1

I have saved a copy of the UEFI firmware currently running on my motherboard through the built-in flash utility. Now I want to compare the firmware dump with the newest firmware update from the manufacture to find out what have changed between the two versions. Both files are of the type Intel serial flash for PCH ROM.

I want to make sure the new version isn't malicious and I'm unable to verify the integrity in any other way, as the manufacture doesn't provide any checksums and the update is only available over plain HTTP. However, I'm not sure how to get started with this.

The built-in flash utility must add system specific data to the firmware dump, because everytime I save the firmware it has a different hash. I guess this should be stripped somehow to prevent it from complicating the process...

Any tips, suggestions etc. on how I can get started is highly appreciated.

1

The dump is likely different due to NVRAM data (basically settings which need to be saved between boots or even BIOS updates, such as boot device, RAM timings, serial number/MAC address and so on). The contents of the firmware volumes containing code should not change between boots.

There are at least two options I know of to check for differences between UEFI ROM dumps:

  • UEFITool or the sister project UEFIextract: extract both images then compare using a standard file diffing tool (e.g. Beyond Compare or even diff).

  • chipsec project has a whitelist module which is intended to verify that the list of UEFI modules has not changed:


The module can generate a list of EFI executables from (U)EFI firmware file or
extracted from flash ROM, and then later check firmware image in flash ROM or
file against this list of [expected/whitelisted] executables

Usage:

  ``chipsec_main -m tools.uefi.whitelist [-a generate|check,<json>,<fw_image>]``

    - ``generate``  Generates a list of EFI executable binaries from the UEFI

                        firmware image (default)

    - ``check``     Decodes UEFI firmware image and checks all EFI executable

                        binaries against a specified list

    - ``json``      JSON file with configuration of white-listed EFI

                        executables (default = ``efilist.json``)

    - ``fw_image``  Full file path to UEFI firmware image. If not specified,

                        the module will dump firmware image directly from ROM



Examples:



>>> chipsec_main -m tools.uefi.whitelist



Creates a list of EFI executable binaries in ``efilist.json`` from the firmware

image extracted from ROM



>>> chipsec_main -i -n -m tools.uefi.whitelist -a generate,efilist.json,uefi.rom



Creates a list of EFI executable binaries in ``efilist.json`` from ``uefi.rom``

firmware binary 



>>> chipsec_main -i -n -m tools.uefi.whitelist -a check,efilist.json,uefi.rom



Decodes ``uefi.rom`` UEFI firmware image binary and checks all EFI executables

in it against a list defined in ``efilist.json``

Note that a BIOS update by its nature will mean some modules will change (due to bugfixes/new features etc.) but this should at least let you know which specific parts changed and maybe even inspect them in detail.

  • Thanks. chipsec was exactly what I needed. I now have a clear overview of what modules have been added/removed/modified. It has also made it clear to me that I won't be able to verify that the changes aren't malicious, as there are over 200 modified modules that would have to be reverse engineered. However, only a few new modules have been added and as far as I know, a malicious modification of UEFI firmware will usually be in the form of an added module, so if I can just verify the new modules I think it's unlikely that my firmware update has been modified. – Ken Hansen Jul 29 '17 at 0:27
  • Both methods are incorrect. Executable modules of the format PE+ contain the field "TimeDateStamp". Even two identical Firmware clones repeatedly created from source will be different. In "PEIM" modules, the "ImageBase" field is equal to their position in Firmware (almost always). Changing position of this module reduce Relocs changing. Chipsec current version 1.3.2 calculates hashes using the same field (not clear). "WhiteList" now is a big pile of garbage and nothing more. Public tools for compare two "Firmware" absent now. More in detail I can write in Russian (if interested) – Alex V Sep 5 '17 at 12:30
  • @AlexV: you really think each new BIOS release is rebuilt from scratch? I really doubt that; I expect that only the modules which need changes are updated. Anyway, if you think chipsec's whitelist feature is flawed, I invite you to make an issue on their tracker and explain the problems, this is a wrong place to discuss it. However, it was obviously useful to Ken. P.S. if you have a better idea of how to compare the differences, please post a proper answer, don't misuse answer box for comments. – Igor Skochinsky Sep 5 '17 at 18:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.