Hot answers tagged


Probably the fastest and easiest way to get started with analyzing binaries such this is to begin with using binwalk to scan the file. Here is the signature scan output for your file: $ binwalk EFI64.ROM DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 ...


IDA 7.0 is x64 application, i.e. both ida.exe and ida64.exe are built for x64, despite the naming. So you won't be able to run 7.0 on x86 at all. Use IDA versions previous to 7.0.


Most UEFI implementations use a standard ROM layout (FFS - Flash File System), described in the UEFI's PI (Platform Initialization) specification. There are many tools and scripts which can parse this format, the simplest is probably UEFITool.


It's not compressed, it's just has some format IDA doesn't recognize, so it makes a wrong assumption that it's code for zilog processor. You should select Meta PC processor instead, and then specify that you want to process it as 32-bit code. It'll allow you to see some pieces of the code. But you'll have to learn the format of this EFI64.ROM file in order ...

Only top voted, non community-wiki answers of a minimum length are eligible