# efiSeek

> Ghidra analyzer extension from Digital Security for individual UEFI modules, enabled by default during auto-analysis of x86 and x64 PE images with an EFI subsystem. It labels known GUIDs from a bundled database, applies UEFI types from bundled data-type archives, passes the image handle and system table from the entry point into called functions, and marks protocols located with LocateProtocol or installed with InstallProtocolInterface, protocol-notify callbacks and SMI handlers registered for software, hardware and child interrupts. Findings are also kept as JSON in the program, which a headless-mode script uses to sort SMM modules into project folders by handler type.

- Type: Tool
- Targets: Firmware
- Category: Firmware tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-20
- Added to the catalog: 2026-11-02
- Original resource: <https://github.com/DSecurity/efiSeek>
- Primary source: <https://github.com/DSecurity/efiSeek/blob/573f4b9b5ba2731cdecafc6594d0fd0570e28fff/README.md>
- Catalog page: <https://awesomerea.org/resources/efiseek/>
- Record JSON: <https://awesomerea.org/resources/efiseek/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/efiseek/index.md)

## Requirements & limits

- The repository has no releases or tags; the latest master commit, from 2022-04-26, adds compatibility with a Ghidra 10.2 development build. Open issues report that the pinned Gradle 7.4.2 wrapper does not work with Ghidra 11.2 and newer and that a PE header API change in Ghidra 12.0 causes errors; the pull requests proposing fixes were unmerged at review, so building for current Ghidra releases may need those or similar changes.
- Built from source with the bundled Gradle wrapper against a Ghidra installation named by GHIDRA_INSTALL_DIR; the build fetches the org.json library from Maven Central. The README then has the zip from dist copied into Ghidra's Extensions/Ghidra folder and the extension enabled, after which the analyzer is preselected when an EFI file is opened.
- Input is a single UEFI module the analyst already has: the analyzer accepts only PE images with an EFI subsystem and only the x86 and x64 machine types, so modules must first be taken out of a full firmware image. It rebases the program to 0x80000000 and makes every memory block readable, writable and executable.
- Apache-2.0, per LICENSE and the source headers. The repository bundles the Behemotx32.gdt and Behemotx64.gdt data-type archives and the guids-db.ini GUID database that the analyzer loads, plus the Gradle wrapper JAR. Labels and handler classifications are heuristic annotations for analyst review.

## Primary sources

1. <https://github.com/DSecurity/efiSeek/blob/573f4b9b5ba2731cdecafc6594d0fd0570e28fff/README.md>
2. <https://github.com/DSecurity/efiSeek/blob/573f4b9b5ba2731cdecafc6594d0fd0570e28fff/src/main/java/efiSeek/EfiSeekAnalyzer.java>
3. <https://github.com/DSecurity/efiSeek/blob/573f4b9b5ba2731cdecafc6594d0fd0570e28fff/src/main/java/efiSeek/EfiSeek.java>
4. <https://github.com/DSecurity/efiSeek/blob/573f4b9b5ba2731cdecafc6594d0fd0570e28fff/ghidra_scripts/TransferEfiFilesToProject.java>
5. <https://github.com/DSecurity/efiSeek/blob/573f4b9b5ba2731cdecafc6594d0fd0570e28fff/build.gradle>
6. <https://github.com/DSecurity/efiSeek/blob/573f4b9b5ba2731cdecafc6594d0fd0570e28fff/gradle/wrapper/gradle-wrapper.properties>
7. <https://github.com/DSecurity/efiSeek/blob/573f4b9b5ba2731cdecafc6594d0fd0570e28fff/LICENSE>
8. <https://github.com/DSecurity/efiSeek/commit/573f4b9b5ba2731cdecafc6594d0fd0570e28fff>
9. <https://github.com/DSecurity/efiSeek/issues/15>
10. <https://github.com/DSecurity/efiSeek/pull/18>

## More in Firmware and hardware

- [FwAnalyzer](https://awesomerea.org/resources/fwanalyzer/index.md) · Tool
- [FwHunt Community Scanner (fwhunt-scan)](https://awesomerea.org/resources/fwhunt-scan/index.md) · Tool
- [sniffROM](https://awesomerea.org/resources/sniffrom/index.md) · Tool
- [Pawn](https://awesomerea.org/resources/google-pawn/index.md) · Tool
- [EMBArk](https://awesomerea.org/resources/embark/index.md) · Tool
- [IDAPython Embedded Toolkit](https://awesomerea.org/resources/idapython-embedded-toolkit/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.