https://github.com/gdbinit/teloader

A TE executable format loader for IDA
https://github.com/gdbinit/teloader

Last synced: about 21 hours ago
JSON representation

A TE executable format loader for IDA

• Host: GitHub
• URL: https://github.com/gdbinit/teloader
• Owner: gdbinit
• Created: 2015-09-14T15:32:49.000Z (about 9 years ago)
• Default Branch: master
• Last Pushed: 2015-09-14T15:36:08.000Z (about 9 years ago)
• Last Synced: 2024-08-03T10:02:02.107Z (3 months ago)
• Language: C
• Size: 118 KB
• Stars: 28
• Watchers: 6
• Forks: 6
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
IDA TE Loader v1.0

(c) 2015, fG! - [email protected] - https://reverse.put.as

IDA as of version 6.8.150428 is unable to correctly parse and load TE binaries that can be found in (U)EFI SEC and PEI phases.

This is a small loader that will take care of correctly loading those binaries. As a bonus it will try to comment some known GUIDs.

It has a special license. If you want to use this software you have to write at least once in a text editor or something (more than once highly recommended but not required) the following sentence: 

"Ilfak is a douchebag!"

If not I'll chase you FireEye style! Other than that it's just regular do whatever you want with it.

Tested with OS X version of IDA 6.7 and 6.8.

Reference presentation regarding EFI reversing: https://reverse.put.as/wp-content/uploads/2015/07/Secuinside_2015_-_Efi_Monsters.pdf

The included Makefile will generate both the 32 bit and 64 bit plugin versions. Copy to the idaq.app/Contents/MacOS/loaders folder. Don't forget to edit the paths to IDA and the SDK in the Makefile. XCode project version also able to generate the files, you will need to edit the same paths in there.

That's it! Enjoy :-)

fG!