{"id":13395891,"url":"https://github.com/theopolis/uefi-firmware-parser","last_synced_at":"2025-05-15T03:06:58.041Z","repository":{"id":13610008,"uuid":"16303018","full_name":"theopolis/uefi-firmware-parser","owner":"theopolis","description":"Parse BIOS/Intel ME/UEFI firmware related structures: Volumes, FileSystems, Files, etc","archived":false,"fork":false,"pushed_at":"2025-04-30T03:27:35.000Z","size":637,"stargazers_count":820,"open_issues_count":26,"forks_count":162,"subscribers_count":73,"default_branch":"master","last_synced_at":"2025-04-30T04:26:23.310Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/theopolis.png","metadata":{"files":{"readme":"README.rst","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":"AUTHORS","dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2014-01-28T05:25:47.000Z","updated_at":"2025-04-28T08:36:24.000Z","dependencies_parsed_at":"2023-01-13T17:33:23.823Z","dependency_job_id":"a6428205-38bb-468e-8a65-5da0ff6d84ac","html_url":"https://github.com/theopolis/uefi-firmware-parser","commit_stats":{"total_commits":156,"total_committers":28,"mean_commits":5.571428571428571,"dds":"0.23717948717948723","last_synced_commit":"dfb15b068960b771e2e1536d34790dac9b5bfe32"},"previous_names":[],"tags_count":15,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Fuefi-firmware-parser","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Fuefi-firmware-parser/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Fuefi-firmware-parser/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/theopolis%2Fuefi-firmware-parser/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/theopolis","download_url":"https://codeload.github.com/theopolis/uefi-firmware-parser/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254264766,"owners_count":22041793,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-30T18:00:35.114Z","updated_at":"2025-05-15T03:06:53.032Z","avatar_url":"https://github.com/theopolis.png","language":"Python","funding_links":[],"categories":["Tools","Tools :hammer:","***BIOS UEFI***","📚 Table of Contents"],"sub_categories":["Open Source","***Tools***","Firmware Analysis \u0026 Extraction"],"readme":"UEFI Firmware Parser\n====================\n\n.. image:: https://travis-ci.org/theopolis/uefi-firmware-parser.svg?branch=master\n    :target: https://travis-ci.org/theopolis/uefi-firmware-parser\n\n\nThe UEFI firmware parser is a simple module and set of scripts for parsing, extracting, \nand recreating UEFI firmware volumes.\nThis includes parsing modules for BIOS, OptionROM, Intel ME and other formats too. \nPlease use the example scripts for parsing tutorials.\n\nInstallation\n------------\n\nThis module is available through PyPi as `uefi_firmware \u003chttps://pypi.python.org/pypi/uefi_firmware\u003e`_\n\n::\n\n  $ sudo pip install uefi_firmware\n\nTo install from Github, checkout this repo and use:\n\n::\n\n  $ sudo python ./setup.py install\n\n**Requirements**\n\n- Python development headers, usually found in the ``python-dev`` package.\n- The compression/decompression features will use the python headers and ``gcc``.\n\nUsage\n-----\n\nThe simplest way to use the module to detect or parse firmware is through the ``AutoParser`` class.\n\n::\n\n  import uefi_firmware\n  with open('/path/to/firmware.rom', 'r') as fh:\n    file_content = fh.read()\n  parser = uefi_firmware.AutoParser(file_content)\n  if parser.type() != 'unknown':\n    firmware = parser.parse()\n    firmware.showinfo()\n\nThere are several classes within the **uefi**, **pfs**, **me**, and **flash** packages that\naccept file contents in their constructor. In all cases there are abstract methods implemented:\n\n- ``process()`` performs parsing work and returns a ``True`` or ``False``\n- ``showinfo()`` print a hierarchy of information about the structure\n- ``dump()`` walk the hierarchy and write each to a file\n\nScripts\n-------\n\nA Python script is installed ``uefi-firmware-parser``\n\n::\n\n  $ uefi-firmware-parser -h\n  usage: uefi-firmware-parser [-h] [-b] [--superbrute] [-q] [-o OUTPUT] [-O]\n                              [-c] [-e] [-g GENERATE] [--test]\n                              file [file ...]\n\n  Parse, and optionally output, details and data on UEFI-related firmware.\n\n  positional arguments:\n    file                  The file(s) to work on\n\n  optional arguments:\n    -h, --help            show this help message and exit\n    -b, --brute           The input is a blob and may contain FV headers.\n    --superbrute          The input is a blob and may contain any sort of\n                          firmware object\n    -q, --quiet           Do not show info.\n    -o OUTPUT, --output OUTPUT\n                          Dump firmware objects to this folder.