I have an ifrextractor output from a uefi module and I am not sure if I am reading it properly. Here is a snippet.
OneOf Prompt: “L2 TLB Associativity”, Help: “0 - L2 TLB ways [11:8] are fully associative. 1 - =L2 TLB ways [11:8] are 4K-only.”, QuestionFlags: 0x10, QuestionId: 0xE, VarStoreId: 0x5000, VarOffset: 0x22, Flags: 0x10, Size: 8, Min: 0x0, Max: 0x3, Step: 0x0 { 05 91 13 00 14 00 0E 00 00 50 22 00 10 10 00 03 00 }
0x17460: OneOfOption Option: “0” Value: 0 { 09 07 12 00 00 00 00 }
0x17467: OneOfOption Option: “1” Value: 1 { 09 07 11 00 00 00 01 }
0x1746E: OneOfOption Option: “Auto” Value: 3, Default { 09 07 10 00 10 00 03 }
0x17475: End { 29 02 }
With this output am I correct that ‘VarOffset: 0x22’ means that this variable will begin at byte 0x22 in the associated efivar?
With the ‘Size: 8’ am I correct that this variable spans eight bytes?
With ‘OneOfOption Option: “0” Value: 0 { 09 07 12 00 00 00 00 }’ am I correct in reading that to select option zero the hex value ’ 09 07 12 00 00 00 00’ should be added to the efivar starting at the appropriate offset and since it is an eight byte var I would then have another ‘00’ at the end since the current option only lists seven bytes?
Thanks for help sorting out this syntax and positioning