longsoft/ifrextractor-rs

Rust utility to extract UEFI IFR data into human-readable text

IFRExtractor RS

Rust utility to extract UEFI IFR data found in a binary file into human-readable text.

What is this IFR thing about?

UEFI Internal Form Representation (IFR) is a binary format that UEFI Human Interface Infrastructure (HII) subsystem uses to store strings, forms, images, animations and other things that eventually supposed to end up on BIOS Setup screen. In many cases there are multiple settings that are still present in IFR data, but not visible from BIOS Setup for various reasons, and IFR data can also help in finding which byte of which non-volatile storage available to UEFI corresponds to which firmware setting.

ifrextractor-rs's Issues

Differing Offsets from IFRExtractor LS and RS

Hello,

i have attempted to use IFRExtractor, both the LS and RS versions, and they each give different offsets for the option I am trying to disable.

My BIOS has some sort of "Enable Flash Protection Range Registers" enabled so I cannot write the BIOS region of my SPI, so I am attempting to disable it.

In both extractors I can see the range register text but I am getting different offsets; however when reading the offsets, those values are 0x00, when the correct value should be enabled as I am trying to disable it.

Can I have one of you all look at my BIOS as maybe there's something in it thats messing up the formatting of IFRExtractor?

For clarification, I am using setup_var.efi 0x73A (or 0x73D, both reported offsets) to see the values from an EFI shell and they both are reading as 0x00.

EDIT: After changing the command to setup_var.efi 0x73A -n PchSetup (or 0x73D) I was able to see the enabled bytes, however disabling them made no difference. After a reboot the value didn't persist, so i tried using fpt.efi to write to the BIOS region of the flash chip while the bytes were set to 0 in the EFI shell and I am still receiving the error that Protected Range Registers are currently set.

Thanks for any help in advance,
Chris

No IFR data found

I’m trying to modify BIOS of my Asus H7604JV laptop.
You can find origin.bin (Origin BIOS) in google drive : H7604JV BIOS – Google Drive

I extracted three files from orign.bin by using UEFITool.
However, when I use ifrextractor, I got “No IFR data found”

Any advices?

No IFR data found with new UEFI 2.8 AMI bios

Hello,
I've tried dump my bios and extract Setup from dumped bios with UEFITool (click on PE32 image section and select Extract as is...)

After that, I run command IFRExtractor but it said no IFR data found.

Here is the Setup file.
Section_PE32_image_Setup_Setup.zip

Could you check if there is any error with this Setup file ?

how to extract UEFI Internal Form Representation (IFR) at efi runtime

Hello.
First of all, thanks for creating this rep it's really helpful.

i wonder
how to extract UEFI Internal Form Representation (IFR) at efi runtime，like run a efi at edk2 shell，thanks in advance

Collect images to test that every opcode is getting parsed correctly

There are a lot (100+) of small parsers for both Framework and UEFI HII structures, and there are also a ton of images out there in the wild.
We need to ensure that every opcode that is possible in a firmware image is indeed parsed correctly, and if not, fix it.

• Investigate UEFI VarStoreEfi opcode not getting parsed on some images
• Build a collection of images covering as many UEFI and Framework opcodes as possible, probably with help of LVFS project (CC @hughsie)

Differing Sizes from IFRExtractor LS and RS

Hi! I've just found that RS shows Size: 8 on some variables which has a few options of values (for example Disabled or Enabled), while LS shows Size: 1 as expected. Is this because of RS reports Size as bits and LS as bytes?

I'm asking because some tools like setup_var.efi uses bytes (as param) to write values, and may be confusing for someone who wants to use this tool.

A documentation or difference list between LS and RS would be appreciated.

Thanks in advance.

[Feature request] Retrocompatibility with previuous IFR-Extractor

Hello, thank you for keeping alive a newly written version of this tool :)

Previously with the C++ tool, when extracting UEFI sections, there were keys such as VarStore: 0xhex-value and the name of the corresponding UEFI section was flagged with VarStoreId: 0xhex-value and then the name of the section, e.g. SaSetup or CpuSetup.

Now instead, every key has next to it the offset first, and ther VarStoreId instead of just VarStore

Would you mind to revert this as it was previously?

The reason I'm asking for this is because with the previous version it was immediate to switch the Ctrl + F key from VarStore: 0x3 to VarStoreId: 0x3 to get the name of the UEFI section at the top of the file, now instead there are hundreds of items at the key value VarStoreId:

I'm attaching some screenshots to further explain what I mean:

Now:

Previously:

Dell Precision 5820

Hello. I am trying to extract the bios files from this bios: https://dl.dell.com/FOLDER11491866M/1/M33X_2.36.0.exe . I am following this tutorial: https://github.com/xCuri0/ReBarUEFI/wiki/Enabling-hidden-4G-decoding as i am trying to enable rebar on the machine and it required a bios bin file. After some poking around i found this utility and am able to get bin files (produces 2 folders: 3 CombineBiosName2 v99.1.45 and 2 CombineBiosName2 v99.1.45). Within those folders there are a number of bin files.

I choose 3 CombineBiosName2 v99.1.45 -- 1 System BIOS [V0 AMI] v2.36.0.bin or 2 CombineBiosName2 v99.1.45 -- 1 System BIOS [V0 AMI] v2.36.0.bin and using UEFITool do a search for "4G Decod" and it finds entries and when i select extract body it seems to extract a file, but when i run it against ifrextractor (.\ifrextractor.exe .\4GDecodBody.bin) it doesnt produce anything. This is all over my head but was hoping to get some help. If there is somewhere else i can ask for that'd be great as well.

Cannot find string in BIOS extracted UEFI IFR data

Hello! I cannot find the string "Overclocking Lock" in the extracted UEFI IFR data (with the command ifrextractor.exe Section_PE32_image_Setup_Setup.sct verbose) using the attached PE32 section sct (saved with UEFITool)

this is the extracted PE32 Section image

Section_PE32_image_Setup_Setup.zip

those are the results of the ifrextractor.exe extraction

Section_PE32_image_Setup_Setup.bin.1.0.en-US.ifr.txt
Section_PE32_image_Setup_Setup.bin.0.0.en-US.ifr.txt

Can you help me? What am I doing wrong? Thanks!

[suggestion] single file Form Set extraction mode

It'd be nice if all Form Sets were in the same file like it used to be in the old IFR Extractor.

Please check in cargo.lock

Executables should have a version-controlled cargo.lock. Could this please be added?

https://doc.rust-lang.org/cargo/faq.html#why-do-binaries-have-cargolock-in-version-control-but-not-libraries

Merge projects?

Hello. I accidentally found this project while looking for a possible solution of an issue in another project: https://github.com/linuxboot/uefisettings (also capable of parsing HiiDB, also written in Rust and also is using a BSD license)

But uefisettings is not an active project (because there is no manpower to improve it). So I was curious if may be instead of spinning out a new similar project from scratch you'd like to pick up uefisettings? I'm currently the only maintainer, and I remember LongSoft makes great tools, so it feels like you might be a better maintainer than me :)

Detect compression/packing and throw a warning

And only that, it's not like the tool would have to handle it.
It's really just a quality of life feature, to hint the noobest users that their file might be returning null/empty/unknown results because they extracted the PE wrong.