efiXplorer

efiXplorer - IDA plugin for UEFI firmware analysis and reverse engineering automation

Supported versions of Hex-Rays products: everytime we focus on last versions of IDA and Decompiler because we try to use most recent features from new SDK releases. That means we tested only on recent versions of Hex-Rays products and do not guarantee stable work on previous generations.

Why not IDApython: all code developed in C++ because it's a more stable and performant way to support a complex plugin and get full power of most recent SDK's features.

Supported Platforms: Windows, Linux and OSX.

efiXplorer core features

efiXloader description

Build instructions and Installation

Publications

• efiXplorer: Hunting for UEFI Firmware Vulnerabilities at Scale with Automated Static Analysis
• Static analysis-based recovery of service function calls in UEFI firmware
• How efiXplorer helping to solve challenges in reverse engineering of UEFI firmware

References

• https://github.com/LongSoft/UEFITool
• https://github.com/yeggor/uefi_retool
• https://github.com/gdbinit/EFISwissKnife
• https://github.com/snare/ida-efiutils
• https://github.com/al3xtjames/ghidra-firmware-utils
• https://github.com/DSecurity/efiSeek
• https://github.com/p-state/ida-efitools2
• https://github.com/zznop/bn-uefi-helper