Pkg.UEFIFirmwareImage — API for parsing UEFI firmware images¶
Overview¶
The Pkg.UEFIFirmwareImage module contains the API for parsing UEFI firmware images. The following image types are supported:
UEFI firmware volumes
(U)EFI capsule updates
UEFI firmware files
Dell PFS files
Intel ME modules
Flash descriptors and regions
Parsing a UEFI Firmware Image¶
The following code example demonstrates how to parse a UEFI firmware image and walk its tree:
from Pro.Core import *
from Pkg.UEFIFirmwareImage import *
def parseUEFIFirmwareImage(fname):
c = createContainerFromFile(fname)
if c.isNull():
return
obj = UEFIFirmwareImageObject()
if not obj.Load(c) or not obj.Initialize():
return
root = obj.GetRoot()
if root is None:
return
print("image type:", obj.GetImageType())
for entry in root.Walk():
prefix = " " * _depth(entry)
desc = entry.GetDescription()
print(prefix + desc)
# extract data for firmware files (when available)
if entry.GetKind() == UEFIEntryKind_FirmwareFile:
data = entry.GetData()
if not data.isNull():
print(prefix + " data size: 0x%X" % data.size())
def _depth(entry):
n = 0
p = entry.GetParent()
while p is not None:
n += 1
p = p.GetParent()
return n
Module API¶
Pkg.UEFIFirmwareImage module API.
Classes:
This class represents an entry in the tree of a parsed UEFI firmware image.
This class represents a parsed UEFI firmware image.
- class UEFIEntry¶
This class represents an entry in the tree of a parsed UEFI firmware image.
Instances of this class are not created directly; they are obtained by traversing the tree starting from
UEFIFirmwareImageObject.GetRoot().Methods:
GetChild(i)Returns the child entry at the given index.
Returns the number of child entries.
GetData()Returns the data associated with the entry as an
NTContainer, decompressing the content when applicable (e.g.Returns a human-readable description of the entry, including key fields such as GUID, type, size and attributes when applicable.
GetGUID()Returns the GUID of the entry as an upper-case string if available; otherwise returns an empty string.
GetKind()Returns a stable identifier describing the kind of entry (e.g.
GetName()Returns the name of the entry if available; otherwise returns an empty string.
Returns the parent entry or
Nonefor the root entry.Returns the friendly name associated with the entry GUID from the built-in list of known UEFI GUIDs if available; otherwise returns an empty string.
GetSize()Returns the size in bytes of the entry.
Returns the type name of the underlying object as a human-readable string.
Walk()Iterates over this entry and all its descendants in depth-first order.
- GetChild(i: int) → Optional[Pkg.UEFIFirmwareImage.UEFIEntry]¶
Returns the child entry at the given index.
- Parameters
i (int) – The child index.
- Returns
The child entry if the index is valid; otherwise returns
None.- Return type
Optional[UEFIEntry]
See also
GetChildCount().
- GetChildCount() → int¶
Returns the number of child entries.
- Returns
The child count.
- Return type
int
See also
GetChild().
- GetData() → Pro.Core.NTContainer¶
Returns the data associated with the entry as an
NTContainer, decompressing the content when applicable (e.g. LZMA-compressed CPD entries); returns an invalid container when the entry exposes no data.
- Returns
The entry data.
- Return type
- GetDescription() → str¶
Returns a human-readable description of the entry, including key fields such as GUID, type, size and attributes when applicable.
- Returns
The description string.
- Return type
str
- GetGUID() → str¶
Returns the GUID of the entry as an upper-case string if available; otherwise returns an empty string.
- Returns
The GUID string.
- Return type
str
- GetKind() → str¶
Returns a stable identifier describing the kind of entry (e.g.
"FirmwareVolume","FirmwareFile").The returned value matches one of the
UEFIEntryKind_*constants.
- Returns
The entry kind identifier.
- Return type
str
- GetName() → str¶
Returns the name of the entry if available; otherwise returns an empty string.
For firmware file sections the name is resolved from the sibling user-interface section when present.
- Returns
The entry name.
- Return type
str
- GetParent() → Optional[Pkg.UEFIFirmwareImage.UEFIEntry]¶
Returns the parent entry or
Nonefor the root entry.
- Returns
The parent entry or
None.- Return type
Optional[UEFIEntry]
- GetResolvedGUIDName() → str¶
Returns the friendly name associated with the entry GUID from the built-in list of known UEFI GUIDs if available; otherwise returns an empty string.
- Returns
The resolved GUID name.
- Return type
str
- GetSize() → int¶
Returns the size in bytes of the entry.
- Returns
The size in bytes.
- Return type
int
- GetTypeName() → str¶
Returns the type name of the underlying object as a human-readable string.
- Returns
The type name.
- Return type
str
- Walk() → Iterator[Pkg.UEFIFirmwareImage.UEFIEntry]¶
Iterates over this entry and all its descendants in depth-first order.
- Returns
An iterator over the entries.
- Return type
Iterator[UEFIEntry]
- class UEFIFirmwareImageObject¶
Bases:
Pro.Core.CFFObjectThis class represents a parsed UEFI firmware image.
Supported inputs include UEFI firmware volumes, (U)EFI capsule updates, UEFI firmware files, Dell PFS files, Intel ME modules, flash descriptors and flash regions.
Methods:
Returns the name of the detected top-level image type.
GetRoot()Returns the root entry of the parsed image tree.
- GetImageType() → str¶
Returns the name of the detected top-level image type.
- Returns
The image type name, or an empty string if the image has not been parsed.
- Return type
str
- GetRoot() → Optional[Pkg.UEFIFirmwareImage.UEFIEntry]¶
Returns the root entry of the parsed image tree.