I'm looking to identify code changes in the latest UEFI release for my motherboard, to verify whether the changes include mitigations for the row hammer vulnerability. I'm specifically looking at the last 3 releases (2401, 2304, 2201) of the Asus Maximus VII Hero board, which can be downloaded here.
The UEFI binaries are provided as CAP files, which I'm not used to seeing. Apparently these are "UEFI Capsules", which Intel has a specification for, but I've tried both automatic analysis (with uefi-firmware-parser) and some manual digging to no avail. Running binwalk across them results in the usual noise of supposed LZMA blobs, but even once I grep past those I just run into a couple of false positive detections for encrypted data.
The actual data within alternates between repetitive, structured, and high-entropy (encrypted / compressed) blocks, but I can't find anything obvious. Running a bindiff across the different revisions shows me some majorly changed blocks, and some odd bytes here and there.
IDA doesn't seem to recognise anything in there as being EFI code, so I'm now stumped.
How can I get started with these CAP files? Is there any research out there that I should read? Are there any toolchains to work with them?