[UEFITool] UEFI firmware image viewer and editor

Discussion in 'MDL Projects and Applications' started by CodeRush, Oct 8, 2013.

  1. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
  2. BDMaster

    BDMaster MDL BIOS/EFI Modifier

    Aug 2, 2009
    821
    313
    30
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
    Too few free space for repacked files, it must be modified manually.
    Problems with Windows XP will hopefully be solved in next release.
     
  4. Tito

    Tito Super Mod / Adviser
    Staff Member

    Nov 30, 2009
    18,816
    19,023
    340
  5. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
    @Tito, you are talking about HII files parser with very interesting interface, and it can be done, but it will be a project more complex and harder to develop as the whole UEFITool before. It's possible as an idea, but I won't do this right now for sure.
     
  6. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
    UEFITool 0.18.2 is out.

    Changes:
    - messages are now delayed until tree item is created and therefore double click on a message selects the item itself, not it's parent, as it was by all previous versions.
    - error messages are now user-friendlier, i.e "UEFI volumes not found" instead of "Error code: 14".

    Search for GUID and pattern-based search will be implemented in next version.
    Please test and write your reports here or on issue tracker.
     
  7. Tito

    Tito Super Mod / Adviser
    Staff Member

    Nov 30, 2009
    18,816
    19,023
    340
    Take your time... no need to hurry.

    :hug2:
     
  8. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
    Another UEFITool update - 0.18.3.

    Changes:
    - '.' (dot) symbol can be used as "any hex digit" placeholder for hex pattern search
    - added search for GUIDs (pattern format is the same as above)
    - added copy action to copy the text of selected message (hotkey: Ctrl+Shift+C)
    - small changes to focus handling in search window

    Please test and report any errors you may find.
     
  9. gabiz_ro

    gabiz_ro MDL Member

    Feb 2, 2010
    173
    12
    10
    Something about DXE dependency will be useful,if that info could be decoded.
    Another useful ideea I think,since I see on some BIOS they don't have user interface sections,in that case display possible name from a predefined list based on GUID ID.
    For free form ones parse module and if PCIR detected,name it Option rom and append hardware id into resulted name. Same method could apply for SSDT DSDT etc
     
  10. Aigor

    Aigor MDL Novice

    Feb 27, 2014
    22
    4
    0
    #191 Aigor, Jul 17, 2014
    Last edited by a moderator: Apr 20, 2017
  11. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
    @Aigor, I have a lot of such BIOSes. FFF.. volume is an NVRAM storage on that platform, 005.. is some non-FV board data I don't know anything about, and for those non-FV (i.e. no FFS files inside) modules there are always some inconsistencies in BlockMap or VolumeSize, so I recommend not to give a f*ck here.
    Sections with 0xF0 type are common too, and their puprose is somewhat related to CRC32 calculation, I think, but any modification can be performed and works so it appears that this checkums are nowhere to be verified.
    There are nothing to do about OSX there, don't be confused by names. PartitionDxe is a normal EDK-based partition driver that consumes DISK_IO device node and produces BLOCK_IO nodes for each partitions it could find on specific disk.
     
  12. Aigor

    Aigor MDL Novice

    Feb 27, 2014
    22
    4
    0
    Thank you CodeRush for your knwoledge that you share with me :)
    If i can i would like to ask you another thing, it seems that this bios is uefi, but in bios i cant see anything about efi, maybe it's hidden?
    do you know some software like amibcp that show bios menu and so on?
    Thank you in advance
    I hope that my messages dont bother you :)
     
  13. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
    1. I can either be hidden or just removed because UEFI boot didn't work as expected for some reason that time.
    2. I don't know any dedicated software, but D6K's Universal IFR Extractor may help in digging thru menus.
     
  14. akcent

    akcent MDL BIOS/EFI Modifier

    Aug 20, 2009
    2,453
    1,247
    90
    CodeRush

    Look PM
     
  15. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
    UEFITool 0.18.5 is out.

    Changes:
    -added "Copy all" action for messages
    -solved a bug with inserting/replacing RAW files introduced in 0.18.0
    -windows version compiled by VS2010

    Please check if the program still works in Windows XP, I don't have a platform to test it.
     
  16. blakeniel

    blakeniel MDL Novice

    Jun 3, 2010
    11
    2
    0
    Hi CodeRush,
    Is it possible to use one of your tools to extract Thinkpad T420 UEFI bios and create a capsule file? I have a bricked T420 and tried many methods to recover it with no luck. Please let me know if there is a method. Your hard work always appreciated.
     
  17. CodeRush

    CodeRush MDL Member

    Jun 20, 2011
    221
    674
    10
    @blakeniel, it's possible, I think, but rather pointless. If the capsule header has a signature - nether I nor anyone without private key can forge a right capsule, and there is no signature there - just use hex editor to transfer the whole capsule from BIOS update file and you are done.
    To unbrick your board I would buy or built a hardware SPI programmer (20-30 bucks on ebay), download a full dump from the same laptop (such dumps can be found on repairmen's sites) and flash it into your SPI chip. You can also dump it's contents before reflashing to be able to extract all individual board data and transfer it to new image, if they aren't corrupted by bricking.