperatingSystemVersion;

+  UINT16                    MinorOperatingSystemVersion;

+  UINT16                    MajorImageVersion;

+  UINT16                    MinorImageVersion;

+  UINT16                    MajorSubsystemVersion;

+  UINT16                    MinorSubsystemVersion;

+  UINT32                    Win32VersionValue;

+  UINT32                    SizeOfImage;

+  UINT32                    SizeOfHeaders;

+  UINT32                    CheckSum;

+  UINT16                    Subsystem;

+  UINT16                    DllCharacteristics;

+  UINT64                    SizeOfStackReserve;

+  UINT64                    SizeOfStackCommit;

+  UINT64                    SizeOfHeapReserve;

+  UINT64                    SizeOfHeapCommit;

+  UINT32                    LoaderFlags;

+  UINT32                    NumberOfRvaAndSizes;

+  EFI_IMAGE_DATA_DIRECTORY  DataDirectory[EFI_IMAGE_NUMBER_OF_DIRECTORY_ENTRIES];

+} EFI_IMAGE_OPTIONAL_HEADER64;

+

+

+///

+/// @attention

+/// EFI_IMAGE_NT_HEADERS32 is for use ONLY by tools.

+///

+typedef struct {

+  UINT32                      Signature;

+  EFI_IMAGE_FILE_HEADER       FileHeader;

+  EFI_IMAGE_OPTIONAL_HEADER32 OptionalHeader;

+} EFI_IMAGE_NT_HEADERS32;

+

+#define EFI_IMAGE_SIZEOF_NT_OPTIONAL32_HEADER sizeof (EFI_IMAGE_NT_HEADERS32)

+

+///

+/// @attention

+/// EFI_IMAGE_HEADERS64 is for use ONLY by tools.

+///

+typedef struct {

+  UINT32                      Signature;

+  EFI_IMAGE_FILE_HEADER       FileHeader;

+  EFI_IMAGE_OPTIONAL_HEADER64 OptionalHeader;

+} EFI_IMAGE_NT_HEADERS64;

+

+#define EFI_IMAGE_SIZEOF_NT_OPTIONAL64_HEADER sizeof (EFI_IMAGE_NT_HEADERS64)

+

+//

+// Other Windows Subsystem Values

+//

+#define EFI_IMAGE_SUBSYSTEM_UNKNOWN     0

+#define EFI_IMAGE_SUBSYSTEM_NATIVE      1

+#define EFI_IMAGE_SUBSYSTEM_WINDOWS_GUI 2

+#define EFI_IMAGE_SUBSYSTEM_WINDOWS_CUI 3

+#define EFI_IMAGE_SUBSYSTEM_OS2_CUI     5

+#define EFI_IMAGE_SUBSYSTEM_POSIX_CUI   7

+

+///

+/// Length of ShortName.

+///

+#define EFI_IMAGE_SIZEOF_SHORT_NAME 8

+

+///

+/// Section Table. This table immediately follows the optional header.

+///

+typedef struct {

+  UINT8 Name[EFI_IMAGE_SIZEOF_SHORT_NAME];

+  union {

+    UINT32  PhysicalAddress;

+    UINT32  VirtualSize;

+  } Misc;

+  UINT32  VirtualAddress;

+  UINT32  SizeOfRawData;

+  UINT32  PointerToRawData;

+  UINT32  PointerToRelocations;

+  UINT32  PointerToLinenumbers;

+  UINT16  NumberOfRelocations;

+  UINT16  NumberOfLinenumbers;

+  UINT32  Characteristics;

+} EFI_IMAGE_SECTION_HEADER;

+

+///

+/// Size of EFI_IMAGE_SECTION_HEADER.

+///

+#define EFI_IMAGE_SIZEOF_SECTION_HEADER       40

+         

+//

+// Section Flags Values

+//

+#define EFI_IMAGE_SCN_TYPE_NO_PAD                  BIT3   ///< 0x00000008  ///< Reserved.

+#define EFI_IMAGE_SCN_CNT_CODE                     BIT5   ///< 0x00000020

+#define EFI_IMAGE_SCN_CNT_INITIALIZED_DATA         BIT6   ///< 0x00000040

+#define EFI_IMAGE_SCN_CNT_UNINITIALIZED_DATA       BIT7   ///< 0x00000080

+                                                   

+#define EFI_IMAGE_SCN_LNK_OTHER                    BIT8   ///< 0x00000100  ///< Reserved.

+#define EFI_IMAGE_SCN_LNK_INFO                     BIT9   ///< 0x00000200  ///< Section contains comments or some other type of information.

+#define EFI_IMAGE_SCN_LNK_REMOVE                   BIT11  ///< 0x00000800  ///< Section contents will not become part of image.

+#define EFI_IMAGE_SCN_LNK_COMDAT                   BIT12  ///< 0x00001000

+                                                   

+#define EFI_IMAGE_SCN_ALIGN_1BYTES                 BIT20  ///< 0x00100000

+#define EFI_IMAGE_SCN_ALIGN_2BYTES                 BIT21  ///< 0x00200000

+#define EFI_IMAGE_SCN_ALIGN_4BYTES          (BIT20|BIT21) ///< 0x00300000

+#define EFI_IMAGE_SCN_ALIGN_8BYTES                 BIT22  ///< 0x00400000

+#define EFI_IMAGE_SCN_ALIGN_16BYTES         (BIT20|BIT22) ///< 0x00500000

+#define EFI_IMAGE_SCN_ALIGN_32BYTES         (BIT21|BIT22) ///< 0x00600000

+#define EFI_IMAGE_SCN_ALIGN_64BYTES   (BIT20|BIT21|BIT22) ///< 0x00700000

+                                              

+#define EFI_IMAGE_SCN_MEM_DISCARDABLE              BIT25  ///< 0x02000000

+#define EFI_IMAGE_SCN_MEM_NOT_CACHED               BIT26  ///< 0x04000000

+#define EFI_IMAGE_SCN_MEM_NOT_PAGED                BIT27  ///< 0x08000000

+#define EFI_IMAGE_SCN_MEM_SHARED                   BIT28  ///< 0x10000000

+#define EFI_IMAGE_SCN_MEM_EXECUTE                  BIT29  ///< 0x20000000

+#define EFI_IMAGE_SCN_MEM_READ                     BIT30  ///< 0x40000000

+#define EFI_IMAGE_SCN_MEM_WRITE                    BIT31  ///< 0x80000000

+

+///

+/// Size of a Symbol Table Record.

