Two small scripts for pulling apart UEFI/BIOS firmware dumps in
Ghidra.
stage-pe32-modules.sh takes a
UEFIExtract
dump directory and stages every embedded PE32/PE32+ module (PEI and DXE
drivers) into a flat folder with real, readable names instead of
UEFITool's GUID-keyed paths — ready for Ghidra's batch importer.
DumpDecompile.java is a Ghidra headless post-script that
dumps every function's decompiled C, plus defined strings and exported
symbols, for a given module straight to a text file — useful when you
want to grep or diff a driver's logic without opening the GUI at all.
A companion write-up to the toolkit above.
UEFITool's
current "New Engine" build only ships extract-only CLI tools —
no scriptable insert/replace, just a GUI. Turns out the older
"legacy engine" releases (plain semver tags like
0.28.0, from before the rewrite) still ship a
standalone UEFIReplace/UEFIPatch CLI
that works great for one-shot firmware edits — no GUI
automation needed. The write-up covers usage, a section-type
reference table, a real verification recipe, and a gotcha
about the large-looking "cascade diff" you'll see whenever a
patched file needs recompression.
Also bundled: an updated stage-pe32-modules.sh
(see above) that fixes a real naming bug — most firmware
modules sit under an extra "Compressed section" wrapper
directory that the original version didn't walk past, so
they'd get staged under a useless generic name instead of the
real module name.