amd-ucode-patch 1.1.0__tar.gz → 2.0.0__tar.gz

{amd_ucode_patch-1.1.0 → amd_ucode_patch-2.0.0}/.github/workflows/build.yml

@@ -18,10 +18,10 @@ jobs:
   
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -58,4 +58,4 @@ jobs:
         path: dist/
 
     - name: Publish distribution to PyPI
-      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1

{amd_ucode_patch-1.1.0 → amd_ucode_patch-2.0.0}/.github/workflows/codeql.yml

@@ -48,7 +48,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -58,7 +58,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
+      uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -86,6 +86,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
+      uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
       with:
         category: "/language:${{matrix.language}}"

{amd_ucode_patch-1.1.0 → amd_ucode_patch-2.0.0}/.github/workflows/scorecard.yml

@@ -19,12 +19,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
@@ -38,6 +38,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           sarif_file: results.sarif

{amd_ucode_patch-1.1.0 → amd_ucode_patch-2.0.0}/.gitignore

@@ -1,2 +1,3 @@
 # Python
 __pycache__/
+dist/

{amd_ucode_patch-1.1.0 → amd_ucode_patch-2.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: amd-ucode-patch
-Version: 1.1.0
+Version: 2.0.0
 Summary: A Python library for parsing and interpreting AMD microcode patch files
 Project-URL: Homepage, https://github.com/amd-zenith/amd-ucode-patch
 Project-URL: Repository, https://github.com/amd-zenith/amd-ucode-patch
@@ -23,7 +23,7 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: System :: Hardware
 Classifier: Topic :: Utilities
 Requires-Python: >=3.10
-Requires-Dist: amd-cpuid==1.0.1
+Requires-Dist: amd-cpuid==1.0.2
 Requires-Dist: pycryptodome==3.23.0
 Requires-Dist: rich==15.0.0
 Description-Content-Type: text/markdown
@@ -47,35 +47,24 @@ pip install amd-ucode-patch
 
 ## Command line tools
 
-Installing the package provides the following command line tools.
+Installing the package provides the following command line tools. Run any tool
+with `--help` for usage details.
 
-### `amd_ucode_patch_info`
-
-Inspect one or more AMD microcode patch files and print their header
-information as a table.
-
-```bash
-amd_ucode_patch_info <files...> [-f {text,md,csv}]
-```
-
-Arguments:
-
-- `files`: One or more patch files to inspect. Glob patterns (e.g. `*.bin` or `**/*.bin`) are expanded automatically.
-- `-f`, `--format`: Output format. One of:
-  - `text` (default): A table rendered for the terminal.
-  - `md`: A Markdown table.
-  - `csv`: Comma separated values.
-
-For every patch file the following fields are reported: file name, date, update revision, loader ID, processor revision, CPUID, family, model, stepping, autorun, encrypted and body size.
+| Tool                   | Description                                                                            |
+| ---------------------- | -------------------------------------------------------------------------------------- |
+| `amd_ucode_patch_info` | Inspect patch files and print their decoded fields as a table (text, Markdown or CSV). |
+| `amd_ucode_patch_sign` | Inspect, verify (`verify`) and re-sign (`resign`) patch signatures.                    |
 
 ## Library usage
 
 The package can also be used programmatically:
 
 ```python
-from amd_ucode_patch.parse import ucode_patch_parse
+from pathlib import Path
+from amd_ucode_patch.structures.patch import Patch
 
-patch = ucode_patch_parse("firmware.bin")
-print(patch.header.cpuid_str)
-print(patch.header.update_revision)
+patch = Patch.from_file(Path("firmware.bin"))
+print(patch.header.patch_level)                          # e.g. 0a000033
+print(f"{patch.header.data.cpuid.cpuid_signature:08X}")  # e.g. 00A00F00
+print(patch.name_canonical)                              # canonical filename
 ```

{amd_ucode_patch-1.1.0 → amd_ucode_patch-2.0.0}/README.md

@@ -17,35 +17,24 @@ pip install amd-ucode-patch
 
 ## Command line tools
 
-Installing the package provides the following command line tools.
+Installing the package provides the following command line tools. Run any tool
+with `--help` for usage details.
 
