UEFI

Kalanit Suzan Segal, Hadar Cochavi Gorelik, Oleg Brodt, Yuval Elbahar, Y. Elovici, A. Shabtai

Modern computing systems rely on the Unified Extensible Firmware Interface (UEFI), which has replaced the legacy Basic Input/Output System (BIOS) as the firmware standard for the modern boot process. Although the UEFI represents a significant advancement in system firmware, it is increasingly targeted by threat actors seeking to exploit its execution environment and take advantage of its persistence mechanisms. While some security-related analysis of UEFI components has been performed--primarily via debugging and runtime behavior testing--to the best of our knowledge, no prior study has specifically addressed the capturing and analysis of volatile UEFI runtime memory to detect malicious exploitation during the pre-OS phase. This gap in UEFI forensic tools limits the ability to conduct in-depth security analysis in pre-OS environments. Such a gap is particularly surprising, given that memory forensics is widely regarded as foundational to modern incident response, as reflected by the popularity of above-OS memory analysis frameworks, such as Rekall, Volatility, and MemProcFS. To address the lack of below-OS memory forensics, we introduce a framework for UEFI memory forensics. The proposed framework consists of two components: UEFIMemDump, a memory acquisition tool, and UEFIDumpAnalysis, an extendable collection of analysis modules capable of detecting malicious activities such as function pointer hooking, inline hooking, malicious image loading, and gadget-based control-flow manipulation. Our proof-of-concept implementation demonstrates the framework's ability to detect modern UEFI threats, such as Thunderstrike, CosmicStrand, and Glupteba bootkits. By providing an open-source solution, our work enables researchers and practitioners to investigate firmware-level threats, develop additional analysis modules, and advance overall below-OS security through UEFI memory analysis.

Zheng Lu, Yu-an Tan, Xiaochun Cheng, Zhihan Zheng, Ning Shi, Yuanzhang Li

Myint Myat Aung, Aung Nway Oo, W. Thant, Thinn Thinn Wai

This paper presents the implementation of a minimalist UEFI x64 bootloader and kernel entirely in FASM assembly. The bootloader loads a simple kernel that displays "HELLOWORLD". The implementation is unique in that both the bootloader and kernel executables are created from simple flat binary output of the assembler. The generation of PE32+ and ELF64 executables and the interfaces required to interact with UEFI hardware are implemented from scratch by referring to their ABI specification documents without relying on libraries. This technique eliminates toolchain dependencies, grants full control to the system architect, and facilitates a deeper understanding of internal mechanisms. The work serves as both a foundation for the future development of a modern operating system free from legacy design decisions and an educational resource for understanding the esoteric nature of operating systems development.

Gelson José de A. Filho, J. Santi, N. Will, R. Machado, A. Leles

A segurança de firmware é crítica devido a seus privilégios elevados e à ausência de defesas típicas de sistemas operacionais (SOs). Enquanto os SOs contam com múltiplas camadas de proteção, o firmware permanece mais vulnerável e atrativo para ataques. Seguindo os princípios do DevSecOps, este trabalho propõe um pipeline que automatiza testes dinâmicos em módulos UEFI. A metodologia utiliza instrumentação binária e fuzzing executado em contêineres para análise dinâmica e escalável. Em experimentos com uma BIOS real, o pipeline identificou falhas em mais de 5% dos módulos analisados. Os resultados indicam que a abordagem reduz custos operacionais e fortalece o ciclo de desenvolvimento seguro de firmware baseado na UEFI.

Hua Yan, Baojiang Cui

Since its extensive implementation in 2006, the Unified Extensible Firmware Interface (UEFI) has supplanted traditional BIOS as the industry standard, serving as an essential link between computer hardware and operating systems. UEFI's advantageous role in system design provides it with comprehensive access to system resources, beyond those of the operating system kernel. Consequently, detecting and thoroughly characterizing memory corruption vulnerabilities in UEFI firmware is essential for preserving the integrity and security of computer systems. The techniques for finding UEFI firmware vulnerabilities nowadays mostly face two main difficulties: First of all, the special character of UEFI firmware makes direct dynamic examination inside the operating system especially difficult; Second, conventional fuzzing techniques lead to ineffective testing with their shallow knowledge of UEFI input structures. We propose a novel approach combining static analysis with fuzzing techniques to help to reduce these limits. Our approach starts with static reverse engineering to fully understand the structural characteristics of inputs throughout several UEFI interfaces, followed by cross-validation against open-source firmware implementations. We then use this structured knowledge to guide the seed file mutation technique, hence improving the accuracy and efficiency of fuzzing activities.