zznop / bn-uefi-helper Goto Github PK
View Code? Open in Web Editor NEWHelper plugin for analyzing UEFI firmware
Helper plugin for analyzing UEFI firmware
Analyze calls to gBS->LocateProtocol (and other APIs) to derive the protocol names and types from GUIDs and assign the protocol name and type to the variable.
Ideally, for this to happen, BN will need to support bitfields. Related issue: Vector35/binaryninja-api#694
First, thanks for this great plugin. It helps a lot.
While reversing an EFI binary build with UEFI Development Kit I realize there is an offset mismatch
of EFI_BOOT_SERVICES
in EFI_SYSTEM_TABLE
struct. This plugin tells me it should have an offset of 0x70
But in edk2 it is 0x60.
How to reproduce:
Build HelloWorld.efi and compare UefiBootServicesTableLibConstructor()
in MdePkg/Library/UefiBootServicesTableLib/UefiBootServicesTableLib.c
Source code:
EFI_STATUS
EFIAPI
UefiBootServicesTableLibConstructor (
IN EFI_HANDLE ImageHandle,
IN EFI_SYSTEM_TABLE *SystemTable
)
{
//
// Cache the Image Handle
//
gImageHandle = ImageHandle;
ASSERT (gImageHandle != NULL);
//
// Cache pointer to the EFI System Table
//
gST = SystemTable;
ASSERT (gST != NULL);
//
// Cache pointer to the EFI Boot Services Table
//
gBS = SystemTable->BootServices;
ASSERT (gBS != NULL);
return EFI_SUCCESS;
}
HLIL:
000007b9 EFI_STATUS UefiBootServicesTableLibConstructor(EFI_HANDLE ImageHandle, struct EFI_SYSTEM_TABLE* SystemTable)
000007d7 data_46a0 = ImageHandle
000007fa if (sub_75b() != 0 && data_46a0 == 0)
0000081f sub_668(0x2d28) {"/home/sylv/work/…"}
0000082f data_46a8 = SystemTable
00000852 if (sub_75b() != 0 && data_46a8 == 0)
00000877 sub_668(0x2d28) {"/home/sylv/work/…"}
0000088b data_46b0 = SystemTable->StdErr
000008ae if (sub_75b() != 0 && data_46b0 == 0)
000008d3 sub_668(0x2d28) {"/home/sylv/work/…"}
000008db return 0
LLIL snipped:
20 @ 00000879 rax = [rbp + 0x18 {arg_10}].q
21 @ 0000087d rdx = [rax + 0x60 {EFI_SYSTEM_TABLE::StdErr}].q
22 @ 00000881 rax = 0x46b0
23 @ 0000088b [rax {data_46b0}].q = rdx
24 @ 0000088e rax = 0x75b
25 @ 00000898 call(rax)
26 @ 0000089c if (al == 0) then 36 @ 0x8d5 else 40 @ 0x89e
Relatet types in binary ninja:
struct EFI_SYSTEM_TABLE
{
struct EFI_TABLE_HEADER Hdr;
CHAR16* FirmwareVendor;
UINT32 FirmwareRevision;
EFI_HANDLE ConsoleInHandle;
struct EFI_SIMPLE_TEXT_INPUT_PROTOCOL* ConIn;
EFI_HANDLE ConsoleOutHandle;
struct EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL* ConOut;
EFI_HANDLE StandardErrorHandle;
struct EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL* StdErr;
struct EFI_RUNTIME_SERVICES* RuntimeServices;
struct EFI_BOOT_SERVICES* BootServices;
UINTN NumberOfTableEntries;
struct EFI_CONFIGURATION_TABLE* ConfigurationTable;
};
struct EFI_TABLE_HEADER
{
UINT64 Signature;
UINT32 Revision;
// 4 byte empty
UINT32 HeaderSize;
// 4 byte empty
UINT32 CRC32;
// 4 byte empty
UINT32 Reserved;
};
It is probably related to EFI_TABLE_HEADER size, but I haven't investigated it yet.
Thanks!
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.