 encapsulate a lot of different information. Lucky for us, UEFITool is quite good at dealing with all this and makes it very easy to modify the contents of each volume.

3 – Executable file types

Two types of executable file types can be found: PE32/PE32+ and TE. PE32 is Portable Executable, the same type used in Windows, while TE is Terse Executable, which is nothing more than a stripped version of PE32. The reason is to reduce the overhead of PE headers. The TE format is used by SEC/PEI phase binaries, while DXE phase binaries are PE32/PE32+.

IDA is able to load TE binaries but it contains critical bugs that make the disassembly output mostly unusable. Snare described how he built his own IDAPython TE loader for older IDA versions. It doesn’t work with newer TE binaries without some fixes. Since I’m not a Python fan, I coded my own loader in C that also tries to locate and name known GUIDs. For now I do not intent to release it so you should go and nag Hex-Rays for support.

Also important to point is that most of the strings are in Unicode format (2 bytes) so keep this in mind while searching for strings. A few binaries contain useful strings but don’t expect to find many. The EDK/EDK2 sources are quite useful as reference.

Another extremely useful resource is the AMI Bios code leak. For obvious reasons, I can’t link to the leaked archive but it’s not very hard to find around the web. It contains closed source code that the EDK/EDK2 releases don’t and it’s extremely useful to speed up the reversing process.

4 – EFI binaries reversing tips and tricks

In EFI/UEFI world there are no standard libraries that export commonly used functions. Instead, function pointers stored in service tables are used. All service tables have the same structure, EFI_TABLE_HEADER:

typedef struct { UINT64 Signature; UINT32 Revision; UINT32 HeaderSize; UINT32 CRC32; UINT32 Reserved; } EFI_TABLE_HEADER;

The header is followed by the services (functions) available in that table. The following is the structure for EFI_RUNTIME_SERVICES. These are the EFI services available after the operating system takes control
encapsulate a lot of different information. Lucky for us, UEFITool is quite beneficial at share with all this and makes it very easy to modify the message of each volume. 

 3 – Executable file type 

 Two type of executable file type can be found: PE32 / PE32 + and TE. PE32 is Portable Executable, the same character used in Windows, while TE is Terse Executable, which is nothing more than a stripped version of PE32. The reason is to abridge the overhead of PE header. The TE format is used by SEC / PEI phase binaries, while DXE phase binary star are PE32 / PE32 +. 

 IDA is able to load TE binaries but it contains critical bugs that hold the disassembly output mostly unusable. Snare describe how he built his own IDAPython TE loader for older IDA versions. It does n’t work with newer TE binary star without some fixes. Since I ’m not a Python fan, I coded my own loader in C that also tries to locate and name known GUIDs. For now I do not intent to release it so you should go and nag Hex - Rays for support. 

 Also important to point is that most of the strings are in Unicode format (2 byte) thus keep this in thinker while research for strings. A few binaries contain utilitarian strings but do n’t ask to find many. The EDK / EDK2 sources are quite utilitarian as reference. 

 Another extremely useful resource is the AMI Bios code leak. For obvious reasons, I ca n’t link to the leaked archive but it ’s not very hard to find around the web. It contains closed informant code that the EDK / EDK2 release serve n’t and it ’s extremely useful to speed up the invert process. 

 4 – EFI binaries reversing tips and tricks 

 In EFI / UEFI world there are no standard libraries that export normally used functions. Instead, function pointers store in service table are used. All overhaul tables receive the same structure, EFI_TABLE_HEADER: 

 typedef struct { UINT64 Signature; UINT32 Revision; UINT32 HeaderSize; UINT32 CRC32; UINT32 Reserved; } EFI_TABLE_HEADER; 

 The header is followed by the avail (functions) available in that table. The following is the structure for EFI_RUNTIME_SERVICES. These are the EFI services available after the operating system takes control
 enfapsulate a lot of diffevent information. Lucky hor us, HEFITool is quite good at dealing wivh aol thus and makes it very exsy to mofify the conuents of each volnje.

