UEFI_RETool is a tool for UEFI firmware reverse engineering.
UEFI firmware analysis with uefi_retool.py script
Usage
- Copy
ida_plugin/uefi_analyser.py
script andida_plugin/uefi_analyser
directory to IDA plugins directory - Edit
config.json
filePE_DIR
is a directory that contains all executable images from the UEFI firmwareDUMP_DIR
is a directory that contains all components from the firmware filesystemLOGS_DIR
is a directory for logsIDA_PATH
andIDA64_PATH
are paths to IDA Pro executable files
- Run
pip install -r requirements.txt
- Run
python uefi_retool.py
command to display the help message
Commands
python uefi_retool.py
Usage: uefi_retool.py [OPTIONS] COMMAND [ARGS]…
Options:
–help Show this message and exit.
Commands:
get-images Get executable images from UEFI firmware.
get-info Analyze the entire UEFI firmware.
get-pp Get a list of proprietary protocols in the UEFI firmware.
Get-Images
python uefi_retool.py get-images –help
Usage: uefi_retool.py get-images [OPTIONS] FIRMWARE_PATH
Get executable images from UEFI firmware. Images are stored in “modules”
directory.
Options:
–help Show this message and exit.
Example
python uefi_retool.py get-images test_fw/fw-tp-x1-carbon-5th.bin
Get-Info
python uefi_retool.py get-info –help
Usage: uefi_retool.py get-info [OPTIONS] FIRMWARE_PATH
Analyze the entire UEFI firmware. The analysis result is saved to .json
file.
Options:
-w, –workers INTEGER Number of workers (8 by default).
–help Show this message and exit.
Example:
python uefi_retool.py get-info -w 6 test_fw/fw-tp-x1-carbon-5th.bin
Get-PP
python uefi_retool.py get-pp –help
Usage: uefi_retool.py get-pp [OPTIONS] FIRMWARE_PATH
Get a list of proprietary protocols in the UEFI firmware. The result is
saved to .json file.
Options:
-w, –workers INTEGER Number of workers (8 by default).
–help Show this message and exit.
Example:
python uefi_retool.py get-pp -w 6 test_fw/fw-tp-x1-carbon-5th.bin
Additional Tools
tools/update_edk2_guids.py
is a script that updates protocol GUIDs list fromedk2
project
IDA plugin
Analyser & Protocol explorer
Usage
- Copy
uefi_analyser
anduefi_analyser.py
to your%IDA_DIR%/plugins
directory - Open the executable UEFI image in IDA and go to
Edit
->Plugins
->UEFI analyser
(alternatively, you can use the key combinationCtrl+Alt+U
)
Example
- Before analysis
![](https://1.bp.blogspot.com/-xkMTPNsXB-0/Xy-tmRQ2aBI/AAAAAAAAHRw/2nCksRPOhRg7SmbBvlEQyRIfrlVjubmIgCLcBGAsYHQ/s907/UEFI_RETool-1.png)
- After analysis
![](https://1.bp.blogspot.com/-SJ84w5fWfrM/Xy-tmSzgyBI/AAAAAAAAHRs/m-IqGeOQZ2cOGf5i1EephozaFVq5QmQXwCLcBGAsYHQ/s1009/UEFI_RETool-2.png)
- Protocol explorer window
![](https://1.bp.blogspot.com/-RtmHX70-9RU/Xy-tnVIQqhI/AAAAAAAAHR4/pgDV4puk_l4q-BdotM_AnYDvrN2Oju80wCLcBGAsYHQ/s2047/UEFI_RETool-3.png)
Dependency Browser & Dependency Graph
Usage
- Analyse the firmware using uefi_retool.py python uefi_retool.py get-info FIRMWARE_PATH
- Load
<LOGS_DIR>/<FIRMWARE_NAME>-all-info.json
file to IDA (File
->UEFI_RETool...
)
![](https://1.bp.blogspot.com/-b5fRTcW8gcw/Xy-tnhOm4oI/AAAAAAAAHR8/RrMpvDZivI0b6uOfKLzqQjw7l-rj-WVoACLcBGAsYHQ/s762/UEFI_RETool-4.png)
- alternatively, you can use the key combination
Ctrl+Alt+J
)
Example
- Dependency browser window
![](https://1.bp.blogspot.com/-PDi7ic7fJs8/Xy-tqg0jvkI/AAAAAAAAHSA/sC-jasAi2LwIw0eSZPLHA_wJCNQdHeLmQCLcBGAsYHQ/s2048/UEFI_RETool-5.png)
- Dependency graph
![](https://1.bp.blogspot.com/-VQpgDtFTDnM/Xy-tqwRFJWI/AAAAAAAAHSE/G4TMqWIlVe8uKtpFDQ-gghh_J2-rDu21wCLcBGAsYHQ/s2176/UEFI_RETool-6.png)