{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/yeggor/uefi_retool/blob/be13abf0a84179f53a9ac8858a4cb2686b312a67/ida_plugin/README.md",
    "https://github.com/yeggor/uefi_retool/blob/be13abf0a84179f53a9ac8858a4cb2686b312a67/uefi_retool.py",
    "https://github.com/yeggor/uefi_retool/blob/be13abf0a84179f53a9ac8858a4cb2686b312a67/config.json",
    "https://github.com/yeggor/uefi_retool/blob/be13abf0a84179f53a9ac8858a4cb2686b312a67/requirements.txt",
    "https://github.com/yeggor/uefi_retool/blob/be13abf0a84179f53a9ac8858a4cb2686b312a67/ida_plugin/uefi_analyser/analyser.py",
    "https://github.com/yeggor/uefi_retool/blob/be13abf0a84179f53a9ac8858a4cb2686b312a67/ida_plugin/uefi_analyser/log_pp_guids.py",
    "https://github.com/yeggor/uefi_retool/blob/be13abf0a84179f53a9ac8858a4cb2686b312a67/tools/get_efi_images.py",
    "https://github.com/yeggor/uefi_retool/tree/be13abf0a84179f53a9ac8858a4cb2686b312a67/ida_plugin/uefi_analyser/guids",
    "https://github.com/yeggor/uefi_retool/blob/be13abf0a84179f53a9ac8858a4cb2686b312a67/LICENSE"
  ],
  "category": "firmware",
  "description_en": "Python command-line tool and IDA Pro plugin for UEFI firmware reverse engineering. uefi_retool.py unpacks a firmware image with uefi-firmware-parser, collects its executable modules and runs IDA in batch mode on each one, writing their boot-service calls and protocol GUIDs to JSON; a separate command lists protocols whose GUIDs are absent from its EDK2, AMI and vendor GUID tables as proprietary. Inside IDA the plugin applies EFI system-table types and names, lists protocols in an explorer window and, from the JSON, shows a dependency browser and graph across the firmware’s modules.",
  "description_zh": "用于 UEFI 固件逆向工程的 Python 命令行工具及 IDA Pro 插件。uefi_retool.py 用 uefi-firmware-parser 解包固件镜像，收集其中的可执行模块，并以批处理模式逐一交给 IDA 分析，把各模块的引导服务调用和协议 GUID 写入 JSON；另一条命令则把 GUID 不在其 EDK2、AMI 及厂商 GUID 表中的协议列为专有协议。在 IDA 中，插件会应用 EFI 系统表的类型和名称，在浏览窗口中列出协议，并根据该 JSON 展示固件各模块之间的依赖浏览器和依赖图。",
  "entry_url": "https://awesomerea.org/resources/uefi-retool/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/uefi-retool/",
  "evidence_url": "https://github.com/yeggor/uefi_retool/blob/be13abf0a84179f53a9ac8858a4cb2686b312a67/README.md",
  "group": "tools",
  "id": "uefi-retool",
  "json_url": "https://awesomerea.org/resources/uefi-retool/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/uefi-retool/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/uefi-retool/index.md",
  "name": "uefi_retool",
  "name_zh": "uefi_retool UEFI 固件逆向工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The repository is archived. Its last commit (2024-12-28) only updates the README, the last code changes date from 2021-08-03, and the only tag, 1.2.0 from 2020-05-07, is eight commits older; there are no GitHub releases. The tree contains an IDA plugin only and no Ghidra component.",
    "Needs a licensed IDA Pro with IDAPython and PyQt5: copy uefi_analyser.py and the uefi_analyser package into IDA’s plugins directory, then set the IDA and IDA64 executable paths and the module, dump and log directories in config.json, whose example points to IDA Pro 7.6 on Windows. The script uses Python with Click, colorama, terminaltables, tqdm and uefi-firmware-parser 1.8, installed from a tarball named in requirements.txt.",
    "Input is a UEFI firmware image the user supplies; README examples name a ThinkPad X1 Carbon 5th-generation image that the repository does not include, and no firmware images are committed. The analyser recognizes x86 and x86-64 instruction patterns and chooses IDA or IDA64 from each image’s machine type. The bundled GUID tables come from EDK2 and EDK, from ida-efiutils for AMI, and from Dell, Lenovo and ASRock lists, and tools/update_edk2_guids.py refreshes the EDK2 table.",
    "MIT license (2018–2021, yeggor). The repository has no tests or CI. Labels and dependency graphs come from GUID matching and instruction patterns, so they need analyst checking."
  ],
  "requirements_zh": [
    "该仓库已归档。最后一次提交（2024-12-28）只更新了 README，最后的代码改动在 2021-08-03，唯一的标签 1.2.0 发布于 2020-05-07，比当前提交早八个提交；没有 GitHub 发行版。代码树只包含 IDA 插件，没有 Ghidra 组件。",
    "需要已授权的 IDA Pro，并具备 IDAPython 和 PyQt5：将 uefi_analyser.py 和 uefi_analyser 包复制到 IDA 的插件目录，再在 config.json 中设置 IDA 与 IDA64 可执行文件路径以及模块、转储和日志目录；示例配置指向 Windows 上的 IDA Pro 7.6。脚本需要 Python 及 Click、colorama、terminaltables、tqdm，以及按 requirements.txt 中的压缩包地址安装的 uefi-firmware-parser 1.8。",
    "输入是使用者自行提供的 UEFI 固件镜像；README 示例提到的 ThinkPad X1 Carbon 第五代镜像并不在仓库中，仓库也未提交任何固件镜像。分析器识别 x86 和 x86-64 指令模式，并根据每个镜像的机器类型选择 IDA 或 IDA64。随附的 GUID 表来自 EDK2 和 EDK、ida-efiutils 中的 AMI 列表，以及 Dell、Lenovo 和 ASRock 的列表，tools/update_edk2_guids.py 可刷新 EDK2 表。",
    "采用 MIT 许可证（2018–2021，yeggor）。仓库没有测试或 CI。标签和依赖图来自 GUID 匹配和指令模式，需由分析人员核对。"
  ],
  "targets": [
    "firmware"
  ],
  "url": "https://github.com/yeggor/uefi_retool",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}