# Delving Deep into Reverse Engineering of UEFI Firmwares via Human Interface Infrastructure
## 2 Background
### Challenges in Firmware Analysis  
Low-power, single-purpose embedded devices (such as routers and IoT devices) are ubiquitous. While they have automated and simplified many aspects of users' lives, recent large-scale attacks have demonstrated that they pose a serious threat to the internet infrastructure due to their vast numbers. Unfortunately, the software on these systems relies on hardware and typically runs in unique, minimized environments with non-standard configurations, making security analysis particularly challenging. In the field of reverse engineering, the correct image base of firmware has very important significance for the reverse engineers to understand the firmware by building accurate cross references. However, for a large number of embedded system firmwares, the format is nonstandard and the image base is unknown. Thus, [23] presents a two-step method to determine the image base of firmwares for ARM-based devices. First, based on the storage characteristic of string in the firmware files and the encoding feature of literal pools that contain string addresses, we propose an algorithm called FIND-LP to recognize all possible literal pools in firmware. Second, we propose an algorithm called Determining image Base by Matching Literal Pools (DBMLP) to determine the image base. Addressing the non-standardized firmware formats, [PERSON]. [24] describes a methodology for automatically determining the image base of firmware of ARM-based industrial control systems. Two algorithms, FIND-String and FIND-LDR, are presented that obtain the offsets of strings in firmware and the string addresses loaded by LDR instructions, respectively. [PERSON]. [25] introduced Karonte, a static analysis approach capable of analyzing embedded device firmware by modeling and tracking multi-binary interactions. This method propagates tainted information between binary files to detect insecure interactions and identify vulnerabilities. [PERSON]. [26] designed and implemented a new tool named FIE, which builds on the KLEE symbolic execution engine to provide a scalable platform for detecting errors in firmware programs of the popular MSP430 series microcontrollers. FIE incorporates new symbolic execution techniques, enabling it to verify the security properties of simple firmware common in practice. Ref. [27] designed a software framework that continuously executes given firmware binary files while bootstrapping inputs from off-the-shelf fuzzers, achieving hardware-independent and scalable firmware testing. This framework employs a novel technique called P2 IM, which abstracts various peripherals and processes firmware I/O in real-time based on automatically generated models. P2 IM is agnostic to peripheral designs and generic to firmware implementations, making it applicable to a wide range of embedded devices. Ref. [28] introduced FIRMSCOPE, an innovative static analysis system that analyzes Android firmware to expose unwanted functionalities in pre-installed applications using efficient and practical context-sensitive, flow-sensitive, field-sensitive, and partially object-sensitive taint analysis.  
For UEFI, existing static analyses fail to effectively detect such vulnerabilities in stripped COTS UEFI firmware images, which are developed based on a custom callback mechanism that organizes callable functions into protocols identified by GUIDs. Leveraging this callback-based programming paradigm, [PERSON]. [29] introduced the first static detection framework, SPENDER, built upon a novel protocol-centric analysis for efficiently and accurately discovering potential SMM privilege escalation vulnerabilities in UEFI firmware. The calling conventions in UEFI are so unusual that existing reverse engineering tools cannot handle them natively. Therefore, [PERSON]. [30] developed an extension for Ghidra [31] to better analyze UEFI modules.