-### `amd_ucode_patch_info`
-
-Inspect one or more AMD microcode patch files and print their header
-information as a table.
-
-```bash
-amd_ucode_patch_info <files...> [-f {text,md,csv}]
-```
-
-Arguments:
-
-- `files`: One or more patch files to inspect. Glob patterns (e.g. `*.bin` or `**/*.bin`) are expanded automatically.
-- `-f`, `--format`: Output format. One of:
-  - `text` (default): A table rendered for the terminal.
-  - `md`: A Markdown table.
-  - `csv`: Comma separated values.
-
-For every patch file the following fields are reported: file name, date, update revision, loader ID, processor revision, CPUID, family, model, stepping, autorun, encrypted and body size.
+| Tool                   | Description                                                                            |
+| ---------------------- | -------------------------------------------------------------------------------------- |
+| `amd_ucode_patch_info` | Inspect patch files and print their decoded fields as a table (text, Markdown or CSV). |
+| `amd_ucode_patch_sign` | Inspect, verify (`verify`) and re-sign (`resign`) patch signatures.                    |
 
 ## Library usage
 
 The package can also be used programmatically:
 
 ```python
-from amd_ucode_patch.parse import ucode_patch_parse
+from pathlib import Path
+from amd_ucode_patch.structures.patch import Patch
 
-patch = ucode_patch_parse("firmware.bin")
-print(patch.header.cpuid_str)
-print(patch.header.update_revision)
+patch = Patch.from_file(Path("firmware.bin"))
+print(patch.header.patch_level)                          # e.g. 0a000033
+print(f"{patch.header.data.cpuid.cpuid_signature:08X}")  # e.g. 00A00F00
+print(patch.name_canonical)                              # canonical filename
 ```

{amd_ucode_patch-1.1.0 → amd_ucode_patch-2.0.0}/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["hatchling==1.31.0", "hatch-vcs==0.5.0"]
+requires = ["hatchling==1.32.0", "hatch-vcs==0.5.0"]
 build-backend = "hatchling.build"
 
 [project]
@@ -30,7 +30,7 @@ classifiers = [
     "Topic :: Utilities",
 ]
 dependencies = [
-  "amd-cpuid==1.0.1",
+  "amd-cpuid==1.0.2",
   "pycryptodome==3.23.0",
   "rich==15.0.0",
 ]
@@ -49,3 +49,7 @@ source = "vcs"
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/amd_ucode_patch"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]

