auditing-uefi-firmware-with-chipsec

mukul975/Anthropic-Cybersecurity-SkillsSecurityAudit pendingSnapshot a2acdaef8945

Summary

This source did not publish a separate summary. Review SKILL.md before using the skill.

SKILL.md

Auditing UEFI Firmware with CHIPSEC

Authorized Use Only: CHIPSEC loads a kernel driver and reads/writes low-level hardware registers, SPI flash, and SMM. Run it only on systems you own or are explicitly authorized to assess, ideally on dedicated test hardware. Misuse (especially write/modify modules) can brick a machine. Never run write-capable modules on production systems.

Overview

CHIPSEC is the open-source Platform Security Assessment Framework created by Intel's Advanced Threat Research team. It inspects the low-level security configuration of x86 platform firmware and hardware — the layer below the operating system where bootkits and firmware implants live. CHIPSEC loads a signed kernel driver (Linux, Windows, or it can run from the UEFI shell) to read and write hardware registers, Model-Specific Registers (MSRs), PCI config space, SPI flash, and UEFI variables, then runs an automated test suite that checks whether the platform's defensive locks are actually engaged.

The threat CHIPSEC addresses is MITRE ATT&CK T1542.001 — Pre-OS Boot: System Firmware: adversaries who modify system firmware (the BIOS/UEFI image on SPI flash) to gain stealthy, persistent, OS-survivable control. Firmware implants persist across OS reinstall and disk replacement and are invisible to most EDR. CHIPSEC's value is verifying the prerequisites that prevent such implants: that the SPI flash BIOS region is write-protected (BIOS_CNTL BLE/SMM_BWP, SPI Protected Ranges), that the flash descriptor locks region access, that SMRAM/SMRR are configured, and that Secure Boot variables are protected. It also dumps the SPI flash for offline forensic comparison.

Sources: Intel/CHIPSEC project (https://github.com/chipsec/chipsec), CHIPSEC documentation (https://chipsec.github.io/).

When to Use

Baseline firmware-security assessment of a new laptop/server platform or fleet image
Verifying that BIOS write protection and SPI flash locks are correctly enabled by the OEM

# From PyPI
pip install chipsec

# Or from source (builds the kernel helper/driver)
git clone https://github.com/chipsec/chipsec
cd chipsec
python setup.py install        # builds and installs, including the Linux driver

# Verify
sudo chipsec_main --help
sudo chipsec_util --help

Technique ID	Name	Tactic
T1542.001	Pre-OS Boot: System Firmware	Persistence / Defense Evasion

sudo chipsec_main

# Save machine-readable output for reporting / diffing
sudo chipsec_main -j results.json -x results.xml -l chipsec.log

# Run the whole common group
sudo chipsec_main -m common

# BIOS write protection: checks BIOS_CNTL BLE/SMM_BWP and SPI protected ranges
sudo chipsec_main -m common.bios_wp

# SPI flash descriptor lock (FLOCKDN) — are flash region accesses locked?
sudo chipsec_main -m common.spi_lock

# SMRR programming — protects SMRAM from cache-based attacks
sudo chipsec_main -m common.smrr

# SMM BIOS write protection
sudo chipsec_main -m common.smm

# S3 resume boot-script protection (against bootscript table attacks)
sudo chipsec_main -m common.uefi.s3bootscript

# Checks that Secure Boot UEFI variables are properly protected
sudo chipsec_main -m common.secureboot.variables

# To actively test write protection of the variables (test hardware ONLY):
sudo chipsec_main -m common.secureboot.variables -a modify

# Report SPI flash regions, descriptor, and access permissions
sudo chipsec_util spi info

# Check the SPI access-control module
sudo chipsec_main -m common.spi_access

# Dump the entire SPI flash to a file
sudo chipsec_util spi dump rom.bin

# Decode the dumped image: extracts firmware volumes, files, NVRAM variables, etc.
sudo chipsec_util decode rom.bin

# List all UEFI variables from the runtime interface
sudo chipsec_util uefi var-list

# List variables directly from the SPI image (offline)
sudo chipsec_util uefi var-find PK
sudo chipsec_util uefi var-read db <GUID> db.bin

# Decode the UEFI firmware structure
sudo chipsec_util uefi decode rom.bin

sudo chipsec_main -n            # --no_driver: skip checks that need the driver
sudo chipsec_main -p <PLATFORM> # force platform code if auto-detect fails

Tool	Purpose	Source
chipsec_main	Automated platform-security test suite	https://github.com/chipsec/chipsec
chipsec_util	Manual hardware/firmware access (spi, uefi, decode)	https://chipsec.github.io/
UEFITool	GUI/CLI parsing of dumped UEFI images	https://github.com/LongSoft/UEFITool
Binarly fwhunt	Firmware vulnerability/implant hunting rules	https://github.com/binarly-io/fwhunt-scan
NSA UEFI Secure Boot guidance	Hardening reference	https://media.defense.gov/

Module	Checks
common.bios_wp	BIOS_CNTL BLE / SMM_BWP and SPI Protected Ranges
common.spi_lock	SPI flash descriptor FLOCKDN
common.spi_access	SPI flash region read/write permissions
common.smrr	System Management Range Registers programming
common.smm	SMM BIOS write protection
common.secureboot.variables	Secure Boot variable protection
common.uefi.s3bootscript	S3 resume boot-script protection

auditing-uefi-firmware-with-chipsec

Summary

SKILL.md

Auditing UEFI Firmware with CHIPSEC

Overview

When to Use

Prerequisites

Objectives

MITRE ATT&CK Mapping

Workflow

Step 1: Run the full automated test suite

Step 2: Run the core firmware-protection modules individually

Step 3: Verify Secure Boot variable protection

Step 4: Inspect SPI flash region access permissions

Step 5: Dump SPI flash for offline forensics

Step 6: Enumerate and triage UEFI variables

Step 7: Limited assessment without a kernel driver

Step 8: Triage results and report

Tools and Resources

Core Module Reference

Validation Criteria

Related skills