UEFI_RETool - A Tool For UEFI Firmware Reverse Engineering

A tool for UEFI firmware reverse engineering.

UEFI firmware analysis with uefi_retool.py script
Usage:

Copy ida_plugin/uefi_analyser.py script and ida_plugin/uefi_analyser directory to IDA plugins directory Edit config.json file PE_DIR is a directory that contains all executable images from the UEFI firmware DUMP_DIR is a directory that contains all components from the firmware filesystem LOGS_DIR is a directory for logs IDA_PATH and IDA64_PATH are paths to IDA Pro executable files Run pip install -r requirements.txt Run python uefi_retool.py command to display the help message

Commands

Usage: uefi_retool.py [OPTIONS] COMMAND [ARGS]... Options: --help Show this message and exit. Commands: get-images Get executable images from UEFI firmware. get-info Analyze the entire UEFI firmware. get-pp Get a list of proprietary protocols in the UEFI firmware.

get-images

python uefi_retool.py get-images --help

Usage: uefi_retool.py get-images [OPTIONS] FIRMWARE_PATH Get executable images from UEFI firmware. Images are stored in "modules" directory. Options: --help Show this message and exit.

Example:

python uefi_retool.py get-images test_fw/fw-tp-x1-carbon-5th.bin

get-info

python uefi_retool.py get-info --help

Usage: uefi_retool.py get-info [OPTIONS] FIRMWARE_PATH Analyze the entire UEFI firmware. The analysis result is saved to .json file. Options: -w, --workers INTEGER Number of workers (8 by default). --help Show this message and exit.

Example:

python uefi_retool.py get-info -w 6 test_fw/fw-tp-x1-carbon-5th.bin

get-pp

python uefi_retool.py get-pp --help

Usage: uefi_retool.py get-pp [OPTIONS] FIRMWARE_PATH Get a list of proprietary protocols in the UEFI firmware. The result is saved to .json file. Options: -w, --workers INTEGER Number of workers (8 by default). --help Show this message and exit.

Example:

python uefi_retool.py get-pp -w 6 test_fw/fw-tp-x1-carbon-5th.bin

Additional tools

tools/update_edk2_guids.py is a script that updates protocol GUIDs list from edk2 project

IDA plugin
IDA plugin for UEFI analysis

Analyser & Protocol explorer

Usage

Copy uefi_analyser and uefi_analyser.py to your %IDA_DIR%/plugins directory
Open the executable UEFI image in IDA and go to Edit -> Plugins -> UEFI analyser (alternatively, you can use the key combination Ctrl+Alt+U)

Example

Before analysis