https://github.com/DSecurity/efiSeek

Skip to content
 
Sign up Sign up

  * Why GitHub?
    Features -
      + Mobile -
      + Actions -
      + Codespaces -
      + Packages -
      + Security -
      + Code review -
      + Project management -
      + Integrations -
      + GitHub Sponsors -
      + Customer stories-
  * Team
  * Enterprise
  * Explore
      + Explore GitHub -

    Learn and contribute

      + Topics -
      + Collections -
      + Trending -
      + Learning Lab -
      + Open source guides -

    Connect with others

      + The ReadME Project -
      + Events -
      + Community forum -
      + GitHub Education -
      + GitHub Stars program -
  * Marketplace
  * Pricing
    Plans -
      + Compare plans -
      + Contact Sales -
      + Education -

[                    ] [search-key]

  *  
    #
    In this repository All GitHub |
    Jump to |

  * No suggested jump to results

  *  
    #
    In this repository All GitHub |
    Jump to |
  *  
    #
    In this organization All GitHub |
    Jump to |
  *  
    #
    In this repository All GitHub |
    Jump to |

Sign in Sign up Sign up
{{ message }}

DSecurity / efiSeek

  * Notifications
  * Star 132
  * Fork 7

Ghidra analyzer for UEFI firmware.

Apache-2.0 License
132 stars 7 forks
Star
Notifications

  * Code
  * Issues 0
  * Pull requests 0
  * Actions
  * Projects 0
  * Security
  * Insights

More

  * Code
  * Issues
  * Pull requests
  * Actions
  * Projects
  * Security
  * Insights

master
Switch branches/tags
[                    ]
Branches Tags
Nothing to show
{{ refName }} default View all branches
Nothing to show
{{ refName }} default
View all tags
1 branch 0 tags
Go to file Code
 
Clone
HTTPS GitHub CLI
[https://github.com/D]

Use Git or checkout with SVN using the web URL.

[gh repo clone DSecur]

Work fast with our official CLI. Learn more.

  * Open with GitHub Desktop
  * Download ZIP

Launching GitHub Desktop

If nothing happens, download GitHub Desktop and try again.

Go back

Launching GitHub Desktop

If nothing happens, download GitHub Desktop and try again.

Go back

Launching Xcode

If nothing happens, download Xcode and try again.

Go back

Launching Visual Studio

If nothing happens, download the GitHub extension for Visual Studio
and try again.

Go back

Latest commit

@TheJokiv
TheJokiv hardcoded version changed to @extversion@
...
259bf4d Mar 9, 2021
hardcoded version changed to @extversion@
259bf4d

Git stats

  * 20 commits

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
data
Initial commit
Jul 4, 2020
ghidra_scripts
Updated processing of meta.
Nov 8, 2020
gradle/wrapper
Initial commit
Jul 4, 2020
img
Initial commit
Jul 4, 2020
src/main/java/efiSeek
Loading of external data types has been changed.
Nov 8, 2020
.gitignore
updated gitignore
Oct 18, 2020
LICENSE
Initial commit
Jul 4, 2020
Module.manifest
Initial commit
Jul 4, 2020
README.md
Update README.
Jul 7, 2020
build.gradle
Added json lib load
Sep 30, 2020
extension.properties
hardcoded version changed to @extversion@
Mar 9, 2021
gradlew
Initial commit
Jul 4, 2020
gradlew.bat
Initial commit
Jul 4, 2020
View code
efiSeek for Ghidra About Features Finds known EFI GUID's Identifies
protocols located with LOCATE_PROTOCOL function Identifies functions
used as the NOTIFY function Identifies protocols installed in the
module through INSTALL_PROTOCOL_INTERFACE Identifies functions used
as an interrupt function (like some hardware, software/child
interrupt) Script for loading efi modules to relevant directories in
Headless mode Installation Usage References

README.md

 efiSeek for Ghidra

 About

The analyzer automates the process of researching EFI files, helps to
discover and analyze well-known protocols, smi handlers, etc.

 Features

 Finds known EFI GUID's

guids

 Identifies protocols located with LOCATE_PROTOCOL function

locateProtocols

 Identifies functions used as the NOTIFY function

notify

 Identifies protocols installed in the module through
INSTALL_PROTOCOL_INTERFACE

install

 Identifies functions used as an interrupt function (like some
hardware, software/child interrupt)

ioTrap

sx

child

sw

 Script for loading efi modules to relevant directories in Headless
mode

Sorting smm modules relying on meta information into next folders:

  * SwInterrupts
  * ChildInterrupts
  * HwInterrupts
  * UnknownInterrupts

sort

 Installation

Set GHIDRA_INSTALL_DIR environment variable to ghidra path.

Start gradlew.bat, after the completion of building a copy archive
from the dist directory to GHIDRA_HOME_DIR/Extensions/Ghidra/. And
turn on this extention in your ghidra.

 Usage

After installation you are free to use this analyzer. If you open a
EFI file, the analyzer appears selected automatically. To start the
analyzer, press A or Analysis/Auto Analyze and press Analyze.

 References

  * https://github.com/al3xtjames/ghidra-firmware-utils
  * https://github.com/danse-macabre/ida-efitools/

About

Ghidra analyzer for UEFI firmware.

Topics

firmware reverse-engineering uefi ghidra-plugin

Resources

Readme

License

Apache-2.0 License

Releases

No releases published

Packages 0

No packages published

Languages

  * Java 100.0%

  * (c) 2021 GitHub, Inc.
  * Terms
  * Privacy
  * Security
  * Status
  * Docs

 

  * Contact GitHub
  * Pricing
  * API
  * Training
  * Blog
  * About

You can't perform that action at this time.
You signed in with another tab or window. Reload to refresh your
session. You signed out in another tab or window. Reload to refresh
your session.