chipsec.utilcmd.decode_cmd moduleΒΆ

CHIPSEC can parse an image file containing data from the SPI flash (such as the result of chipsec_util spi dump). This can be critical in forensic analysis.

This will create multiple log files, binaries, and directories that correspond to the sections, firmware volumes, files, variables, etc. stored in the SPI flash.

Usage:

>>> chipsec_util decode <rom> [fw_type]

For a list of fw types run:

>>> chipsec_util decode types

Examples:

>>> chipsec_util decode spi.bin vss

Note

  • It may be necessary to try various options for fw_type in order to correctly parse NVRAM variables. Currently, CHIPSEC does not autodetect the correct format. If the nvram directory does not appear and the list of nvram variables is empty, try again with another type.