efiXplorer
efiXplorer copied to clipboard
IDA crashes after analyzing firmware sample with efiXplorer latest builds
Hi, I'm using IDA Pro 7.7 with SDK 7.7 (on Windows) and used your latest builds to install. When loading this firmware sample from Asus: https://github.com/3vangel1st/FWare/blob/main/X515JAAS.306 , I do see it gets loaded. When starting the efiXplorer plugin from the menu, I click through the pop-ups and it starts running and doing some analysis. However it never completes since after a while IDA crashes and generates a mini-dump.
Any idea what possibly is going wrong? I admit this is the only firmware sample I've used so far ;)
Hi. I just checked. Can not reproduce this issue. It's working fine for me:

If you are using IDA without a Hex-Rays decompiler, it is best to build the plugin from master with Hex-Rays analysis disabled. I'll PM you to clarify some details.
Understood - don't have the Hex-Rays decompiler.
@yeggor could you please fix the code to not invoke decompiler APIs if the decompiler is not present (e.g. init_hexrays_plugin()
returned false)? We're getting crash reports from customers because the plugin calls nullptr.
@skochinsky thank you. It fixed now
I've tested it on x86 and arm EFI modules. Works without problems now. Sorry for the inconvenience.
Python>ida_hexrays.init_hexrays_plugin()
False
Python>ida_loader.load_and_run_plugin("efiXplorer", 1)
...
[efiXplorer] the log is saved in a JSON file
True