EV_EFI_BOOT_SERVICES_APPLICATION event

[danko-miladinovic]

Hi everyone,

I'm unsure where to post this question, so I am posting it here. If I made a mistake, I apologize. If so, could you point me to where I can find an answer?

I have an event log, and I booted my VM with just OVMF, kernel, initrd, and a kernel command line. Nothing more. I got this in my event log, but the digest is not the kernel digest. I understood that this is the path to the kernel, but I am unable to reproduce the digest. Any thoughts? Am I misinterpreting this in some way?

- EventNum: 14
  PCRIndex: 4
  EventType: EV_EFI_BOOT_SERVICES_APPLICATION
  DigestCount: 2
  Digests:
  - AlgorithmId: sha256
    Digest: "b3822b43b8ec3ad2c6450fa9f1d25cf500fc832749cec182294c137dc640c5ec"
  - AlgorithmId: sha384
    Digest: "a5e3b95c1da6bfa9a6ce2e3e5901fdc9b922f8abac2524e1941ad5860760bd7401781a0ff80730bd806af3d935d54977"
  EventSize: 74
  Event:
    ImageLocationInMemory: 0x7c78c018
    ImageLengthInMemory: 6580440
    ImageLinkTimeAddress: 0x0
    LengthOfDevicePath: 42
    DevicePath: '0403140072f728144ab61e44b8c39ebdd7f893c7040412006b00650072006e0065006c0000007fff0400'

The ImageLengthInMemory matches the size of the bzImage that I am using.

Kind regards,
Danko