This repository contains a collection of UEFI/BIOS security materials. Collected my own, not comprehensive. Feel free to PR.
- UIUCTF-2022 SMM Cow Say 1
- UIUCTF-2022 SMM Cow Say 2
- UIUCTF-2022 SMM Cow Say 3
- D^3CTF-2022-pwn-d3guard
- corCTF 2023 smm-diary
- Dubhe CTF 2024 ToySMM
- DVUEFI
- UEFI Forum
- UEFI Specification v2.10
- UEFI Platform Initialization Specification v1.7a
- UEFI Shell Specification V2.2
- UEFI Platform Initialization Distribution Packaging Specification v1.1
- ACPI Specification v6.5
- EDK II
- edk2-pytool-library
- edk2-libc
- uefi-rs
- UEFI-Lessons
- arch-secure-boot
- EDK II Module Write Guide
Some interesting projects
ATT&CK Attack Vector
| Time | Name |
|---|---|
| Oct. 2022 | BlackLotus |
| Jul. 2022 | CosmicStrand |
| Jan. 2022 | MoonBounce |
| Oct. 2021 | Especter |
| Sep. 2021 | FinSpy |
| Dec. 2020 | Trickbot |
| Oct. 2020 | MosaicRegressor |
| 2018 | LoJax |
Bootkits related repositories:
- efiXplorer: IDA Pro plugin, the best plugin for analyzing UEFI binaries for now.
- UEFITool: Tool for parsing and extracting UEFI firmware images.
- brick: IDA Pro plugin, a static vulnerability scanner, support several types of vulnerabilities.
- fwhunt-scan
- FwHunt
- qiling: Qiling has an EFI mode, which can partially emulate UEFI binary files.
- efiSeek: A Ghidra plugin for UEFI binaries analyzing.
- efi_fuzz: A coverage-guided emulator-based NVRAM fuzzer for UEFI (based on qiling).
- efi_dxe_emulator: A simple emulator for UEFI DXE files.
- uefi-firmware-parser: Library for parsing UEFI firmware images.
- uefi-retool
- BIOSUtiities: A lot of scripts to parse and extract UEFI firmware images directly from exe files.
- innoextract: A tool to unpack installers created by Inno Setup
- Chipsec: The most commonly used tool for extracting UEFI firmware and exploiting UEFI vulnerabilities.
- LVFS
- EfiGuard
- ghidra-firmware-utils
- dropWPBT
- fwexpl
- fiano
- UefiVarMonitor
- VBiosFinder
- kraft_dinner
- Voyager
- efi-memory
- smram_parse
- ebvm
- UEFI-SecureBoot-SignTool
- PciLeech: PciLeech supports DMA attacks against UEFI, and it contains a mode can hook UEFI Runtime Services and print some chars.
- bob_efi_fuzzer
- uefi-rs: A rust wrapper for UEFI. You can built UEFI applications and vulnerabilities PoCs easily with this library.
- tsffs: A snapshotting, coverage-guided fuzzer for software (UEFI, Kernel, firmware, BIOS) built on SIMICS, released by Intel.
- efi-inspector: A Binary Ninja plugin for parsing UEFI firmware images.
- efi-resolver: Official UEFI plugin for Binary Ninja; it supports type propogation, which is really cool, and it starts supporting PEI files now.
- python-uefivars: A python tool to inspect UEFI variables (but it cannot take firmware images as input).
- PixieFail: Nine vulnerabilities in Tianocore's EDK II IPv6 network stack.
- Vulnerability-REsearch: Vulnerabilities found by Binarly-IO, really a lot.
- vulnerability-disclosures: Vulnerabilities found by ESET, some of the vulnerabilities in the repo related to UEFI.
- vulnerabilities: Vulnerabilities found by 10TG, some of the vulnerabilities related to UEFI.
- CVE-2022-3430, CVE-2022-3431, CVE-2022-3432: These three vulnerabilities are found by ESET Research, all of which are NVRAM vulnerabilities in Lenovo devices that could disable Secure Boot.
- CVE-2022-4020: NVRAM vulnerability found by ESET Research, which exists in Acer devices and could disable Secure Boot by setting a UEFI Variable.
