Secure Boot Off in OVMF TPM BIOS - Windows 11

[Friis]

Hello

After creating a new Windows 11 with the OVMF TPM BIOS, I noticed that windows 11 says that secure boot is Off (msinfo32).

To my understanding that after selecting OVMF TPM BIOS, It should create VM with TPM and secure boot.

Searching for secure boot for VMs give answers to pre OVMF TPM guides (That I couldn't understand how worked).

 

Am I missing something to activate secure boot since Windows 11 reports it as Off?

[ghost82]

On 9/22/2022 at 11:17 AM, Friis said:

To my understanding that after selecting OVMF TPM BIOS, It should create VM with TPM and secure boot.

That OVMF files are tpm enabled and secure boot compatible (which is enough for installing and running windows 11): this doesn't mean secure boot is enabled, but only capable.

To enable secure boot you need microsoft keys injected.

 

In other words ovmf was compiled with these flags:

-D SECURE_BOOT_ENABLE -D TPM2_ENABLE

or with:

-D SECURE_BOOT_ENABLE -D TPM_ENABLE

depending on the ovmf version;

but microsoft keys injection is up to you.

https://projectacrn.github.io/latest/tutorials/waag-secure-boot.html

Edited September 27, 2022 by ghost82

[Friis]

I got to "Use QEMU to Inject Secure Boot Keys Into OVMF" section of the guide and started to have problems.

Is there a way to convert the guide to fit with Unraid? I also tried creating a ubuntu VM to run qemu within, but the command seem to fail at "-hda fat:hda-contents \"
Wish the process of getting secure boot enabled was easier.

[ghost82]

21 hours ago, Friis said:

I got to "Use QEMU to Inject Secure Boot Keys Into OVMF" section of the guide and started to have problems.

Is there a way to convert the guide to fit with Unraid? I also tried creating a ubuntu VM to run qemu within, but the command seem to fail at "-hda fat:hda-contents \"
Wish the process of getting secure boot enabled was easier.

 

What you have to do is to simply inject files by booting the ovmf bios setup of your current windows virtual machine. You can use only your actual windows machine even for creating the certificate for PK, or use another vm or another pc with linux.

If it's not clear what that tutorial describes:

1- Create a private key and certificate to be used for PK

2- Download microsoft files (certificates for KEK and DB)

3- Run a basic virtual machine, with a virtual disk with certificates in it, to boot into uefi shell, ovmf bios and inject the files into the ovmf VARS file (maybe this wasn't clear...:it runs qemu via command line then it manages that basic vm through virt manager to access the gui of the uefi shell and ovmf bios) --> by injecting certificates with a basic vm your ovmf vars file will be "cleaner", because it contains only injected certificates, otherwise vars file contains other info, such as the boot drive and other uefi variables.

 

21 hours ago, Friis said:

but the command seem to fail at "-hda fat:hda-contents

It isn't needed you can boot your windows virtual machine and inject files from there, check my point (3)

 

What you have to do:

1. Download attachment Microsoft.zip, extract it somewhere, it contains files for KEK and DB: if you don't trust me download files directly from microsoft

2. Generate a private key and a .der certificate: I used a linux virtual machine with openssl installed, run these commands in a terminal:

openssl req -newkey rsa:2048 -nodes -keyout PKpriv.key -x509 -days 358000 -out PKtestDER.crt

NOTE: the certificate will expire after 980 years!!!(358000 days); for security you may want to decrease this amount of time.

 

Convert the created certificate from .crt to .der:

openssl x509 -in PKtestDER.crt -outform der -out PKtestDER.der

 

3. Create a new vdisk with unraid terminal to copy all the needed files to inject certificates:

qemu-img create -f raw /path/to/vdisk.img 2G

 

4. Format FAT32 that disk:

mkfs.vfat -s 16 -F 32 /path/to/vdisk.img

 

5. Mount vdisk.img somewhere and copy inside:

MicCorUEFCA2011_2011-06-27.crt

MicWinProPCA2011_2011-10-19.crt

MicCorKEKCA2011_2011-06-24.crt

PKtestDER.der

 

6. Unmount vdisk.img, modify your windows vm to include the new vdisk.img, for example add:

    <disk type='file' device='disk'>
      <driver name='qemu' type='raw' cache='writeback'/>
      <source file='/path/to/vdisk.img'/>
      <target dev='hdc' bus='sata'/>
      <address type='drive' controller='0' bus='0' target='0' unit='2'/>
    </disk>

