I am currently trying to figure out just how remote attestation for a TPM works in combination with the PCR-values.
Is it true that the PCR values are only measured on system boot and cannot be changed until after we boot the computer once again?
For instance, let's assume I am starting up my computer and all of the PCR-values I am measuring are correct and safe. If my computer were to get infected with some virus after the boot process and while it is running, or if I were to change the source code of some applications while the computer is running, remote attestation would still display the "correct" values from the boot-process and I could essentially fake being a trusted platform?
Because as far as I understood, PCR-values are only measured at the boot-process and are not dynamically updated afterwards until we boot it again.