Aptio firmware update capsules contain strange sections that break parsing

[melvyn2]

Continuing from #454 (comment)
UEFITool mis-parses some firmware update capsules I have encountered due to these regularly-placed unidentified sections. Within each processor generation, the size and header of these sections is consistent.

I have collected sample capsules from different vendors and different generations of Intel chipsets for which this applies. I haven't located an Aptio AMD update capsule so I don't know if this issue also exists for those. I didn't see this problem with Insyde capsules from Framework (for either CPU vendor).

Lunar Lake

To remove the sections:

perl -0777 -pe 's/\x03\x00\x00\x00\x05\x00\x00\x00.{384}\x01\x00\x01\x00.{384}(?:\x02\x00\x00\x00.*?\x00\x00\x00\x00\xFF\x00\x00\x00\x00\x00\x00\x00)?//sg' in.cap > out.cap

Unmodified samples:
LNK0023 (ASUS).zip
P16ALY (Samsung).zip

Meteor Lake

perl -0777 -pe 's/\x02\x00\x00\x00\x03\x00\x00\x00.{384}\x01\x00\x01\x00.{384}(?:\x02\x00\x00\x00.*?\x00\x00\x00\x00\xFF\x00\x00\x00\x00\x00\x00\x00)?//sg'

P03RHH (Samsung).zip

Alder Lake

perl -0777 -pe 's/\x01\x00\x00\x00\x01\x00\x00\x00.{256}\x01\x00\x01\x00.{256}(?:\x02\x00\x00\x00.*?\x00\x00\x00\x00\xFF\x00\x00\x00\x00\x00\x00\x00)?//sg'

1.03 (Acer).zip
RC0070 (Intel).zip
P11RGK (Samsung).zip

[NikolajSchlej]

That crap is a result of Intel Platform Flash Armoring Technology being (mis)used by vendors for no reason other than "AMI had zero idea what that shit is or how it works, but Intel said it add to FWSEC, and they obliged".

UEFITool is not a right tool to support unwrapping every damn type of capsule in existence, but there's such a tool already - https://github.com/platomav/BIOSUtilities