 

7. run your windows vm, press esc to access ovmf settings

 

8. inject certificates and enable secure boot:

Device Manager / Secure Boot Configuration / Secure Boot Mode: --> change from “Standard Mode” to “Custom Mode”

“Custom Secure Boot Options” will show up, click and enter

PK Options / Enroll PK / Enroll PK Using File: select the HD corresponding to vdisk.img, select PKtestDer.cer, then “Commit Changes and Exit”

KEK Options / Enroll KEK / Enroll KEK Using File: select the HD corresponding to vdisk.img, select MicCorKEKCA2011_2011-06-24.crt, then “Commit Changes and Exit”

DB Options / Enroll Signature / Enroll Signature Using File: select the HD corresponding to vdisk.img, select MicWinProPCA2011_2011-10-19.crt, then “Commit Changes and Exit”

DB Options / Enroll Signature / Enroll Signature Using File: select the HD corresponding to vdisk.img, select MicCorUEFCA2011_2011-06-27.crt, then “Commit Changes and Exit”

 

Save with F10 and shutdown the vm.

 

Now all the files are injected into the OVMF_VARS.fd file.

 

--------

I'm attaching OVMF-2022-05-TPM-SECBOOT-ENABLED.zip, which contains my compiled version of ovmf 202205 with tpm and secure boot, with secure boot enabled and injected certificates. These files are ready to be used (just change in the xml the paths to ovmf code and ovmf vars), but take into account that PKtestDER.der was generated with a private key which I own.

If you want your own PKtestDER.der you need to follow all the above steps.

If you open OVMF_VARS_SECBOOT.fd with a hex editor you will notice the certificates injected.

 

 

NOTE: I compiled this ovmf without smm, so you don't need smm emulation set in libvirt

Microsoft.zip OVMF-2022-05-TPM-SECBOOT-ENABLED.zip

Edited September 27, 2022 by ghost82

[steve1977]

This reads fairly complicated, but I think I need to find a way to enable it to play Fifa 23?

 

Will there be an Unraid update to support this natively?

[ghost82]

42 minutes ago, steve1977 said:

This reads fairly complicated, but I think I need to find a way to enable it to play Fifa 23?

Well...it depends, I don't find it too much complicated; if you want just to test if fifa 23 needs secure boot enabled to run (it seems a bit strange that a game requires secure boot....why??), download and use the OVMF-2022-..... files attached in my post above and point the vars/code files to these files in the xml.

About security concern of the private key, well, unless you are not the cia or some sort of secrecy agency with secrets of billion of dollars in your pc, you could stay safe..

With the private key I can build uefi malware injected in the bios and I can install this modified bios and since the certificates are still valid the malware will be injected.

But....I need local access to your pc, or I need to send you the modified bios and you install it: you can understand that both options are a no go

I could have already modified the attached files with malware, well.. I did not

 

I'd try to find a tool to be able to inject certificates into the vars file without having to use a vm to start the ovmf setup, but my searches found nothing.

If there was a tool like this, all could be easier since I think that the certificate can be created on unraid itself.

However I think that a docker could be created quite easily even if a basic vm is needed to be run for certificates injection.

Edited November 27, 2022 by ghost82

[steve1977]

Thanks for your helpful response. Unfortunately, Fifa 23 indeed needs this to be set as secure. Internet is all over complaining about this requirement

 

Where would I need to copy the file to? Let me give it a try and see whether this would make Fifa work.

 

In general I don't like messing with the VM XML file as this often leads to trouble later. For example when I change the RAM allocation later, this will override this change and I will likely forget how to make this manual change again.

[ghost82]

1 minute ago, steve1977 said:

Where would I need to copy the file to?

First switch to xml view, copy all and save a backup copy somewhere so you can restore all things.

 

Then download OVMF-2022-05-TPM-SECBOOT-ENABLED.zip, extract the archive and you will have 2 files:

OVMF_CODE_SECBOOT.fd

OVMF_VARS_SECBOOT.fd

 

Save these files where you want, it doesn't matter the location, let's call '/path/to/'

In the xml you have the os section with ovmf code and ovmf vars, change it to:

  <os>
.....
    <loader readonly='yes' type='pflash'>/path/to/OVMF_CODE_SECBOOT.fd</loader>
    <nvram>/path/to/OVMF_VARS_SECBOOT.fd</nvram>
.....
  </os>

 

Save and start the vm.

