[Name]
GGFWPi

[Version]
0.6.6-beta

[Homepage]
https://github.com/patapik/ggfwpi

[Download]
https://github.com/patapik/ggfwpi/releases/tag/v0.6.6-beta

[Author]
Maciej Gojny
Developed for GGSEC / GG Advanced IT Security UG

[Licence]
Apache License 2.0

The repository includes the LICENSE, NOTICE and AUTHORS.md files.

[Description]
GGFWPi is a read-only Raspberry Pi firmware and platform security auditor.

It collects and evaluates SPI EEPROM, boot-chain, Secure Boot, OTP, boot-configuration and operating-system security evidence. The current release has been tested primarily on Raspberry Pi 5 BCM2712 running Kali Linux ARM64.

Main capabilities:

• read-only SPI EEPROM acquisition using flashrom;
• SPI EEPROM write-protection status assessment;
• raw SPI EEPROM versus live boot-configuration comparison;
• Raspberry Pi boot-chain discovery;
• boot-chain integrity baselines and drift detection;
• Raspberry Pi customer Secure Boot chain validation;
• RSA-2048 PKCS#1 v1.5 SHA-256 verification;
• boot.img and boot.sig validation;
• EEPROM bootconf signature analysis;
• BCM2712 bootsys customer countersignature validation;
• OTP security-state analysis;
• external rpiboot -j provisioning metadata support;
• weak and default credential detection;
• network listener and APT transport checks;
• JSON reports and portable .ggcap evidence packages;
• severity and policy gates for automated workflows;
• fail-closed evidence, summary and gate accounting invariants.

GGFWPi is intentionally read-only. It does not provide:

• SPI EEPROM write operations;
• SPI erase operations;
• write-protection modification;
• OTP programming;
• Secure Boot key provisioning.

The SPI implementation is limited to device probing, write-protection status inspection and read-only EEPROM acquisition.

[Dependencies]
Required:

• Python 3
• flashrom
• vcgencmd
• rpi-eeprom-config
• rpi-eeprom-update

Optional or platform-dependent:

• rpi-eeprom-ab
• python3-passlib
• rpiboot metadata for authoritative BCM2712 provisioning evidence

[Similar tools]
CHIPSEC provides broad firmware and platform security analysis, primarily for x86 systems.

GGFWPi is specifically focused on Raspberry Pi SPI EEPROM, boot configuration, OTP evidence, Secure Boot customer-chain validation and Raspberry Pi platform policy.

[Activity]
The project is under active development.

Version 0.6.6-beta is the initial public beta release. It includes a 63-test regression suite covering:

• cryptographic validation;
• valid and tampered boot images;
• malformed and missing signatures;
• BCM2711 and BCM2712 Secure Boot chains;
• OTP decoding;
• policy evaluation;
• summary and gate accounting;
• evidence package generation;
• semantic selection of the current GGFWPi module.

[How to install]
Download the tagged v0.6.6-beta release from:

https://github.com/patapik/ggfwpi/releases/tag/v0.6.6-beta

Install the required Kali packages:

sudo apt update
sudo apt install python3 flashrom python3-passlib

The Raspberry Pi firmware utilities must also be available on the target system:

• vcgencmd
• rpi-eeprom-config
• rpi-eeprom-update
• rpi-eeprom-ab where supported

Run the included regression suite:

python3 test_GGFWPi_latest.py

Expected result:

[*] GGFW regression target: GGFWPi_v0.6.6-beta.py

Ran 63 tests
OK

[How to use]
Standard audit:

sudo python3 GGFWPi_v0.6.6-beta.py

Audit using the Secure Boot policy profile:

sudo python3 GGFWPi_v0.6.6-beta.py
--policy-profile secure-boot-required
--secure-boot-evidence
--show-otp
--fail-on HIGH

Create a boot-chain baseline:

sudo python3 GGFWPi_v0.6.6-beta.py
--write-baseline /var/lib/ggfw/boot-baseline.json

Compare against an existing baseline:

sudo python3 GGFWPi_v0.6.6-beta.py
--baseline /var/lib/ggfw/boot-baseline.json

Exit codes:

• 0: scan completed and the selected gate was not triggered;
• 1: tool, dependency, acquisition, argument, package, baseline or accounting error;
• 2: configured security or policy gate triggered.

[Packaged]
No.

GGFWPi is not currently packaged for Debian or Kali. The v0.6.6-beta release is distributed as a Python source application. Debian packaging can be prepared if the tool is accepted for further review.