1. System Requirment:
    1.1. Microsoft Windows 7 or later.

2. Usage:
For Signing Secure Image with a installed certificate
Usage: iEFIFlashSigner.exe sign [options]
        -n <NAME>*           Specify the Subject Name of the signing cert, or a 
                              substring.
        -nbg <NAME>          Specify the Subject Name for BIOS Guard signing. Support RSA 2048 and RSA 3072 key.
                              Tool will sign secure capsule with the subject name input from -n and sign BIOS Guard
                               update block with this subject name.
                              Without this command, tool will sign secure capsule and BIOS Guard update block with the
                               subject name input from -n.
        -t <URL>             Specify the timestamp server's URL. If this option is
                              not present, the signed file will not be timestamped.
                             A warning is generated if timestamping fails.
        -bios <FILE>*        Specify BIOS image for flash utility.
        -ini <FILE>*         Specify platform.ini for flash utility.
        -ec <FILE>           Specify EC image for flash utility.
        -me <FILE>           Specify Intel native ME image.
        -oemid <GUID>        Specify OEM ID GUID for Intel native ME update.
                             <GUID> format is "12345678-1234-1234-1234-123456789ABC".
        -ish <FILE>          Specify Intel integrated sensor hub image.
        -pdt <FILE>          Specify Intel platform descriptor table image.
        -opath <PATH>        Specify output path.(Default: .\isflash.bin)
                             Paths to a file or a folder are both acceptable.
        -capsuleheader       Add capsule header in front of signed capsule file.
        -guid <GUID>         Specify the GUID of capsule firmware.
                             When input image is BIOS with ESRT, this option can be
                              ignored.
                             Signer will get GUID from ESRT automatically.
                             <GUID> format is "12345678-1234-1234-1234-123456789ABC"
        -instant             Make capsule header's flag to 0 (Default: 0x00050000) 
        -signtool <PATH>     Specify the location of signtool.exe
        -securebiosguard     sign biosguard with capsule header.
        -sha512              sign bios by sha512 rather than sha256.

For Signing Secure Image with a cryptographic service provider
Usage: iEFIFlashSigner.exe sign [options]
        -f <PFX_FILE>*       Specify the signing cert in a file. If this file is a PFX
                              with a password, the password may be supplied with the
                              "-pass" option.
        ==== Using HSM (Requires Console Access as 'Admin') ====
        -f <FILE>*           Specify the signing certificate file.
        -c <CSPName>*        Specify the name of cryptographic service provider
        -k <PKContainer>*    Specify the name of private key container
        ========================================================
        -bios <FILE>*        Specify BIOS image for flash utility.
        -ini <FILE>*         Specify platform.ini for flash utility.
        -pass <pass1> [<pass2> <pass3>]
                             Specify passwords.
                             If 1 password is input, the tool always uses the same password.
                             If 3 password is input, the tool uses passwords one by one.
        -fbg <PFX_FILE>      Specify the signing certificate file for signing BIOS Guard binary.
        -cbg <CSPName>       Specify the name of cryptographic service provider for signing BIOS Guard binary.
        -kbg <PKContainer>   Specify the name of private key container for signing BIOS Guard binary.
        -pbg <PASSWORD>      Specify the password for signing BIOS Guard binary.
        -ec <FILE>           Specify EC image for flash utility.
        -me <FILE>           Specify Intel native ME image.
        -oemid <GUID>        Specify OEM ID GUID for Intel native ME update.
                             <GUID> format is "12345678-1234-1234-1234-123456789ABC".
        -ish <FILE>          Specify Intel integrated sensor hub image.
        -pdt <FILE>          Specify Intel platform descriptor table image.
        -opath <PATH>        Specify output path.(Default: .\isflash.bin)
                              Paths to a file or a folder are both acceptable.
        -capsuleheader       Add capsule header in front of signed capsule file.
        -guid <GUID>         Specify the GUID of capsule firmware.
                             When input image is BIOS with ESRT, this option can be
                              ignored.
                             Signer will get GUID from ESRT automatically.
                             <GUID> format is "12345678-1234-1234-1234-123456789ABC"
        -instant             Make capsule header's flag to 0 (Default: 0x00050000) 
        -signtool <PATH>     Specify the location of signtool.exe
        -securebiosguard     sign biosguard with capsule header.
        -sha512              sign bios by sha512 rather than sha256.

