Skip to content

GGFWPi v0.6.6-beta

Pre-release
Pre-release

Choose a tag to compare

View all tags
@patapik patapik released this 05 Aug 12:08
v0.6.6-beta
17e9b77
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

GGFWPi v0.6.6-beta — Initial Public Beta

This is the first public beta release of GGFWPi, a read-only Raspberry Pi firmware and platform security auditor developed by Maciej Gojny for GGSEC.

GGFWPi is designed to collect and evaluate firmware, boot-chain, Secure Boot, OTP, SPI EEPROM, and operating-system security evidence on Raspberry Pi platforms.

The current release has been tested primarily on:

  • Raspberry Pi 5
  • Broadcom BCM2712
  • Kali Linux ARM64

Testing on additional Raspberry Pi models and Raspberry Pi OS is planned.

Key capabilities

  • Read-only SPI EEPROM acquisition using flashrom
  • SPI EEPROM write-protection status assessment
  • Raw SPI EEPROM versus live boot configuration comparison
  • Raspberry Pi boot-chain discovery and integrity baselines
  • Customer Secure Boot chain validation
  • RSA-2048 PKCS#1 v1.5 SHA-256 signature verification
  • boot.img and boot.sig validation
  • EEPROM bootconf signature analysis
  • BCM2712 bootsys customer countersignature validation
  • OTP security-state decoding
  • External rpiboot -j provisioning metadata support
  • Secure Boot policy profiles
  • Weak and default credential detection
  • Network listener and APT transport checks
  • JSON reports and portable .ggcap evidence packages
  • Severity and policy gates suitable for automated workflows
  • Fail-closed evidence classification
  • Summary and gate accounting invariants

Read-only design

GGFWPi does not provide:

  • SPI EEPROM write operations
  • SPI erase operations
  • write-protection modification
  • OTP programming
  • Secure Boot key provisioning

SPI access is limited to device probing, write-protection status inspection, and read-only EEPROM acquisition.

Regression test suite

This release includes a 63-test regression suite covering:

  • Secure Boot signature validation
  • valid and tampered boot images
  • incorrect public keys
  • malformed and missing signatures
  • BCM2711 and BCM2712 Secure Boot chains
  • OTP evidence decoding
  • policy evaluation
  • gate accounting
  • summary accounting
  • multi-attribute findings
  • evidence package generation
  • semantic selection of the current GGFWPi module

Run the tests with:

python3 test_GGFWPi_latest.py

The runner prints the exact GGFWPi module selected for testing.

Expected result:

[*] GGFW regression target: GGFWPi_v0.6.6-beta.py

Ran 63 tests
OK

Basic usage

Run a standard audit:

sudo python3 GGFWPi_v0.6.6-beta.py

Run with the Secure Boot policy profile:

sudo python3 GGFWPi_v0.6.6-beta.py \
  --policy-profile secure-boot-required \
  --secure-boot-evidence \
  --show-otp \
  --fail-on HIGH

Create a boot-chain baseline:

sudo python3 GGFWPi_v0.6.6-beta.py \
  --write-baseline /var/lib/ggfw/boot-baseline.json

Compare the current boot chain against a baseline:

sudo python3 GGFWPi_v0.6.6-beta.py \
  --baseline /var/lib/ggfw/boot-baseline.json

Exit codes

  • 0 — scan completed and the selected gate was not triggered
  • 1 — tool, acquisition, dependency, argument, package, baseline, or accounting error
  • 2 — configured security or policy gate triggered

Evidence semantics

GGFWPi distinguishes between:

  • confirmed security findings;
  • policy failures;
  • evidence acquisition requirements;
  • coverage gaps;
  • aggregate findings;
  • informational observations;
  • controls that are not required by the selected profile.

Missing evidence does not automatically become a cryptographic failure. Where authenticity cannot be conclusively established, GGFWPi reports UNVERIFIED or EVIDENCE_INCOMPLETE instead of claiming an invalid signature without sufficient proof.

Beta status

This release is intended for testing, technical review, and feedback.

The report schema, command-line interface, Raspberry Pi OS compatibility, OTP coverage, and Secure Boot evidence model may still change before the first stable release.

Do not treat beta output as the sole basis for a production security decision without reviewing the collected evidence.

Known limitations

  • BCM2712 customer Secure Boot OTP state cannot always be determined from the public runtime otp_dump mapping.
  • External provisioning metadata collected using rpiboot -j may be required.
  • Raspberry Pi OS compatibility has not yet been comprehensively validated.
  • EEPROM A/B state may remain unverified on configurations where an authoritative interface is unavailable.
  • Physical SPI #WP assertion is not directly measured.
  • Full positive Secure Boot validation requires a correctly provisioned and signed customer boot chain.

Licence and attribution

GGFWPi is distributed under the Apache License 2.0.

Copyright 2026 GG Advanced IT Security UG.

Developed by Maciej Gojny for GGSEC.

See the included LICENSE, NOTICE, and AUTHORS.md files for details.

Feedback

Technical testing and review are particularly welcome in the following areas:

  • Raspberry Pi OS compatibility
  • Raspberry Pi 4 and older platform coverage
  • BCM2712 OTP and provisioning evidence
  • customer Secure Boot validation
  • EEPROM A/B state reporting
  • Debian and Kali packaging
  • reproducible test fixtures

Please use GitHub Issues for reproducible bugs, technical compatibility reports, and narrowly scoped feature requests.

Assets 3
Loading