Efildr hit Hacker News with a release that turns a standard UEFI PE32+ application into a self‑contained, encrypted, file‑less EFI binary. The generated file includes a ~36 KB reflective loader stub and reports size reductions of 10‑40% after its custom RLE compression.
How Efildr works
The tool packs a payload by (1) validating the PE header, (2) compressing with run‑length encoding, (3) encrypting using a stateful ARX stream cipher, and (4) appending the overlay to a pure‑C loader stub. At runtime the stub reads its own overlay, decrypts and decompresses it in RAM, maps the sections reflectively, optionally erases PE headers, and jumps to the entry point—all without ever writing the original image to disk.
Quick start steps
git clone https://github.com/vk-candpython/efildr.git
cd efildr
chmod +x setup.sh && ./setup.sh # builds loader.efi (~36 KB)
python3 efildr.py myapp.efi # creates efildr‑myapp.efi
The resulting efildr‑myapp.efi can be tested in QEMU with OVMF or copied to real hardware as BOOTX64.EFI.
Trade‑offs and limitations
- Platform – Only supports UEFI x86_64 (PE32+) binaries; input size must be between 512 B and 8 MiB.
- Toolchain – Requires GCC with GNU‑EFI headers and Python 3.6+; no external Python packages.
- Security – Includes optional anti‑VM and anti‑debug checks, but they are disabled by default.
- Cost – The project is free and open source; the repository does not list any pricing or commercial licensing.
- Legal – The README warns that the tool is for educational purposes and authorized security auditing only, and the author disclaims liability.
When to try Efildr
If you need to ship a UEFI payload that must hide its code from static analysis—e.g., red‑team tooling, research demos, or proof‑of‑concept firmware—it’s worth cloning the repo and running the quick‑start. For production firmware you’ll need to audit the loader, enable the runtime protections you require, and verify compatibility with your target hardware.
