AwesomeREA.org

Tool

efiSeek

Ghidra analyzer extension from Digital Security for individual UEFI modules, enabled by default during auto-analysis of x86 and x64 PE images with an EFI subsystem. It labels known GUIDs from a bundled database, applies UEFI types from bundled data-type archives, passes the image handle and system table from the entry point into called functions, and marks protocols located with LocateProtocol or installed with InstallProtocolInterface, protocol-notify callbacks and SMI handlers registered for software, hardware and child interrupts. Findings are also kept as JSON in the program, which a headless-mode script uses to sort SMM modules into project folders by handler type.

Requirements & limits

  • The repository has no releases or tags; the latest master commit, from 2022-04-26, adds compatibility with a Ghidra 10.2 development build. Open issues report that the pinned Gradle 7.4.2 wrapper does not work with Ghidra 11.2 and newer and that a PE header API change in Ghidra 12.0 causes errors; the pull requests proposing fixes were unmerged at review, so building for current Ghidra releases may need those or similar changes.
  • Built from source with the bundled Gradle wrapper against a Ghidra installation named by GHIDRA_INSTALL_DIR; the build fetches the org.json library from Maven Central. The README then has the zip from dist copied into Ghidra's Extensions/Ghidra folder and the extension enabled, after which the analyzer is preselected when an EFI file is opened.
  • Input is a single UEFI module the analyst already has: the analyzer accepts only PE images with an EFI subsystem and only the x86 and x64 machine types, so modules must first be taken out of a full firmware image. It rebases the program to 0x80000000 and makes every memory block readable, writable and executable.
  • Apache-2.0, per LICENSE and the source headers. The repository bundles the Behemotx32.gdt and Behemotx64.gdt data-type archives and the guids-db.ini GUID database that the analyzer loads, plus the Gradle wrapper JAR. Labels and handler classifications are heuristic annotations for analyst review; no firmware was analyzed and nothing was built.

About this entry

Type
Tool
Category
Firmware tools
Relationship
Foundation tool
Targets
Firmware

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · DSecurity/efiSeek · Revision 573f4b9
  2. src/main/java/efiSeek/EfiSeekAnalyzer.java GitHub · DSecurity/efiSeek · Revision 573f4b9
  3. src/main/java/efiSeek/EfiSeek.java GitHub · DSecurity/efiSeek · Revision 573f4b9
  4. ghidra_scripts/TransferEfiFilesToProject.java GitHub · DSecurity/efiSeek · Revision 573f4b9
  5. build.gradle GitHub · DSecurity/efiSeek · Revision 573f4b9
  6. gradle/wrapper/gradle-wrapper.properties GitHub · DSecurity/efiSeek · Revision 573f4b9
  7. LICENSE GitHub · DSecurity/efiSeek · Revision 573f4b9
  8. https://github.com/DSecurity/efiSeek/commit/573f4b9b5ba2731cdecafc6594d0fd0570e28fff
  9. https://github.com/DSecurity/efiSeek/issues/15
  10. https://github.com/DSecurity/efiSeek/pull/18

More in Firmware and hardware

All 42 entries in Firmware and hardware