Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I want to analyse this UEFI bios here. When I open it in IDA it looks compressed to me. Also IDA lists the processor type as ZLOG. Shouldn't this be the multi processor setting for IDA?
Anyway, If I am not mistaken it's compressed and divided into some odd sections. How can I decompress this and look at this in more detail?
If this isn't compressed how can I go about doing some static analysis on this?
Thanks
Most UEFI implementations use a standard ROM layout (FFS - Flash File System), described in the UEFI's PI (Platform Initialization) specification. There are many tools and scripts which can parse this format, the simplest is probably UEFITool.
Probably the fastest and easiest way to get started with analyzing binaries such this is to begin with using binwalk to scan the file.
Here is the signature scan output for your file:
$ binwalk EFI64.ROM
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 UEFI PI Firmware Volume, volume size: 2097152, header size: 0, revision: 0, EFI Firmware File System v2, GUID: 8C8CE578-8A3D-4F1C-3599-896185C32DD3
332 0x14C Microsoft executable, portable (PE)
36864 0x9000 Microsoft executable, portable (PE)
90112 0x16000 Microsoft executable, portable (PE)
122880 0x1E000 Microsoft executable, portable (PE)
155648 0x26000 Microsoft executable, portable (PE)
221184 0x36000 Microsoft executable, portable (PE)
249924 0x3D044 Microsoft executable, portable (PE)
401408 0x62000 Microsoft executable, portable (PE)
434176 0x6A000 Microsoft executable, portable (PE)
462936 0x71058 LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 4636688 bytes
According to binwalk, this is a UEFI Platform Inititalization volume containing several PE files and a large LZMA-compressed block.
There is a large region of high entropy within the binary, indicating that compression or encryption is present, so it seems likely that the LZMA signature binwalk detected is a true positive. Visualization can help us see this:
Via binwalk plus the -E flag:
Via binvis.io (pink is high entropy, black is low entropy):
We can also try to extract the PE files and LZMA compressed block using the -e flag with binwalk. The extracted file is similar to the original but appears to contain many more PE files, plus strings and data:
_EFI64.ROM.extracted $ binwalk 71058
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
16 0x10 UEFI PI Firmware Volume, volume size: 4636672, header size: 0, revision: 0, EFI Firmware File System v2, GUID: 8C8CE578-8A3D-4F1C-3599-896185C32DD3
220 0xDC Microsoft executable, portable (PE)
29152 0x71E0 Microsoft executable, portable (PE)
57916 0xE23C Microsoft executable, portable (PE)
78508 0x132AC Microsoft executable, portable (PE)
123668 0x1E314 Microsoft executable, portable (PE)
140148 0x22374 Microsoft executable, portable (PE)
173004 0x2A3CC Microsoft executable, portable (PE)
193580 0x2F42C Microsoft executable, portable (PE)
214156 0x3448C Microsoft executable, portable (PE)
247771 0x3C7DB mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
251403 0x3D60B mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
288024 0x46518 Microsoft executable, portable (PE)
308624 0x4B590 Microsoft executable, portable (PE)
333292 0x515EC Microsoft executable, portable (PE)
419420 0x6665C Microsoft executable, portable (PE)
440012 0x6B6CC Microsoft executable, portable (PE)
456516 0x6F744 Microsoft executable, portable (PE)
477128 0x747C8 Microsoft executable, portable (PE)
497708 0x7982C Microsoft executable, portable (PE)
518328 0x7E8B8 Microsoft executable, portable (PE)
534844 0x8293C Microsoft executable, portable (PE)
551556 0x86A84 Microsoft executable, portable (PE)
576212 0x8CAD4 Microsoft executable, portable (PE)
617252 0x96B24 Microsoft executable, portable (PE)
650108 0x9EB7C Microsoft executable, portable (PE)
687140 0xA7C24 Microsoft executable, portable (PE)
805379 0xC4A03 mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
834684 0xCBC7C Microsoft executable, portable (PE)