+///

+#define EFI_IMAGE_SIZEOF_SYMBOL 18

+

+//

+// Symbols have a section number of the section in which they are

+// defined. Otherwise, section numbers have the following meanings:

+//

+#define EFI_IMAGE_SYM_UNDEFINED (UINT16) 0  ///< Symbol is undefined or is common.

+#define EFI_IMAGE_SYM_ABSOLUTE  (UINT16) -1 ///< Symbol is an absolute value.

+#define EFI_IMAGE_SYM_DEBUG     (UINT16) -2 ///< Symbol is a special debug item.

+

+//

+// Symbol Type (fundamental) values.

+//

+#define EFI_IMAGE_SYM_TYPE_NULL   0   ///< no type.

+#define EFI_IMAGE_SYM_TYPE_VOID   1   ///< no valid type.

+#define EFI_IMAGE_SYM_TYPE_CHAR   2   ///< type character.

+#define EFI_IMAGE_SYM_TYPE_SHORT  3   ///< type short integer.

+#define EFI_IMAGE_SYM_TYPE_INT    4

+#define EFI_IMAGE_SYM_TYPE_LONG   5

+#define EFI_IMAGE_SYM_TYPE_FLOAT  6

+#define EFI_IMAGE_SYM_TYPE_DOUBLE 7

+#define EFI_IMAGE_SYM_TYPE_STRUCT 8

+#define EFI_IMAGE_SYM_TYPE_UNION  9

+#define EFI_IMAGE_SYM_TYPE_ENUM   10  ///< enumeration.

+#define EFI_IMAGE_SYM_TYPE_MOE    11  ///< member of enumeration.

+#define EFI_IMAGE_SYM_TYPE_BYTE   12

+#define EFI_IMAGE_SYM_TYPE_WORD   13

+#define EFI_IMAGE_SYM_TYPE_UINT   14

+#define EFI_IMAGE_SYM_TYPE_DWORD  15

+

+//

+// Symbol Type (derived) values.

+//

+#define EFI_IMAGE_SYM_DTYPE_NULL      0 ///< no derived type.

+#define EFI_IMAGE_SYM_DTYPE_POINTER   1

+#define EFI_IMAGE_SYM_DTYPE_FUNCTION  2

+#define EFI_IMAGE_SYM_DTYPE_ARRAY     3

+

+//

+// Storage classes.

+//

+#define EFI_IMAGE_SYM_CLASS_END_OF_FUNCTION   ((UINT8) -1)

+#define EFI_IMAGE_SYM_CLASS_NULL              0

+#define EFI_IMAGE_SYM_CLASS_AUTOMATIC         1

+#define EFI_IMAGE_SYM_CLASS_EXTERNAL          2

+#define EFI_IMAGE_SYM_CLASS_STATIC            3

+#define EFI_IMAGE_SYM_CLASS_REGISTER          4

+#define EFI_IMAGE_SYM_CLASS_EXTERNAL_DEF      5

+#define EFI_IMAGE_SYM_CLASS_LABEL             6

+#define EFI_IMAGE_SYM_CLASS_UNDEFINED_LABEL   7

+#define EFI_IMAGE_SYM_CLASS_MEMBER_OF_STRUCT  8

+#define EFI_IMAGE_SYM_CLASS_ARGUMENT          9

+#define EFI_IMAGE_SYM_CLASS_STRUCT_TAG        10

+#define EFI_IMAGE_SYM_CLASS_MEMBER_OF_UNION   11

+#define EFI_IMAGE_SYM_CLASS_UNION_TAG         12

+#define EFI_IMAGE_SYM_CLASS_TYPE_DEFINITION   13

+#define EFI_IMAGE_SYM_CLASS_UNDEFINED_STATIC  14

+#define EFI_IMAGE_SYM_CLASS_ENUM_TAG          15

+#define EFI_IMAGE_SYM_CLASS_MEMBER_OF_ENUM    16

+#define EFI_IMAGE_SYM_CLASS_REGISTER_PARAM    17

+#define EFI_IMAGE_SYM_CLASS_BIT_FIELD         18

+#define EFI_IMAGE_SYM_CLASS_BLOCK             100

+#define EFI_IMAGE_SYM_CLASS_FUNCTION          101

+#define EFI_IMAGE_SYM_CLASS_END_OF_STRUCT     102

+#define EFI_IMAGE_SYM_CLASS_FILE              103

+#define EFI_IMAGE_SYM_CLASS_SECTION           104

+#define EFI_IMAGE_SYM_CLASS_WEAK_EXTERNAL     105

+

+//

+// type packing constants

+//

+#define EFI_IMAGE_N_BTMASK  017

+#define EFI_IMAGE_N_TMASK   060

+#define EFI_IMAGE_N_TMASK1  0300

+#define EFI_IMAGE_N_TMASK2  0360

+#define EFI_IMAGE_N_BTSHFT  4

+#define EFI_IMAGE_N_TSHIFT  2

+

+//

+// Communal selection types.

+//

+#define EFI_IMAGE_COMDAT_SELECT_NODUPLICATES    1

+#define EFI_IMAGE_COMDAT_SELECT_ANY             2

+#define EFI_IMAGE_COMDAT_SELECT_SAME_SIZE       3

+#define EFI_IMAGE_COMDAT_SELECT_EXACT_MATCH     4

+#define EFI_IMAGE_COMDAT_SELECT_ASSOCIATIVE     5

+                                       

+//

+// the following values only be referred in PeCoff, not defined in PECOFF.

+//

+#define EFI_IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY  1

+#define EFI_IMAGE_WEAK_EXTERN_SEARCH_LIBRARY    2

+#define EFI_IMAGE_WEAK_EXTERN_SEARCH_ALIAS      3

+

+///

+/// Relocation format.

