Tool
FwHunt Community Scanner (fwhunt-scan)
Binarly's Python scanner that checks UEFI firmware modules against FwHunt rules, the YAML detection format for known UEFI firmware vulnerabilities whose rules are kept in the separate fwhunt repository. Its rizin-based analyzer reports a PE or TE module's Boot, Runtime and PEI service calls, protocols, PPIs, GUIDs, NVRAM variables and SMI handlers, which rules combine with code patterns, strings and hex strings. The CLI analyzes or scans one module, or extracts the modules of a whole firmware image and scans them, and the same classes work as a Python library.
- Targets
- Firmware
- Category
- Firmware tools
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- The repository has no GitHub releases or tags. The reviewed master commit, from 2025-05-02 and the latest at review, follows the setup.py bump to 2.3.8, the version uploaded to PyPI that day; a separate release branch publishes Docker images to GHCR tagged by commit.
- Needs Python 3 (README: tested on 3.6 and above; CI runs on 3.9 to 3.13) with click, rzpipe 0.4.0, PyYAML and uefi_firmware, plus an installed rizin. The README names rizin v0.6.2, and the Dockerfile builds that release from source on a python:3.11 image. Passing an in-memory blob instead of a file path works only on Linux.
- Input is a UEFI module or firmware image the user already has, plus FwHunt rule files; no rules are bundled, and the README's rules/ and test/fw.bin example paths are not in this repository. scan-firmware applies firmware-target rules to the whole image and module rules only to modules from the volumes their volume_guids name, unless --force applies them to every module; extract writes all found modules to a directory.
- The only test checks GUID table lookups, and CI runs it after a flake8 syntax check. A scan reports, per rule and variant, whether a known pattern matched, printed as threat detected or not; no match does not show that a module is free of other vulnerabilities.
- GPL-3.0: setup.py declares GPL-3.0 and source headers GPL-3.0+; the separate fwhunt rule repository is CC0-1.0.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
- fwhunt_scan_analyzer.py GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
- fwhunt_scan/uefi_analyzer.py#L781-L820 GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
- fwhunt_scan/uefi_scanner.py GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
- requirements.txt GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
- setup.py GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
- Dockerfile GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
- .github/workflows/ci.yml GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
- fwhunt_scan/test_internal.py GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
- LICENSE GitHub · binarly-io/fwhunt-scan · Revision 6fc7115
- https://pypi.org/project/fwhunt-scan/2.3.8/
- README.md GitHub · binarly-io/fwhunt · Revision a2e3be6