888036 0xD8CE4 Microsoft executable, portable (PE)
912684 0xDED2C Microsoft executable, portable (PE)
937332 0xE4D74 Microsoft executable, portable (PE)
970180 0xECDC4 Microsoft executable, portable (PE)
990732 0xF1E0C Microsoft executable, portable (PE)
1019468 0xF8E4C Microsoft executable, portable (PE)
1052308 0x100E94 Microsoft executable, portable (PE)
1101532 0x10CEDC Microsoft executable, portable (PE)
1122116 0x111F44 Microsoft executable, portable (PE)
1224664 0x12AFD8 Microsoft executable, portable (PE)
1310756 0x140024 Microsoft executable, portable (PE)
1351772 0x14A05C Microsoft executable, portable (PE)
1372316 0x14F09C Microsoft executable, portable (PE)
1401060 0x1560E4 Microsoft executable, portable (PE)
1430052 0x15D224 Microsoft executable, portable (PE)
1458804 0x164274 Microsoft executable, portable (PE)
1487788 0x16B3AC Microsoft executable, portable (PE)
1516564 0x172414 Microsoft executable, portable (PE)
1533148 0x1764DC Microsoft executable, portable (PE)
1553740 0x17B54C Microsoft executable, portable (PE)
1650772 0x193054 Microsoft executable, portable (PE)
1683620 0x19B0A4 Microsoft executable, portable (PE)
1720548 0x1A40E4 Microsoft executable, portable (PE)
1757476 0x1AD124 Microsoft executable, portable (PE)
1790308 0x1B5164 Microsoft executable, portable (PE)
1827244 0x1BE1AC Microsoft executable, portable (PE)
1860084 0x1C61F4 Microsoft executable, portable (PE)
1892964 0x1CE264 Microsoft executable, portable (PE)
1913756 0x1D339C Microsoft executable, portable (PE)
1946836 0x1DB4D4 Microsoft executable, portable (PE)
1991980 0x1E652C Microsoft executable, portable (PE)
2037140 0x1F1594 Microsoft executable, portable (PE)
2057716 0x1F65F4 Microsoft executable, portable (PE)
2094676 0x1FF654 Microsoft executable, portable (PE)
2127516 0x20769C Microsoft executable, portable (PE)
2184932 0x2156E4 Microsoft executable, portable (PE)
2246444 0x22472C Microsoft executable, portable (PE)
2283396 0x22D784 Microsoft executable, portable (PE)
2303940 0x2327C4 Microsoft executable, portable (PE)
2349060 0x23D804 Microsoft executable, portable (PE)
2426948 0x250844 Microsoft executable, portable (PE)
2488452 0x25F884 Microsoft executable, portable (PE)
2517188 0x2668C4 Microsoft executable, portable (PE)
2562308 0x271904 Microsoft executable, portable (PE)
2607436 0x27C94C Microsoft executable, portable (PE)
2652564 0x287994 Microsoft executable, portable (PE)
2734564 0x29B9E4 Microsoft executable, portable (PE)
2826055 0x2B1F47 Neighborly text, "Neighbor Solicitation messages sent while performing Duplicate Address Detection on a tentative address. A value of zero indicatAddress Detection on a tentative address. A value of zero indicates that Duplicate Address Detection is not performed."
2841124 0x2B5A24 Microsoft executable, portable (PE)
2886244 0x2C0A64 Microsoft executable, portable (PE)
2935468 0x2CCAAC Microsoft executable, portable (PE)
2984732 0x2D8B1C Microsoft executable, portable (PE)
3005316 0x2DDB84 Microsoft executable, portable (PE)
3029964 0x2E3BCC Microsoft executable, portable (PE)
3054636 0x2E9C2C Microsoft executable, portable (PE)
3079324 0x2EFC9C Microsoft executable, portable (PE)
3099944 0x2F4D28 Microsoft executable, portable (PE)
3136900 0x2FDD84 Microsoft executable, portable (PE)
3157508 0x302E04 Microsoft executable, portable (PE)
3182196 0x308E74 Microsoft executable, portable (PE)
3206884 0x30EEE4 Microsoft executable, portable (PE)
3231580 0x314F5C Microsoft executable, portable (PE)
3256252 0x31AFBC Microsoft executable, portable (PE)
3272732 0x31F01C Microsoft executable, portable (PE)
3313804 0x32908C Microsoft executable, portable (PE)
3358956 0x3340EC Microsoft executable, portable (PE)
3388919 0x33B5F7 Copyright string: "Copyright (c) 1998-2002,2004,2006-2016 Glenn Randers-Pehrson"
3388980 0x33B634 Copyright string: "Copyright (c) 1996-1997 Andreas Dilger"
3389019 0x33B65B Copyright string: "Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc."