+///

+typedef struct {

+  UINT32  VirtualAddress;

+  UINT32  SymbolTableIndex;

+  UINT16  Type;

+} EFI_IMAGE_RELOCATION;

+

+///

+/// Size of EFI_IMAGE_RELOCATION

+///

+#define EFI_IMAGE_SIZEOF_RELOCATION 10

+

+//

+// I386 relocation types.

+//

+#define EFI_IMAGE_REL_I386_ABSOLUTE 0x0000  ///< Reference is absolute, no relocation is necessary.

+#define EFI_IMAGE_REL_I386_DIR16    0x0001  ///< Direct 16-bit reference to the symbols virtual address.

+#define EFI_IMAGE_REL_I386_REL16    0x0002  ///< PC-relative 16-bit reference to the symbols virtual address.

+#define EFI_IMAGE_REL_I386_DIR32    0x0006  ///< Direct 32-bit reference to the symbols virtual address.

+#define EFI_IMAGE_REL_I386_DIR32NB  0x0007  ///< Direct 32-bit reference to the symbols virtual address, base not included.

+#define EFI_IMAGE_REL_I386_SEG12    0x0009  ///< Direct 16-bit reference to the segment-selector bits of a 32-bit virtual address.

+#define EFI_IMAGE_REL_I386_SECTION  0x000A

+#define EFI_IMAGE_REL_I386_SECREL   0x000B

+#define EFI_IMAGE_REL_I386_REL32    0x0014  ///< PC-relative 32-bit reference to the symbols virtual address.

+

+// 

+// x64 processor relocation types.

+// 

+#define IMAGE_REL_AMD64_ABSOLUTE  0x0000

+#define IMAGE_REL_AMD64_ADDR64    0x0001

+#define IMAGE_REL_AMD64_ADDR32    0x0002

+#define IMAGE_REL_AMD64_ADDR32NB  0x0003

+#define IMAGE_REL_AMD64_REL32     0x0004

+#define IMAGE_REL_AMD64_REL32_1   0x0005

+#define IMAGE_REL_AMD64_REL32_2   0x0006

+#define IMAGE_REL_AMD64_REL32_3   0x0007

+#define IMAGE_REL_AMD64_REL32_4   0x0008

+#define IMAGE_REL_AMD64_REL32_5   0x0009

+#define IMAGE_REL_AMD64_SECTION   0x000A

+#define IMAGE_REL_AMD64_SECREL    0x000B

+#define IMAGE_REL_AMD64_SECREL7   0x000C

+#define IMAGE_REL_AMD64_TOKEN     0x000D

+#define IMAGE_REL_AMD64_SREL32    0x000E

+#define IMAGE_REL_AMD64_PAIR      0x000F

+#define IMAGE_REL_AMD64_SSPAN32   0x0010

+

+///

+/// Based relocation format.

+///

+typedef struct {

+  UINT32  VirtualAddress;

+  UINT32  SizeOfBlock;

+} EFI_IMAGE_BASE_RELOCATION;

+

+///

+/// Size of EFI_IMAGE_BASE_RELOCATION.

+///

+#define EFI_IMAGE_SIZEOF_BASE_RELOCATION  8

+

+//

+// Based relocation types.

+//

+#define EFI_IMAGE_REL_BASED_ABSOLUTE        0

+#define EFI_IMAGE_REL_BASED_HIGH            1

+#define EFI_IMAGE_REL_BASED_LOW             2

+#define EFI_IMAGE_REL_BASED_HIGHLOW         3

+#define EFI_IMAGE_REL_BASED_HIGHADJ         4

+#define EFI_IMAGE_REL_BASED_MIPS_JMPADDR    5

+#define EFI_IMAGE_REL_BASED_ARM_MOV32A      5

+#define EFI_IMAGE_REL_BASED_ARM_MOV32T      7

+#define EFI_IMAGE_REL_BASED_IA64_IMM64      9

+#define EFI_IMAGE_REL_BASED_MIPS_JMPADDR16  9

+#define EFI_IMAGE_REL_BASED_DIR64           10

+

+///

+/// Line number format.

+///

+typedef struct {

+  union {

+    UINT32  SymbolTableIndex; ///< Symbol table index of function name if Linenumber is 0.

+    UINT32  VirtualAddress;   ///< Virtual address of line number.

+  } Type;

+  UINT16  Linenumber;         ///< Line number.

+} EFI_IMAGE_LINENUMBER;

+

+///

+/// Size of EFI_IMAGE_LINENUMBER.

+///

+#define EFI_IMAGE_SIZEOF_LINENUMBER 6

+

+//

+// Archive format.

+//

+#define EFI_IMAGE_ARCHIVE_START_SIZE        8

+#define EFI_IMAGE_ARCHIVE_START             "!<arch>\n"

+#define EFI_IMAGE_ARCHIVE_END               "`\n"

+#define EFI_IMAGE_ARCHIVE_PAD               "\n"

+#define EFI_IMAGE_ARCHIVE_LINKER_MEMBER     "/               "

+#define EFI_IMAGE_ARCHIVE_LONGNAMES_MEMBER  "//              "

+

+///

+/// Archive Member Headers

+///

+typedef struct {

+  UINT8 Name[16];     ///< File member name - `/' terminated.

+  UINT8 Date[12];     ///< File member date - decimal.

+  UINT8 UserID[6];    ///< File member user id - decimal.

+  UINT8 GroupID[6];   ///< File member group id - decimal.

+  UINT8 Mode[8];      ///< File member mode - octal.

+  UINT8 Size[10];     ///< File member size - decimal.

+  UINT8 EndHeader[2]; ///< String to end header. (0x60 0x0A).

+} EFI_IMAGE_ARCHIVE_MEMBER_HEADER;

+

+///

+/// Size of EFI_IMAGE_ARCHIVE_MEMBER_HEADER.

+///

+#define EFI_IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR 60

+

+

+//

+// DLL Support

+//

+

+///

+/// Export Directory Table.

