UEFITool

Last updated
UEFITool
Original author(s) Nikolaj Schlej
Stable release
A62 / 2022 October 03;15 months ago (03-10-2022)
Written in C++
Operating system Windows, macOS, Linux
License BSD-2-Clause license
Website https://github.com/LongSoft/UEFITool/wiki

UEFITool is a software program for reading and modifying EEPROM images with UEFI firmware. [1] It is written in C++ using the Qt library. [2] Features include the ability to view the flash regions and to extract and import them. [3] UEFITool allows the user to search for hex and text patterns. [4]

UEFITool presents UEFI firmware images in a tree-like structure. It highlights the modules which are protected by the Intel Boot Guard. [4]

Related Research Articles

<span class="mw-page-title-main">BIOS</span> Firmware for hardware initialization and OS runtime services

In computing, BIOS is firmware used to provide runtime services for operating systems and programs and to perform hardware initialization during the booting process. The BIOS firmware comes pre-installed on an IBM PC or IBM PC compatible's system board and exists in some UEFI-based systems to maintain compatibility with operating systems that do not support UEFI native operation. The name originates from the Basic Input/Output System used in the CP/M operating system in 1975. The BIOS originally proprietary to the IBM PC has been reverse engineered by some companies looking to create compatible systems. The interface of that original system serves as a de facto standard.

<span class="mw-page-title-main">Preboot Execution Environment</span> Standard for booting from a server

In computing, the Preboot eXecution Environment, PXE specification describes a standardized client–server environment that boots a software assembly, retrieved from a network, on PXE-enabled clients. On the client side it requires only a PXE-capable network interface controller (NIC), and uses a small set of industry-standard network protocols such as DHCP and TFTP.

<span class="mw-page-title-main">UEFI</span> Operating system and firmware specification

Unified Extensible Firmware Interface is a specification that defines the architecture of the platform firmware used for booting the computer hardware and its interface for interaction with the operating system. Examples of firmware that implement the specification are AMI Aptio, Phoenix SecureCore, TianoCore EDK II, InsydeH2O. UEFI replaces the BIOS which was present in the boot ROM of all personal computers that are IBM PC compatible, although it can provide backwards compatibility with the BIOS using CSM booting. Intel developed the original Extensible Firmware Interface (EFI) specification. Some of the EFI's practices and data formats mirror those of Microsoft Windows. In 2005, UEFI deprecated EFI 1.10.

<span class="mw-page-title-main">American Megatrends</span> International hardware and software company

American Megatrends International, LLC, doing business as AMI, is an international hardware and software company, specializing in PC hardware and firmware. The company was founded in 1985 by Pat Sarma and Subramonian Shankar. It is headquartered in Building 800 at 3095 Satellite Boulevard in unincorporated Gwinnett County, Georgia, United States, near the city of Duluth, and in the Atlanta metropolitan area.

coreboot Open-source computer firmware

coreboot, formerly known as LinuxBIOS, is a software project aimed at replacing proprietary firmware found in most computers with a lightweight firmware designed to perform only the minimum number of tasks necessary to load and run a modern 32-bit or 64-bit operating system.

<span class="mw-page-title-main">Nonvolatile BIOS memory</span> Small, battery-backed memory component for storing a computers BIOS settings

Nonvolatile BIOS memory refers to a small memory on PC motherboards that is used to store BIOS settings. It is traditionally called CMOS RAM because it uses a volatile, low-power complementary metal–oxide–semiconductor (CMOS) SRAM powered by a small "CMOS" battery when system and standby power is off. It is referred to as non-volatile memory or NVRAM because, after the system loses power, it does retain state by virtue of the CMOS battery.

<span class="mw-page-title-main">UEFI Forum</span> Non-profit corporation based in Oregon

UEFI Forum, Inc. is an alliance between technology companies to coordinate the development of the UEFI specifications. The board of directors includes representatives from twelve promoter companies: AMD, American Megatrends, ARM, Apple, Dell, Hewlett Packard Enterprise, HP Inc., Insyde Software, Intel, Lenovo, Microsoft, and Phoenix Technologies.

Advanced Configuration and Power Interface (ACPI) is an open standard that operating systems can use to discover and configure computer hardware components, to perform power management, auto configuration, and status monitoring. First released in December 1996, ACPI aims to replace Advanced Power Management (APM), the MultiProcessor Specification, and the Plug and Play BIOS (PnP) Specification. ACPI brings power management under the control of the operating system, as opposed to the previous BIOS-centric system that relied on platform-specific firmware to determine power management and configuration policies. The specification is central to the Operating System-directed configuration and Power Management (OSPM) system. ACPI defines hardware abstraction interfaces between the device's firmware, the computer hardware components, and the operating systems.

<span class="mw-page-title-main">GUID Partition Table</span> Computer disk partitioning standard

The GUID Partition Table (GPT) is a standard for the layout of partition tables of a physical computer storage device, such as a hard disk drive or solid-state drive, using universally unique identifiers, which are also known as globally unique identifiers (GUIDs). Forming a part of the Unified Extensible Firmware Interface (UEFI) standard, it is nevertheless also used for some BIOSs, because of the limitations of master boot record (MBR) partition tables, which use 32 bits for logical block addressing (LBA) of traditional 512-byte disk sectors.

