4

I'm looking to identify code changes in the latest UEFI release for my motherboard, to verify whether the changes include mitigations for the row hammer vulnerability. I'm specifically looking at the last 3 releases (2401, 2304, 2201) of the Asus Maximus VII Hero board, which can be downloaded here.

The UEFI binaries are provided as CAP files, which I'm not used to seeing. Apparently these are "UEFI Capsules", which Intel has a specification for, but I've tried both automatic analysis (with uefi-firmware-parser) and some manual digging to no avail. Running binwalk across them results in the usual noise of supposed LZMA blobs, but even once I grep past those I just run into a couple of false positive detections for encrypted data.

The actual data within alternates between repetitive, structured, and high-entropy (encrypted / compressed) blocks, but I can't find anything obvious. Running a bindiff across the different revisions shows me some majorly changed blocks, and some odd bytes here and there.

IDA doesn't seem to recognise anything in there as being EFI code, so I'm now stumped.

How can I get started with these CAP files? Is there any research out there that I should read? Are there any toolchains to work with them?

Improve this question

2 Answers 2

Reset to default
3

Someone pointed me to UEFITool, which does exactly what I wanted. There's also an extractor version which dumps out all the separate nested binary components to directories. From this I was able to go through and analyse individual modules in IDA (they're x86 PE files, so it's easy).

I've not got quite as far as identifying whether the rowhammer mitigations are in place, but I'm writing some scripts to do bindiffs of each changed component, which should hopefully give me some idea of what I'm looking for.

Improve this answer
2

The firmware isn't contained in an area denoted by a normal EFI_CAPSULE_GUID, like the specification your link describes. I can't find reference to the GUID in that CAP file in a public specification.

You can use this python script to strip off the capsule and then the resulting firmware file can be parsed with uefi-firmware-parser.

Alternatively, if you're using IDA, this looks like it might be pretty useful - it seems to be aware of the strange GUID.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.