+///

+typedef struct {

+  UINT32  Characteristics;

+  UINT32  TimeDateStamp;

+  UINT16  MajorVersion;

+  UINT16  MinorVersion;

+  UINT32  Name;

+  UINT32  Base;

+  UINT32  NumberOfFunctions;

+  UINT32  NumberOfNames;

+  UINT32  AddressOfFunctions;

+  UINT32  AddressOfNames;

+  UINT32  AddressOfNameOrdinals;

+} EFI_IMAGE_EXPORT_DIRECTORY;

+

+///

+/// Hint/Name Table.

+///

+typedef struct {

+  UINT16  Hint;

+  UINT8   Name[1];

+} EFI_IMAGE_IMPORT_BY_NAME;

+

+///

+/// Import Address Table RVA (Thunk Table).

+///

+typedef struct {

+  union {

+    UINT32                    Function;

+    UINT32                    Ordinal;

+    EFI_IMAGE_IMPORT_BY_NAME  *AddressOfData;

+  } u1;

+} EFI_IMAGE_THUNK_DATA;

+

+#define EFI_IMAGE_ORDINAL_FLAG              BIT31    ///< Flag for PE32.

+#define EFI_IMAGE_SNAP_BY_ORDINAL(Ordinal)  ((Ordinal & EFI_IMAGE_ORDINAL_FLAG) != 0)

+#define EFI_IMAGE_ORDINAL(Ordinal)          (Ordinal & 0xffff)

+

+///

+/// Import Directory Table

+///

+typedef struct {

+  UINT32                Characteristics;

+  UINT32                TimeDateStamp;

+  UINT32                ForwarderChain;

+  UINT32                Name;

+  EFI_IMAGE_THUNK_DATA  *FirstThunk;

+} EFI_IMAGE_IMPORT_DESCRIPTOR;

+

+

+///

+/// Debug Directory Format.

+///

+typedef struct {

+  UINT32  Characteristics;

+  UINT32  TimeDateStamp;

+  UINT16  MajorVersion;

+  UINT16  MinorVersion;

+  UINT32  Type;

+  UINT32  SizeOfData;

+  UINT32  RVA;           ///< The address of the debug data when loaded, relative to the image base.

+  UINT32  FileOffset;    ///< The file pointer to the debug data.

+} EFI_IMAGE_DEBUG_DIRECTORY_ENTRY;

+

+#define EFI_IMAGE_DEBUG_TYPE_CODEVIEW 2     ///< The Visual C++ debug information.

+

+///

+/// Debug Data Structure defined in Microsoft C++.

+///

+#define CODEVIEW_SIGNATURE_NB10  SIGNATURE_32('N', 'B', '1', '0')

+typedef struct {

+  UINT32  Signature;                        ///< "NB10"

+  UINT32  Unknown;

+  UINT32  Unknown2;

+  UINT32  Unknown3;

+  //

+  // Filename of .PDB goes here

+  //

+} EFI_IMAGE_DEBUG_CODEVIEW_NB10_ENTRY;

+

+///

+/// Debug Data Structure defined in Microsoft C++.

+///

+#define CODEVIEW_SIGNATURE_RSDS  SIGNATURE_32('R', 'S', 'D', 'S')

+typedef struct {

+  UINT32  Signature;                        ///< "RSDS".

+  UINT32  Unknown;

+  UINT32  Unknown2;

+  UINT32  Unknown3;

+  UINT32  Unknown4;

+  UINT32  Unknown5;

+  //

+  // Filename of .PDB goes here

+  //

+} EFI_IMAGE_DEBUG_CODEVIEW_RSDS_ENTRY;

+

+

+///

+/// Debug Data Structure defined by Apple Mach-O to Coff utility.

+///

+#define CODEVIEW_SIGNATURE_MTOC  SIGNATURE_32('M', 'T', 'O', 'C')

+typedef struct {

+  UINT32    Signature;                       ///< "MTOC".

+  EFI_GUID      MachOUuid;

+  //

+  //  Filename of .DLL (Mach-O with debug info) goes here

+  //

+} EFI_IMAGE_DEBUG_CODEVIEW_MTOC_ENTRY;

+

+///

+/// Resource format.

+///

+typedef struct {

+  UINT32  Characteristics;

+  UINT32  TimeDateStamp;

+  UINT16  MajorVersion;

+  UINT16  MinorVersion;

+  UINT16  NumberOfNamedEntries;

+  UINT16  NumberOfIdEntries;

+  //

+  // Array of EFI_IMAGE_RESOURCE_DIRECTORY_ENTRY entries goes here.

+  //

+} EFI_IMAGE_RESOURCE_DIRECTORY;

+

+///

+/// Resource directory entry format.

+///

+typedef struct {

+  union {

+    struct {

+      UINT32  NameOffset:31;

+      UINT32  NameIsString:1;

+    } s;

+    UINT32  Id;

+  } u1;

+  union {

+    UINT32  OffsetToData;

+    struct {

+      UINT32  OffsetToDirectory:31;

+      UINT32  DataIsDirectory:1;

+    } s;

+  } u2;

+} EFI_IMAGE_RESOURCE_DIRECTORY_ENTRY;

+

+///

+/// Resource directory entry for string.

+///

+typedef struct {

+  UINT16  Length;

+  CHAR16  String[1];

+} EFI_IMAGE_RESOURCE_DIRECTORY_STRING;

+

+///

+/// Resource directory entry for data array.

+///

+typedef struct {

+  UINT32  OffsetToData;

+  UINT32  Size;

+  UINT32  CodePage;

+  UINT32  Reserved;

+} EFI_IMAGE_RESOURCE_DATA_ENTRY;

+

+///

+/// Header format for TE images, defined in the PI Specification, 1.0.

+///

+typedef struct {

+  UINT16                    Signature;            ///< The signature for TE format = "VZ".

+  UINT16                    Machine;              ///< From the original file header.

+  UINT8                     NumberOfSections;     ///< From the original file header.

+  UINT8                     Subsystem;            ///< From original optional header.

+  UINT16                    StrippedSize;         ///< Number of bytes we removed from the header.

+  UINT32                    AddressOfEntryPoint;  ///< Offset to entry point -- from original optional header.

+  UINT32                    BaseOfCode;           ///< From original image -- required for ITP debug.

+  UINT64                    ImageBase;            ///< From original file header.

+  EFI_IMAGE_DATA_DIRECTORY  DataDirectory[2];     ///< Only base relocation and debug directory.

