[Bug]: Wrong textual representation of DBXSVN GUID's in 'dbx_info_msft_latest.json' file

[PatrickDittrich]

Is there an existing issue for this?

• I have searched existing issues

Current Behavior

The textual representation of the GUID's in the field "guid" do not "correctly" match the GUID that is in the field "value".
https://raw.githubusercontent.com/microsoft/secureboot_objects/main/PreSignedObjects/DBX/dbx_info_msft_latest.json

C# Code

new Guid(Convert.FromHexString("612B139DD5598843AB1C185C3CB2EB92")) # Bytes [1..16] from field "value"
9d132b61-59d5-4388-ab1c-185c3cb2eb92
new Guid("{9d132b61-59d5-4388-1cab-185c3cb2eb92}") # Textual representation from field "guid"
9d132b61-59d5-4388-1cab-185c3cb2eb92
new Guid("{9d132b61-59d5-4388-ab1c-185c3cb2eb92}") # Correct textual representation that would match the bytes from "value"
9d132b61-59d5-4388-ab1c-185c3cb2eb92

The two "bytes" of the 4th group are swapped in all three entries

"svns": [
	{
        "value": "01612B139DD5598843AB1C185C3CB2EB92000007000000000000000000000000",
        "version": "7.0",
        "filename": "bootmgfw.efi",
        "guid": "{9d132b61-59d5-4388-1cab-185c3cb2eb92} == EFI_BOOTMGR_DBXSVN_GUID",
        "description": "Windows Bootmgr SVN CVE-2023-24932",
        "dateOfLastChange": "2025-06-06"
    },
	{
        "value": "019D2EF8E827E15841A4884C18ABE2F284000003000000000000000000000000",
        "version": "3.0",
        "filename": "cdboot.efi",
        "guid": "{e8f82e9d-e127-4158-88a4-4c18abe2f284} == EFI_CDBOOT_DBXSVN_GUID",
        "description": "Windows cdboot SVN CVE-2023-24932",
        "dateOfLastChange": "2024-04-01"
    },
	{
        "value": "01C2CA99C9FE7F6F4981279E2A8A535976000003000000000000000000000000",
        "version": "3.0",
        "filename": "wdsmgfw.efi",
        "guid": "{c999cac2-7ffe-496f-2781-9e2a8a535976} == EFI_WDSMGR_DBXSVN_GUID",
        "description": "Windows wdsmgfw SVN CVE-2023-24932",
        "dateOfLastChange": "2024-04-01"
    }

Expected Behavior

This would be the correct textual representation of the GUID's

"svns": [
	{
        "value": "01612B139DD5598843AB1C185C3CB2EB92000007000000000000000000000000",
        "version": "7.0",
        "filename": "bootmgfw.efi",
        "guid": "{9d132b61-59d5-4388-ab1c-185c3cb2eb92} == EFI_BOOTMGR_DBXSVN_GUID",
        "description": "Windows Bootmgr SVN CVE-2023-24932",
        "dateOfLastChange": "2025-06-06"
    },
	{
        "value": "019D2EF8E827E15841A4884C18ABE2F284000003000000000000000000000000",
        "version": "3.0",
        "filename": "cdboot.efi",
        "guid": "{e8f82e9d-e127-4158-a488-4c18abe2f284} == EFI_CDBOOT_DBXSVN_GUID",
        "description": "Windows cdboot SVN CVE-2023-24932",
        "dateOfLastChange": "2024-04-01"
    },
	{
        "value": "01C2CA99C9FE7F6F4981279E2A8A535976000003000000000000000000000000",
        "version": "3.0",
        "filename": "wdsmgfw.efi",
        "guid": "{c999cac2-7ffe-496f-8127-9e2a8a535976} == EFI_WDSMGR_DBXSVN_GUID",
        "description": "Windows wdsmgfw SVN CVE-2023-24932",
        "dateOfLastChange": "2024-04-01"
    }

Steps To Reproduce

Documentation issue

Build Environment

Documentation issue

Version Information

Latest

Urgency

Low

Are you going to fix this?

Someone else needs to fix it

Do you need maintainer feedback?

No maintainer feedback needed

Anything else?

This applies also to the archived CSV versions of
https://github.com/microsoft/secureboot_objects/blob/main/Archived/dbx_info_msft_4_09_24_svns.csv

[cjee21]

Ya it should be "9d132b61-59d5-4388-ab1c-185c3cb2eb92" with "ab1c" instead of "1cab".

The following code actually produces the correct GUID from the raw data:

secureboot_objects/scripts/utility_functions.py

Line 107 in 80afccf

application_guid = UUID(bytes_le=data[1:17])

---

The JSON schema at https://github.com/microsoft/secureboot_objects/blob/main/PreSignedObjects/DBX/HashesJsonSchema.json does not seem to match the actual JSON content as well, causing validation errors.

UPDATE: Submitted a PR to fix the schema.

[PatrickDittrich]

Caution, your mixing things up. SVN_OWNER_GUID in the python script has the correct textual representation. It looks just very similar to the DBXSVN of the bootmgr (last byte of first segment and third byte of the last segment are not identical with the owner GUID for the SVN data).

    // Signature owner Microsoft
    const string EFI_GUID_MICROSOFT = "{77fa9abd-0359-4d32-bd60-28f4e78f784b}";
    // Signature owner Microsoft for revocation by version number in dbx
    const string EFI_GUID_MICROSOFT_SVN = "{9d132b6c-59d5-4388-ab1c-185cfcb2eb92}";

    // DBXSVN (bytes[1..16] from revoked "hash")
    const string EFI_BOOTMGR_DBXSVN_GUID = "{9d132b61-59d5-4388-ab1c-185c3cb2eb92}";
    const string EFI_CDBOOT_DBXSVN_GUID = "{e8f82e9d-e127-4158-a488-4c18abe2f284}";
    const string EFI_WDSMGR_DBXSVN_GUID = "{c999cac2-7ffe-496f-8127-9e2a8a535976}";

[cjee21]

Oops, I looked too quickly and missed that. Corrected.

[PatrickDittrich]

The other two GUIDs (cdboot and wdsmgr) are still wrong. Please reopen this issue.