icaas / efiswissknife Goto Github PK
View Code? Open in Web Editor NEWThis project forked from gdbinit/efiswissknife
An IDA plugin to improve (U)EFI reversing
This project forked from gdbinit/efiswissknife
An IDA plugin to improve (U)EFI reversing
______________________.___ \_ _____/\_ _____/| | | __)_ | __) | | | \ | \ | | /_______ / \___ / |___| \/ \/ _________ .__ ____ __. .__ _____ / _____/_ _ _|__| ______ ______ | |/ _| ____ |__|/ ____\____ \_____ \\ \/ \/ / |/ ___// ___/ | < / \| \ __\/ __ \ / \\ /| |\___ \ \___ \ | | \| | \ || | \ ___/ /_______ / \/\_/ |__/____ >____ > |____|__ \___| /__||__| \___ > \/ \/ \/ \/ \/ \/ EFI Swiss Knife An IDA plugin to improve (U)EFI reversing Copyright (C) 2016, 2017 Pedro Vilaça (fG!) - [email protected] - https://reverse.put.as This is an IDA plugin to assist in (U)EFI binaries reversing. It is based on original work by Snare - https://github.com/snare/ida-efiutils Since I hate Python I did something new in C adding some extra features that I wanted. Tested with IDA 6.9/6.95 Mac OS X version. To compile for OS X use the Makefile or the XCode Project. You will need to edit the XCode project and set the paths to the SDK. (default is to /Applications/IDA Pro 6.95/idasdk695) You should edit config.h and modify the log and database paths. Copy EFISwissKnife.pmc64 to /Applications/IDA Pro 6.95/idaq.app/Contents/MacOS/plugins/ By default it only compiles the plugin to the 64 bit version of IDA. If you want the plugin to 32 bit version you need to edit the Xcode Project and change __EA64__=1 to 0. To call it from IDA use Shift+F2 and then 1) To display a menu with run options: RunPlugin("EFISwissKnife", 1); 2) To run with default options: RunPlugin("EFISwissKnife", 0); 3) To run in batch mode: RunPlugin("EFISwissKnife", 2); The plugin supports batch mode in case you want to mass analyse EFI binaries and gather some statistics about services usage. You probably want to update the GUIDs available at efi_guids.h. This code is targetting Mac OS X EFI binaries. It should work with other platforms UEFI binaries without problems or with minor modifications and updates. Only PE binaries supported, no TE binaries supported yet. That's it! Enjoy :-) fG! v1.0 - Initial version IDA BUGS: Another bug is related to the PLUGIN_UNL flag. It is used to "Unload the plugin immediately after calling 'run'.". If this option is set, it crashes the Windows version. Mac version seems do to fine with it.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.