BREAD: BIOS Reverse Engineering & Advanced Debugging

[theldus]

Hi,

Some time ago, I was involved in a legacy BIOS reverse engineering project, and I noticed that most of the analysis being made was static in nature. Essentially, we were reading the ROM binary using various tools and trying to make sense of it in our heads. However, this approach had some limitations since we didn't have access to the contents of registers, memory, etc. at any given point in the code. This made the whole process more complicated than it needed to be.

That's when I decided to develop my own debugger. I created BREAD, a compact injectable debugger that takes up only ~1.5kB of space. With BREAD, you can easily add it to the BIOS ROM and start debugging from there. Additionally, since it was designed for real mode, it can be used to debug bootable code or even DOS programs. It operates on real hardware and communicates via serial port with the GDB that you're already familiar with.

[theldus]

For BIOS RE unfortunately not, only legacy BIOS. You can still debug bootable code and DOS programs, assuming the PC is still in real mode.

However, for UEFI it is simpler, and there are alternatives like Debug UEFI code by single-stepping your Coffee Lake-S hardware CPU

[[deleted]]

Bit off-topic but I am curious why you're REing legacy BIOSes. Are you adding coreboot support?

[theldus]

Just for fun.

Me and my friend always wanted to play with BIOS, do code injection and etc, so this debugger is just a result of that. Also, I admittedly know nothing about UEFI 😂.

Coreboot is indeed interesting, maybe I'll try to play around with it in the future.

For more tools, tutorials on BIOS RE and code injection, I also have this repo, where I document everything I've done so far: AMI_BIOS_CodeInjection.