Module hook 

Block IO hooking engine.

See docs/architecture.md “Block IO 후킹 메커니즘”. The engine:

1. enumerates Block IO devices via LocateHandleBuffer(EFI_BLOCK_IO_PROTOCOL),
2. matches the target partition by GPT partition GUID,
3. saves the original ReadBlocks / WriteBlocks function pointers and replaces the protocol vtable entries with our hooks,
4. on a hooked read, decrypts after the original fills the buffer; on a hooked write, encrypts a copy of the plaintext before forwarding.

Hooked-read decision (all comparisons are in data-region relative sectors):

lba in metadata region        -> original read, passthrough (plaintext)
rel = lba - offset_sector
rel <  encrypted_offset.sector -> original read, then AES-XTS decrypt
rel >= encrypted_offset.sector -> original read, passthrough (plaintext)

Hooked-write decision (symmetric):

lba in metadata region        -> passthrough to original write (plaintext)
rel = lba - offset_sector
rel <  encrypted_offset.sector -> encrypt a copy, then original write
rel >= encrypted_offset.sector -> passthrough to original write (plaintext)

Modules

block_io

EFI_BLOCK_IO_PROTOCOL hooking (ReadBlocks + WriteBlocks).

block_io2

EFI_BLOCK_IO2_PROTOCOL hooking (ReadBlocksEx).

Structs

BlockIoHookEngine

Installs and removes Block IO read/write hooks for the target volume, and holds the cipher supplier used by the hooked paths.