[coreboot] BootGuard policy decoder?

[mr gadha]

Are there any known tools for decoding the BootGuard policy?

I’m new to coreboot but have a system that I was interested in investigating adding support for it.

The flash image has BootGuard signatures,  but at least some parts of the UEFI area of the flash are modifiable (variables, logo, etc).   I’m wondering if the DXE area is even protected at all…

Or does one just abandon any attempt as soon as a BootGuard header is seen?

Thanks!