- ThinkPwn
- Aptiocalypsis
- UsbRt_ROP
- CVE-2022-21894
- CVE-2014-8274
- Super-UEFIinSecureBoot-Disk
- SmmExploit
- CERT/CC UEFI Analysis Resources: This repo contains an example of CVE-2021-28216
-
- Multiple Vulnerabilities In Qualcomm And Lenovo ARM-Based Devices
- Firmware Patch Deep-Dive: Lenovo Patches Fail To Fix Underlying Vulnerabilities
- OpenSSL Usage In UEFI Firmware Exposes Weakness In SBOMs
- The Firmware Supply-Chain Security Is Broken: Can We Fix It?
- Leaked Intel Boot Guard Keys: What Happened? How Does It Affect The Software Supply Chain?
- New Attacks To Disable And Bypass Windows Management Instrumentation
- Binarly Discloses High-Impact Firmware Vulnerabilities In Insyde-Based Devices
- Binarly Discovers Multiple High-Severity Vulnerabilities In AMI-Based Devices
- Binarly Finds Six High Severity Firmware Vulnerabilities In HP Enterprise Devices
- The Intel PPAM Attack Story
- Using Symbolic Execution To Detect UEFI Firmware Vulnerabilities
- Blasting Event-Driven Cornucopia
- FirmwareBleed: The Industry Fails To Adopt Return Stack Buffer Mitigations In SMM
- FwHunt The Next Chapter: Firmware Threat Detection At Scale
- A Deeper UEFI Dive Into MoonBounce
- Repeatable Failures: AMI UsbRt - Six Years Later, Firmware Attack Vector Still Affect Millions Of Enterprise Devices
- Repeatable Firmware Security Failures: 16 High Impact Vulnerabilities Discovered In HP Devices
- An In-Depth Look At The 23 High-Impact Vulnerabilities
- Detecting Firmware Vulnerabilities At Scale: Intel BSSA DFT Case Study
- Why Firmware Integrity Is Insufficient For Effective Threat Detection And Hunting
- Firmware Supply Chain Is Hard(Coded)
- Attacking (Pre)EFI Ecosystem
-
- Exploiting AMI Aptio firmware on example of Intel NUC
- Exploring and exploiting Lenovo firmware secrets
- Exploiting SMM callout vulnerabilities in Lenovo firmware
- Breaking UEFI security with software DMA attacks
- Building reliable SMM backdoor for UEFI based platforms
- Exploiting UEFI boot script table vulnerability
-
- FIRMWARE ATTACKS: AN ENDPOINT TIMELINE
- ONE BOOTLOADER TO LOAD THEM ALL
- FIRMWARE SECURITY REALIZATIONS – PART 2 – START YOUR MANAGEMENT ENGINE
- FIRMWARE SECURITY REALIZATIONS – PART 1 – SECURE BOOT AND DBX
- YET ANOTHER UEFI BOOTKIT DISCOVERED: MEET COSMICSTRAND
- THE ILOBLEED IMPLANT: LIGHTS OUT MANAGEMENT LIKE YOU WOULDN’T BELIEVE
- “EVIL MAID” FIRMWARE ATTACKS USING USB DEBUG
-
- BlackLotus UEFI bootkit: Myth confirmed
- ESET Research Podcast: UEFI in crosshairs of ESPecter bootkit
- When “secure” isn’t secure at all: High‑impact UEFI vulnerabilities discovered in Lenovo consumer laptops
- UEFI threats moving to the ESP: Introducing ESPecter bootkit
- Needles in a haystack: Picking unwanted UEFI components out of millions of samples
- A machine‑learning method to explore the UEFI landscape
- LOJAX: First UEFI rootkit found in the wild, courtesy of the Sednit group
- UEFI malware: How to exploit a false sense of security
- Bootkit Threat Evolution in 2011
-
- Moving From Common-Sense Knowledge About UEFI To Actually Dumping UEFI Firmware
- Moving From Manual Reverse Engineering of UEFI Modules To Dynamic Emulation of UEFI Firmware
- Moving From Dynamic Emulation of UEFI Modules To Coverage-Guided Fuzzing of UEFI Firmware
- Adventures From UEFI Land: the Hunt For the S3 Boot Script
- Zen and the Art of SMM Bug Hunting | Finding, Mitigating and Detecting UEFI Vulnerabilities
- Another Brick in the Wall: Uncovering SMM Vulnerabilities in HP Firmware
-
Others
- Debugging System with DCI and Windbg
- Reverse engineering (Absolute) UEFI modules for beginners
- Experiment in extracting runtime drivers on Windows
- BIOS Based Rootkits
- Understanding modern UEFI-based platform boot
- Attacking UEFI Runtime Services and Linux
- Using an Unimpressive Bug in EDK II to Do Some Fun Exploitation