For Signing Shell Flash Utility
Usage: iEFIFlashSigner.exe signefi [options]
        -in <FILE>*          Specify flash utility for signing.
        -n <NAME>*           Specify the Subject Name of the signing cert, or a 
                              substring.
        -f <PFX_FILE>        Specify the signing cert in a file. If this file is a PFX
                              with a password, the password may be supplied with the
                              "-pass" option.
        -pass <PASSWORD>     Specify a password to use when opening the PFX file.
        -t <URL>             Specify the timestamp server's URL. If this option is
                              not present, the signed file will not be timestamped.
                             A warning is generated if timestamping fails.

For Signing Logo File
Usage: iEFIFlashSigner.exe signlogo [options]
        -in <FILE>*          Specify flash utility for signing.
        -n <NAME>*           Specify the Subject Name of the signing cert, or a 
                              substring.
        -f <PFX_FILE>        Specify the signing cert in a file. If this file is a PFX
                              with a password, the password may be supplied with the
                              "-pass" option.
        -pass <PASSWORD>     Specify a password to use when opening the PFX file.
        -t <URL>             Specify the timestamp server's URL. If this option is
                              not present, the signed file will not be timestamped.
                             A warning is generated if timestamping fails.

For backup unsigned firmware volume
Usage: iEFIFlashSigner.exe backup [options]
        -bios <FILE>*        Specify BIOS image for flash utility.
        -opath <PATH>        Specify BIOS output path.(Default: .\isflash.bin)
        -bkfv <PATH>         Specify FV output path.(Default: .\BackupFv.bin)

For restore unsigned firmware volume
Usage: iEFIFlashSigner.exe restore [options]
        -bios <FILE>*        Specify BIOS image for flash utility.
        -opath <PATH>        Specify BIOS output path.(Default: .\isflash.bin)
        -bkfv <PATH>*        Specify FV output path for flash utility.

For only pack secure capsule
Usage: iEFIFlashSigner.exe pack [options]
  First Stage
        -bios <FILE>*        Specify BIOS image for flash utility.
        -ini <FILE>*         Specify platform.ini for flash utility.
        -ec <FILE>           Specify EC image for flash utility.
        -p7 <FILE>*          Specify PKCS #7 file for flash utility.
        -opath <PATH>        Specify output path.(Default: .\isflash.bin)
  Second Stage
        -drv2app <FILE>*     Specify Signed efi driver for flash utility.
        -opath <PATH>        Specify output path.(Default: .\isflash.bin)

For add capsule header
Usage: iEFIFlashSigner.exe capsuleheader [options]
        -bios <FILE>*        Specify BIOS image.
        -opath <PATH>        Specify output path. Default: program directory(.\).
        -guid <GUID>         Specify the GUID of capsule firmware.
                             When input image is BIOS with ESRT, this option can be
                              ignored.
                             Signer will get GUID from ESRT automatically.
                             <GUID> format is "12345678-1234-1234-1234-123456789ABC"
        -instant             Make capsule header's flag to 0 (Default: 0x00050000) 

For Signing Intel native ME only
Usage: iEFIFlashSigner.exe signbin [options]
        -n <NAME>*           Specify the Subject Name of the signing cert, or a
                             substring.
        -sha1 <HASH>         Specify the SHA1 thumbprint of the signing cert.
                             When there are two keys (or more) have the same Subject
                              Name, you can use this option to identify which key you
                              want to use.
        -f <PFX_FILE>        Specify the signing cert in a file. If this file is a PFX
                              with a password, the password may be supplied with the
                              "-pass" option.
        -pass <PASSWORD>     Specify a password to use when opening the PFX file.
        -t <URL>             Specify the timestamp server's URL. If this option is not
                              present, the signed file will not be timestamped.
                             A warning is generated if timestamping fails.
        -ini <FILE>          Specify platform.ini.
        -me <FILE>*          Specify Intel native ME image.
        -oemid <GUID>        Specify OEM ID GUID for Intel native ME update.
                             <GUID> format is "12345678-1234-1234-1234-123456789ABC".
        -opath <PATH>        Specify output path. Default: program directory(.\).
        -x32                 Use 32bit template.

