1

I want to analyse this UEFI bios here. When I open it in IDA it looks compressed to me. Also IDA lists the processor type as ZLOG. Shouldn't this be the multi processor setting for IDA?

Anyway, If I am not mistaken it's compressed and divided into some odd sections. How can I decompress this and look at this in more detail?

If this isn't compressed how can I go about doing some static analysis on this?

Thanks

2

Most UEFI implementations use a standard ROM layout (FFS - Flash File System), described in the UEFI's PI (Platform Initialization) specification. There are many tools and scripts which can parse this format, the simplest is probably UEFITool.

enter image description here

  • I want to say that I like all these answers. So it's very difficult for me to choose just one as I see them all helpful. @Igor Skochinsky, how did you get names for the sections ? I just see GUIDs for each of them . – Qndel Dec 11 '17 at 11:13
  • 1
    latest (alpha) releases of UEFITool include a database of Guid-> name mappings. – Igor Skochinsky Dec 11 '17 at 11:15
3

Probably the fastest and easiest way to get started with analyzing binaries such this is to begin with using binwalk to scan the file.

Here is the signature scan output for your file:

$ binwalk EFI64.ROM 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             UEFI PI Firmware Volume, volume size: 2097152, header size: 0, revision: 0, EFI Firmware File System v2, GUID: 8C8CE578-8A3D-4F1C-3599-896185C32DD3
332           0x14C           Microsoft executable, portable (PE)
36864         0x9000          Microsoft executable, portable (PE)
90112         0x16000         Microsoft executable, portable (PE)
122880        0x1E000         Microsoft executable, portable (PE)
155648        0x26000         Microsoft executable, portable (PE)
221184        0x36000         Microsoft executable, portable (PE)
249924        0x3D044         Microsoft executable, portable (PE)
401408        0x62000         Microsoft executable, portable (PE)
434176        0x6A000         Microsoft executable, portable (PE)
462936        0x71058         LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 4636688 bytes

According to binwalk, this is a UEFI Platform Inititalization volume containing several PE files and a large LZMA-compressed block.

There is a large region of high entropy within the binary, indicating that compression or encryption is present, so it seems likely that the LZMA signature binwalk detected is a true positive. Visualization can help us see this:

Via binwalk plus the -E flag:

binwalk entropy plot

Via binvis.io (pink is high entropy, black is low entropy):

binvis entropy plot

We can also try to extract the PE files and LZMA compressed block using the -e flag with binwalk. The extracted file is similar to the original but appears to contain many more PE files, plus strings and data:

_EFI64.ROM.extracted $ binwalk 71058

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
16            0x10            UEFI PI Firmware Volume, volume size: 4636672, header size: 0, revision: 0, EFI Firmware File System v2, GUID: 8C8CE578-8A3D-4F1C-3599-896185C32DD3
220           0xDC            Microsoft executable, portable (PE)
29152         0x71E0          Microsoft executable, portable (PE)
57916         0xE23C          Microsoft executable, portable (PE)
78508         0x132AC         Microsoft executable, portable (PE)
123668        0x1E314         Microsoft executable, portable (PE)
140148        0x22374         Microsoft executable, portable (PE)
173004        0x2A3CC         Microsoft executable, portable (PE)
193580        0x2F42C         Microsoft executable, portable (PE)
214156        0x3448C         Microsoft executable, portable (PE)
247771        0x3C7DB         mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
251403        0x3D60B         mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
288024        0x46518         Microsoft executable, portable (PE)
308624        0x4B590         Microsoft executable, portable (PE)
333292        0x515EC         Microsoft executable, portable (PE)
419420        0x6665C         Microsoft executable, portable (PE)
440012        0x6B6CC         Microsoft executable, portable (PE)
456516        0x6F744         Microsoft executable, portable (PE)
477128        0x747C8         Microsoft executable, portable (PE)
497708        0x7982C         Microsoft executable, portable (PE)
518328        0x7E8B8         Microsoft executable, portable (PE)
534844        0x8293C         Microsoft executable, portable (PE)
551556        0x86A84         Microsoft executable, portable (PE)
576212        0x8CAD4         Microsoft executable, portable (PE)
617252        0x96B24         Microsoft executable, portable (PE)
650108        0x9EB7C         Microsoft executable, portable (PE)
687140        0xA7C24         Microsoft executable, portable (PE)
805379        0xC4A03         mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
834684        0xCBC7C         Microsoft executable, portable (PE)
888036        0xD8CE4         Microsoft executable, portable (PE)
912684        0xDED2C         Microsoft executable, portable (PE)
937332        0xE4D74         Microsoft executable, portable (PE)
970180        0xECDC4         Microsoft executable, portable (PE)
990732        0xF1E0C         Microsoft executable, portable (PE)
1019468       0xF8E4C         Microsoft executable, portable (PE)
1052308       0x100E94        Microsoft executable, portable (PE)
1101532       0x10CEDC        Microsoft executable, portable (PE)
1122116       0x111F44        Microsoft executable, portable (PE)
1224664       0x12AFD8        Microsoft executable, portable (PE)
1310756       0x140024        Microsoft executable, portable (PE)
1351772       0x14A05C        Microsoft executable, portable (PE)
1372316       0x14F09C        Microsoft executable, portable (PE)
1401060       0x1560E4        Microsoft executable, portable (PE)
1430052       0x15D224        Microsoft executable, portable (PE)
1458804       0x164274        Microsoft executable, portable (PE)
1487788       0x16B3AC        Microsoft executable, portable (PE)
1516564       0x172414        Microsoft executable, portable (PE)
1533148       0x1764DC        Microsoft executable, portable (PE)
1553740       0x17B54C        Microsoft executable, portable (PE)
1650772       0x193054        Microsoft executable, portable (PE)
1683620       0x19B0A4        Microsoft executable, portable (PE)
1720548       0x1A40E4        Microsoft executable, portable (PE)
1757476       0x1AD124        Microsoft executable, portable (PE)
1790308       0x1B5164        Microsoft executable, portable (PE)
1827244       0x1BE1AC        Microsoft executable, portable (PE)
1860084       0x1C61F4        Microsoft executable, portable (PE)
1892964       0x1CE264        Microsoft executable, portable (PE)
1913756       0x1D339C        Microsoft executable, portable (PE)
1946836       0x1DB4D4        Microsoft executable, portable (PE)
1991980       0x1E652C        Microsoft executable, portable (PE)
2037140       0x1F1594        Microsoft executable, portable (PE)
2057716       0x1F65F4        Microsoft executable, portable (PE)
2094676       0x1FF654        Microsoft executable, portable (PE)
2127516       0x20769C        Microsoft executable, portable (PE)
2184932       0x2156E4        Microsoft executable, portable (PE)
2246444       0x22472C        Microsoft executable, portable (PE)
2283396       0x22D784        Microsoft executable, portable (PE)
2303940       0x2327C4        Microsoft executable, portable (PE)
2349060       0x23D804        Microsoft executable, portable (PE)
2426948       0x250844        Microsoft executable, portable (PE)
2488452       0x25F884        Microsoft executable, portable (PE)
2517188       0x2668C4        Microsoft executable, portable (PE)
2562308       0x271904        Microsoft executable, portable (PE)
2607436       0x27C94C        Microsoft executable, portable (PE)
2652564       0x287994        Microsoft executable, portable (PE)
2734564       0x29B9E4        Microsoft executable, portable (PE)
2826055       0x2B1F47        Neighborly text, "Neighbor Solicitation messages sent while performing Duplicate Address Detection on a tentative address. A value of zero indicatAddress Detection on a tentative address. A value of zero indicates that Duplicate Address Detection is not performed."
2841124       0x2B5A24        Microsoft executable, portable (PE)
2886244       0x2C0A64        Microsoft executable, portable (PE)
2935468       0x2CCAAC        Microsoft executable, portable (PE)
2984732       0x2D8B1C        Microsoft executable, portable (PE)
3005316       0x2DDB84        Microsoft executable, portable (PE)
3029964       0x2E3BCC        Microsoft executable, portable (PE)
3054636       0x2E9C2C        Microsoft executable, portable (PE)
3079324       0x2EFC9C        Microsoft executable, portable (PE)
3099944       0x2F4D28        Microsoft executable, portable (PE)
3136900       0x2FDD84        Microsoft executable, portable (PE)
3157508       0x302E04        Microsoft executable, portable (PE)
3182196       0x308E74        Microsoft executable, portable (PE)
3206884       0x30EEE4        Microsoft executable, portable (PE)
3231580       0x314F5C        Microsoft executable, portable (PE)
3256252       0x31AFBC        Microsoft executable, portable (PE)
3272732       0x31F01C        Microsoft executable, portable (PE)
3313804       0x32908C        Microsoft executable, portable (PE)
3358956       0x3340EC        Microsoft executable, portable (PE)
3388919       0x33B5F7        Copyright string: "Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson"
3388980       0x33B634        Copyright string: "Copyright (c) 1996-1997 Andreas Dilger"
3389019       0x33B65B        Copyright string: "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc."
3389516       0x33B84C        CRC32 polynomial table, little endian
3393612       0x33C84C        CRC32 polynomial table, big endian
3416404       0x342154        Microsoft executable, portable (PE)
3436964       0x3471A4        PNG image, 16 x 23, 8-bit/color RGBA, non-interlaced
3437904       0x347550        Microsoft executable, portable (PE)
3456260       0x34BD04        Microsoft executable, portable (PE)
3480948       0x351D74        Microsoft executable, portable (PE)
3505628       0x357DDC        Microsoft executable, portable (PE)
3530360       0x35DE78        Microsoft executable, portable (PE)
3591800       0x36CE78        Microsoft executable, portable (PE)
3608308       0x370EF4        Microsoft executable, portable (PE)
3628928       0x375F80        Microsoft executable, portable (PE)
3653612       0x37BFEC        Microsoft executable, portable (PE)
3674284       0x3810AC        Microsoft executable, portable (PE)
3740004       0x391164        Microsoft executable, portable (PE)
3789332       0x39D214        Microsoft executable, portable (PE)
3830392       0x3A7278        LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 33562 bytes
3840284       0x3A991C        XML document, version: "1.0"
3849137       0x3ABBB1        Copyright string: "Copyright</key>"
3849162       0x3ABBCA        Copyright string: "Copyright Apple Computer, Inc. 2000-2003. Copyright David Elliott 2007</string>"
3849204       0x3ABBF4        Copyright string: "Copyright David Elliott 2007</string>"
3849716       0x3ABDF4        XML document, version: "1.0"
3850010       0x3ABF1A        Copyright string: "Copyright 2002-2006 Apple Computer, Inc.</string>"
3853372       0x3ACC3C        XML document, version: "1.0"
3855380       0x3AD414        XML document, version: "1.0"
3888980       0x3B5754        XML document, version: "1.0"
3923772       0x3BDF3C        Microsoft executable, portable (PE)
4577500       0x45D8DC        CRC32 polynomial table, little endian

