Shell & Firmware Tools Seed

IFR Extractor for Hidden Setup Options

How IFR extraction helps firmware engineers debug hidden BIOS setup options, SuppressIf logic, VarStore mapping, and HII forms.

3 min read
Shell & Firmware Tools cover

A setup option exists in the source code, but the user cannot see it in BIOS Setup.

The UI is not broken. It may be suppressed, grayed out, hidden by manufacturing mode, hidden by platform policy, or tied to a different VarStore than expected.

IFR extraction is how firmware engineers inspect the compiled setup logic.

01 VFR

Human-authored form source

Defines formsets, forms, questions, options, defaults, and conditions.

02 IFR

Internal Forms Representation

Compiled form opcodes consumed by Setup Browser.

03 HII DB

Package registration

Driver publishes form packages and string packages.

04 Browser

Setup rendering

Evaluates SuppressIf, GrayOutIf, defaults, callbacks, and storage.

05 NVRAM

Variable storage

Question values map to VarStore offsets, name/value stores, or callbacks.

From setup source to visible question

Real world example: option hidden by SuppressIf

IFR output may show something like:

Suppress If:
  QuestionId: 0x123 equals 0x0
One Of: PCIe ASPM, VarStoreInfo VarOffset: 0x45
  Option: Disabled, Value: 0x0
  Option: Enabled, Value: 0x1
End If

The option is not missing. It is conditionally hidden.

The next question becomes:

Who owns QuestionId 0x123?
What variable or callback feeds that value?
Is the board policy different on this SKU?

What to inspect in IFR

Item Value Note
FormSet Setup page group Useful for locating the page that owns the question.
QuestionId Browser-level question identity Useful when callbacks or conditions reference another question.
VarStore Storage definition Shows whether the question maps to a UEFI variable, buffer, or name/value store.
VarOffset Offset inside storage Useful when matching setup option to NVRAM structure.
SuppressIf Hide condition The option is not shown when condition is true.
GrayOutIf Disable condition The option is shown but not editable when condition is true.
Default Default value Useful when reset to default behaves unexpectedly.

Common pitfall: changing NVRAM without understanding callbacks

Some setup questions are not simple variable writes. A callback may validate, reject, mirror, or trigger side effects when the user changes a value.

So this chain matters:

IFR Question
    ↓
VarStore / QuestionId
    ↓
ConfigAccess Callback
    ↓
RouteConfig / ExtractConfig
    ↓
NVRAM variable

Found this useful?

Save it or share it with someone learning firmware, BIOS/UEFI, and embedded systems.

Nội dung liên quan

Một số bài viết, ghi chú hoặc project có liên quan đến nội dung bạn vừa đọc.

Ghi chúShell & Firmware Tools

Missing Setup Option Playbook

A practical debug playbook for BIOS setup options hidden by HII, IFR, SuppressIf, GrayOutIf, VarStore, callbacks, or platform policy.

Ghi chúHII / BIOS Setup Terms

What is VarStore?

Quick note explaining VarStore for BIOS/UEFI and embedded firmware readers.

Ghi chúHII / BIOS Setup Terms

What is VFR?

Quick note explaining VFR for BIOS/UEFI and embedded firmware readers.

Biến note thành bài viết hoàn chỉnh

Notes là nơi ghi nhanh khái niệm.

Đọc blog Xem notes khác