# Delving Deep into Reverse Engineering of UEFI Firmwares via Human Interface Infrastructure
These tools can help researchers understand and analyze the structure and content of UEFI binary images. However, these tools alone are far from sufficient for analyzing the user interface. To achieve this goal, this paper will use reverse engineering tools, like the UEFI Tool and IDA Pro, and delve deeply into the crucial role that the HII framework plays in the analysis of the UEFI UI. By applying existing reverse engineering techniques to the analysis of the UEFI UI, we reveal key information hidden in the firmware as well as some design flaws. In this paper, we systematically investigate the password policy of UEFI. For systems that have set a UEFI password, we need to enter the correct password to gain access when we power on the system or enter the UEFI UI. Therefore, the UEFI password often becomes our first interaction with the user interface, sparking our intense interest to deeply analyze the implementation of the password policy. However, in many UEFI firmware, manufacturers have implemented various protection measures such as code obfuscation techniques, making it challenging for us to find the password implementation program via direct reverse engineering. Hence, to address this situation, we propose a protocol-centric static analysis method to analysis the UEFI password policy. In addition, we aim to find the actual location of the password within the flash chip. Therefore, by analyzing the HII framework and combining it with the open-source tool Universal-IFR-Extractor [12], we reverse-engineered the VFR language that implements the UEFI UI. As a result, we found the storage locations of the password and other variables. Moreover, during this process, by validating all the modules of the Dell r730 firmware against the manufacturer's standard firmware, we found that not only is the UEFI password stored within the firmware, but previously used passwords are also recorded. This is because NVRAM variables were stored in the UEFI firmware by developers, which undeniably presents a significant security risk. Finally, regarding the richer configuration options provided by UEFI, we studied the hardware port configurations, using secure boot as a case study. Additionally, combining the HII framework and IDA, we analyzed the logic of the UEFI UI in setting hardware interfaces. In summary, we make the following contributions:  
* We analyzed the UEFI password policy of different manufacturers, using HII protocols. For the first time, from a reverse engineering perspective, we found the way that the AMI standard protocol implements password policy. We proposed a protocol-centered static analysis method for password policies. * We deeply analyzed the role of the VFR language in the UEFI UI from a reverse engineering perspective. we found the storage locations of some sensitive information in the UEFI firmware image. Ultimately, during the analysis, we discovered that the UEFI firmware used by a series of models exposes the encrypted password content and salt value in the binary firmware and even records previously used passwords and salt values. * Compared to traditional BIOS, UEFI offers richer features. We analyzed how UEFI configures hardware ports by reverse engineering the VFR language. The rest of this work is structured as follows: Section 2 provides a comprehensive background; Section 3 describes the HII framework and its related technologies; Section 4 provides implementation details of the UEFI management Interface analysis process; Section 5 describes related work; Section 6 discusses additional research questions; and Section 7 concludes.