AwesomeREA.org

Tool

uefi_retool

Python command-line tool and IDA Pro plugin for UEFI firmware reverse engineering. uefi_retool.py unpacks a firmware image with uefi-firmware-parser, collects its executable modules and runs IDA in batch mode on each one, writing their boot-service calls and protocol GUIDs to JSON; a separate command lists protocols whose GUIDs are absent from its EDK2, AMI and vendor GUID tables as proprietary. Inside IDA the plugin applies EFI system-table types and names, lists protocols in an explorer window and, from the JSON, shows a dependency browser and graph across the firmware’s modules.

Targets
Firmware
Category
Firmware tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • The repository is archived. Its last commit (2024-12-28) only updates the README, the last code changes date from 2021-08-03, and the only tag, 1.2.0 from 2020-05-07, is eight commits older; there are no GitHub releases. The reviewed tree contains an IDA plugin only and no Ghidra component.
  • Needs a licensed IDA Pro with IDAPython and PyQt5: copy uefi_analyser.py and the uefi_analyser package into IDA’s plugins directory, then set the IDA and IDA64 executable paths and the module, dump and log directories in config.json, whose example points to IDA Pro 7.6 on Windows. The script uses Python with Click, colorama, terminaltables, tqdm and uefi-firmware-parser 1.8, installed from a tarball named in requirements.txt.
  • Input is a UEFI firmware image the user supplies; README examples name a ThinkPad X1 Carbon 5th-generation image that the repository does not include, and no firmware images are committed. The analyser recognizes x86 and x86-64 instruction patterns and chooses IDA or IDA64 from each image’s machine type. The bundled GUID tables come from EDK2 and EDK, from ida-efiutils for AMI, and from Dell, Lenovo and ASRock lists, and tools/update_edk2_guids.py refreshes the EDK2 table.
  • MIT license (2018–2021, yeggor). The repository has no tests or CI, and this review ran neither the script nor the plugin. Labels and dependency graphs come from GUID matching and instruction patterns, so they need analyst checking. The reviewed sources establish no REA or AI use.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · yeggor/uefi_retool · Revision be13abf
  2. ida_plugin/README.md GitHub · yeggor/uefi_retool · Revision be13abf
  3. uefi_retool.py GitHub · yeggor/uefi_retool · Revision be13abf
  4. config.json GitHub · yeggor/uefi_retool · Revision be13abf
  5. requirements.txt GitHub · yeggor/uefi_retool · Revision be13abf
  6. ida_plugin/uefi_analyser/analyser.py GitHub · yeggor/uefi_retool · Revision be13abf
  7. ida_plugin/uefi_analyser/log_pp_guids.py GitHub · yeggor/uefi_retool · Revision be13abf
  8. tools/get_efi_images.py GitHub · yeggor/uefi_retool · Revision be13abf
  9. ida_plugin/uefi_analyser/guids GitHub · yeggor/uefi_retool · Revision be13abf
  10. LICENSE GitHub · yeggor/uefi_retool · Revision be13abf

More in Firmware and hardware

All 47 entries in Firmware and hardware