extracted entropy plot

The entropy plot of the extracted file looks similar to the entropy of the first portion of the original file preceding the LZMA compressed block.

A possible next step in the analysis could be to verify that the signatures that binwalk detects as PE file headers are true positives and that there really are PE files embedded within. binwalk detects x86 opcodes (this might mean nothing because the architecture of the file is x86-64, but it seems relevant), and when a hex dump is examined, what appears to be PE file information can be seen:

 $ binwalk -A 71058

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
3857660       0x3ADCFC        Intel x86 instructions, function prologue
3857700       0x3ADD24        Intel x86 instructions, function prologue
3857740       0x3ADD4C        Intel x86 instructions, function prologue
3857800       0x3ADD88        Intel x86 instructions, function prologue
3857860       0x3ADDC4        Intel x86 instructions, function prologue
3857920       0x3ADE00        Intel x86 instructions, function prologue
3857934       0x3ADE0E        Intel x86 instructions, function prologue
3857992       0x3ADE48        Intel x86 instructions, function prologue
3858050       0x3ADE82        Intel x86 instructions, function prologue
3858102       0x3ADEB6        Intel x86 instructions, function prologue
3858160       0x3ADEF0        Intel x86 instructions, function prologue
3858212       0x3ADF24        Intel x86 instructions, function prologue
3858508       0x3AE04C        Intel x86 instructions, function prologue
3858644       0x3AE0D4        Intel x86 instructions, function prologue
3858678       0x3AE0F6        Intel x86 instructions, function prologue
3858708       0x3AE114        Intel x86 instructions, function prologue
3858780       0x3AE15C        Intel x86 instructions, function prologue
3858834       0x3AE192        Intel x86 instructions, function prologue
3858858       0x3AE1AA        Intel x86 instructions, function prologue
3858882       0x3AE1C2        Intel x86 instructions, function prologue

Side-by-side hex dump of EFI64.ROM and the extracted file via binwalk -W -l 6000 ../EFI64.ROM 71058 (note the strings PE, .text, .data - click on the image to enlarge it):

hex dump

You can try slicing out the bytes extending from one PE header to another and disassembling it. If the slice can be disassembled and the disassembly looks correct, it probably really is a PE file. If this is the case, the same methodology can be applied to extract the rest of the embedded PE files.

1

It's not compressed, it's just has some format IDA doesn't recognize, so it makes a wrong assumption that it's code for zilog processor. You should select Meta PC processor instead, and then specify that you want to process it as 32-bit code. It'll allow you to see some pieces of the code. But you'll have to learn the format of this EFI64.ROM file in order to load it properly to IDA. Otherwise the code will loaded to the wrong addresses and will not address the proper data (i.e. string, function addresses and constants).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.