{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/REhints/efiXplorer/blob/9e3b40a2ac0524e04dc69540ab4ff911fda13d27/ida-plugin.json",
    "https://github.com/REhints/efiXplorer/blob/9e3b40a2ac0524e04dc69540ab4ff911fda13d27/.gitmodules",
    "https://github.com/REhints/efiXplorer/blob/9e3b40a2ac0524e04dc69540ab4ff911fda13d27/LICENSE",
    "https://github.com/REhints/efiXplorer/wiki/efiXplorer-features/7ce26a454a0585c3c17785b61c28633123eae6f6",
    "https://github.com/REhints/efiXplorer/wiki/efiXloader/7ce26a454a0585c3c17785b61c28633123eae6f6",
    "https://github.com/REhints/efiXplorer/wiki/Build-instruction-and-installation/7ce26a454a0585c3c17785b61c28633123eae6f6",
    "https://github.com/REhints/efiXplorer/releases/tag/v6.3.0",
    "https://plugins.hex-rays.com/binarly-io/efixplorer",
    "https://i.blackhat.com/eu-20/Wednesday/eu-20-Labunets-efiXplorer-Hunting-For-UEFI-Firmware-Vulnerabilities-At-Scale-With-Automated-Static-Analysis.pdf"
  ],
  "category": "firmware",
  "description_en": "IDA Pro plugin and loader that automate static analysis of UEFI firmware. The plugin annotates Boot, Runtime, SMM and PEI service calls, lists the EFI protocols and known GUIDs a module installs or consumes, applies protocol interface types in the Hex-Rays decompiler, flags suspected SMM callout and GetVariable out-of-bounds write patterns for review and saves a JSON report. The efiXloader module opens a whole firmware image in one IDA database, with driver entry points, navigation between drivers and a DXE driver dependency graph.",
  "description_zh": "用于自动化 UEFI 固件静态分析的 IDA Pro 插件与加载器。插件可标注 Boot、Runtime、SMM 和 PEI 服务调用，列出模块安装或使用的 EFI 协议与已知 GUID，在 Hex-Rays 反编译器中应用协议接口类型，标记疑似 SMM callout 及 GetVariable 越界写入模式供人工复核，并保存 JSON 报告。efiXloader 加载模块可在单个 IDA 数据库中打开整个固件镜像，提供各驱动入口点、驱动间导航和 DXE 驱动依赖关系图。",
  "entry_url": "https://awesomerea.org/resources/efixplorer/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/efixplorer/",
  "evidence_url": "https://github.com/REhints/efiXplorer/blob/9e3b40a2ac0524e04dc69540ab4ff911fda13d27/README.md",
  "group": "tools",
  "id": "efixplorer",
  "json_url": "https://awesomerea.org/resources/efixplorer/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/efixplorer/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/efixplorer/index.md",
  "name": "efiXplorer",
  "name_zh": "efiXplorer UEFI 固件分析 IDA 插件",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v6.3.0, published 2026-08-20 as a zip of prebuilt binaries; the reviewed master commit is two GUID-database submodule updates ahead. ida-plugin.json declares IDA 8.3 or newer on Windows x86_64, Linux x86_64 and macOS x86_64/aarch64; the plugin is listed in Hex-Rays' plugin repository and can be installed with ida-hcli.",
    "Needs a licensed IDA Pro. Applying protocol interface types also needs the Hex-Rays decompiler, and the build instructions cover building without it. Source builds use CMake or build.py against the IDA SDK, UEFITool and GUID database submodules; a manual install copies the plugin and the guids directory into IDA's plugins folder and the loader into its loaders folder.",
    "Input is a UEFI firmware image or individual UEFI driver the analyst already has. The wiki's feature table lists SMM services and the dependency graph for 64-bit modules only and PEI services for 32-bit only. Its loader page still says only 64-bit drivers are supported, while the v6.3.0 notes add 32-bit modules in the loader, and the wiki pages still link the earlier binarly-io repository.",
    "GPL-3.0; ida-plugin.json declares GPL-3.0-only. Vulnerability-scanner hits are suspected findings presented for analyst review, not confirmed bugs; the authors' Black Hat Europe 2020 and EKO 2020 publications describe the approach."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v6.3.0，于 2026-08-20 以预编译二进制 zip 包发布；所审阅的 master 提交比它多两次 GUID 数据库子模块更新。ida-plugin.json 声明需要 IDA 8.3 或更高版本，支持 Windows x86_64、Linux x86_64 以及 macOS x86_64/aarch64；该插件已收录于 Hex-Rays 插件库，可用 ida-hcli 安装。",
    "需要已授权的 IDA Pro。应用协议接口类型还需要 Hex-Rays 反编译器，构建说明也介绍了不含该反编译器的构建方式。从源码构建时，通过 CMake 或 build.py 使用 IDA SDK、UEFITool 和 GUID 数据库子模块；手动安装需把插件和 guids 目录复制到 IDA 的 plugins 文件夹，把加载器复制到 loaders 文件夹。",
    "输入为分析者已有的 UEFI 固件镜像或单个 UEFI 驱动。wiki 的功能表将 SMM 服务和依赖关系图列为仅支持 64 位模块，PEI 服务仅支持 32 位。其加载器页面仍称只支持 64 位驱动，而 v6.3.0 的发布说明已为加载器加入 32 位模块支持；wiki 页面也仍链接到早先的 binarly-io 仓库。",
    "采用 GPL-3.0；ida-plugin.json 声明为 GPL-3.0-only。漏洞扫描结果只是供分析者复核的疑似问题，并非已确认的缺陷；作者在 Black Hat Europe 2020 和 EKO 2020 的发表材料介绍了相关方法。"
  ],
  "targets": [
    "firmware"
  ],
  "url": "https://github.com/REhints/efiXplorer",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}