[steve1977]

Thanks for your help. Unfortunately, this did not work for me. I copied the files and made above change to the XML. The screen resolution seems off and there is an error message about non-bootable device. Any further advice appreciated!

[ghost82]

10 minutes ago, steve1977 said:

Thanks for your help. Unfortunately, this did not work for me. I copied the files and made above change to the XML. The screen resolution seems off and there is an error message about non-bootable device. Any further advice appreciated!

Post the original xml and the modified one; doubple check with the terminal that the paths to ovmf files are correct; press esc when running the vm to enter ovmf bios setup and rearrenge boot order, or boot from the ovmf setup page directly.

The vars file contains only the micorsoft certificates, so any boot order saved in there is gone and needs to be rewritten (it's like you did a nvram/cmos reset).

[ghost82]

Or just add to your existing vm the attached vdisk.

- unzip the attachment, save it somewhere

- add vdiskcert.img as a vidisk to your windows vm (raw)  - step 6 of this post: https://forums.unraid.net/topic/128595-secure-boot-off-in-ovmf-tpm-bios-windows-11/?do=findComment&comment=1173154

- do step 7

- do step 8: for the selection "of the HD corresponding to vdisk.img" the disk will show up with label CERT, see following picture; inside there will be all the needed files.

 

 

vdiskcert.zip

Edited November 27, 2022 by ghost82

[steve1977]

Thanks @ghost82. Sorry for late resonse and really appreciate your help.

 

Finally having some time to keep trying this out. Unfortunately, I tried many things, but cannot get it to work. May benefit from some more step-by-step explanations.

 

1) I downloaded the file above (vdiskcert.zip). Unzipped the file and then have a file labeled "vdiskcert.img".

 

2) Added "vdiskcert.img" as "2nd vDisk Location" (set to manual). Kept default settings as "raw" and "virtio".

 

3) I am then starting the VM. Don't know then how to follow the instruction to "Unmount vdisk.img". And then I am stuck

 

Thanks for your help!

[ghost82]

2 hours ago, steve1977 said:

3) I am then starting the VM. Don't know then how to follow the instruction to "Unmount vdisk.img". And then I am stuck

Once you added the vdisk in your vm settings you should be able to boot your vm and press esc to access the ovmf bios settings, just ignore "unmount vdisk".

If the vdisk is not detected into the ovmf bios settings try sata instead of virtio.

[steve1977]

Thanks for your help. Tried both virtio and SATA without success. Some more info about my VM seetings below.

 

I don't get a message that "ESC" gets me into bios. I still hammer ESC, but end up at Windows login screen 😞

 

i440fx-7.1

OVMF-TPM, enable USB boot: No

Hyper-V: Yes

USB controller: 2.0 (EHCI)

Virtio drivers ISO: /mnt/user/isos/virtio-win-0.1.221-1.iso

Primary vdisk: My vdisk, virtio, Bootorder 1

Secondary vdisk: File provided by you, tried both virtio and sata

Network model: virtio-net

[ghost82]

8 minutes ago, steve1977 said:

I don't get a message that "ESC" gets me into bios

ok, I think it could be tricky to access the ovmf bios settings if you connect to the vm with vnc, you should be fast to open the vnc client, connect and press esc continuously before the boot process starts.

You could try to remove from the vm the windows disk, just have only the "cert" vdisk: by this way the vm should boot to the uefi shell; type "exit" and press enter and the vm should reboot without closing the vnc client window, so you can press esc when it reboots.

Once you finished injecting the certificates you can add back the windows disk.

[steve1977]

Thanks. Getting closer, but it seems I may have bricked the VM now 😞 Is below instruction and both of these files emnroled to DB options?

 

 

DB Options / Enroll Signature / Enroll Signature Using File: select the HD corresponding to vdisk.img, select MicWinProPCA2011_2011-10-19.crt, then “Commit Changes and Exit”

DB Options / Enroll Signature / Enroll Signature Using File: select the HD corresponding to vdisk.img, select MicCorUEFCA2011_2011-06-27.crt, then “Commit Changes and Exit”

[steve1977]

Ok, I seem to have succeeded to enable it. So, first step is done...

 

Unfortunately, I still cannot play Fifa 23 as it gives me a new error message (This software cannot be used at the same time as the game: Hypervisor). I disabled Hyper-V in docker settings and also disabled the "Virtualization Based Security". Still no luck.

