Tspi_TPM_GetEvents Events in the TCS event log are 0 indexed. So, a call such as: UINT32 five = 5; Tspi_TPM_GetEvents(hTPM, ulPcrIndex, 1, &five, &prgbPcrEvents); will get you 5 events (assuming at least 6 events have happened on the PCR) which will be the 2nd through 6th events on the PCR. (Since the 1st event is at index 0). This is probably what you want: UINT32 five = 5; Tspi_TPM_GetEvents(hTPM, ulPcrIndex, 0, &five, &prgbPcrEvents); |