README.md

Ghidra Firmware Utilities

Various modules for Ghidra to assist with PC firmware reverse-engineering. This was accepted as a coreboot project for GSoC 2019.

Features (very much WIP)

PCI option ROM loader

• Implements a FS loader for PCI option ROMs (handles hybrid ROMs with multiple images, e.g. legacy x86 + UEFI)
• Loads UEFI executables from PCI option ROMs (including compressed images)
• Defines the entry point function and various header data types for legacy x86 option ROMs

Planned functionality / TODO

Firmware image loader

• Implement FS loader for firmware images
• Write parsers for Intel IFD (BIOS region), coreboot CBFS/FMAP, and UEFI firmware volumes

UEFI loader

• Write helper script to import GUIDs/etc (similar to ida-efitools)

Building & Installation

Ghidra's standard Gradle build system is used. Set the GHIDRA_INSTALL_DIR environment variable before building:

$ export GHIDRA_INSTALL_DIR="/path/to/ghidra"
$ gradle

The module ZIP will be output to dist/. Use File > Install Extensions and select the green plus to browse to the extension. Restart Ghidra when prompted.

Usage

PCI option ROM loader

Add a PCI option ROM to a Ghidra project. Legacy x86 option ROMs can be directly loaded for analysis. Ensure that the binary format is set to x86 PCI Option ROM, and import the binary.

UEFI option ROMs or option ROMs that contain more than one image should be imported using the filesystem loader. When prompted to select an import mode, select File system. The images contained within the option ROM will be displayed, and can be imported for analysis. Legacy x86 images will be handled the x86 PCI Option ROM loader, and UEFI images will be handled by the PE32 loader (compression is supported). Information for each image can be displayed by selecting Get Info in the right-click menu.

License

Apache 2.0, with some exceptions:

• src/efidecompress/c/efidecompress.c: BSD

Credits

src/efidecompress/c/efidecompress.c is a lightly modified version of Decompress.c from uefi-firmware-parser (which itself is derived from the original in EDK2 BaseTools).