{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/binarly-io/fwhunt-scan/blob/6fc7115959e4825199882f5b397a0d7c34cbbfd1/fwhunt_scan_analyzer.py",
    "https://github.com/binarly-io/fwhunt-scan/blob/6fc7115959e4825199882f5b397a0d7c34cbbfd1/fwhunt_scan/uefi_analyzer.py#L781-L820",
    "https://github.com/binarly-io/fwhunt-scan/blob/6fc7115959e4825199882f5b397a0d7c34cbbfd1/fwhunt_scan/uefi_scanner.py",
    "https://github.com/binarly-io/fwhunt-scan/blob/6fc7115959e4825199882f5b397a0d7c34cbbfd1/requirements.txt",
    "https://github.com/binarly-io/fwhunt-scan/blob/6fc7115959e4825199882f5b397a0d7c34cbbfd1/setup.py",
    "https://github.com/binarly-io/fwhunt-scan/blob/6fc7115959e4825199882f5b397a0d7c34cbbfd1/Dockerfile",
    "https://github.com/binarly-io/fwhunt-scan/blob/6fc7115959e4825199882f5b397a0d7c34cbbfd1/.github/workflows/ci.yml",
    "https://github.com/binarly-io/fwhunt-scan/blob/6fc7115959e4825199882f5b397a0d7c34cbbfd1/fwhunt_scan/test_internal.py",
    "https://github.com/binarly-io/fwhunt-scan/blob/6fc7115959e4825199882f5b397a0d7c34cbbfd1/LICENSE",
    "https://pypi.org/project/fwhunt-scan/2.3.8/",
    "https://github.com/binarly-io/fwhunt/blob/a2e3be630e407a49c8076178c712bcf6cccda1bf/README.md"
  ],
  "category": "firmware",
  "description_en": "Binarly's Python scanner that checks UEFI firmware modules against FwHunt rules, the YAML detection format for known UEFI firmware vulnerabilities whose rules are kept in the separate fwhunt repository. Its rizin-based analyzer reports a PE or TE module's Boot, Runtime and PEI service calls, protocols, PPIs, GUIDs, NVRAM variables and SMI handlers, which rules combine with code patterns, strings and hex strings. The CLI analyzes or scans one module, or extracts the modules of a whole firmware image and scans them, and the same classes work as a Python library.",
  "description_zh": "Binarly 推出的 Python 扫描器，用 FwHunt 规则检查 UEFI 固件模块；FwHunt 是针对已知 UEFI 固件漏洞的 YAML 检测规则格式，规则本身存放在独立的 fwhunt 仓库中。其基于 rizin 的分析器可报告 PE 或 TE 模块的 Boot、Runtime 与 PEI 服务调用、协议、PPI、GUID、NVRAM 变量和 SMI 处理程序，规则将这些信息与代码模式、字符串和十六进制串组合匹配。命令行工具可分析或扫描单个模块，也可从整个固件镜像中提取模块后逐一扫描，相同的类也能作为 Python 库调用。",
  "entry_url": "https://awesomerea.org/resources/fwhunt-scan/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/fwhunt-scan/",
  "evidence_url": "https://github.com/binarly-io/fwhunt-scan/blob/6fc7115959e4825199882f5b397a0d7c34cbbfd1/README.md",
  "group": "tools",
  "id": "fwhunt-scan",
  "json_url": "https://awesomerea.org/resources/fwhunt-scan/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/fwhunt-scan/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/fwhunt-scan/index.md",
  "name": "FwHunt Community Scanner (fwhunt-scan)",
  "name_zh": "FwHunt 社区版 UEFI 固件规则扫描器",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The repository has no GitHub releases or tags. The reviewed master commit, from 2025-05-02 and the latest at review, follows the setup.py bump to 2.3.8, the version uploaded to PyPI that day; a separate release branch publishes Docker images to GHCR tagged by commit.",
    "Needs Python 3 (README: tested on 3.6 and above; CI runs on 3.9 to 3.13) with click, rzpipe 0.4.0, PyYAML and uefi_firmware, plus an installed rizin. The README names rizin v0.6.2, and the Dockerfile builds that release from source on a python:3.11 image. Passing an in-memory blob instead of a file path works only on Linux.",
    "Input is a UEFI module or firmware image the user already has, plus FwHunt rule files; no rules are bundled, and the README's rules/ and test/fw.bin example paths are not in this repository. scan-firmware applies firmware-target rules to the whole image and module rules only to modules from the volumes their volume_guids name, unless --force applies them to every module; extract writes all found modules to a directory.",
    "The only test checks GUID table lookups, and CI runs it after a flake8 syntax check. A scan reports, per rule and variant, whether a known pattern matched, printed as threat detected or not; no match does not show that a module is free of other vulnerabilities.",
    "GPL-3.0: setup.py declares GPL-3.0 and source headers GPL-3.0+; the separate fwhunt rule repository is CC0-1.0."
  ],
  "requirements_zh": [
    "仓库没有 GitHub 发布版本或标签。所审阅的 master 提交日期为 2025-05-02，也是审阅时的最新提交，位于 setup.py 升至 2.3.8 之后，该版本于同日上传至 PyPI；另有一个 release 分支向 GHCR 发布以提交号为标签的 Docker 镜像。",
    "需要 Python 3（README 称在 3.6 及以上版本测试，CI 在 3.9 至 3.13 上运行），以及 click、rzpipe 0.4.0、PyYAML 和 uefi_firmware，并需安装 rizin。README 指定 rizin v0.6.2，Dockerfile 在 python:3.11 镜像上从源码构建该版本。以内存数据块代替文件路径传入的方式仅支持 Linux。",
    "输入为使用者已有的 UEFI 模块或固件镜像，以及 FwHunt 规则文件；仓库不附带任何规则，README 示例中的 rules/ 和 test/fw.bin 路径也不在本仓库中。scan-firmware 将目标为 firmware 的规则用于整个镜像，模块规则则只用于其 volume_guids 所指固件卷中的模块，除非使用 --force 将其用于所有模块；extract 命令把找到的全部模块写入一个目录。",
    "唯一的测试只检查 GUID 表查找，CI 在 flake8 语法检查后运行它。扫描结果按规则及其变体报告已知模式是否命中，输出为检测到或未检测到威胁；未命中并不说明模块不存在其他漏洞。",
    "采用 GPL-3.0：setup.py 声明 GPL-3.0，源码文件头为 GPL-3.0+；独立的 fwhunt 规则仓库采用 CC0-1.0。"
  ],
  "targets": [
    "firmware"
  ],
  "url": "https://github.com/binarly-io/fwhunt-scan",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}