Firmware retrieval and analysis

A method performed by a computing device, the method comprising:

• attaching a bus filter driver to a bus device of the computing device, the bus device communicatively coupled to a memory component of the computing device storing firmware;
• retrieving bus device metadata including a date from the bus device;
• if the date is less recent than a specific date, retrieving a firmware image of the firmware from the memory component in response to receiving a start message from the bus device;
• creating an external component library (ECL) for communication with a kernel-mode component;
• retrieving, by a security agent via the ECL, the firmware image from the bus filter driver;
• and
• performing, by the security agent, a security analysis off the firmware image.

One or more non-transitory computer readable storage media storing thereon computer-executable instructions that, when executed by one or more processors, perform operations comprising:

• conditionally attaching a bus filter driver to a bus device of a computing device based on at least one of a vendor identifier or chipset identifier associated with a memory component of the computing device, the bus device communicatively coupled to the memory component storing firmware;
• retrieving bus device metadata including a date from the bus device;
• if the date is less recent than a specific date, retrieving a firmware image of the firmware from the memory component in response to receiving a start message from the bus device;
• creating an external component library (ECL) for communication with a kernel-mode component;
• retrieving, by a security agent via the ECL, the firmware image from the bus filter driver;
• and
• performing, by the security agent, a security analysis off the firmware image.