+} EFI_TE_IMAGE_HEADER;

+

+

+#define EFI_TE_IMAGE_HEADER_SIGNATURE  SIGNATURE_16('V', 'Z')

+

+//

+// Data directory indexes in our TE image header

+//

+#define EFI_TE_IMAGE_DIRECTORY_ENTRY_BASERELOC  0

+#define EFI_TE_IMAGE_DIRECTORY_ENTRY_DEBUG      1

+

+

+///

+/// Union of PE32, PE32+, and TE headers.

+///

+typedef union {

+  EFI_IMAGE_NT_HEADERS32   Pe32;

+  EFI_IMAGE_NT_HEADERS64   Pe32Plus;

+  EFI_TE_IMAGE_HEADER      Te;

+} EFI_IMAGE_OPTIONAL_HEADER_UNION;

+

+typedef union {

+  EFI_IMAGE_NT_HEADERS32            *Pe32;

+  EFI_IMAGE_NT_HEADERS64            *Pe32Plus;

+  EFI_TE_IMAGE_HEADER               *Te;

+  EFI_IMAGE_OPTIONAL_HEADER_UNION   *Union;

+} EFI_IMAGE_OPTIONAL_HEADER_PTR_UNION;

+

+typedef struct {

+	WIN_CERTIFICATE Hdr;

+	UINT8           CertData[1];

+} WIN_CERTIFICATE_EFI_PKCS;

+

+#define SHA256_DIGEST_SIZE  32

+#define WIN_CERT_TYPE_PKCS_SIGNED_DATA 0x0002

+

+typedef struct {

+	UINT64 ImageAddress;

+	UINT64 ImageSize;

+	UINT64 EntryPoint;

+	UINTN SizeOfHeaders;

+	UINT16 ImageType;

+	UINT16 NumberOfSections;

+	EFI_IMAGE_SECTION_HEADER *FirstSection;

+	EFI_IMAGE_DATA_DIRECTORY *RelocDir;

+	EFI_IMAGE_DATA_DIRECTORY *SecDir;

+	UINT64 NumberOfRvaAndSizes;

+	EFI_IMAGE_OPTIONAL_HEADER_UNION *PEHdr;

+} PE_COFF_LOADER_IMAGE_CONTEXT;

