{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/DSecurity/efiSeek/blob/573f4b9b5ba2731cdecafc6594d0fd0570e28fff/src/main/java/efiSeek/EfiSeekAnalyzer.java",
    "https://github.com/DSecurity/efiSeek/blob/573f4b9b5ba2731cdecafc6594d0fd0570e28fff/src/main/java/efiSeek/EfiSeek.java",
    "https://github.com/DSecurity/efiSeek/blob/573f4b9b5ba2731cdecafc6594d0fd0570e28fff/ghidra_scripts/TransferEfiFilesToProject.java",
    "https://github.com/DSecurity/efiSeek/blob/573f4b9b5ba2731cdecafc6594d0fd0570e28fff/build.gradle",
    "https://github.com/DSecurity/efiSeek/blob/573f4b9b5ba2731cdecafc6594d0fd0570e28fff/gradle/wrapper/gradle-wrapper.properties",
    "https://github.com/DSecurity/efiSeek/blob/573f4b9b5ba2731cdecafc6594d0fd0570e28fff/LICENSE",
    "https://github.com/DSecurity/efiSeek/commit/573f4b9b5ba2731cdecafc6594d0fd0570e28fff",
    "https://github.com/DSecurity/efiSeek/issues/15",
    "https://github.com/DSecurity/efiSeek/pull/18"
  ],
  "category": "firmware",
  "description_en": "Ghidra analyzer extension from Digital Security for individual UEFI modules, enabled by default during auto-analysis of x86 and x64 PE images with an EFI subsystem. It labels known GUIDs from a bundled database, applies UEFI types from bundled data-type archives, passes the image handle and system table from the entry point into called functions, and marks protocols located with LocateProtocol or installed with InstallProtocolInterface, protocol-notify callbacks and SMI handlers registered for software, hardware and child interrupts. Findings are also kept as JSON in the program, which a headless-mode script uses to sort SMM modules into project folders by handler type.",
  "description_zh": "Digital Security 开发的 Ghidra 分析器扩展，面向单个 UEFI 模块，在自动分析带 EFI 子系统的 x86 和 x64 PE 映像时默认启用。它依据自带的数据库标注已知 GUID，从自带的数据类型归档应用 UEFI 类型，把入口点的映像句柄和系统表参数传递到被调用的函数中，并标记通过 LocateProtocol 定位或通过 InstallProtocolInterface 安装的协议、协议通知回调，以及为软件、硬件和子中断注册的 SMI 处理函数。分析结果还以 JSON 形式保存在程序中，无界面模式脚本据此按处理函数类型把 SMM 模块分到不同的项目文件夹。",
  "entry_url": "https://awesomerea.org/resources/efiseek/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/efiseek/",
  "evidence_url": "https://github.com/DSecurity/efiSeek/blob/573f4b9b5ba2731cdecafc6594d0fd0570e28fff/README.md",
  "group": "tools",
  "id": "efiseek",
  "json_url": "https://awesomerea.org/resources/efiseek/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/efiseek/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/efiseek/index.md",
  "name": "efiSeek",
  "name_zh": "efiSeek UEFI 模块 Ghidra 分析器",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The repository has no releases or tags; the latest master commit, from 2022-04-26, adds compatibility with a Ghidra 10.2 development build. Open issues report that the pinned Gradle 7.4.2 wrapper does not work with Ghidra 11.2 and newer and that a PE header API change in Ghidra 12.0 causes errors; the pull requests proposing fixes were unmerged at review, so building for current Ghidra releases may need those or similar changes.",
    "Built from source with the bundled Gradle wrapper against a Ghidra installation named by GHIDRA_INSTALL_DIR; the build fetches the org.json library from Maven Central. The README then has the zip from dist copied into Ghidra's Extensions/Ghidra folder and the extension enabled, after which the analyzer is preselected when an EFI file is opened.",
    "Input is a single UEFI module the analyst already has: the analyzer accepts only PE images with an EFI subsystem and only the x86 and x64 machine types, so modules must first be taken out of a full firmware image. It rebases the program to 0x80000000 and makes every memory block readable, writable and executable.",
    "Apache-2.0, per LICENSE and the source headers. The repository bundles the Behemotx32.gdt and Behemotx64.gdt data-type archives and the guids-db.ini GUID database that the analyzer loads, plus the Gradle wrapper JAR. Labels and handler classifications are heuristic annotations for analyst review."
  ],
  "requirements_zh": [
    "仓库没有发布版本或标签；master 分支的最新提交日期为 2022-04-26，用于兼容 Ghidra 10.2 开发版。未关闭的 issue 报告称，固定的 Gradle 7.4.2 包装器无法用于 Ghidra 11.2 及更新版本，且 Ghidra 12.0 中 PE 头部 API 的变化会导致错误；提出修复的拉取请求在审阅时均未合并，因此为当前 Ghidra 版本构建时可能需要这些或类似的修改。",
    "需借助自带的 Gradle 包装器，针对由 GHIDRA_INSTALL_DIR 指定的 Ghidra 安装从源码构建；构建过程会从 Maven Central 获取 org.json 库。README 随后要求把 dist 中的 zip 复制到 Ghidra 的 Extensions/Ghidra 文件夹并启用该扩展，此后打开 EFI 文件时会自动勾选该分析器。",
    "输入为分析者已有的单个 UEFI 模块：分析器只接受带 EFI 子系统的 PE 映像，且仅支持 x86 和 x64 机器类型，因此需先从完整固件镜像中取出各个模块。它会把程序基址重设为 0x80000000，并将所有内存块设为可读、可写、可执行。",
    "依据 LICENSE 和源文件头部声明采用 Apache-2.0。仓库自带分析器加载的 Behemotx32.gdt、Behemotx64.gdt 数据类型归档和 guids-db.ini GUID 数据库，以及 Gradle 包装器 JAR。生成的标注和处理函数分类均为启发式结果，需分析者复核。"
  ],
  "targets": [
    "firmware"
  ],
  "url": "https://github.com/DSecurity/efiSeek",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}