Post

Ida Free with efiXplorer

Just so you know ida sdk was open sourced released this september, with binarly's efiXplorer developed in C++. This allows us to use the plugin in Free version of Ida.

Ida Free with efiXplorer


Info

Ida Free has just became more powerful with Binarly’s efiXplorer Ida plugin. Coupling efiXplorer with Ida Free’s online decompiler support while limited to x86 and x64 decompilation, it provides plenty enough capability for a reverse engineer to analyze efi firmware, especially analysing malicious efi.

The efiXplorer Build is pretty straight forward. I build mine using the CMAKE instruction.

Here is a screenhot of blacklotus efi under Ida Free and efiXplorer Plugin: idafreeimg

The loader may not work, this is due to Ida Free being limited to PE/ELF/MACHO, just continue loading the firmware, once loaded run the efiXplorer plugin.

[Reference:]

  • https://hex-rays.com/blog/open-sourcing-ida-sdk
  • https://github.com/binarly-io/efiXplorer
This post is licensed under CC BY 4.0 by the author.