Shell & Firmware Tools Seed

UEFITool for BIOS Image Analysis

How firmware engineers use UEFITool to read BIOS images through firmware volumes, FFS files, GUIDs, PE32 sections, and setup modules.

3 min read
Shell & Firmware Tools cover

You receive a BIOS image and one question:

“Which module changed?”

Opening the file in a hex editor is possible, but it is the slowest way to get lost. UEFITool gives the image a firmware structure again.

01 SPI

Full flash image

May contain descriptor, ME/CSME, GbE, BIOS region, EC region, or OEM-specific areas.

02 BIOS

BIOS region

Contains UEFI firmware volumes and platform data.

03 FV

Firmware Volume

A container for FFS files such as PEI modules, DXE drivers, raw files, and free space.

04 FFS

Firmware File System file

Identified by GUID and type. Often maps to a firmware module or data object.

05 Section

PE32, TE, UI, Depex, raw

Sections hold executable code, dependency expressions, names, compressed data, or setup resources.

Typical BIOS image anatomy

What to look for first

Item Value Note
Firmware volumes FV layout Useful for checking image structure, free space, and major firmware containers.
FFS GUID Module identity Useful when comparing builds or locating known modules.
UI section Human-readable name Often reveals module names such as Setup, UsbBusDxe, or PciBusDxe.
PE32 / TE section Executable code Can be extracted for symbol, string, or binary diff analysis.
Depex section Driver dependency Useful when a DXE driver does not dispatch.
Raw / GUID-defined section Data or compressed content Often requires extraction or decompression.

Real world example: setup option disappeared

The setup page changed after a BIOS update.

A practical path:

Open old BIOS in UEFITool
    ↓
Find Setup module
    ↓
Extract PE32 / body
    ↓
Run IFR extractor
    ↓
Repeat with new BIOS
    ↓
Compare SuppressIf / GrayOutIf / VarStore / QuestionId

This connects image analysis directly with HII debugging.

Common pitfall: GUID without context

A GUID alone does not explain behavior. Pair it with:

FFS type
UI name
section type
firmware volume location
old vs new comparison
strings around the module

Found this useful?

Save it or share it with someone learning firmware, BIOS/UEFI, and embedded systems.

Nội dung liên quan

Một số bài viết, ghi chú hoặc project có liên quan đến nội dung bạn vừa đọc.

Ghi chúBIOS Terms

What is Firmware Volume?

Quick note explaining Firmware Volume for BIOS/UEFI and embedded firmware readers.

Ghi chúBIOS Terms

What is FV and FFS?

Quick note explaining FV and FFS for BIOS/UEFI and embedded firmware readers.

Biến note thành bài viết hoàn chỉnh

Notes là nơi ghi nhanh khái niệm.

Đọc blog Xem notes khác