For Signing Intel Firmware (ISH/PDT) only
Usage: iEFIFlashSigner.exe signbin [options]
        -n <NAME>*           Specify the Subject Name of the signing cert, or a
                             substring.
        -sha1 <HASH>         Specify the SHA1 thumbprint of the signing cert.
                             When there are two keys (or more) have the same Subject
                              Name, you can use this option to identify which key you
                              want to use.
        -f <PFX_FILE>        Specify the signing cert in a file. If this file is a PFX
                              with a password, the password may be supplied with the
                              "-pass" option.
        -pass <PASSWORD>     Specify a password to use when opening the PFX file.
        -t <URL>             Specify the timestamp server's URL. If this option is not
                              present, the signed file will not be timestamped.
                             A warning is generated if timestamping fails.
        -ini <FILE>          Specify platform.ini.
        -ish <FILE>*         Specify Intel integrated sensor hub image.
        -pdt <FILE>*         Specify Intel platform descriptor table image.
        -opath <PATH>        Specify output path. Default: program directory(.\).
        -x32                 Use 32bit template.

For Signing Intel Retimer only
Usage: iEFIFlashSigner.exe signbin [options]
        -n <NAME>*           Specify the Subject Name of the signing cert, or a
                              substring.
        -sha1 <HASH>         Specify the SHA1 thumbprint of the signing cert.
                             When there are two keys (or more) have the same Subject
                              Name, you can use this option to identify which key you
                              want to use.
        -f <PFX_FILE>        Specify the signing cert in a file. If this file is a PFX
                              with a password, the password may be supplied with the
                              "-pass" option.
        -pass <PASSWORD>     Specify a password to use when opening the PFX file.
        -t <URL>             Specify the timestamp server's URL. If this option is not
                              present, the signed file will not be timestamped.
                             A warning is generated if timestamping fails.
        -ini <FILE>          Specify platform.ini.
        -retimer <FILE>*     Specify Intel Retimer image.
        -ver <VALUE>*        Specify Intel Retimer version. Start from 1, value range 1 ~ 65535.
        -funcnum <HEX>       Specify Intel Retimer function number, value range 00h ~ FFh.
        -opath <PATH>        Specify output path. Default: program directory(.\).
        -x32                 Use 32bit template.

For Signing Intel Microcode Firmware only
Usage: iEFIFlashSigner.exe signbin [options]
        -n <NAME>*           Specify the Subject Name of the signing cert, or a
                              substring.
        -sha1 <HASH>         Specify the SHA1 thumbprint of the signing cert.
                             When there are two keys (or more) have the same Subject
                              Name, you can use this option to identify which key you
                              want to use.
        -f <PFX_FILE>        Specify the signing cert in a file. If this file is a PFX
                              with a password, the password may be supplied with the
                              "-pass" option.
        -pass <PASSWORD>     Specify a password to use when opening the PFX file.
        -t <URL>             Specify the timestamp server's URL. If this option is not
                              present, the signed file will not be timestamped.
                             A warning is generated if timestamping fails.
        -ini <FILE>          Specify platform.ini.
        -microcode* <FILE>   Specify Intel microcode image.
        -opath <PATH>        Specify output path. Default: program directory(.\).
        -x32                 Use 32bit template.


3. Output file name:
    isflash.bin

4. Example:
Sign bios image only:
    iEFIFlashSigner.exe sign -n "QA Certificate." -bios BIOS.fd -ini platform.ini
    iEFIFlashSigner.exe sign -f "QA.pfx" -bios BIOS.fd -ini platform.ini

Sign bios and EC image:
    iEFIFlashSigner.exe sign -n "QA Certificate." -bios BIOS.fd -ini platform.ini -ec EC.rom
    iEFIFlashSigner.exe sign -f "QA.pfx" -bios BIOS.fd -ini platform.ini -ec EC.rom

Sign PFAT bios image only:
    iEFIFlashSigner.exe sign -n "QA Certificate." -bios BIOS.fd -securebiosguard
    iEFIFlashSigner.exe sign -f "QA.pfx" -bios BIOS.fd -securebiosguard
	
Sign bios image with cryptographic service provider:
	iEFIFlashSigner.exe sign -f "signing certificate file" -c "cryptographic service provider" 
	-k "private key container" -bios BIOS.fd -ini platform.ini -pass "password1" "password2" "password3"
	
Sign shell flash utility:
    iEFIFlashSigner.exe signefi -n "QA Certificate." -in isflashx64.efi
    iEFIFlashSigner.exe signefi -f "QA.pfx" -in isflashx64.efi
	
5. A possible issue with signtool.exe.
If some warning messages as the following are displayed after the tool's execution,
you could remove signtool.exe, mssign32.dll and wintrust.dll from the tool's folder,
and add the path of the signtool.exe installed in your Windows to "path" in environment variables.
Then, the tool would call the signtool.exe installed in your Windows.
	=========================== warning message ================================
	This application has requested the Runtime to terminate it in an unusual way.
	Please contact the application's support team for more information.
	============================================================================
