Awesome

About

It is an IDA plugin for extending UEFI reverse engineering capabilities. Based on ida-efitools with a bunch of fixes and new features.
Works with both Python 2 and Python 3. Supports outdated versions of IDA Pro 7.x with no guarantees.

Features

• GUIDs defining
• Structures propagating (registers, xrefs, stack vars)
• Protocols & interfaces identification
• Unknown protocols initialization

Extended features

• It can be used as a plugin and as a script.
• Automatically imports custom C declarations (structs, enums, unions, typedefs) from efitools2/types directory
• Sets permissions of code segment to RWE (to fix incorrect dead code elimination in decompiler view)

Plugin-only features

• Provides ability to sync external types
• Prints and copies to clipboard selected EFI_GUID from disassembler view
• Extracts EFI_GUID from local variable assignments

Important notes

• behemoth.til is rejected in favor of IDA's uefi.til and uefi64.til
• Do not use uefi(64).til from IDA 7.3 because it has errors

Usage

As script

Just run efitools2/efitools.py from IDA.

As plugin

Hotkeys:

• Ctrl-Alt-E - does all the magic
• Ctrl-Alt-G (on data) - print and copy EFI_GUID at current cursor location
• Ctrl-Alt-G (on code) - extract and copy EFI_GUID from local variable assignment (set cursor at EFI_GUID.data1 assignment)
• F5 (on Local Types window) - synchronize local types from types folder

Adjustment

• Hotkeys can be configured in ida-efitool2.py file.
• A few preferences can be found in efitools2/efitools.py file.
• Custom GUIDs should be placed within efitools2/guids/custom.ini file.
• Custom protocols should be placed inside efitools2/types folder. See available examples.

How to export custom types

It's IDA's built-in feature. Just open the context menu for the type in Local Types window and select 'Export to header file' action.

Prerequisites

• pip install future - For Python 2 only.
• pip install clipboard - If you want to automatically copy EFI_GUID contents to the clipboard.

Plugin installation

Just copy ida-efitools2.py file and efitools2 folder to IDA's plugins directory.

Credits

@snare for original code base of ida-efiutils.
@danse-macabre for rewritten from scratch ida-efitools.
@djpohly, @al3xtjames, @vutung2311 for contributions (forks).
@p-state (me) for breathing a new life into this.