It's also a nice showcase of Unicorn potential and limitations. It's based on gdb/gdbinit commands.Įven with all its limitations this is a pretty useful tool for reversing some EFI binaries, improving a lot the reverse engineering process from a static analysis only (for us who don't have 6k JTAG based EFI debuggers). It works pretty well if we know what we are doing. The debugger command line parser is pretty crude and definitely needs serious work to improve it. These are due to the JIT used by Unicorn/QEMU. The hook implementation for breakpoints also has some limitations. Unicorn has some limitations regarding this, such as problems changing the EFLAGS register inside a hook. The debugger is still pretty basic but allows to view and modify registers and memory, step into calls or over them, and breakpoints. So some stuff is configured/hardcoded for this specific goal (the sample ini file is configured with the required binaries). This tool was created to reverse engineer and analyse the EFI binaries related to Apple's firmware password reset described in this blog post. This can be done with extra work, since the core code to load binaries already exists, although it needs to be modularized.Ĭan be used to easier reverse some EFI binaries that don't interact with hardware or graphical EFI interface. Not every service is yet implemented, such as services to load and locate other binaries. It works by implementing basic EFI Boot and Runtime services. It allows to run EFI DXE binaries inside a Unicorn virtual nachine with a basic interactive debugger that allows to step and interact with the EFI code. Reference blogpost explaining how it works: Crafting an EFI Emulator and Interactive Debugger. This is an EFI DXE phase binaries emulator based on Unicorn. An EFI DXE binary emulator based on UnicornĬopyright © 2016-2019 Pedro Vilaca.

Macbook pro 2016 scbo file