amd_ucode_patch-2.0.0/src/amd_ucode_patch/cli/info.py

@@ -0,0 +1,192 @@
+#!/usr/bin/env python
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+"""
+A command line tool to print information about AMD uCode patch files.
+
+A format with no header-data model of its own still parses, with the fields
+only that format defines left empty.
+"""
+
+import argparse
+import csv
+import sys
+
+from rich import box
+from rich.console import Console
+from rich.table import Table
+
+from amd_ucode_patch.cli.banner import BANNER
+from amd_ucode_patch.cli.paths import expand_paths
+from amd_ucode_patch.structures.header_data import HeaderData
+from amd_ucode_patch.structures.patch import Patch
+
+#: Columns follow the order of the fields in the patch: the prologue, then the
+#: header data in offset order, then the signature block and the body header,
+#: with derived values shown next to the field they come from.
+COLS = ["File", "Date", "Patch level", "Loader ID", "Triads", "Init",
+        "Checksum", "CPUID", "Signed", "Encrypted", "Body PL", "Size"]
+
+#: Shown wherever a field is not defined by the patch's format.
+_NA = "-"
+
+
+def _field(data: HeaderData, name: str) -> object | None:
+    """A header-data field, or ``None`` when this format does not model it."""
+    return getattr(data, name, None)
+
+
+def _checksum_matches(data: HeaderData, raw: bytes) -> bool | None:
+    """
+    Whether the stored checksum matches the content it covers, or ``None`` when
+    this format has no checksum or the patch is too short to compute one.
+    """
+    stored = _field(data, "op_triad_checksum")
+    compute = getattr(data, "compute_op_triad_checksum", None)
+    if stored is None or compute is None:
+        return None
+    try:
+        return compute(raw) == stored
+    except ValueError:
+        return None
+
+
+def _row_fields(path, raw: bytes) -> tuple[tuple[str, ...], dict[str, str]]:
+    """
+    One table row for ``path``, filling what the patch's format supports, plus a
+    map of column -> "green"/"red" for the cells whose value is cross-checked.
+    """
+    patch = Patch.from_bytes(raw)
+    header = patch.header
+    data = header.data
+    body_header = patch.body.body_header
+
+    triads = _field(data, "op_triad_count")
+    # The same "run the patch on load" signal lives in the pre-Zen header data
+    # (``init_flag``) and in the Zen body header; show whichever one this format
+    # carries.
+    init = _field(data, "init_flag")
+    if init is None and body_header is not None:
+        init = body_header.init_flag
+    checksum = _field(data, "op_triad_checksum")
+    cpuid = _field(data, "cpuid")
+    pl_family = header.patch_level.family
+    # ``encrypted`` and the mirrored patch level live only in the body header.
+    encrypted = body_header.encrypted if body_header is not None else None
+    body_pl = body_header.patch_level if body_header is not None else None
+
+    cells = (
+        str(path),
+        str(header.date),
+        f"{header.patch_level} (fam {pl_family:#04x})",
+        str(header.loader_id),
+        str(triads) if triads is not None else _NA,
+        ("yes" if init else "no") if init is not None else _NA,
+        f"{checksum:08x}" if checksum is not None else _NA,
+        f"{cpuid.ucode_signature:04x} ({cpuid.description})"
+        if cpuid is not None else _NA,
+        "yes" if header.signature is not None else "no",
+        ("yes" if encrypted else "no") if encrypted is not None else _NA,
+        str(body_pl) if body_pl is not None else _NA,
+        str(len(raw)),
+    )
+
+    colours: dict[str, str] = {}
+    # Flag the known-malformed patch levels red; every other one is well-formed.
+    colours["Patch level"] = (
+        "red" if header.patch_level.is_anomalous else "green"
+    )
+    checksum_ok = _checksum_matches(data, raw)
+    if checksum_ok is not None:
+        colours["Checksum"] = "green" if checksum_ok else "red"
+    # Cross-check the patch level against the header's CPUID field. Newer patch
+    # levels pack the whole CPUID, so the whole signature is checked; older ones
+    # carry only the family, so just that is.
+    pl_cpuid = header.patch_level.cpuid
+    if cpuid is not None:
+        if pl_cpuid is not None:
+            matches = pl_cpuid.ucode_signature == cpuid.ucode_signature
+        else:
+            matches = pl_family == cpuid.family
+        colours["CPUID"] = "green" if matches else "red"
+    if body_pl is not None:
+        # The body header's patch level should mirror the header's.
+        matches = body_pl.value == header.patch_level.value
+        colours["Body PL"] = "green" if matches else "red"
+    return cells, colours
+
+
+def _rows(paths):
+    """
+    Build a row per readable patch, with its checksum verdict.
+
+    Diagnostics go to stderr so that piping the table or the CSV somewhere
+    yields only the data.
+    """
+    console = Console(stderr=True)
+    unmodelled = 0
+    for path in paths:
+        try:
+            raw = path.read_bytes()
+            cells, colours = _row_fields(path, raw)
+        except Exception as exc:                                   # noqa: BLE001
+            console.log(f"Error parsing {path}: {exc}")
+            continue
+        unmodelled += cells[COLS.index("Triads")] == _NA
+        yield cells, colours
+    if unmodelled:
+        console.log(f"{unmodelled} file(s): that format has no header-data "
+                    f"model of its own, so only shared fields are shown")
+
+
+def _apply_colours(cells: tuple[str, ...], colours: dict[str, str]) -> list[str]:
+    """Wrap each cross-checked cell in its verdict colour (green/red)."""
+    out = list(cells)
+    for column, colour in colours.items():
+        index = COLS.index(column)
+        out[index] = f"[{colour}]{out[index]}[/{colour}]"
+    return out
+
+
+def print_table(console: Console, paths, format):
+    table = Table(*COLS, box=format)
+    for cells, colours in _rows(paths):
+        table.add_row(*_apply_colours(cells, colours))
+    console.print(table)
+
+
+def print_csv(paths):
+    """
+    Write the rows as CSV to stdout.
+
+    Written with :mod:`csv` rather than through the console: cell values contain
+    commas (a processor description, for one), and machine-readable output
+    should carry neither console formatting nor the checksum colouring.
+    """
+    writer = csv.writer(sys.stdout, lineterminator="\n")
+    writer.writerow(COLS)
+    writer.writerows(cells for cells, _ in _rows(paths))
+
+
+def main():
+    console = Console()
+
+    parser = argparse.ArgumentParser(description="Inspect AMD microcode patch files.")
+    parser.add_argument("files", nargs="+", help="Patch files to inspect")
+    parser.add_argument("-f", "--format", choices=["text", "md", "csv"], default="text")
+    args = parser.parse_args()
+
+    if args.format != "csv":
+        console.print(BANNER, highlight=False)
+
+    paths = expand_paths(args.files)
+    if args.format == "text":
+        print_table(console, paths, box.HEAVY_HEAD)
+    elif args.format == "md":
+        print_table(console, paths, box.MARKDOWN)
+    elif args.format == "csv":
+        print_csv(paths)
+
+
+if __name__ == "__main__":
+    main()