\n    -O, --outputfolder    Dump firmware objects to a folder based on filename\n                          ${FILENAME}_output/\n    -c, --echo            Echo the filename before parsing or extracting.\n    -e, --extract         Extract all files/sections/volumes.\n    -g GENERATE, --generate GENERATE\n                          Generate a FDF, implies extraction (volumes only)\n    --test                Test file parsing, output name/success.\n\nTo test a file or directory of files:\n\n::\n\n  $ uefi-firmware-parser --test ~/firmware/*\n  ~/firmware/970E32_1.40: UEFIFirmwareVolume\n  ~/firmware/CO5975P.BIO: EFICapsule\n  ~/firmware/me-03.obj: IntelME\n  ~/firmware/O990-A03.exe: None\n  ~/firmware/O990-A03.exe.hdr: DellPFS\n\nIf you need to parse and extract a large number of firmware files check out the ``-O`` option to auto-generate an output folder per file. If parsing and searching for internals in a shell the ``--echo`` option will print the input filename before parsing.\n\nThe firmware-type checker will decide how to best parse the file. If the ``--test`` option fails to identify the type, or calls it ``unknown``, try to use the ``-b`` or ``--superbrute`` option. The later performs a byte-by-byte type checker.\n::\n\n  $ uefi-firmware-parser --test ~/firmware/970E32_1.40\n  ~/firmware/970E32_1.40: unknown\n  $ uefi-firmware-parser --superbrute ~/firmware/970E32_1.40\n  [...]\n\n**Features**\n\n- UEFI Firmware Volumes, Capsules, FileSystems, Files, Sections parsing\n- Intel PCH Flash Descriptors\n- Intel ME modules parsing (ME, TXE, etc)\n- Dell PFS (HDR) updates parsing\n- Tiano/EFI, and native LZMA (7z) [de]compression\n\n- Complete UEFI Firmware volume object hierarchy display\n- Firmware descriptor [re]generation using the parsed input volumes\n- Firmware File Section injection\n\n**GUID Injection**\n\nInjection or GUID replacement (no addition/subtraction yet) can be performed on sections within a UEFI firmware file, or on UEFI firmware files within a firmware filesystem.\n\n:: \n\n  $ python ./scripts/fv_injector.py -h\n  usage: fv_injector.py [-h] [-c] [-p] [-f] [--guid GUID] --injection INJECTION\n                        [-o OUTPUT]\n                        file\n\n  Search a file for UEFI firmware volumes, parse and output.\n\n  positional arguments:\n    file                  The file to work on\n\n  optional arguments:\n    -h, --help            show this help message and exit\n    -c, --capsule         The input file is a firmware capsule.\n    -p, --pfs             The input file is a Dell PFS.\n    -f, --ff              Inject payload into firmware file.\n    --guid GUID           GUID to replace (inject).\n    --injection INJECTION\n                          Pre-generated EFI file to inject.\n    -o OUTPUT, --output OUTPUT\n                          Name of the output file.\n\nNote: when injecting into a firmware file the user will be prompted for which section to replace. At the moment this is not-yet-scriptable. \n\n**IDA Python support**\n\nThere is an included script to generate additional GUID labels to import into IDA Python\nusing Snare's plugins. Using the ``-g LABEL`` the script will generate a Python dictionary-formatted output. This project will try to keep up-to-date with popular vendor GUIDs automatically.\n\n::\n\n  $ python ./scripts/uefi_guids.py -h\n  usage: uefi_guids.py [-h] [-c] [-b] [-d] [-g GENERATE] [-u] file\n\n  Output GUIDs for files, optionally write GUID structure file.\n\n  positional arguments:\n    file                  The file to work on\n\n  optional arguments:\n    -h, --help            show this help message and exit\n    -c, --capsule         The input file is a firmware capsule, do not search.\n    -b, --brute           The input file is a blob, search for firmware volume\n                          headers.\n    -d, --flash           The input file is a flash descriptor.\n    -g GENERATE, --generate GENERATE\n                          Generate a behemoth-style GUID output.\n    -u, --unknowns        When generating also print unknowns.\n\n**Supported Vendors**\n\nThis module has been tested on BIOS/UEFI/firmware updates from the following vendors.\nNot every update for every product will parse, some may required a-priori decompression\nor extraction from the distribution update mechanism (typically a PE). \n\n- ASRock\n- Dell\n- Gigabyte\n- Intel\n- Lenovo\n- HP\n- MSI\n- VMware\n- Apple\n- Qualcomm\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftheopolis%2Fuefi-firmware-parser","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftheopolis%2Fuefi-firmware-parser","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftheopolis%2Fuefi-firmware-parser/lists"}