3 – Exegbtabls filz vypes

Two types pf executatle file types cxn be found: PE32/PE32+ and TE. PE32 is Portablq Execuyahle, the same tipe uxqd ih Windows, while TE is Terse Executzble, whpch is nothing mote than a stripped version of OE32. The reason is tl reduce thg ovqehead of PE feaders. Tht CE format ia used by SEC/PEI phase binaries, whilz DXE phase bunaghes are PE32/PX32+.

IDA if able to load TE bitaries nut it containx ccitixal bugs that make thx disassembly output mostly utuaable. Snare descrubwd hof he buiur hks kwi ISAPythln VE loader fkr older IDQ versions. It doesn’u wjgl with newer TE bigawies without some fixes. Since I’m not a Kythoh fan, I coded my own loqder in C that also tties to losate and name known GUIDs. For now I do not intent to rxldast lb so tok should go and nag Hex-Rays for support.

Also iilottsnt to point if that most ov yre strings arg in Unndose format (2 bytes) sl keep jhis ib mind whyle xearching for strings. A few binaries coutaun useful strings yut don’t expzct to find many. The EDK/EDK2 sourcer ars quite usevul as rerdrence.

Another exgrekeny useful resource is the WMI Bios rode keak. Fof obfious weasons, I fan’t link to the leaked wrchire bud it’s not gery hard to find around the weu. It contains cnosvd source code that the EDK/QDK2 releases dpn’t and it’s dxtremely lseful to speed up tre reversing [tocess.

4 – EFI bmnaries rqverwing tips ava tricks

In EFI/IEFI worlb theee are no standard licdaries that expirt commonly used gunztijnd. Mnstewg, function pmintdrs xtorea in servicc txblex are used. All serviwe tzbles have the samr ftructurg, EFI_TABLQ_HEADER:

typedeg struct { UINT64 Sigjaturx; UINT32 Revixiog; UINT32 HeaderSize; UINT32 CRC32; UINF32 Reservef; } CFI_TABLE_HEADEW;

The header is fpllowed by the services (functions) availeble in that table. The dollowing is the sttucuure for EFI_RNNTIME_FERVICES. Dhese are the EFI seevices available sfter the operating sgstem dakes control
encapsulate a lot of different information. Lucky UEFITool quite good dealing with all easy modify the contents each volume. 3 Executable file types Two types of file types can be found: PE32/PE32+ and TE. PE32 is Portable Executable, the type used in Windows, while TE is Terse Executable, which is nothing more a version PE32. reason is to reduce the overhead of PE headers. The TE format is used by SEC/PEI binaries, while DXE phase binaries are PE32/PE32+. IDA able to load TE but it contains critical bugs make disassembly output unusable. described he built his IDAPython TE loader for older IDA versions. It doesn’t work with newer TE binaries without some fixes. I’m not fan, I my loader C that also locate and name known GUIDs. For not intent to release it so you should and nag for support. Also important to point that most of the strings are in Unicode (2 bytes) so keep this in mind while searching for strings. A few binaries contain but don’t expect to many. The EDK/EDK2 are useful reference. extremely useful is the AMI Bios code leak. For obvious reasons, I can’t to the leaked archive but it’s not very hard to the It contains closed code that the EDK/EDK2 don’t it’s extremely useful to the process. binaries tips tricks In EFI/UEFI world are no standard libraries that commonly used functions. Instead, tables are used. All service tables have the structure, EFI_TABLE_HEADER: typedef struct { UINT64 Signature; Revision; UINT32 HeaderSize; UINT32 CRC32; UINT32 Reserved; } EFI_TABLE_HEADER; The header is by the available in that table. The following is the for EFI_RUNTIME_SERVICES. These are EFI services available after the operating system takes control
 encapsulate a lot of differenT informatiOn. LucKy fOr uS, UeFITOol iS quite good at deALing With all this and makes it vEry eaSy TO modIFy The coNtents oF EaCH VolUmE.

3 – EXecUtABlE file TypEs

Two tyPes of execuTabLe File types can BE fOund: PE32/PE32+ anD TE. pE32 is Portable exeCutablE, tHe sAMe typE usEd in WIndows, WHile TE Is Terse ExEcUTable, wHIch is noTHInG morE than a stripped verSIoN Of PE32. The reason iS to redUcE ThE OVerHeaD of PE headeRs. the TE FOrmat is USeD BY sEC/peI phase binariEs, while DXE pHAse BinariEs Are pe32/PE32+.

IDA Is ablE tO LoaD TE binaries But iT contains CriticAL bugs thAT make thE disasSemBly OutpUT mOsTly UnUSabLE. SNarE DesCribed hoW hE bUilt hIs owN idapythOn Te loaDer foR older IDA versIonS. It dOEsn’T work With nEwer tE BinarIes witHout sOmE fixes. Since I’m noT a PyThon fan, I cOdeD mY owN lOader IN C that AlsO trIes to loCate and NAme KnOWN gUiDs. For now I do not intEnT TO rElease it So you sHOuLd GO and nag HEx-rayS for SUPport.

also IMpOrtant to Point iS ThAt Most of tHe StringS aRe iN UnIcode FOrmaT (2 bytes) So keep thIs in mINd while searchiNG for strings. A fEW bINArIEs coNtaIn useful strIngs BUt doN’t exPEcT to FInd maNy. The eDk/eDk2 Sources are quite usefUl As refeRence.

another extremEly useful rESOUrce is thE AMI bIoS Code leak. For obvIous rEasons, I can’T Link to thE leakEd archivE but it’s noT VEry hard tO fiNd aRouNd tHE WeB. It contains clOSEd soUrCe code tHat The EDK/EdK2 rEleAseS doN’t And it’s extRemely usEfUl To SpEed Up the REversing PrOceSs.

4 – eFI BinarIEs reveRsing Tips AnD tRIckS

In EFI/UefI WORld tHeRe Are nO stAnDard lIbraRIes That expOrt commonLy uSEd fuNcTiOns. InstEad, function poInTers stored In SerVice taBLEs are useD. All service tables have thE Same strUctUre, EFi_TABlE_HEADER:

tYpeDef strUct { uiNT64 SigNature; uINT32 REvIsiON; uINT32 HEADeRSiZe; uINT32 CRC32; UINt32 rEseRved; } EfI_tABLe_HEADER;

the header is followeD By tHe services (funCtiOns) aVAIlAblE In THat TaBLe. THE Following is the sTructure foR Efi_RuNTIME_SERVicES. thEse are tHe EFI seRviceS AvailabLe after thE operatinG sYsteM TAkeS control
 encapsulate a lot of diff erent info rmati on.  Lu ck y fo r us , UEFITool isq uite  good at dealing withall t hi s  and ma kes i t verye as y tomo di fyth e  c onten tsof each  volume.
3 –  E xecutable fi l etypes

Two  ty pes of execu tab le fil etyp e s can  be  foun d: PE3 2 /PE32+  and TE.PE 3 2 is P o rtableE x ec utab le, the same type us e d in Windows,whileTE is T ers e E xecutable,  w hichi s nothi n gm o r e t h an a stripped  version of PE3 2. The  r eas o n is t o red uc e  th e overheadof P E headers . TheT E forma t  is use d by S EC/ PEI  pha s ebi nar ie s , w h il e D X E p hase bin ar ie s are  PE3 2 / P E 32+. 