{amd_ucode_patch-1.1.0 → amd_ucode_patch-2.0.0}/src/amd_ucode_patch/cli/sign.py

@@ -1,63 +1,66 @@
 #!/usr/bin/env python
 # SPDX-License-Identifier: GPL-2.0-or-later
-'''
-A command line tool to inspect, verify, sign and resign AMD uCode patches.
-'''
+
+"""
+A command line tool to verify and resign AMD uCode patch signatures.
+"""
 
 import sys
 import argparse
 from pathlib import Path
+
 from rich import box
 from rich.console import Console
 from rich.table import Table
+
+from amd_ucode_patch.cli.argtypes import parse_key, parse_modulus, parse_private
 from amd_ucode_patch.cli.banner import BANNER
-from amd_ucode_patch.parse import ucode_patch_parse
+from amd_ucode_patch.cli.paths import expand_paths
+from amd_ucode_patch.structures.patch import Patch
+from amd_ucode_patch.structures.signature_fam17plus import SignatureFam17Plus
 from amd_ucode_patch.utils.cmac import cmac_digest
 from amd_ucode_patch.utils.entrysign import produce_colliding_key
 from amd_ucode_patch.utils.rsa import montgomery_n_prime, sign_pkcs1_v15_payload
-from amd_ucode_patch.cli.paths import expand_paths
-from amd_ucode_patch.cli.argtypes import parse_key, parse_modulus, parse_private
-
 
 COLS = ["File", "Signed", "Digest", "Valid"]
 
 
-def _verify_row(path, key):
-    """Return the four display cells (File, Signed, Digest, Valid) for one patch."""
-    patch = ucode_patch_parse(path)
+def _verify_row(path: Path, key: bytes | None) -> tuple[str, ...]:
+    """The four display cells (File, Signed, Digest, Valid) for one patch."""
+    patch = Patch.from_bytes(path.read_bytes())
     signature = patch.header.signature
 
     if signature is None:
         return (str(path), "[yellow]no[/yellow]", "", "[dim]n/a[/dim]")
 
+    if not isinstance(signature, SignatureFam17Plus):
+        # A signature slot that is not the RSA block (family 0x16): present, but
+        # nothing to recover or verify.
+        return (str(path), "[green]yes[/green]", "[dim]not RSA[/dim]",
+                "[dim]n/a[/dim]")
+
     recovered = signature.recover_digest()
     digest = recovered.hex() if recovered is not None else "[red]<bad padding>[/red]"
 
     if key is None:
         return (str(path), "[green]yes[/green]", digest, "[dim]not checked[/dim]")
 
-    computed = cmac_digest(patch.body.to_bytes(), key)
-    verdict = recovered is not None and recovered == computed
-    valid = "[green]yes[/green]" if verdict else "[red]no[/red]"
+    verified = patch.signature_verifies(key)
+    valid = "[green]yes[/green]" if verified else "[red]no[/red]"
     return (str(path), "[green]yes[/green]", digest, valid)
 
