# Delving Deep into Reverse Engineering of UEFI Firmwares via Human Interface Infrastructure
## 6 Related Work  
### Security Research on UEFI  
Researchers [PERSON] and [PERSON] first proposed that before executing the UEFI firmware executable file, its digital signature should be verified to ensure the integrity and legitimacy of the UEFI firmware executable file [32]. This method is based on digital authentication technology and provides a set of signing, authentication, and key management service interfaces to assist users, firmware systems, and operating systems in executing trustworthy operations. However, implementing this method relies on a large amount of authentication information and key information, which burdens the UEFI firmware memory; verifying the integrity of the file before execution affects the boot efficiency of the UEFI firmware [33]. Building upon [PERSON] and [PERSON]'s work, the literature [34] proposed a method based on trusted computing. Using the TPM chip as a trusted root node,it establishes a trusted chain for computer system startup to ensure the legitimacy of the executing nodes, thereby securing the UEFI firmware boot process. This method establishes a trusted node on the hardware, starting from the platform power-on to the application execution, authenticating each level and trusting each level, building a complete trust chain, prohibiting the execution of unauthenticated programs, and identifying \"self\" and \"non-self\" components in a timely manner, thus constructing a secure computer operating environment. The challenge of this method is how to distinguish between the \"self\" and \"non-self\" components. Flexible distinction rules facilitate UEFI firmware applications, but they reduce the security of UEFI firmware. Strict rules ensure UEFI firmware security, but restrict its application, reducing firmware extensibility. Attacks targeting UEFI are also frequently researched now. SMM (System Management Mode) is a CPU execution mode with the highest privileges, and attackers can modify the UEFI configuration and hardware chip using SMM vulnerabilities [32]. Moreover, attackers may exploit the S3 Resume Boot Script [35], Secure Boot [36;37], UEFI updates, and tamper with UEFI variables, among other tactics. In the face of increasingly severe firmware attacks, analyzing the vulnerability security of UEFI is of significant importance [38]. The paper first introduces the commonly used trusted authentication mechanisms of UEFI. Subsequently, targeting the vulnerabilities in the trust verification process of UEFI during the startup phase, and by integrating the state transition diagrams, the PageRank algorithm, and the Bayesian network theory, an analysis model for the UEFI trust verification startup vulnerability is constructed. The paper also conducts validation and analysis based on specific instances. Through the verification and analysis of the acquired data, vulnerable attack paths and critical vulnerability nodes are identified. Finally, based on the analysis results, security reinforcement measures for UEFI are proposed. In addition to UEFI firmware for PCs and servers, the firmware of other platforms is also worthy of study. As a critical part in mobile cloud computing, the vulnerability of Android devices can directly affect the security of the mobile cloud. The unsecured Android can be potentially exploited by malwares to obtain the root privilege. Root privilege misuse is the critical issue for Android security, which breaks the integrity of Android security and rises the risk of permission escalation from malwares. The existing solutions still fail to balance the trade-off between the users desires on using root privilege and the Android security, which lays risks in leading to the root privilege misuse. To address this issue, [PERSON]. [39] proposes a root privilege management scheme named Root Privilege Manager (RPM), which adopts root privilege access control to guarantee the exclusive root access opportunity of authenticated apps.