+

+#endif

diff --git a/include/configtable.h b/include/configtable.h
new file mode 100644
index 00000000..fa2b5058
--- /dev/null
+++ b/include/configtable.h
@@ -0,0 +1,68 @@
+/* definitions straight from TianoCore */
+
+typedef UINT32 EFI_IMAGE_EXECUTION_ACTION;
+
+#define EFI_IMAGE_EXECUTION_AUTHENTICATION      0x00000007 
+#define EFI_IMAGE_EXECUTION_AUTH_UNTESTED       0x00000000
+#define EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED     0x00000001
+#define EFI_IMAGE_EXECUTION_AUTH_SIG_PASSED     0x00000002
+#define EFI_IMAGE_EXECUTION_AUTH_SIG_NOT_FOUND  0x00000003
+#define EFI_IMAGE_EXECUTION_AUTH_SIG_FOUND      0x00000004
+#define EFI_IMAGE_EXECUTION_POLICY_FAILED       0x00000005
+#define EFI_IMAGE_EXECUTION_INITIALIZED         0x00000008
+
+typedef struct {
+  ///
+  /// Describes the action taken by the firmware regarding this image.
+  ///
+  EFI_IMAGE_EXECUTION_ACTION    Action;
+  ///
+  /// Size of all of the entire structure.
+  ///
+  UINT32                        InfoSize;
+  ///
+  /// If this image was a UEFI device driver (for option ROM, for example) this is the 
+  /// null-terminated, user-friendly name for the device. If the image was for an application, 
+  /// then this is the name of the application. If this cannot be determined, then a simple 
+  /// NULL character should be put in this position.
+  /// CHAR16                    Name[];
+  ///
+
+  ///
+  /// For device drivers, this is the device path of the device for which this device driver 
+  /// was intended. In some cases, the driver itself may be stored as part of the system 
+  /// firmware, but this field should record the device's path, not the firmware path. For 
+  /// applications, this is the device path of the application. If this cannot be determined, 
+  /// a simple end-of-path device node should be put in this position.
+  /// EFI_DEVICE_PATH_PROTOCOL  DevicePath;
+  ///
+
+  ///
+  /// Zero or more image signatures. If the image contained no signatures, 
+  /// then this field is empty.
+  ///
+  ///EFI_SIGNATURE_LIST            Signature;
+  UINT8 Data[];
+} EFI_IMAGE_EXECUTION_INFO;
+
+typedef struct {
+  ///
+  /// Number of EFI_IMAGE_EXECUTION_INFO structures.
+  ///
+  UINTN                     NumberOfImages; 
+  ///
+  /// Number of image instances of EFI_IMAGE_EXECUTION_INFO structures.
+  ///
+  EFI_IMAGE_EXECUTION_INFO  InformationInfo[];
+} EFI_IMAGE_EXECUTION_INFO_TABLE;
+
+
+void *
+configtable_get_table(EFI_GUID *guid);
+EFI_IMAGE_EXECUTION_INFO_TABLE *
+configtable_get_image_table(void);
+EFI_IMAGE_EXECUTION_INFO *
+configtable_find_image(const EFI_DEVICE_PATH *DevicePath);
+int
+configtable_image_is_forbidden(const EFI_DEVICE_PATH *DevicePath);
+
diff --git a/include/console.h b/include/console.h
new file mode 100644
index 00000000..7eb8a0be
--- /dev/null
+++ b/include/console.h
@@ -0,0 +1,21 @@
+EFI_INPUT_KEY
+console_get_keystroke(void);
+void
+console_print_box_at(CHAR16 *str_arr[], int highlight, int start_col, int start_row, int size_cols, int size_rows, int offset, int lines);
+void
+console_print_box(CHAR16 *str_arr[], int highlight);
+int
+console_yes_no(CHAR16 *str_arr[]);
+int
+console_select(CHAR16 *title[], CHAR16* selectors[], int start);
+void
+console_errorbox(CHAR16 *err);
+void
+console_error(CHAR16 *err, EFI_STATUS);
+void
+console_alertbox(CHAR16 **title);
+void
+console_notify(CHAR16 *string);
+void
+console_reset(void);
+#define NOSEL 0x7fffffff
diff --git a/include/efiauthenticated.h b/include/efiauthenticated.h
new file mode 100644
index 00000000..f7d6bcb1
--- /dev/null
+++ b/include/efiauthenticated.h
@@ -0,0 +1,222 @@
+#ifndef _INC_EFIAUTHENTICATED_H
+#define _INC_EFIAUTHENTICATED_H
+#include <wincert.h>
+//***********************************************************************
+// Signature Database
+//***********************************************************************
+///
+/// The format of a signature database. 
+///
+#pragma pack(1)
+
+typedef struct {
+  ///
+  /// An identifier which identifies the agent which added the signature to the list.
+  ///
+  EFI_GUID          SignatureOwner;
+  ///
+  /// The format of the signature is defined by the SignatureType.
+  ///
+  UINT8             SignatureData[1];
+} EFI_SIGNATURE_DATA;
+
+typedef struct {
+  ///
+  /// Type of the signature. GUID signature types are defined in below.
+  ///
+  EFI_GUID            SignatureType;
+  ///
+  /// Total size of the signature list, including this header.
+  ///
+  UINT32              SignatureListSize;
+  ///
+  /// Size of the signature header which precedes the array of signatures.
+  ///
+  UINT32              SignatureHeaderSize;
+  ///
+  /// Size of each signature.
+  ///
+  UINT32              SignatureSize; 
+  ///
+  /// Header before the array of signatures. The format of this header is specified 
+  /// by the SignatureType.
+  /// UINT8           SignatureHeader[SignatureHeaderSize];
+  ///
+  /// An array of signatures. Each signature is SignatureSize bytes in length. 
+  /// EFI_SIGNATURE_DATA Signatures[][SignatureSize];
+  ///
+} EFI_SIGNATURE_LIST;
+
+#pragma pack()
+
+//
+// _WIN_CERTIFICATE.wCertificateType
+// 
+#define WIN_CERT_TYPE_PKCS_SIGNED_DATA 0x0002
+#define WIN_CERT_TYPE_EFI_PKCS115      0x0EF0
+#define WIN_CERT_TYPE_EFI_GUID         0x0EF1
+
+#define EFI_CERT_X509_GUID \
+  (EFI_GUID){								\
+    0xa5c059a1, 0x94e4, 0x4aa7, {0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72} \
+  }
+
+#define EFI_CERT_RSA2048_GUID \
+  (EFI_GUID){								\
+    0x3c5766e8, 0x269c, 0x4e34, {0xaa, 0x14, 0xed, 0x77, 0x6e, 0x85, 0xb3, 0xb6} \
+  }
+
+
+#define EFI_CERT_TYPE_PKCS7_GUID \
+  (EFI_GUID){								\
+    0x4aafd29d, 0x68df, 0x49ee, {0x8a, 0xa9, 0x34, 0x7d, 0x37, 0x56, 0x65, 0xa7} \
+  }
+
+///
+/// WIN_CERTIFICATE_UEFI_GUID.CertType
+/// 
+#define EFI_CERT_TYPE_RSA2048_SHA256_GUID \
+  {0xa7717414, 0xc616, 0x4977, {0x94, 0x20, 0x84, 0x47, 0x12, 0xa7, 0x35, 0xbf } }
+
+///
+/// WIN_CERTIFICATE_UEFI_GUID.CertData
