chipsec

Analyze offline UEFI firmware dumps to detect malware and vulnerabilities.

811|123|Updated Nov 17, 2025

Search Tags:#security #firmware #static-analysis #nvram #chipsec #UEFI

Ready to run

npx skills add https://github.com/BrownFineSecurity/iothackbot --skill chipsec

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: chipsec
Source: https://github.com/BrownFineSecurity/iothackbot/tree/main/skills/chipsec
Command: npx skills add https://github.com/BrownFineSecurity/iothackbot --skill chipsec

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Analyzing UEFI/BIOS firmware often requires hardware access and kernel drivers. This skill provides offline static analysis capabilities using chipsec to decode firmware, inventory EFI modules, and detect known threats without live hardware.

Core Features & Use Cases

EFI Inventory with Hashes: Generate a manifest of all EFI modules with cryptographic hashes for baseline comparison.
Malware & Vulnerability Scans: Detect known UEFI rootkits and SMM vulnerabilities.
Firmware Decode & NVRAM Extraction: Decode firmware structure and extract UEFI variables for offline review.
Baseline Comparison: Compare current firmware against a known-good baseline to spot unauthorized changes.

Quick Start

chipsec_main -i -n -m tools.uefi.scan_image -a generate inventory.json firmware.bin

Frequently Asked Questions about chipsec

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I analyze UEFI firmware offline without hardware access?▼

Static analysis of UEFI firmware is possible offline using chipsec to decode firmware dumps in .bin, .rom, .fd, and .cap formats without kernel drivers or live hardware. Chipsec scans for malware, vulnerabilities, and extracts NVRAM variables from dumped firmware images for offline review.

Can I detect UEFI rootkits and SMM vulnerabilities in firmware dumps?▼

Yes. Chipsec performs malware and vulnerability scans on offline UEFI firmware to detect known UEFI rootkits and SMM vulnerabilities. Scanning generates structured outputs identifying threats for remediation.

What's the best way to create a firmware baseline for comparison?▼

Generate a cryptographic inventory of EFI modules from a known-good firmware dump using chipsec, then compare current firmware against that baseline to detect unauthorized changes or modifications in structure and NVRAM content.

How do I extract UEFI variables and decode firmware structure?▼

Chipsec decodes offline firmware structure and extracts UEFI NVRAM variables from dumped images, producing decoded firmware data and NVRAM lists suitable for downstream analysis and RAG pipeline integration.

Do I need kernel drivers to analyze firmware with chipsec?▼

No. Chipsec's offline static analysis mode operates without kernel drivers, making it suitable for analyzing firmware dumps in isolated environments or security labs where hardware access is unavailable.

What firmware formats does offline static analysis support?▼

Offline firmware analysis supports .bin, .rom, .fd, and .cap format dumps. Chipsec processes these standardized UEFI firmware image formats to generate inventories, scan for threats, and extract NVRAM data.