A new post titled "[GSoC] Ghidra firmware utilities, week 5" has been published on the coreboot blog. Find the full post at https://blogs.coreboot.org/blog/2019/06/25/gsoc-ghidra-firmware-utilities-week-5/


<div class="wp-block-image"><figure class="alignright"><img src="https://i0.wp.com/blogs.coreboot.org/files/2019/06/01.png?w=660&#038;ssl=1" alt="" class="wp-image-4696" srcset="https://i0.wp.com/blogs.coreboot.org/files/2019/06/01.png?w=134&amp;ssl=1 134w, https://i0.wp.com/blogs.coreboot.org/files/2019/06/01.png?resize=62%2C300&amp;ssl=1 62w" sizes="(max-width: 134px) 100vw, 134px" data-recalc-dims="1" /></figure></div>



<p>Hi everyone. As stated in my previous blogpost, I have been working on a FS loader for Intel Flash Descriptor (IFD) images. The IFD is used on Intel x86 platforms to define various regions in the SPI flash. These may include the Intel ME firmware region, BIOS region, Gigabit ethernet firmware region, etc. The IFD also defines read/write permissions for each flash region, and it may also contain various configurable chipset parameters (PCH straps). Additional information about the firmware descriptor can be found in <a href="https://www.win-raid.com/t3553f39-Guide-Unlock-Intel-Flash-Descriptor-Read-Write-Access-Permissions-for-SPI-Servicing.html">this helpful post</a> by plutomaniac on the Win-Raid forum, as well as <a href="http://opensecuritytraining.info/IntroBIOS_files/Day2_02_Advanced%20x86%20-%20BIOS%20and%20SMM%20Internals%20-%20Flash%20Descriptor.pdf">these slides</a> from Open Security Training.</p>



<p>For a filesystem loader, the flash regions are exposed as files. FLMAP0 in the descriptor map and the component/region sections are parsed to determine the base and limit addresses for each region; both IFD v1/v2 (since Skylake) are supported. Ghidra supports nested filesystem loaders, so the FMAP and CBFS loaders that I&#8217;ve previously written can be used for parsing the BIOS region.</p>



<ul class="wp-block-gallery columns-2 is-cropped"><li class="blocks-gallery-item"><figure><img src="https://i0.wp.com/blogs.coreboot.org/files/2019/06/02-1.png?w=660&#038;ssl=1" alt="" data-id="4700" class="wp-image-4700" srcset="https://i0.wp.com/blogs.coreboot.org/files/2019/06/02-1.png?w=512&amp;ssl=1 512w, https://i0.wp.com/blogs.coreboot.org/files/2019/06/02-1.png?resize=257%2C300&amp;ssl=1 257w" sizes="(max-width: 512px) 100vw, 512px" data-recalc-dims="1" /></figure></li><li class="blocks-gallery-item"><figure><img src="https://i0.wp.com/blogs.coreboot.org/files/2019/06/03-1.png?w=660&#038;ssl=1" alt="" data-id="4701" data-link="https://blogs.coreboot.org/?attachment_id=4701" class="wp-image-4701" srcset="https://i0.wp.com/blogs.coreboot.org/files/2019/06/03-1.png?w=622&amp;ssl=1 622w, https://i0.wp.com/blogs.coreboot.org/files/2019/06/03-1.png?resize=287%2C300&amp;ssl=1 287w" sizes="(max-width: 622px) 100vw, 622px" data-recalc-dims="1" /></figure></li></ul>



<p>If you encounter any issues with the IFD FS loader, please feel free to submit an issue report in <a href="https://github.com/al3xtjames/ghidra-firmware-utils">the GitHub repository</a>.</p>



<h4>Plans for this week</h4>



<p>I have started working on a filesystem loader for UEFI firmware volumes. In conjunction with the IFD loader, this will allow UEFI firmware images to be imported for analysis in Ghidra (behaving somewhat similar to the excellent <a href="https://github.com/LongSoft/UEFITool">UEFITool</a>).</p>