HP Firmware DXE Extraction

I recently analyzed some HP Laptop firmware using UEFITool, and one thing I noticed in newer firmware images is that there are no results for DXE modules listed in UEFITool. After a lot of messing around, I figured out that there is a Firmware Volume (FV) LZMA compressed in the UEFI image file. I’m not sure why UEFITool doesn’t recognize this FV. I needed a way to examine DXE modules though, so I wrote a small python3 script that takes a file path to an HP UEFI firmware image file and dumps the DXE modules to a directory in $PWD called volume-0.

I used a combination of binwalk and uefi_firmware to perform the extraction. It is important to note that in the segment that binwalk extracts, the UEFI PI FV begins at 16 (0x10) bytes into the segment.

Without further adieu:

#!/usr/bin/env python3
#
# Author: Nicholas Starke
# Date: 2022-02-22
#
# To install necessary dependencies, run:
# $ pip3 install uefi_firmware binwalk
#

import uefi_firmware, binwalk, sys, os

print("[*] Beginning HP Firmware DXE Extraction.")
for module in binwalk.scan(sys.argv[1], signature=True, quiet=True, extract=True):
    for result in module.results:
        if "LZMA" in result.description:
            try:
                lzma_file = open(module.extractor.output[result.file.path].extracted[result.offset].files[0], 'rb').read()
            except:
                print("[-] An error occured and extraction failed.  Bummer.")
                continue

            parser = uefi_firmware.AutoParser(lzma_file[0x10:])
            parsed_lzma_file = parser.parse()
            if parsed_lzma_file is None:
                continue
            parsed_lzma_file.dump()
            print("[+] Success! Extracted DXE files should be in directory 'volume-0'")
            os.rmdir(module.extractor.directory)
            print("[*] Cleaned up binwalk extraction contents. Exiting now")
            sys.exit()

    os.rmdir(module.extractor.directory)
    print("[-] Extraction failed.")
Home