|
|
|
|
EFICHECK(8) BSD System Manager's Manual EFICHECK(8) NAME
eficheck -- check the integrity of the x86 flash chip firmware. SYNOPSIS
eficheck --integrity-check [-h EFI-hash-input-file] [-b EFI-binary-input-file] eficheck --show-hashes [-h EFI-hash-input-file] [-b EFI-binary-input-file] eficheck --generate-hashes [-h EFI-hash-output-file] [-p output-path] eficheck --save [-b EFI-binary-output-file] eficheck --cleanup [-b EFI-binary-input-and-output-file>] eficheck --version eficheck --help DESCRIPTION
eficheck is a tool to check the x86 flash chip firmware. The following commands can be used with eficheck: --integrity-check hashes portion of the firmware and compares against known-good hashes --generate-hashes outputs hashes for a given firmware to be used as known-good hashes --show-hashes shows the hashes for the sub-sections of the firmware which are measured --save saves the full flash chip contents to a binary file. Requires root privileges. --cleanup zeros any privacy-sensitive data (such as nvram), enabling the file to be shared for analysis. --version print out eficheck version number. --help display a short help. EXAMPLES
'eficheck --save -b firmware.bin' Save this system's EFI firmware as firmware.bin 'eficheck --cleanup -b firmware.bin' Overwrite the EFI variables portion of the firmware.bin, in place 'eficheck --generate-hashes' Analyze the current system's installed EFI firmware, and store the hashes into hash file(s) in current folder File name(s) will be selected according to image's EFI version(s) 'eficheck --generate-hashes -b firmware.bin' Analyze the firmware.bin, and store the hashes into hash file(s) in current folder. Filename will be based on the detected firmware version. 'eficheck --generate-hashes -p /usr/local/allowlists' Analyze the current system's installed EFI firmware, and store the hashes into hash file(s) in /usr/local/allowlists folder 'eficheck --integrity-check' Attempt to automatically determine which firmware you are running, and integrity check against the appropriate file, and report any differences 'eficheck --integrity-check -h /usr/libexec/firmwarecheckers/eficheck/EFIAllowListShipping.bun- dle/allowlists/IM171.88Z.0105.B08.1604111319.0.ealf' Compare the current system's EFI firmware against the Apple-provided expected measurements for an "iMac17,1" at firmware revision B08, and report any differences 'eficheck --integrity-check -h hash.ealf -b firmware.bin' Compare the given hash file against against the given firmware image and report any differences 'eficheck --show-hashes' Print the hashes for the current system's installed EFI firmware to stdout 'eficheck --show-hashes -b firmware.bin' Print the hashes for the given firmware.bin to stdout 'eficheck --show-hashes -h IM171.88Z.0105.B08.1604111319.0.ealf' Print the hashes for the given allowlist to stdout May 25, 2017