3389516 0x33B84C CRC32 polynomial table, little endian
3393612 0x33C84C CRC32 polynomial table, big endian
3416404 0x342154 Microsoft executable, portable (PE)
3436964 0x3471A4 PNG image, 16 x 23, 8-bit/color RGBA, non-interlaced
3437904 0x347550 Microsoft executable, portable (PE)
3456260 0x34BD04 Microsoft executable, portable (PE)
3480948 0x351D74 Microsoft executable, portable (PE)
3505628 0x357DDC Microsoft executable, portable (PE)
3530360 0x35DE78 Microsoft executable, portable (PE)
3591800 0x36CE78 Microsoft executable, portable (PE)
3608308 0x370EF4 Microsoft executable, portable (PE)
3628928 0x375F80 Microsoft executable, portable (PE)
3653612 0x37BFEC Microsoft executable, portable (PE)
3674284 0x3810AC Microsoft executable, portable (PE)
3740004 0x391164 Microsoft executable, portable (PE)
3789332 0x39D214 Microsoft executable, portable (PE)
3830392 0x3A7278 LZMA compressed data, properties: 0x5D, dictionary size: 16777216 bytes, uncompressed size: 33562 bytes
3840284 0x3A991C XML document, version: "1.0"
3849137 0x3ABBB1 Copyright string: "Copyright</key>"
3849162 0x3ABBCA Copyright string: "Copyright Apple Computer, Inc. 2000-2003. Copyright David Elliott 2007</string>"
3849204 0x3ABBF4 Copyright string: "Copyright David Elliott 2007</string>"
3849716 0x3ABDF4 XML document, version: "1.0"
3850010 0x3ABF1A Copyright string: "Copyright 2002-2006 Apple Computer, Inc.</string>"
3853372 0x3ACC3C XML document, version: "1.0"
3855380 0x3AD414 XML document, version: "1.0"
3888980 0x3B5754 XML document, version: "1.0"
3923772 0x3BDF3C Microsoft executable, portable (PE)
4577500 0x45D8DC CRC32 polynomial table, little endian
The entropy plot of the extracted file looks similar to the entropy of the first portion of the original file preceding the LZMA compressed block.
A possible next step in the analysis could be to verify that the signatures that binwalk detects as PE file headers are true positives and that there really are PE files embedded within. binwalk detects x86 opcodes (this might mean nothing because the architecture of the file is x86-64, but it seems relevant), and when a hex dump is examined, what appears to be PE file information can be seen:
$ binwalk -A 71058
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
3857660 0x3ADCFC Intel x86 instructions, function prologue
3857700 0x3ADD24 Intel x86 instructions, function prologue
3857740 0x3ADD4C Intel x86 instructions, function prologue
3857800 0x3ADD88 Intel x86 instructions, function prologue
3857860 0x3ADDC4 Intel x86 instructions, function prologue
3857920 0x3ADE00 Intel x86 instructions, function prologue
3857934 0x3ADE0E Intel x86 instructions, function prologue
3857992 0x3ADE48 Intel x86 instructions, function prologue
3858050 0x3ADE82 Intel x86 instructions, function prologue
3858102 0x3ADEB6 Intel x86 instructions, function prologue
3858160 0x3ADEF0 Intel x86 instructions, function prologue
3858212 0x3ADF24 Intel x86 instructions, function prologue
3858508 0x3AE04C Intel x86 instructions, function prologue
3858644 0x3AE0D4 Intel x86 instructions, function prologue
3858678 0x3AE0F6 Intel x86 instructions, function prologue
3858708 0x3AE114 Intel x86 instructions, function prologue
3858780 0x3AE15C Intel x86 instructions, function prologue
3858834 0x3AE192 Intel x86 instructions, function prologue
3858858 0x3AE1AA Intel x86 instructions, function prologue
3858882 0x3AE1C2 Intel x86 instructions, function prologue
Side-by-side hex dump of EFI64.ROM and the extracted file via binwalk -W -l 6000 ../EFI64.ROM 71058 (note the strings PE, .text, .data - click on the image to enlarge it):
You can try slicing out the bytes extending from one PE header to another and disassembling it. If the slice can be disassembled and the disassembly looks correct, it probably really is a PE file. If this is the case, the same methodology can be applied to extract the rest of the embedded PE files.
It's not compressed, it's just has some format IDA doesn't recognize, so it makes a wrong assumption that it's code for zilog processor. You should select Meta PC processor instead, and then specify that you want to process it as 32-bit code. It'll allow you to see some pieces of the code. But you'll have to learn the format of this EFI64.ROM file in order to load it properly to IDA. Otherwise the code will loaded to the wrong addresses and will not address the proper data (i.e. string, function addresses and constants).