+/// 
+typedef struct {
+  EFI_GUID  HashType;
+  UINT8     PublicKey[256];
+  UINT8     Signature[256];
+} EFI_CERT_BLOCK_RSA_2048_SHA256;
+
+
+///
+/// Certificate which encapsulates a GUID-specific digital signature
+///
+typedef struct {
+  ///
+  /// This is the standard WIN_CERTIFICATE header, where
+  /// wCertificateType is set to WIN_CERT_TYPE_UEFI_GUID. 
+  ///                         
+  WIN_CERTIFICATE   Hdr;
+  ///
+  /// This is the unique id which determines the 
+  /// format of the CertData. .
+  ///
+  EFI_GUID          CertType;
+  /// 
+  /// The following is the certificate data. The format of
+  /// the data is determined by the CertType. 
+  /// If CertType is EFI_CERT_TYPE_RSA2048_SHA256_GUID,
+  /// the CertData will be EFI_CERT_BLOCK_RSA_2048_SHA256 structure.
+  ///
+  UINT8            CertData[1];
+} WIN_CERTIFICATE_UEFI_GUID;
+
+
+///   
+/// Certificate which encapsulates the RSASSA_PKCS1-v1_5 digital signature.
+///  
+/// The WIN_CERTIFICATE_UEFI_PKCS1_15 structure is derived from
+/// WIN_CERTIFICATE and encapsulate the information needed to  
+/// implement the RSASSA-PKCS1-v1_5 digital signature algorithm as  
+/// specified in RFC2437.  
+///  
+typedef struct {     
+  ///
+  /// This is the standard WIN_CERTIFICATE header, where 
+  /// wCertificateType is set to WIN_CERT_TYPE_UEFI_PKCS1_15.                       
+  ///
+  WIN_CERTIFICATE Hdr;
+  ///
+  /// This is the hashing algorithm which was performed on the
+  /// UEFI executable when creating the digital signature. 
+  ///
+  EFI_GUID        HashAlgorithm;
+  ///
+  /// The following is the actual digital signature. The   
+  /// size of the signature is the same size as the key 
+  /// (1024-bit key is 128 bytes) and can be determined by 
+  /// subtracting the length of the other parts of this header
+  /// from the total length of the certificate as found in 
+  /// Hdr.dwLength.                               
+  ///
+  /// UINT8 Signature[];
+  ///
+} WIN_CERTIFICATE_EFI_PKCS1_15;
+
+#define OFFSET_OF(TYPE, Field) ((UINTN) &(((TYPE *)0)->Field))
+
+///
+/// Attributes of Authenticated Variable
+///
+#define EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS              0x00000010
+#define EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS   0x00000020
+#define EFI_VARIABLE_APPEND_WRITE                            0x00000040
+
+///   
+/// AuthInfo is a WIN_CERTIFICATE using the wCertificateType
+/// WIN_CERTIFICATE_UEFI_GUID and the CertType
+/// EFI_CERT_TYPE_RSA2048_SHA256_GUID. If the attribute specifies
+/// authenticated access, then the Data buffer should begin with an
+/// authentication descriptor prior to the data payload and DataSize
+/// should reflect the the data.and descriptor size. The caller
+/// shall digest the Monotonic Count value and the associated data
+/// for the variable update using the SHA-256 1-way hash algorithm.
+/// The ensuing the 32-byte digest will be signed using the private
+/// key associated w/ the public/private 2048-bit RSA key-pair. The
+/// WIN_CERTIFICATE shall be used to describe the signature of the
+/// Variable data *Data. In addition, the signature will also
+/// include the MonotonicCount value to guard against replay attacks.
+///  
+typedef struct {
+  ///
+  /// Included in the signature of        
+  /// AuthInfo.Used to ensure freshness/no
+  /// replay. Incremented during each     
+  /// "Write" access.   
+  ///                  
+  UINT64                      MonotonicCount;
+  ///
+  /// Provides the authorization for the variable 
+  /// access. It is a signature across the        
+  /// variable data and the  Monotonic Count      
+  /// value. Caller uses Private key that is      
+  /// associated with a public key that has been  
+  /// provisioned via the key exchange.           
+  ///
+  WIN_CERTIFICATE_UEFI_GUID   AuthInfo;
+} EFI_VARIABLE_AUTHENTICATION;
+
+///
+/// When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is 
+/// set, then the Data buffer shall begin with an instance of a complete (and serialized)
+/// EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new 
+/// variable value and DataSize shall reflect the combined size of the descriptor and the new 
+/// variable value. The authentication descriptor is not part of the variable data and is not 
+/// returned by subsequent calls to GetVariable().
+///
+typedef struct {
+  ///
+  /// For the TimeStamp value, components Pad1, Nanosecond, TimeZone, Daylight and 
+  /// Pad2 shall be set to 0. This means that the time shall always be expressed in GMT.
+  ///
+  EFI_TIME                    TimeStamp;
+  /// 
+  /// Only a CertType of  EFI_CERT_TYPE_PKCS7_GUID is accepted.
+  ///
+  WIN_CERTIFICATE_UEFI_GUID   AuthInfo;
+ } EFI_VARIABLE_AUTHENTICATION_2;
+
+///
+/// Size of AuthInfo prior to the data payload.
+///
+#define AUTHINFO_SIZE ((OFFSET_OF (EFI_VARIABLE_AUTHENTICATION, AuthInfo)) + \
+                       (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData)) + \
+                       sizeof (EFI_CERT_BLOCK_RSA_2048_SHA256))
+
+#define AUTHINFO2_SIZE(VarAuth2) ((OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo)) + \
+                                  (UINTN) ((EFI_VARIABLE_AUTHENTICATION_2 *) (VarAuth2))->AuthInfo.Hdr.dwLength)
+
+#define OFFSET_OF_AUTHINFO2_CERT_DATA ((OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo)) + \
+                                       (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData)))
+
+#endif
diff --git a/include/errors.h b/include/errors.h
new file mode 100644
index 00000000..0da4bb59
--- /dev/null
+++ b/include/errors.h
@@ -0,0 +1,9 @@
+#include <efierr.h>
+
+#ifndef EFI_INCOMPATIBLE_VERSION
+#define EFI_INCOMPATIBLE_VERSION	EFIERR(25)
+#endif
+#ifndef EFI_SECURITY_VIOLATION
+#define EFI_SECURITY_VIOLATION		EFIERR(26)
+#endif
+
diff --git a/include/execute.h b/include/execute.h
new file mode 100644
index 00000000..9aecbff8
--- /dev/null