 

Haven't done anything in the bios yet.

 

One post suggests to hide the virtualization (args: -cpu 'host,-hypevisor,kvm=off'), but no idea how to do. Link below and any thoughts appreciated!
 

 

[ghost82]

Try to hide the hypervisor cpu flag:

shutdown the vm

make sure you passthrough the cpu and you are not emulating it, so you have something li ke this:
 

  <cpu mode='host-passthrough' ......

 

Then add to this cpu block hte line to disable the hypervisor flag:

  <cpu mode='host-passthrough' check='none' migratable='on'>
    <topology sockets='2' dies='1' cores='8' threads='2'/>
    <feature policy='disable' name='hypervisor'/>
  </cpu>

 

Obviously change the topology to reflect yours.

 

Now disable the hypervisor cpuid leaves:
just above the closing tag

  </features>

 

paste this block:

  <kvm>
    <hidden state='on'/>
  </kvm>

 

 

---------------

args: -cpu 'host,-hypevisor,kvm=off' are arguments to be passed to qemu, setting libvirt xml as I described does the same thing (cpu host passthrough, hypervisor flag disabled, kvm off/hidden)

[steve1977]

Thanks. I had tried this before, but unfortunately unsuccessful. From what I have googled, the issue is that the Fifa anticheat is on "kernel level" and not on "os level". Whatever this means, but this may make it more difficult to hide that the game is run inside a VM?

[ghost82]

Without knowing what the anticheat checks it's not possible to say anything..it can be easy as injecting smbios properties and hiding the hypervisor or very hard requiring the modification of the qemu source code..

You could try to inject manually smbios properties, such as in this post and see if it works:
https://forums.unraid.net/topic/125745-xml-smbios-sysinfo-not-being-applied-to-vm/#comment-1146255

 

[steve1977]

Thanks. Unfortunately no luck. Still getting the error message "This software cannot be used at the same time as the game: Hypervisor".

[wkromer]

This worked for getting past EA's shite anti-cheat for anyone interested. I have host passthrough on the CPU and Hyper-V is enabled as well. I did follow ghost82's steps on setting up a .img with the custom certs as opposed to downloading the zip files.

[Olivier POATO]

Thank you so much for your advices @ghost82 i've finally managed to have Fifa 23 working on my boy's Win 11 VM.

I've just wonder how some of you successfully created the drive to make it readable by bios. On my side, i've failed. But as a work around i put the files on a a USB Stick and put it on the VM.

Last thought, as now unraid is TPM 2.0 friendly, why not to go full steam ahead and let lambda users to be able to configure a VM withe secure boot activate within a proper template ? ( i second @steve1977's remark)

[steve1977]

21 minutes ago, Olivier POATO said:

Thank you so much for your advices @ghost82 i've finally managed to have Fifa 23 working on my boy's Win 11 VM.

I've just wonder how some of you successfully created the drive to make it readable by bios. On my side, i've failed. But as a work around i put the files on a a USB Stick and put it on the VM.

Last thought, as now unraid is TPM 2.0 friendly, why not to go full steam ahead and let lambda users to be able to configure a VM withe secure boot activate within a proper template ? ( i second @steve1977's remark)

Thanks for sharing. Can you share what you have done from above to make it working? With amazing help by @ghost82, I followed all steps above. But the issue reamsins. Still no Fifa 23 in the VM for me.

[ghost82]

9 hours ago, Olivier POATO said:

I've just wonder how some of you successfully created the drive to make it readable by bios

 

Hi, it's described here:
 

On 9/26/2022 at 3:52 PM, ghost82 said:

3. Create a new vdisk with unraid terminal to copy all the needed files to inject certificates:

qemu-img create -f raw /path/to/vdisk.img 2G

 

4. Format FAT32 that disk:

mkfs.vfat -s 16 -F 32 /path/to/vdisk.img

 

 

So, you created a raw disk and formatted fat32.

Then you mount this disk somewhere, like:

mount /path/to/vdisk.img /path/to/mount/

 

And you copy all the files into it, like:

cp /path/to/file.ext /path/to/mount/

 

And finally you can unmount the vdisk:

umount /path/to/mount/

 

When you add the vdisk to the vm use a virtual sata controller for maximum compatibility.

Edited January 29, 2023 by ghost82