# Delving Deep into Reverse Engineering of UEFI Firmwares via Human Interface Infrastructure
## 5 Discussion  
One attack method on UEFI targets its settings. Once we acquire certain sensitive information, like the location of the password in NVRAM, it can be erased via the UEFI shell. Consequently, the UEFI firmware is left unprotected and can be altered at will. Based  
Figure 19: Secure Boot Strings. Figure 17: Selection Box. Figure 18: Dropdown Box. on HII, it is easy to identify some critical codes, which should be given attention during the UEFI firmware design process. In the above text, we only analyzed AMI firmware. Even though there are different manufacturers producing UEFI, such as Bysoft and Insyde, since the UEFI UI is developed based on the same HII framework, the UEFI firmware produced by different manufacturers is largely similar at the level of the UEFI UI. Therefore, the analysis of AMI firmware is highly representative. We still provide examples of password failure lockout times for UEFI produced by Bysoft and Insyde manufacturers as shown in Figures 20 and 21. For UEFI firmware produced by Bysoft and Insyde manufacturers, we can see that the password failure lockout times are directly displayed in plaintext without any protective measures. On the contrary, we need to spend a lot of effort to find the password failure lockout times in AMI's firmware. All UEFI firmware human-machine interaction systems are developed based on HII. Therefore, if an attacker finds a vulnerability related to HII, it could affect all UEFI firmware. Hence, reverse engineering UEFI firmware can help security researchers discover and fix security vulnerabilities, thereby enhancing system protection capabilities. In the real world, this knowledge will heighten the security awareness of UEFI interaction system developers. Often, developers have a weak sense of security concerning their developments. Understanding the working mechanism of UEFI firmware helps technical support personnel to diagnose and resolve firmware-related issues more effectively. The potential benefit is the ability to improve the security of UEFI during its use, identifying and fixing potential security vulnerabilities, which can reduce the maintenance costs for UEFI manufacturers. The risk is that it might lead to the exposure of security vulnerabilities, increasing the risk of malicious exploitation. In terms of Legal Considerations, UEFI firmware may be protected under copyright law and reverse engineering could infringe upon the intellectual property rights of the creators or owners of the firmware. It is crucial to review the licensing agreement of the firmware to understand what activities are permitted under its terms. Regarding Ethical Considerations, even though reverse engineering can benefit security enhancement and education, it is also essential to respect the labor and rights of the original creators. Figure 21: Password Attempt Times of Insyde. Figure 20: Password Attempt Times of Physoft. Researchers should clarify their intentions when conducting reverse engineering to ensure the legitimacy of their actions and take responsibility for the potential consequences. Therefore, before starting reverse engineering, confirm that the activity does not violate relevant laws, regulations, and licensing agreements. Evaluate the potential security risks that reverse engineering could bring, such as inadvertently creating new security vulnerabilities. Ensure legal compliance and use the acquired knowledge responsibly, but not for illegal or unethical purposes. This article demonstrates that it is possible to extract critical information from UEFI via the HII framework. In the real world, there have been incidents of UEFI critical information leakage. Following a successful cyber-attack by the Money Message extortion group against MSI (Micro-Star International), some of MSI's internal documents were leaked, including sensitive data such as the BootGuard private key.