What cool things can you do if you hack EFI

I think I'm right in thinking Intel Macs use EFI.

I heard rumours that you can create low-level password protection and even install a shell. Info is sparse and limited.

Have any power users hacked their Mac EFI? If so, what did you do and how?

Yes, you can install a shell. You can also setup a firmware password, though you generally use utilities that run under Mac OS X to set it up (Apple include's Firmware Password Utility on the install DVD, but does not actually lay it down on the system partition).

EFI is probably less interesting from an hobbyist perspective than OpenFirmware was. Even if you install an EFI shell, you only have access to a limited scripting environment (basically akin to bash), unlike OpenFirmware where you could actually write substantial things directly in Forth (up to and including writing boot drivers directly at the console without a separate OS and toolchain).

In order to do anything serious with EFI you need to build a cross compile toolchain to compile to native code or EBC, and once you do that you might as well just compile a standalone binary and make it look like a boot vector and just have the firmware boot your code like an OS.