AwesomeREA.org

Tool

FwHunt Community Scanner (fwhunt-scan)

Binarly's Python scanner that checks UEFI firmware modules against FwHunt rules, the YAML detection format for known UEFI firmware vulnerabilities whose rules are kept in the separate fwhunt repository. Its rizin-based analyzer reports a PE or TE module's Boot, Runtime and PEI service calls, protocols, PPIs, GUIDs, NVRAM variables and SMI handlers, which rules combine with code patterns, strings and hex strings. The CLI analyzes or scans one module, or extracts the modules of a whole firmware image and scans them, and the same classes work as a Python library.

Requirements & limits

  • The repository has no GitHub releases or tags. The reviewed master commit, from 2025-05-02 and the latest at review, follows the setup.py bump to 2.3.8, the version uploaded to PyPI that day; a separate release branch publishes Docker images to GHCR tagged by commit.
  • Needs Python 3 (README: tested on 3.6 and above; CI runs on 3.9 to 3.13) with click, rzpipe 0.4.0, PyYAML and uefi_firmware, plus an installed rizin. The README names rizin v0.6.2, and the Dockerfile builds that release from source on a python:3.11 image; newer rizin releases were not checked. Passing an in-memory blob instead of a file path works only on Linux.
  • Input is a UEFI module or firmware image the user already has, plus FwHunt rule files; no rules are bundled, and the README's rules/ and test/fw.bin example paths are not in this repository. scan-firmware applies firmware-target rules to the whole image and module rules only to modules from the volumes their volume_guids name, unless --force applies them to every module; extract writes all found modules to a directory.
  • The only test checks GUID table lookups, and CI runs it after a flake8 syntax check. A scan reports, per rule and variant, whether a known pattern matched, printed as threat detected or not; no match does not show that a module is free of other vulnerabilities.
  • GPL-3.0: setup.py declares GPL-3.0 and source headers GPL-3.0+; the separate fwhunt rule repository is CC0-1.0. The reviewed sources state no REA use, and this collection did not install the scanner or analyze any firmware.

About this entry

Type
Tool
Category
Firmware tools
Relationship
Foundation tool
Targets
Firmware

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
  2. fwhunt_scan_analyzer.py GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
  3. fwhunt_scan/uefi_analyzer.py#L781-L820 GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
  4. fwhunt_scan/uefi_scanner.py GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
  5. requirements.txt GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
  6. setup.py GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
  7. Dockerfile GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
  8. .github/workflows/ci.yml GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
  9. fwhunt_scan/test_internal.py GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
  10. LICENSE GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
  11. https://pypi.org/project/fwhunt-scan/2.3.8/
  12. README.md GitHub · binarly-io/fwhunt · Revision a2e3be6

More in Firmware and hardware

All 42 entries in Firmware and hardware