Skip to content

Instantly share code, notes, and snippets.

@orangecms

orangecms/notes.md

Created January 16, 2024 14:53
Show Gist options
  • Save orangecms/23928f900a9ed96a9eda6ab404674262 to your computer and use it in GitHub Desktop.
Save orangecms/23928f900a9ed96a9eda6ab404674262 to your computer and use it in GitHub Desktop.
Download ZIP
UEFI hacking workshop
Raw
notes.md

Abstract

We take a look at UEFI platform initialization firmware such as found on many current mainboards like laptops, desktops and servers.

Many security flaws, such as the recently discovered LogoFAIL vulnerability, expose both consumers and organizations to severe risks.

What strategies are there to find such issues, and how do we exploit them?

Description

Exploitation 101

The rough plan is commonly:

  • understanding the system/environment
    • data structures
    • domain specific tools
  • manipulating the system/environment
    • input; this is our exploit :)
  • monitoring the system/environment
    • emulators
    • probes
    • loggers, parsers

Tools

We have prepared a tool to scan memory for EFI data structures: https://github.com/platform-system-interface/ems

Here is a Ghidra plugin to assist: https://github.com/al3xtjames/ghidra-firmware-utils

For inspection and extraction, we can use e.g. Fiedka, the Fiano tool suite's utk and UEFITool.

References

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment