Kali Linux

efiXplorer : IDA Plugin For UEFI Firmware Analysis And Reverse Engineering Automation

efiXplorer – IDA plugin for UEFI firmware analysis and reverse engineering automation

Supported versions of Hex-Rays products: everytime we focus on last versions of IDA and Decompiler because we try to use most recent features from new SDK releases. That means we tested only on recent versions of Hex-Rays products and do not guarantee stable work on previous generations.

Why not IDApython: all code developed in C++ because it’s a more stable and performant way to support a complex plugin and get full power of most recent SDK’s features.

Supported Platforms: Windows, Linux and OSX.

efiXplorer core features

Features Summary Table

Feature name32-bit64-bit
Boot Services++
Runtime Services++
SMM services+
PEI Services+
Protocols++
GUIDS++
Applying types for local variables++
Vulnerabilities scanner++
Report in JSON format++
Loader+
Dependency graph+

Identify available Boot Services automatically

Annotate Boot Services calls in assembly code automatically:

Identify available Runtime Services automatically

Annotate Runtime Services calls in assembly code automatically:

Identify available SMM services automatically

Annotate SMM Services calls in assembly code automatically:

Identify available PEI services automatically

Annotate PEI Services calls in assembly code automatically:

Identify available EFI Protocols automatically

Build the list of EFI Protocols firmware consumes and installs:

Identify known EFI GUIDs

Build the list of identified EFI GUIDs (including protocol names for known GUIDS):

Applying Types For Protocols Interfaces

This feature works only in conjunction with a HexRays decompiler. If you don’t have a HexRays decompiler, build efiXplorer without hexrays_sdk.

Vulnerabilities Scanner

efiXplorer scans drivers for the following types of vulnerabilities:

  • SMM callouts
  • OOB Write via wrong GetVariable usage (in PEI, DXE and SMM drivers)

At the end of the analysis, a chooser is displayed with the suspected vulnerabilities.

Report in JSON format

After analysis efiXplorer saves the report in JSON format.

R K

Recent Posts

Bash Arrays Explained Simply: Beginner’s Guide with Examples

If you’re learning Bash scripting, one of the most useful features you’ll come across is…

16 hours ago

Bash For Loop Examples Explained Simply for Beginners

If you are new to Bash scripting or Linux shell scripting, one of the most…

1 day ago

How Does a Firewall Work Step by Step

How Does a Firewall Work Step by Step? What Is a Firewall and How Does…

3 days ago

ROADTools: The Modern Azure AD Exploration Framework

ROADTools is a powerful framework designed for exploring and interacting with Microsoft Azure Active Directory…

6 days ago

How to Enumerate Microsoft 365 Groups Using PowerShell and Python

Microsoft 365 Groups (also known as M365 Groups or Unified Groups) are at the heart…

6 days ago

SeamlessPass: Using Kerberos Tickets to Access Microsoft 365

SeamlessPass is a specialized tool designed to leverage on-premises Active Directory Kerberos tickets to obtain…

7 days ago