+++ b/include/execute.h
@@ -0,0 +1,5 @@
+EFI_STATUS
+generate_path(CHAR16* name, EFI_LOADED_IMAGE *li,
+	      EFI_DEVICE_PATH **path, CHAR16 **PathName);
+EFI_STATUS
+execute(EFI_HANDLE image, CHAR16 *name);
diff --git a/include/guid.h b/include/guid.h
new file mode 100644
index 00000000..10f865ad
--- /dev/null
+++ b/include/guid.h
@@ -0,0 +1,18 @@
+#include <efi.h>
+
+#ifndef BUILD_EFI
+const char *guid_to_str(EFI_GUID *guid);
+void str_to_guid(const char *str, EFI_GUID *guid);
+#endif
+
+extern EFI_GUID GV_GUID;
+extern EFI_GUID SIG_DB;
+extern EFI_GUID X509_GUID;
+extern EFI_GUID RSA2048_GUID;
+extern EFI_GUID PKCS7_GUID;
+extern EFI_GUID IMAGE_PROTOCOL;
+extern EFI_GUID SIMPLE_FS_PROTOCOL;
+extern EFI_GUID EFI_CERT_SHA256_GUID;
+extern EFI_GUID MOK_OWNER;
+extern EFI_GUID SECURITY_PROTOCOL_GUID;
+extern EFI_GUID SECURITY2_PROTOCOL_GUID;
diff --git a/include/security_policy.h b/include/security_policy.h
new file mode 100644
index 00000000..a1c1002d
--- /dev/null
+++ b/include/security_policy.h
@@ -0,0 +1,6 @@
+EFI_STATUS
+security_policy_install(void);
+EFI_STATUS
+security_policy_uninstall(void);
+void
+security_protocol_set_hashes(unsigned char *esl, int len);
diff --git a/include/shell.h b/include/shell.h
new file mode 100644
index 00000000..9cb5d479
--- /dev/null
+++ b/include/shell.h
@@ -0,0 +1,2 @@
+EFI_STATUS
+argsplit(EFI_HANDLE image, int *argc, CHAR16*** ARGV);
diff --git a/include/simple_file.h b/include/simple_file.h
new file mode 100644
index 00000000..fe4fd97d
--- /dev/null
+++ b/include/simple_file.h
@@ -0,0 +1,21 @@
+EFI_STATUS
+simple_file_open (EFI_HANDLE image, CHAR16 *name, EFI_FILE **file, UINT64 mode);
+EFI_STATUS
+simple_file_open_by_handle(EFI_HANDLE device, CHAR16 *name, EFI_FILE **file, UINT64 mode);
+EFI_STATUS
+simple_file_read_all(EFI_FILE *file, UINTN *size, void **buffer);
+EFI_STATUS
+simple_file_write_all(EFI_FILE *file, UINTN size, void *buffer);
+void
+simple_file_close(EFI_FILE *file);
+EFI_STATUS
+simple_dir_read_all(EFI_HANDLE image, CHAR16 *name, EFI_FILE_INFO **Entries,
+		    int *count);
+EFI_STATUS
+simple_dir_filter(EFI_HANDLE image, CHAR16 *name, CHAR16 *filter,
+		  CHAR16 ***result, int *count, EFI_FILE_INFO **entries);
+void
+simple_file_selector(EFI_HANDLE *im, CHAR16 **title, CHAR16 *name,
+		     CHAR16 *filter, CHAR16 **result);
+EFI_STATUS
+simple_volume_selector(CHAR16 **title, CHAR16 **selected, EFI_HANDLE *h);
diff --git a/include/variables.h b/include/variables.h
new file mode 100644
index 00000000..c171bd53
--- /dev/null
+++ b/include/variables.h
@@ -0,0 +1,59 @@
+#include <efiauthenticated.h>
+
+#include <sha256.h>		/* for SHA256_DIGEST_SIZE */
+
+#define certlist_for_each_certentry(cl, cl_init, s, s_init)		\
+	for (cl = (EFI_SIGNATURE_LIST *)(cl_init), s = (s_init);	\
+		s > 0 && s >= cl->SignatureListSize;			\
+		s -= cl->SignatureListSize,				\
+		cl = (EFI_SIGNATURE_LIST *) ((UINT8 *)cl + cl->SignatureListSize))
+
+/*
+ * Warning: this assumes (cl)->SignatureHeaderSize is zero.  It is for all
+ * the signatures we process (X509, RSA2048, SHA256)
+ */
+#define certentry_for_each_cert(c, cl)	\
+  for (c = (EFI_SIGNATURE_DATA *)((UINT8 *) (cl) + sizeof(EFI_SIGNATURE_LIST) + (cl)->SignatureHeaderSize); \
+	(UINT8 *)c < ((UINT8 *)(cl)) + (cl)->SignatureListSize; \
+	c = (EFI_SIGNATURE_DATA *)((UINT8 *)c + (cl)->SignatureSize))
+
+EFI_STATUS
+CreatePkX509SignatureList (
+  IN	UINT8			    *X509Data,
+  IN	UINTN			    X509DataSize,
+  IN	EFI_GUID		    owner,
+  OUT   EFI_SIGNATURE_LIST          **PkCert 
+			   );
+EFI_STATUS
+CreateTimeBasedPayload (
+  IN OUT UINTN            *DataSize,
+  IN OUT UINT8            **Data
+			);
+EFI_STATUS
+SetSecureVariable(CHAR16 *var, UINT8 *Data, UINTN len, EFI_GUID owner, UINT32 options, int createtimebased);
+EFI_STATUS
+get_variable(CHAR16 *var, UINT8 **data, UINTN *len, EFI_GUID owner);
+EFI_STATUS
+get_variable_attr(CHAR16 *var, UINT8 **data, UINTN *len, EFI_GUID owner,
+		  UINT32 *attributes);
+EFI_STATUS
+find_in_esl(UINT8 *Data, UINTN DataSize, UINT8 *key, UINTN keylen);
+EFI_STATUS
+find_in_variable_esl(CHAR16* var, EFI_GUID owner, UINT8 *key, UINTN keylen);
+
+#define EFI_OS_INDICATIONS_BOOT_TO_FW_UI 0x0000000000000001
+
+UINT64
+GetOSIndications(void);
+EFI_STATUS
+SETOSIndicationsAndReboot(UINT64 indications);
+int
+variable_is_secureboot(void);
+int
+variable_is_setupmode(void);
+EFI_STATUS
+variable_enroll_hash(CHAR16 *var, EFI_GUID owner,
+		     UINT8 hash[SHA256_DIGEST_SIZE]);
+EFI_STATUS
+variable_create_esl(void *cert, int cert_len, EFI_GUID *type, EFI_GUID *owner,
+		    void **out, int *outlen);
diff --git a/include/version.h b/include/version.h
new file mode 100644
index 00000000..09fd44ae
--- /dev/null
+++ b/include/version.h
@@ -0,0 +1,8 @@
+#define VERSION "1.3.4"
+
+static void
+version(const char *progname)
+{
+	printf("%s " VERSION "\n", progname);
+}
+
diff --git a/include/wincert.h b/include/wincert.h
new file mode 100644
index 00000000..68d1974a
--- /dev/null
+++ b/include/wincert.h
@@ -0,0 +1,33 @@
+#ifndef _INC_WINCERT_H
+#define _INC_WINCERT_H
+
+///
+/// The WIN_CERTIFICATE structure is part of the PE/COFF specification.
+///
+typedef struct {
+  ///
+  /// The length of the entire certificate,  
+  /// including the length of the header, in bytes.                                
+  ///
+  UINT32  dwLength;
+  ///
+  /// The revision level of the WIN_CERTIFICATE 
+  /// structure. The current revision level is 0x0200.                                   
+  ///
+  UINT16  wRevision;
+  ///
+  /// The certificate type. See WIN_CERT_TYPE_xxx for the UEFI      
+  /// certificate types. The UEFI specification reserves the range of 
+  /// certificate type values from 0x0EF0 to 0x0EFF.                          
+  ///
+  UINT16  wCertificateType;
+  ///
+  /// The following is the actual certificate. The format of   
+  /// the certificate depends on wCertificateType.
+  ///
+  /// UINT8 bCertificate[ANYSIZE_ARRAY];
+  ///
+} WIN_CERTIFICATE;
+
+
+#endif