I have saved a copy of the UEFI firmware currently running on my motherboard through the built-in flash utility. Now I want to compare the firmware dump with the newest firmware update from the manufacture to find out what have changed between the two versions. Both files are of the type Intel serial flash for PCH ROM.I want to make sure the new version isn't malicious and I'm unable to verify the integrity in any other way, as the manufacture doesn't provide any checksums and the update is only available over plain HTTP. However, I'm not sure how to get started with this.The built-in flash utility must add system specific data to the firmware dump, because everytime I save the firmware it has a different hash. I guess this should be stripped somehow to prevent it from complicating the process...Any tips, suggestions etc. on how I can get started is highly appreciated.
Find changes between two UEFI firmware versions?
firmware;patch reversing;bios
The dump is likely different due to NVRAM data (basically settings which need to be saved between boots or even BIOS updates, such as boot device, RAM timings, serial number/MAC address and so on). The contents of the firmware volumes containing code should not change between boots.There are at least two options I know of to check for differences between UEFI ROM dumps:UEFITool or the sister project UEFIextract: extract both images then compare using a standard file diffing tool (e.g. Beyond Compare or even diff).chipsec project has a whitelist module which is intended to verify that the list of UEFI modules has not changed:The module can generate a list of EFI executables from (U)EFI firmware file orextracted from flash ROM, and then later check firmware image in flash ROM orfile against this list of [expected/whitelisted] executablesUsage:  ``chipsec_main -m tools.uefi.whitelist [-a generate|check,<json>,<fw_image>]``    - ``generate``  Generates a list of EFI executable binaries from the UEFI                        firmware image (default)    - ``check``     Decodes UEFI firmware image and checks all EFI executable                        binaries against a specified list    - ``json``      JSON file with configuration of white-listed EFI                        executables (default = ``efilist.json``)    - ``fw_image``  Full file path to UEFI firmware image. If not specified,                        the module will dump firmware image directly from ROMExamples:>>> chipsec_main -m tools.uefi.whitelistCreates a list of EFI executable binaries in ``efilist.json`` from the firmwareimage extracted from ROM>>> chipsec_main -i -n -m tools.uefi.whitelist -a generate,efilist.json,uefi.romCreates a list of EFI executable binaries in ``efilist.json`` from ``uefi.rom``firmware binary >>> chipsec_main -i -n -m tools.uefi.whitelist -a check,efilist.json,uefi.romDecodes ``uefi.rom`` UEFI firmware image binary and checks all EFI executablesin it against a list defined in ``efilist.json``Note that a BIOS update by its nature will mean some modules will change (due to bugfixes/new features etc.) but this should at least let you know which specific parts changed and maybe even inspect them in detail.