"UEFIHelper" script does not propagate EFI data types beyond `entry`

[Windfisch]

In ghidra 12.0 (and 12.0.1 and 12.1.2) with the 2026.01.14 version of this extension, The "UEFIHelper" script fails to properly analyze a DXE binary.

Steps to reproduce:

• Load an UEFI ROM image, navigate to a DXE and add it to the workspace.
• Open it and run auto-analysis with default settings.
  • (Result: we see an entry point with two longlong or ulonglong arguments both in disassembler and decompiler.)
• From Window / Script Manager, find UEFIHelper.java and run the script
• Result:
  • In the disassembler view, the function signature of the entry point is properly adjusted to EFI_STATUS _ModuleEntryPoint (EFI_HANDLE ImageHandle, EFI_SYSTEM_TABLE * SystemTable)
  • In the decompiler view, we still have longlong _ModuleEntryPoint(undefined8 param_1,longlong SystemTable)
  • In any functions called from the entry point, which receive the ImageHandle and SystemTable as arguments, these argument types are not propagated both in disassembler and decompiler: undefined FUN_0000130c (ulonglong param_1, longlong param_2) (which should be (EFI_HANDLE ImageHandle, EFI_SYSTEM_TABLE * SystemTable))
  • Even worse, in the decompiler somehow the call to FUN_0000130c now has no arguments, even though the function itself has a signature with two arguments

Am I holding it wrong, or do you have any ideas how to debug this?

I'm attaching the script output below:

Script output

UEFIHelper.java> Running...
UEFIHelper - UEFI helper script
Loaded Portable Executable
Found entry point function at 0x00001270
Searching for global assignments...
Propagating types to called functions...
Updated FUN_0000130c function signature
Updated FUN_000010d0 function signature
Updated FUN_0000172c function signature
Searching for global assignments in FUN_000010d0...
Searching for global assignments in FUN_00001000...
Searching for global assignments in FUN_0000172c...
Searching for global assignments in FUN_0000130c...
Searching for GUIDs...
GUID: Found EfiSmmVariableProtocolGuid (ed32d533-99e6-4209-9cc0-2d72cdd998a7) at 0x00002000
GUID: Found EfiSmmSmbusProtocolGuid (72e40094-2ee1-497a-8f33-4c934a9e9c0c) at 0x00002010
GUID: Found SmmRsTableGuid (395c33fe-287f-413e-a055-8088c0e1d43e) at 0x00002030
GUID: Found EfiHobListGuid (7739f24c-93d7-11d4-9a3a-0090273fc14d) at 0x00002040
GUID: Found EfiSmmBase2ProtocolGuid (f4ccbfb7-f6e0-47fd-9dd4-10a8f150c191) at 0x00002050
GUID: Found SmmRsTableGuid (395c33fe-287f-413e-a055-8088c0e1d43e) at 0x00002070
GUID: Found EfiSmmAccess2ProtocolGuid (c2702b74-800c-4131-8746-8fb5b89ce4ac) at 0x00002080
Searching for GUIDs...
UEFIHelper.java> Finished!

[al3xtjames]

Can you try #41 (here's the link to the CI artifact). I'm surprised that I didn't hit this before but it's definitely a bug. It might not fix the disassembler propagation though; the parsing code in propagateFunctionParameters is quite hacky and might miss some calls.