UEFI platform config — recovered from uefi.elf

uefi.elf (UEFI DXE, plaintext) embeds the platform config file (uefiplatLA.cfg / uefiplat.cfg) used by UefiPlatCfg.c at boot. Reproduced below, truncated to the security-relevant keys.

Key values (build F956BXXS4DZI1)

[Config]
Version = 3
MaxMemoryRegions = 74
PlatConfigFileName = "uefiplatLA.cfg"
OsTypeString = "LA"
EnableShell = 0x1                          # UEFI shell present
## Security flag ##
SecurityFlag = 0xC4
# SecBootEnableFlag = 0x1          i.e. 0b00000001
# TreeTpmEnableFlag = 0x2
# CommonMbnLoadFlag = 0x4
# DxHdcp2LoadFlag = 0x8
# VariableServicesFlag = 0x10
# WinsecappFlag = 0x20
# LoadSecAppFlag = 0x40
# LoadKeymasterFlag = 0x80
# EnableQseeLogsFlag = 0x100
## Default app to boot in platform BDS init
DefaultChargerApp = "QcomChargerApp"
DefaultBDSBootApp = "LinuxLoader"
## Enable HotKey detection in RETAIL devices
DetectRetailUserAttentionHotkey = 0x00     # off; code 0x17 = SCAN_ESC -> UEFI Setup
DetectRetailUserAttentionHotkeyCode = 0x17
## Enable OEM Setup App launch in Retail ##
EnableOEMSetupAppInRetail = 0x0            # off; the launch path exists
## LogFs partition
EnableLogFsSyncInRetail = 0x0
EnableUefiSecAppDebugLogDump = 0x0
## Allow Non Persistent Varialbes in Retail ##
AllowNonPersistentVarsInRetail = 0x1       # volatile SetVariable allowed in retail
## Enable/Disable Variable Policy Engine ##
EnableVariablePolicyEngine = 0             # DISABLED
EnableACPIFallback = 0x0

Interpretation

• SecurityFlag = 0xC4 = 0b11000100: CommonMbnLoad(0x4) + LoadSecApp(0x40) + LoadKeymaster(0x80). SecBootEnableFlag (0x1) is clear and VariableServicesFlag (0x10) is clear in the UEFI-level flags.
• EnableVariablePolicyEngine = 0 — matches the runtime flag found in uefisecapp: the variable-policy gate byte (0x1f114 in the loaded image) initializes to 0x00 and is never written, so TzVariablePolicyCheck always short-circuits to success. The variable policy engine is off on this firmware — at two independent levels.
• AllowNonPersistentVarsInRetail = 1 — volatile variables can be set during boot without persistence.
• EnableShell = 1 and the hotkey (ESC → UEFI Setup) mechanism are compiled in but disabled for retail.
• No runtime override of these keys was found in the uefivarstore partition dump — the config is compile-time fixed for this build.
• The config key strings have no direct code xrefs (neither ADRP nor literal-pool), suggesting Qualcomm's parser matches keys by hash — needs decompiler analysis.

Why this matters

The published SM8850 chain (see references.md) unlocked a Snapdragon 8 Elite Gen 5 by exploiting exactly this class of misconfiguration: a boot-chain path that loads an EFI image without authenticating the caller/authorization. A disabled variable-policy engine + allowed non-persistent variables + an unauthenticated loading path is the same precondition set. Whether an attacker-feedable load path exists on this build is the open question Track D is chasing.