  Since its major release in 2006, the Unified Extensible Firmware Interface
(UEFI) has become the industry standard for interfacing a computer's hardware
and operating system, replacing BIOS. UEFI has higher privileged security
access to system resources than any other software component, including the
system kernel. Hence, identifying and characterizing vulnerabilities in UEFI is
extremely important for computer security. However, automated detection and
characterization of UEFI vulnerabilities is a challenging problem. Static
vulnerability analysis techniques are scalable but lack precision (reporting
many false positives), whereas symbolic analysis techniques are precise but are
hampered by scalability issues due to path explosion and the cost of constraint
solving. In this paper, we introduce a technique called STatic Analysis guided
Symbolic Execution (STASE), which integrates both analysis approaches to
leverage their strengths and minimize their weaknesses. We begin with a
rule-based static vulnerability analysis on LLVM bitcode to identify potential
vulnerability targets for symbolic execution. We then focus symbolic execution
on each target to achieve precise vulnerability detection and signature
generation. STASE relies on the manual specification of reusable vulnerability
rules and attacker-controlled inputs. However, it automates the generation of
harnesses that guide the symbolic execution process, addressing the usability
and scalability of symbolic execution, which typically requires manual harness
generation to reduce the state space. We implemented and applied STASE to the
implementations of UEFI code base. STASE detects and generates vulnerability
signatures for 5 out of 9 recently reported PixieFail vulnerabilities and 13
new vulnerabilities in Tianocore's EDKII codebase.
