efiXplorer - IDA plugin for UEFI firmware analysis and reverse engineering automation
Supported versions of Hex-Rays products: everytime we focus on last versions of IDA and Decompiler because we try to use most recent features from new SDK releases. That means we tested only on recent versions of Hex-Rays products and do not guarantee stable work on previous generations.
Why not IDApython: all code developed in C++ because it's a more stable and performant way to support a complex plugin and get full power of most recent SDK's features.
Supported Platforms: Windows, Linux and OSX.
efiXplorer core features
efiXloader description
Build instructions and Installation
Publications
- efiXplorer: Hunting for UEFI Firmware Vulnerabilities at Scale with Automated Static Analysis
- Static analysis-based recovery of service function calls in UEFI firmware
- How efiXplorer helping to solve challenges in reverse engineering of UEFI firmware
References
- https://github.com/LongSoft/UEFITool
- https://github.com/yeggor/uefi_retool
- https://github.com/gdbinit/EFISwissKnife
- https://github.com/snare/ida-efiutils
- https://github.com/al3xtjames/ghidra-firmware-utils
- https://github.com/DSecurity/efiSeek
- https://github.com/p-state/ida-efitools2
- https://github.com/zznop/bn-uefi-helper