System Management Mode is an operating mode of x86 central processor units (CPUs) in which all normal execution, including the operating system, is suspended. An alternate software system which usually resides in the computer's firmware, or a hardware-assisted debugger, is then executed with high privileges.

<span class="mw-page-title-main">Apple–Intel architecture</span> Unofficial name used for Macintosh models that use Intel x86 processors

The Apple–Intel architecture, or Mactel, is an unofficial name used for Macintosh personal computers developed and manufactured by Apple Inc. that use Intel x86 processors, rather than the PowerPC and Motorola 68000 ("68k") series processors used in their predecessors or the ARM-based Apple silicon SoCs used in their successors. As Apple changed the architecture of its products, they changed the firmware from the Open Firmware used on PowerPC-based Macs to the Intel-designed Extensible Firmware Interface (EFI). With the change in processor architecture to x86, Macs gained the ability to boot into x86-native operating systems, while Intel VT-x brought near-native virtualization with macOS as the host OS.

Insyde Software is a company that specializes in UEFI system firmware and engineering support services, primarily for OEM and ODM computer and component device manufacturers. They are listed on the Gre Tai Market of Taiwan and headquartered in Taipei, with offices in Westborough, Massachusetts, and Portland, Oregon. The company's market capitalization of the company's common shares is currently around $115M.

<span class="mw-page-title-main">EFI system partition</span> Partition used by Unified Extensible Firmware Interface

The EFIsystem partition or ESP is a partition on a data storage device that is used by computers that have the Unified Extensible Firmware Interface (UEFI). When a computer is booted, UEFI firmware loads files stored on the ESP to start operating systems and various utilities.

The Platform Initialization Specification is a specification published by the Unified EFI Forum that describes the internal interfaces between different parts of computer platform firmware. This allows for more interoperability between firmware components from different sources. This specification is normally, but not by requirement, used in conjunction with the UEFI specification.

InstantGo, also known as InstantOn or Modern Standby, is a Microsoft specification for Windows 8 hardware and software that aims to bring smartphone-type power management capabilities to the PC platform, as well as increasing physical security.

fwupd is an open-source daemon for managing the installation of firmware updates on Linux-based systems, developed by GNOME maintainer Richard Hughes. It is designed primarily for servicing the Unified Extensible Firmware Interface (UEFI) firmware on supported devices via EFI System Resource Table (ESRT) and UEFI Capsule, which is supported in Linux kernel 4.2 and later. Previously, the initiation of UEFI firmware updates within an operating system could, on most systems, only be performed using Microsoft Windows or DOS-specific software. ESRT allows the firmware to expose updatable components to the operating system, which can pass a UEFI capsule with updated firmware for processing and installation on the next boot. Updates can be exposed via a command line tool, or within graphical package managers via a D-Bus interface.

iBoot is the stage 2 bootloader for all Apple products. It replaces the old bootloader, BootX. Compared with its predecessor, iBoot improves authentication performed in the boot chain.

<span class="mw-page-title-main">AMD Platform Security Processor</span> Trusted execution environment subsystem that runs on AMD microprocessors

The AMD Platform Security Processor (PSP), officially known as AMD Secure Technology, is a trusted execution environment subsystem incorporated since about 2013 into AMD microprocessors. According to an AMD developer's guide, the subsystem is "responsible for creating, monitoring and maintaining the security environment" and "its functions include managing the boot process, initializing various security related mechanisms, and monitoring the system for any suspicious activity or events and implementing an appropriate response". Critics worry it can be used as a backdoor and is a security concern. AMD has denied requests to open source the code that runs on the PSP.

Michael A. Rothman is an American engineer and writer of science fiction, epic fantasy, and techno thriller novels. His fiction books are generally published under the name M. A. Rothman. He holds over 1000 patents worldwide, and is one of the primary architects of the UEFI standard. He has co-authored multiple books and papers about the standard.

<span class="mw-page-title-main">TianoCore EDK II</span> Reference software implementation for UEFI

TianoCore EDK II is the reference implementation of UEFI by Intel. EDK is the abbreviation for EFI Development Kit and is developed by the TianoCore community. TianoCore EDK II is the de facto standard generic UEFI services implementation.

References

  1. Lee, Micah (April 28, 2018). "It's Impossible to Prove Your Laptop Hasn't Been Hacked. I Spent Two Years Finding Out". The Intercept . Retrieved 2021-09-13.
  2. Christensen, Jake; Anghel, Ionut Mugurel; Taglang, Rob; Chiroiu, Mihai; Sion, Radu (August 2020). "DECAF: automatic, adaptive de-bloating and hardening of COTS firmware" (PDF). SEC'20: Proceedings of the 29th USENIX Conference on Security Symposium. Retrieved January 22, 2024.
  3. Matrosov, Alex (2019). Rootkits and bootkits: reversing modern malware and next generation threats. Eugene Rodionov, Sergey Bratus. San Francisco: No Starch Press. pp. 380–390. ISBN   978-1-59327-883-0. OCLC   1005741834.
  4. 1 2 de Assumpção, Matheus Bichara; dos Reis, Marcelo Abdalla; Marcondes, Marcos Roberto; da Silva Eleutério, Pedro Monteiro; Vieira, Victor Hugo (March 2023). "Forensic method for decrypting TPM-protected BitLocker volumes using Intel DCI". Forensic Science International: Digital Investigation. 44. doi:10.1016/j.fsidi.2023.301514 . Retrieved January 22, 2024.