UEFI_RETool | A Tool For UEFI Firmware Reverse Engineering

image

A tool for UEFI firmware reverse engineering.

UEFI firmware analysis with uefi_retool.py script
Usage:

  • Copy ida_plugin/uefi_analyser.py script and ida_plugin/uefi_analyser directory to IDA plugins directory
  • Edit config.json file
    • PE_DIR is a directory that contains all executable images from the UEFI firmware
    • DUMP_DIR is a directory that contains all components from the firmware filesystem
    • LOGS_DIR is a directory for logs
    • IDA_PATH and IDA64_PATH are paths to IDA Pro executable files
  • Run pip install -r requirements.txt
  • Run python uefi_retool.py command to display the help message

Commands

python uefi_retool.py
Usage: uefi_retool.py [OPTIONS] COMMAND [ARGS]...Options:  --help  Show this message and exit.Commands:  get-images  Get executable images from UEFI firmware.  get-info    Analyze the entire UEFI firmware.  get-pp      Get a list of proprietary protocols in the UEFI firmware.

get-images

python uefi_retool.py get-images --help
Usage: uefi_retool.py get-images [OPTIONS] FIRMWARE_PATH  Get executable images from UEFI firmware. Images are stored in "modules"  directory.Options:  --help  Show this message and exit.

Example:

python uefi_retool.py get-images test_fw/fw-tp-x1-carbon-5th.bin

get-info

python uefi_retool.py get-info --help
Usage: uefi_retool.py get-info [OPTIONS] FIRMWARE_PATH  Analyze the entire UEFI firmware. The analysis result is saved to .json  file.Options:  -w, --workers INTEGER  Number of workers (8 by default).  --help                 Show this message and exit.

Example:

python uefi_retool.py get-info -w 6 test_fw/fw-tp-x1-carbon-5th.bin

get-pp

python uefi_retool.py get-pp --help
Usage: uefi_retool.py get-pp [OPTIONS] FIRMWARE_PATH  Get a list of proprietary protocols in the UEFI firmware. The result is  saved to .json file.Options:  -w, --workers INTEGER  Number of workers (8 by default).  --help                 Show this message and exit.

Example:

python uefi_retool.py get-pp -w 6 test_fw/fw-tp-x1-carbon-5th.bin

Additional tools

  • tools/update_edk2_guids.py is a script that updates protocol GUIDs list from edk2 project

IDA plugin
IDA plugin for UEFI analysis

Analyser & Protocol explorer

Usage

  • Copy uefi_analyser and uefi_analyser.py to your %IDA_DIR%/plugins directory
  • Open the executable UEFI image in IDA and go to EditPluginsUEFI analyser (alternatively, you can use the key combination Ctrl+Alt+U )

Example

Before analysis

image

After analysis

image

Protocol explorer window

image

Dependency browser & Dependency graph

Usage

python uefi_retool.py get-info FIRMWARE_PATH
  • Load <LOGS_DIR>/<FIRMWARE_NAME>-all-info.json file to IDA ( FileUEFI_RETool... )

image

  • alternatively, you can use the key combination Ctrl+Alt+J )

Example

Dependency browser window

image

Dependency graph

image

Similar works

GitHub:

3 Likes