{
  "added_at": "2026-10-31",
  "additional_evidence_urls": [
    "https://github.com/theopolis/uefi-firmware-parser/blob/c4b8c64e7a1ca647b68db99db80ef0410d9afe79/setup.py",
    "https://github.com/theopolis/uefi-firmware-parser/blob/c4b8c64e7a1ca647b68db99db80ef0410d9afe79/uefi_firmware/__init__.py",
    "https://github.com/theopolis/uefi-firmware-parser/blob/c4b8c64e7a1ca647b68db99db80ef0410d9afe79/bin/uefi-firmware-parser",
    "https://github.com/theopolis/uefi-firmware-parser/blob/c4b8c64e7a1ca647b68db99db80ef0410d9afe79/scripts/fv_injector.py",
    "https://github.com/theopolis/uefi-firmware-parser/blob/c4b8c64e7a1ca647b68db99db80ef0410d9afe79/.github/workflows/ci.yml",
    "https://github.com/theopolis/uefi-firmware-parser/blob/c4b8c64e7a1ca647b68db99db80ef0410d9afe79/LICENSE",
    "https://github.com/theopolis/uefi-firmware-parser/blob/c4b8c64e7a1ca647b68db99db80ef0410d9afe79/uefi_firmware/compression/Tiano/Decompress.c",
    "https://github.com/theopolis/uefi-firmware-parser/releases/tag/v1.16",
    "https://pypi.org/project/uefi_firmware/1.16/"
  ],
  "category": "firmware",
  "description_en": "Python library and uefi-firmware-parser command for identifying, parsing and extracting PC firmware images: UEFI firmware volumes, capsules, firmware file systems, files and sections, Intel PCH flash descriptors, Intel ME modules and Dell PFS update packages. An AutoParser picks the format, or a brute-force scan looks for volumes and other known objects inside an unidentified blob; results print as an object hierarchy or dump to files, with Tiano/EFI and LZMA sections decompressed by a bundled C extension. Helper scripts replace a section or file by GUID inside a volume, generate an FDF flash description from parsed volumes and output GUID labels for IDA scripts.",
  "description_zh": "Python 库及 uefi-firmware-parser 命令行工具，用于识别、解析和提取 PC 固件镜像：UEFI 固件卷、胶囊（capsule）、固件文件系统、文件与节（section），以及 Intel PCH Flash Descriptor、Intel ME 模块和 Dell PFS 更新包。AutoParser 可自动判断格式，暴力扫描模式则在未识别的数据块中查找固件卷及其他已知对象；结果可打印为对象层级或导出为文件，Tiano/EFI 与 LZMA 压缩的节由内置 C 扩展解压。附带的脚本可按 GUID 替换固件卷中的节或文件，根据解析出的固件卷生成 FDF 闪存描述文件，并输出供 IDA 脚本使用的 GUID 标签。",
  "entry_url": "https://awesomerea.org/resources/uefi-firmware-parser/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/uefi-firmware-parser/",
  "evidence_url": "https://github.com/theopolis/uefi-firmware-parser/blob/c4b8c64e7a1ca647b68db99db80ef0410d9afe79/README.rst",
  "group": "tools",
  "id": "uefi-firmware-parser",
  "json_url": "https://awesomerea.org/resources/uefi-firmware-parser/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/uefi-firmware-parser/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/uefi-firmware-parser/index.md",
  "name": "UEFI Firmware Parser",
  "name_zh": "UEFI Firmware Parser 固件结构解析工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v1.16, published 2026-06-04 on GitHub and PyPI with abi3 wheels for Linux, Windows and macOS. The reviewed master commit, from 2026-10-12, is three commits ahead: it adds AMI capsule support and a safe-path utility for dumped files and drops the future dependency, so those changes are not yet released.",
    "Python 3.10+. A source install compiles the bundled efi_compressor C extension, which the README says needs the Python development headers and gcc; the package declares no other runtime dependencies. CI runs the unit tests on Python 3.12 on Ubuntu.",
    "Input is a firmware file the user supplies, such as a vendor BIOS/UEFI update or a flash dump. The README warns that not every vendor update parses and that some must first be decompressed or unpacked from the update mechanism, typically a PE executable; --test reports the detected type, -b searches a blob for volume headers and --superbrute checks every byte offset for any known object. It lists ASRock, Dell, Gigabyte, Intel, Lenovo, HP, MSI, VMware, Apple and Qualcomm updates as tested, without per-version results.",
    "GUID injection with fv_injector.py only replaces existing sections or files, with no addition or removal, and asks interactively which section to replace inside a firmware file. It parses containers and extracts their contents; analyzing the extracted modules needs a separate disassembler or decompiler. CI also parses a separately hosted samples repository.",
    "LICENSE carries MIT-style permission text and points to inline licenses in contributed work, while setup.py and the PyPI metadata declare BSD-3-Clause. The bundled Intel Tiano compression sources are BSD-2-Clause-Patent and the LZMA SDK files are public domain."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v1.16，于 2026-06-04 在 GitHub 和 PyPI 发布，提供适用于 Linux、Windows 和 macOS 的 abi3 wheel。所审阅的 master 提交日期为 2026-10-12，领先该版本三个提交：新增 AMI 胶囊支持和用于导出文件路径的安全路径工具，并移除了 future 依赖，这些改动尚未发布。",
    "需要 Python 3.10+。从源码安装时会编译内置的 efi_compressor C 扩展，README 称这需要 Python 开发头文件和 gcc；该软件包未声明其他运行时依赖。CI 在 Ubuntu 上用 Python 3.12 运行单元测试。",
    "输入为使用者自备的固件文件，例如厂商 BIOS/UEFI 更新包或闪存转储。README 提醒，并非每个厂商更新包都能解析，有些需要先从更新机制（通常是 PE 可执行文件）中解压或解包；--test 会报告识别出的类型，-b 在数据块中搜索固件卷头，--superbrute 则逐字节检查任何已知对象。README 列出 ASRock、Dell、Gigabyte、Intel、Lenovo、HP、MSI、VMware、Apple 和 Qualcomm 的更新包为已测试来源，但没有按版本给出结果。",
    "fv_injector.py 的 GUID 注入只能替换已有的节或文件，不能增删；向固件文件注入时会交互式询问要替换哪个节。它负责解析容器结构并提取内容，分析提取出的模块仍需另用反汇编器或反编译器。CI 还会解析一个另行托管的样本仓库。",
    "LICENSE 文件为 MIT 式授权文本，并提示贡献代码另附内联许可证；而 setup.py 和 PyPI 元数据声明的是 BSD-3-Clause。内置的 Intel Tiano 压缩源码采用 BSD-2-Clause-Patent，LZMA SDK 文件属于公有领域。"
  ],
  "targets": [
    "firmware"
  ],
  "url": "https://github.com/theopolis/uefi-firmware-parser",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}