# UEFI\_RETool | A Tool For UEFI Firmware Reverse Engineering

**URL:** <https://onehack.st/t/uefi-retool-a-tool-for-uefi-firmware-reverse-engineering/100097>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking\
**Created:** [August 9, 2020, 2:26pm UTC](https://onehack.st/t/uefi-retool-a-tool-for-uefi-firmware-reverse-engineering/100097 "2020-08-09T14:26:43Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [August 9, 2020, 2:26pm UTC](https://onehack.st/t/uefi-retool-a-tool-for-uefi-firmware-reverse-engineering/100097/1 "2020-08-09T14:26:43Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/9/6/9617ec2967d047ac1ecafc74abc91972e819b3ea.png)

A tool for UEFI firmware reverse engineering.

**UEFI firmware analysis with [uefi\_retool.py](https://github.com/yeggor/UEFI_RETool/blob/master/uefi_retool.py) script**  
Usage:

- Copy `ida_plugin/uefi_analyser.py` script and `ida_plugin/uefi_analyser` directory to IDA plugins directory
- Edit `config.json` file
  - `PE_DIR` is a directory that contains all executable images from the UEFI firmware
  - `DUMP_DIR` is a directory that contains all components from the firmware filesystem
  - `LOGS_DIR` is a directory for logs
  - `IDA_PATH` and `IDA64_PATH` are paths to IDA Pro executable files

- Run `pip install -r requirements.txt`
- Run `python uefi_retool.py` command to display the help message

**Commands**

```auto
python uefi_retool.py

```

```auto
Usage: uefi_retool.py [OPTIONS] COMMAND [ARGS]...Options: --help Show this message and exit.Commands: get-images Get executable images from UEFI firmware. get-info Analyze the entire UEFI firmware. get-pp Get a list of proprietary protocols in the UEFI firmware.

```

**get-images**

```auto
python uefi_retool.py get-images --help

```

```auto
Usage: uefi_retool.py get-images [OPTIONS] FIRMWARE_PATH Get executable images from UEFI firmware. Images are stored in "modules" directory.Options: --help Show this message and exit.

```

Example:

```auto
python uefi_retool.py get-images test_fw/fw-tp-x1-carbon-5th.bin

```

**get-info**

```auto
python uefi_retool.py get-info --help

```

```auto
Usage: uefi_retool.py get-info [OPTIONS] FIRMWARE_PATH Analyze the entire UEFI firmware. The analysis result is saved to .json file.Options: -w, --workers INTEGER Number of workers (8 by default). --help Show this message and exit.

```

Example:

```auto
python uefi_retool.py get-info -w 6 test_fw/fw-tp-x1-carbon-5th.bin

```

**get-pp**

```auto
python uefi_retool.py get-pp --help

```

```auto
Usage: uefi_retool.py get-pp [OPTIONS] FIRMWARE_PATH Get a list of proprietary protocols in the UEFI firmware. The result is saved to .json file.Options: -w, --workers INTEGER Number of workers (8 by default). --help Show this message and exit.

```

Example:

```auto
python uefi_retool.py get-pp -w 6 test_fw/fw-tp-x1-carbon-5th.bin

```

**Additional tools**

- `tools/update_edk2_guids.py` is a script that updates protocol GUIDs list from `edk2` project

**IDA plugin**  
[IDA plugin for UEFI analysis](https://github.com/yeggor/UEFI_RETool/tree/master/ida_plugin)

**Analyser & Protocol explorer**

**Usage**

- Copy `uefi_analyser` and `uefi_analyser.py` to your `%IDA_DIR%/plugins` directory
- Open the executable UEFI image in IDA and go to `Edit` → `Plugins` → `UEFI analyser`_(alternatively, you can use the key combination `Ctrl+Alt+U` )_

**Example**

**Before analysis**

 ![image](https://onehack.st/uploads/default/original/3X/6/0/60076260aec7acb82a9e26f9a658424aafcc5e2a.png)

**After analysis**

 ![image](https://onehack.st/uploads/default/original/3X/1/a/1a442eec37831a4d934dbadc0c2f3d2e4cb8bdab.png)

**Protocol explorer window**

 ![image](https://onehack.st/uploads/default/original/3X/8/f/8fee7b3617b701bd9aaf51d046b38d3fd89d0b7f.jpeg)

**Dependency browser & Dependency graph**

**Usage**

- Analyse the firmware using [uefi\_retool.py](https://github.com/yeggor/UEFI_RETool/blob/master/uefi_retool.py)

```auto
python uefi_retool.py get-info FIRMWARE_PATH

```

- Load `<LOGS_DIR>/<FIRMWARE_NAME>-all-info.json` file to IDA ( `File` → `UEFI_RETool...` )

 ![image](https://onehack.st/uploads/default/original/3X/c/7/c71adc909c7baeabef945e3bfc3962ffc00705bb.png)

- _alternatively, you can use the key combination `Ctrl+Alt+J`_ )

**Example**

**Dependency browser window**

 ![image](https://onehack.st/uploads/default/original/3X/2/b/2bdbb394fdd66a03ec5654f0fce8cf2f225bf2e2.png)

**Dependency graph**

 ![image](https://onehack.st/uploads/default/original/3X/9/6/9617ec2967d047ac1ecafc74abc91972e819b3ea.png)

**Similar works**

- [ida-efiutils](https://github.com/snare/ida-efiutils)
- [EFISwissKnife](https://github.com/gdbinit/EFISwissKnife)
- [ghidra-firmware-utils](https://github.com/al3xtjames/ghidra-firmware-utils)

## GitHub:

> **[GitHub - yeggor/uefi\_retool: A tool for UEFI firmware reverse engineering](https://github.com/yeggor/UEFI_RETool)**
>
> A tool for UEFI firmware reverse engineering