 
-def verify(args, console):
-    """Process the ``verify`` command: print a signature table for each file."""
+def verify(args, console: Console) -> None:
+    """The ``verify`` command: print a signature table for each file."""
     table = Table(*COLS, box=box.HEAVY_HEAD)
     for path in expand_paths(args.files):
         try:
-            row = _verify_row(path, args.key)
-            table.add_row(*row)
-        except Exception as e:
-            console.log(f"Error reading {path}: {e}")
+            table.add_row(*_verify_row(path, args.key))
+        except Exception as exc:                                   # noqa: BLE001
+            console.log(f"Error reading {path}: {exc}")
     console.print(table)
 
 
-def _write_target(src: Path, output: Path | None) -> Path:
-    return output if output is not None else src
-
-
 def _resign_one(
     path: Path,
     key: bytes,
@@ -65,13 +68,17 @@ def _resign_one(
     modulus: bytes | None,
     output: Path | None,
 ) -> tuple[Path, str]:
-    patch = ucode_patch_parse(path)
+    """Resign one patch, returning where it was written and the signed digest."""
+    patch = Patch.from_bytes(path.read_bytes())
     signature = patch.header.signature
-    if signature is None:
-        raise ValueError("patch is unsigned (pre-Zen), cannot resign")
+    if not isinstance(signature, SignatureFam17Plus):
+        raise ValueError("patch has no RSA signature to resign")
 
     digest = cmac_digest(patch.body.to_bytes(), key)
     if private is None:
+        # No private key given.
+        # Forge a modulus that collides to the CMAC the
+        # loader expects, the way zentool does for the EntrySign exploit.
         target = cmac_digest(signature.modulus, key)
         new_modulus, new_private = produce_colliding_key(target, cmac_key=key)
     else:
@@ -82,16 +89,17 @@ def _resign_one(
     signature.check = montgomery_n_prime(new_modulus)
     signature.signature = sign_pkcs1_v15_payload(digest, new_modulus, new_private)
 
-    out_path = _write_target(path, output)
+    out_path = output if output is not None else path
     out_path.write_bytes(patch.to_bytes())
     return out_path, digest.hex()
 
 
-def resign(args, console) -> int:
+def resign(args, console: Console) -> int:
     """
-    Process the ``resign`` command: re-sign edited patches, in place by default.
-    Returns a process exit code (non-zero if any file failed or the arguments
-    were invalid).
+    The ``resign`` command: re-sign edited patches, in place by default.
+
+    Returns a process exit code, non-zero if any file failed or the arguments
+    were invalid.
     """
     if args.output is not None and len(args.files) != 1:
         console.log("Error: --output is only allowed with a single input file")
@@ -104,15 +112,11 @@ def resign(args, console) -> int:
     for path in expand_paths(args.files):
         try:
             target, digest = _resign_one(
-                path,
-                args.key,
-                args.private,
-                args.modulus,
-                args.output,
+                path, args.key, args.private, args.modulus, args.output
             )
             console.print(f"[green]resigned[/green] {target} digest={digest}")
-        except Exception as e:
-            console.log(f"Error resigning {path}: {e}")
+        except Exception as exc:                                   # noqa: BLE001
+            console.log(f"Error resigning {path}: {exc}")
             exit_code = 1
     return exit_code
 
@@ -125,16 +129,15 @@ def main():
         description="Inspect, verify, sign and resign AMD microcode patch signatures.",
         epilog="The published Zen 1-4 CMAC key is 2b7e151628aed2a6abf7158809cf4f3c.",
     )
-
     subparsers = parser.add_subparsers(dest="command")
 
-    verify_parser = subparsers.add_parser("verify", help="Inspect signatures and verify with -k when provided")
+    verify_parser = subparsers.add_parser("verify", help="Inspect signatures, and verify against the body with -k")
     verify_parser.add_argument("files", nargs="+", help="Patch files to inspect")
-    verify_parser.add_argument("-k", "--key", type=parse_key, default=None, help="AES-128 CMAC key as hex (32 hex chars); enables verification")
+    verify_parser.add_argument("-k", "--key", type=parse_key, default=None, help="AES-128 CMAC key as 32 hex chars. Enables body verification.")
 
