efiXplorer – IDA plugin for UEFI firmware analysis and reverse engineering automation
Supported versions of Hex-Rays products: everytime we focus on last versions of IDA and Decompiler because we try to use most recent features from new SDK releases. That means we tested only on recent versions of Hex-Rays products and do not guarantee stable work on previous generations.
Why not IDApython: all code developed in C++ because it’s a more stable and performant way to support a complex plugin and get full power of most recent SDK’s features.
Supported Platforms: Windows, Linux and OSX.
efiXplorer core features
Features Summary Table
|Applying types for local variables||+||+|
|Report in JSON format||+||+|
Annotate Boot Services calls in assembly code automatically:
Identify available Runtime Services automatically
Annotate Runtime Services calls in assembly code automatically:
Identify available SMM services automatically
Annotate SMM Services calls in assembly code automatically:
Identify available PEI services automatically
Annotate PEI Services calls in assembly code automatically:
Identify available EFI Protocols automatically
Build the list of EFI Protocols firmware consumes and installs:
Identify known EFI GUIDs
Build the list of identified EFI GUIDs (including protocol names for known GUIDS):
Applying Types For Protocols Interfaces
This feature works only in conjunction with a HexRays decompiler. If you don’t have a HexRays decompiler, build
efiXplorer scans drivers for the following types of vulnerabilities:
- SMM callouts
- OOB Write via wrong
GetVariableusage (in PEI, DXE and SMM drivers)
At the end of the analysis, a chooser is displayed with the suspected vulnerabilities.
efiXplorer saves the report in JSON format.