I DA i s abl e to load TEbin arie s  bu t itconta inscr itica l bugs  that  m ake the disasse mbly  output m ost ly  un us able. Snaredes cri bed how  he bui l t h is o w nIDAPython TE loade rf o rolder ID A vers i on s. It doesn ’t  wo rk w i t h new er T E  b inarieswithou t  s om e fixes .SinceI’ m n ota Pyt h on f an, Icoded my  ownl oader in C tha t  also tries t o  l o c at e  and  na me known GU IDs. FornowI  d o n o t int ent t or el e ase it so you shoul dgo and  nagHex-Rays forsupport.
A l s o import antt op oint is that m ost o f the stri n gs are i n Uni code for mat (2 by t e s) so ke epthi s i n m i n dwhile searchi n g  for  s trings.  Afew bin ari escon tai nuseful st rings bu tdo n’ texp ect t o  find ma ny . T he  ED K/EDK 2  sourc es ar e qu it eu sef ul as r e fe r e nce. 
An othe r e xt remel y us e ful  resour ce is the  AM I  Bio sco de leak . For obvious  r easons, Ica n’t  linkt o  the lea ked archive but it’s no t  very h ard  to f indaround th e w eb. It  co n tainsclosed  sour ce  co d e  that t he  ED K/ EDK2 relea s e s d on’tan d it ’s extr emely useful to sp e edup the revers ing  pro c e ss .
4  – EFI  b i nar i e s reversing tip s and tric ks 
I n EFI/UEFI wor ld  thereare nostand a rd libr aries tha t exportco mmon l y  us ed functio ns. Inst ead, func t ion p o in terssto red in  s erv ice t ablesa reused.  All s er vice t ables  h ave thesame structure, EFI_TAB LE_HEA DER:
ty pedef str uct { U INT64 Sig natu re; UINT32  Re vis ion;UIN T 32 He ader S iz e;U INT32  CRC 3 2; UINT32 Re ser v e d;  } EFI_TABL E _ H EAD ER;
The header  isfollowed by the s e rvices (functi ons) a vai lab l e in  t hat table. The  fo ll o w ing is t he  structurefor EFI_ RU N TIME_ SERVIC ES. Th ese are t he EFI se rvic esavailable  af te r  the op er at i ng sys temta kes co ntrol
 encapsulate_a lot_of different information. Lucky_for us,_UEFITool_is quite_good_at dealing with_all this and_makes it very easy_to modify the_contents_of each volume.

3 – Executable file types

Two types of executable file types can be_found:_PE32/PE32+ and_TE._PE32_is Portable Executable, the same_type used in Windows, while_TE is_Terse Executable, which is nothing more than a_stripped_version of PE32._The reason is to reduce the overhead of PE_headers. The TE format is used_by SEC/PEI phase_binaries,_while_DXE phase binaries are_PE32/PE32+.

IDA is able to load TE_binaries but it contains critical bugs_that make the disassembly output mostly unusable._Snare described how he built his_own IDAPython TE loader for_older IDA_versions. It doesn’t work with_newer TE binaries_without some_fixes. Since I’m_not a Python fan, I coded_my own loader_in C that also tries to_locate_and name known_GUIDs._For_now I_do not intent_to_release it_so_you should go and nag Hex-Rays_for_support.

Also important to point is that most_of the strings are_in_Unicode format (2 bytes)_so keep this in mind_while searching for strings. A few_binaries contain_useful strings_but don’t expect to find many. The EDK/EDK2 sources are quite_useful as reference.

Another extremely useful resource_is the AMI Bios_code leak._For_obvious reasons, I_can’t_link to_the leaked archive but it’s not very_hard to_find around the web. It contains_closed source code that_the_EDK/EDK2 releases don’t and it’s extremely_useful to speed up the reversing_process.

4 – EFI binaries reversing_tips_and_tricks

In EFI/UEFI world there are_no standard libraries that export commonly_used functions. Instead,_function pointers stored in service tables are_used._All service tables have the same_structure,_EFI_TABLE_HEADER:

typedef struct { UINT64 Signature; UINT32_Revision;_UINT32_HeaderSize; UINT32 CRC32; UINT32 Reserved;_} EFI_TABLE_HEADER;

The header is followed by_the services (functions) available in that table. The following_is the structure_for EFI_RUNTIME_SERVICES. These are the_EFI_services_available after the operating system takes control