How to set up Boot Guard on a Manufacturing Mode enabled BIOS?

[numbfx]

Could someone please describe how to set up Boot Guard on a Manufacturing Mode enabled BIOS?

I’ve been researching the topic and come up with a few resources that sort of explain it. I’m trying figure out what needs to be signed, how to make a manifest, and how to then put it all together.


The guide on this site touches on the topic for CSME 12:

[Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization

If you happen to have the OEM’s Private RSA Key (unlikely unless you’re the OEM), you can input it at "SMIP Signing Key" field. Then go to "Build > Build Settings", input the Manifest Extension Utility (MEU) executable location at "Intel(R) Manifest Extension Utility Path" field, input Win32 OpenSSL Lite executable location at "Signing Tool Path" field, make sure that "OpenSSL" is selected at "Signing Tool" field, make sure that "Verify manifest signing keys against the OEM Key Manifest" is set to "Yes", leave all other settings intact and click Close. Now proceed to the next step of the guide.

What if you made your own Private RSA Key and signed the firmware? Would that do it?


This site describes how an attacker could take advantage of an unlocked Boot Guard, which seems like maybe sort of same way one could program their own Boot Guard?

Who Watch BIOS Watchers?

1. Modify UEFI firmware update image or Disable Intel Boot Guard
   Initial Boot Block (IBB)
   
   2. Recalculate signature on 2048-bit RSA key pair for IBB
   Modify IBB manifest inside UEFI firmware update file
   Recalculate signature for IBB manifest with different 2048-bit RSA key pair
   
   3. Modify Root Key manifest
   
   Recalculate SHA256 hash of the public key from Root Key Manifest
   
   4. Modify ME region with new key (CVE-2017–11314)
   
   Modify Boot Guard configuration with active verified boot policy
   
   5. Lock Boot Guard configuration with by FPF (CVE-2017–11313)

I guess I’m wondering if I’m on the right track and if anyone can help shed some light on what steps to take for this process?


I found this PDF Guide from Intel:

http://support.prosys.ro/Theon/Theon_470…Rev%201%201.pdf

This document gives an overview of the process of manifesting and signing OEM components that then will be included in the IFWI image for Apollo Lake platforms.OEMs are always required to add manifests to components in the IFWI images. However, they are not required to sign components, or add an OEM Key Manifest, unless they wish to •enable Secure Boot

This mentions Secure Boot, but is Boot Guard the same process?