AwesomeREA.org

Tool

efiXplorer

IDA Pro plugin and loader that automate static analysis of UEFI firmware. The plugin annotates Boot, Runtime, SMM and PEI service calls, lists the EFI protocols and known GUIDs a module installs or consumes, applies protocol interface types in the Hex-Rays decompiler, flags suspected SMM callout and GetVariable out-of-bounds write patterns for review and saves a JSON report. The efiXloader module opens a whole firmware image in one IDA database, with driver entry points, navigation between drivers and a DXE driver dependency graph.

Requirements and limitations

  • Latest release at review: v6.3.0, published 2026-08-20 as a zip of prebuilt binaries; the reviewed master commit is two GUID-database submodule updates ahead. ida-plugin.json declares IDA 8.3 or newer on Windows x86_64, Linux x86_64 and macOS x86_64/aarch64; the plugin is listed in Hex-Rays' plugin repository and can be installed with ida-hcli.
  • Needs a licensed IDA Pro. Applying protocol interface types also needs the Hex-Rays decompiler, and the build instructions cover building without it. Source builds use CMake or build.py against the IDA SDK, UEFITool and GUID database submodules; a manual install copies the plugin and the guids directory into IDA's plugins folder and the loader into its loaders folder.
  • Input is a UEFI firmware image or individual UEFI driver the analyst already has. The wiki's feature table lists SMM services and the dependency graph for 64-bit modules only and PEI services for 32-bit only. Its loader page still says only 64-bit drivers are supported, while the v6.3.0 notes add 32-bit modules in the loader, and the wiki pages still link the earlier binarly-io repository.
  • GPL-3.0; ida-plugin.json declares GPL-3.0-only. Vulnerability-scanner hits are suspected findings presented for analyst review, not confirmed bugs; the authors' Black Hat Europe 2020 and EKO 2020 publications describe the approach. No firmware was analyzed.

About this entry

Type
Tool
Category
Firmware tools
Relationship
Foundation tool
Targets
Firmware

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · REhints/efiXplorer · Revision 9e3b40a
  2. ida-plugin.json GitHub · REhints/efiXplorer · Revision 9e3b40a
  3. .gitmodules GitHub · REhints/efiXplorer · Revision 9e3b40a
  4. LICENSE GitHub · REhints/efiXplorer · Revision 9e3b40a
  5. https://github.com/REhints/efiXplorer/wiki/efiXplorer-features/7ce26a454a0585c3c17785b61c28633123eae6f6
  6. https://github.com/REhints/efiXplorer/wiki/efiXloader/7ce26a454a0585c3c17785b61c28633123eae6f6
  7. https://github.com/REhints/efiXplorer/wiki/Build-instruction-and-installation/7ce26a454a0585c3c17785b61c28633123eae6f6
  8. https://github.com/REhints/efiXplorer/releases/tag/v6.3.0
  9. https://plugins.hex-rays.com/binarly-io/efixplorer
  10. https://i.blackhat.com/eu-20/Wednesday/eu-20-Labunets-efiXplorer-Hunting-For-UEFI-Firmware-Vulnerabilities-At-Scale-With-Automated-Static-Analysis.pdf