Thank The NSA For Their Ghidra Software Now Helping Firmware Reverse Engineering

Ghidra is the open-source reverse engineering tool published by the US National Security Agency as an alternative to existing decompilers/disassemblers and other reverse engineering utilities. As noted earlier this summer, a Google Summer of Code project has been creating Ghidra plug-ins for helping with firmware reverse engineering.

It's been some time since last hearing anything about that effort to boost firmware reverse engineering, but in their final GSoC report, it was a success. With this new Ghidra plug-in there is support for loading into Ghidra of PCI option ROMs, the Intel firmware descriptor, reading the flash map, Coreboot File-System, UEFI Firmware Volumes, and the UEFI Terse Executable format. There is also a helper script for analyzing UEFI binaries.

Moving forward, the student developer Alex James may tackle a processor module for disassembling the EFI Byte Code, support for more features in his UEFI helper script, and other bits to assist in firmware reverse engineering.

The GSoC 2019 recap for this project can be found via the Coreboot.org blog. The new code for Ghidra is currently hosted on Alex's GitHub.