     resign_parser = subparsers.add_parser("resign", help="Re-sign edited patches in-place (zentool-style)")
     resign_parser.add_argument("files", nargs="+", help="Patch files to resign")
-    resign_parser.add_argument("-k", "--key", type=parse_key, required=True, help="AES-128 CMAC key as hex (default: published Zen 1-4 key)")
+    resign_parser.add_argument("-k", "--key", type=parse_key, required=True, help="AES-128 CMAC key as 32 hex chars")
     resign_parser.add_argument("-d", "--private", type=parse_private, default=None, help="RSA private exponent as 512 hex chars (256 bytes). Optional.")
     resign_parser.add_argument("-m", "--modulus", type=parse_modulus, default=None, help="RSA modulus as 512 hex chars (256 bytes). Used with --private.")
     resign_parser.add_argument("-o", "--output", type=Path, default=None, help="Output file (single-input only). Defaults to in-place rewrite")
@@ -146,7 +149,7 @@ def main():
     elif args.command == "resign":
         sys.exit(resign(args, console))
     else:
-        console.log(f"Error: unknown command {args.command!r}")
+        parser.print_help()
 
 
 if __name__ == "__main__":

amd_ucode_patch-2.0.0/src/amd_ucode_patch/structures/body.py

@@ -0,0 +1,61 @@
+#!/usr/bin/env python
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+"""
+The patch body.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from amd_ucode_patch.structures.body_data import BodyData
+from amd_ucode_patch.structures.body_data_registry import body_data_from_bytes
+from amd_ucode_patch.structures.body_header import BodyHeader
+
+
+@dataclass
+class Body:
+    """
+    The patch body: an optional :class:`BodyHeader` followed by the
+    :class:`BodyData`.
+
+    The body header's ``encrypted`` flag selects the kind of body data: opaque
+    when set, plaintext (a modelling target) otherwise.
+    """
+
+    #: The body header, on formats that carry one; ``None`` otherwise.
+    body_header: BodyHeader | None
+    #: The contents past the header.
+    body_data: BodyData
+
+    @classmethod
+    def from_bytes(cls, data: bytes, family: int) -> "Body":
+        """
+        Parse the body from ``data``, which is the body and nothing else, using
+        the CPU ``family`` to pick the layout.
+
+        :class:`BodyHeader` decides whether ``family`` carries a body header; if
+        it does, it is split off the front. The remainder is handed to the body
+        data registry, which picks the opaque or plaintext class from the
+        header's ``encrypted`` flag. A body with no header is plaintext.
+        """
+        data = bytes(data)
+        body_header = BodyHeader.from_bytes(data, family)
+        remainder = data[BodyHeader.SIZE:] if body_header is not None else data
+        encrypted = body_header is not None and bool(body_header.encrypted)
+        body_data = body_data_from_bytes(encrypted, remainder)
+        return cls(
+            body_header=body_header,
+            body_data=body_data,
+        )
+
+    @property
+    def is_encrypted(self) -> bool:
+        """Whether the body data is encrypted (and so cannot be modelled)."""
+        return self.body_data.is_encrypted
+
+    def to_bytes(self) -> bytes:
+        """Serialize the body back to its exact byte encoding."""
+        prefix = self.body_header.to_bytes() if self.body_header is not None else b""
+        return prefix + self.body_data.to_bytes()

amd_ucode_patch-2.0.0/src/amd_ucode_patch/structures/body_data.py

@@ -0,0 +1,21 @@
+#!/usr/bin/env python
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+"""
+The common interface of the body data.
+"""
+
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+
+
+class BodyData(ABC):
+    """The contents of a body past its header, in whatever form the format uses."""
+
+    #: Whether the contents are encrypted (and so can only be raw bytes).
+    is_encrypted: bool
+
+    @abstractmethod
+    def to_bytes(self) -> bytes:
+        """Serialize the body data back to its exact byte encoding."""