{"id":129903,"url":"https://github.com/TheMalwareGuardian/Awesome-Bootkits-Rootkits-Development","name":"Awesome-Bootkits-Rootkits-Development","description":"A curated compilation of extensive resources dedicated to bootkit and rootkit development.","projects_count":490,"last_synced_at":"2026-10-14T10:00:19.113Z","repository":{"id":213973703,"uuid":"729140507","full_name":"TheMalwareGuardian/Awesome-Bootkits-Rootkits-Development","owner":"TheMalwareGuardian","description":"A curated compilation of extensive resources dedicated to bootkit and rootkit development.","archived":false,"fork":false,"pushed_at":"2026-08-16T11:58:16.000Z","size":6937,"stargazers_count":279,"open_issues_count":0,"forks_count":31,"subscribers_count":5,"default_branch":"main","last_synced_at":"2026-09-24T19:23:48.219Z","etag":null,"topics":["bootkit","dxe-driver","kernel","kernel-driver","kernel-programming","kernel-rootkit","low-level-programming","malware-development","malware-research","reverse-engineering","rootkit","uefi","uefi-application","uefi-bootkit"],"latest_commit_sha":null,"homepage":"","language":"HTML","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/TheMalwareGuardian.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-12-08T14:07:39.000Z","updated_at":"2026-09-24T17:06:58.000Z","dependencies_parsed_at":"2024-02-14T13:27:26.886Z","dependency_job_id":"eb6e8732-d14b-42c2-b880-e7c14e7748bc","html_url":"https://github.com/TheMalwareGuardian/Awesome-Bootkits-Rootkits-Development","commit_stats":null,"previous_names":["themalwareguardian/awesome-bootkits-rootkits-development"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/TheMalwareGuardian/Awesome-Bootkits-Rootkits-Development","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TheMalwareGuardian%2FAwesome-Bootkits-Rootkits-Development","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TheMalwareGuardian%2FAwesome-Bootkits-Rootkits-Development/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TheMalwareGuardian%2FAwesome-Bootkits-Rootkits-Development/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TheMalwareGuardian%2FAwesome-Bootkits-Rootkits-Development/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/TheMalwareGuardian","download_url":"https://codeload.github.com/TheMalwareGuardian/Awesome-Bootkits-Rootkits-Development/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TheMalwareGuardian%2FAwesome-Bootkits-Rootkits-Development/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344794859,"owners_count":38307269,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-14T02:00:06.392Z","response_time":82,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"created_at":"2026-05-01T23:01:05.780Z","updated_at":"2026-10-14T10:00:19.113Z","primary_language":null,"list_of_lists":false,"displayable":true,"categories":["***Cybersecurity Resources***","***Windows Kernel***","***BIOS UEFI***","***Environment***","***Rootkits***","***Books***","***Bootkits***","***Courses***","***EDK2***","***TheMalwareGuardian***","***Master's Degree***"],"sub_categories":["***Rootkits (Development)***","***Tools***","***Protection Mechanisms***","***Windows Boot***","***Debugging***","***Drivers***","***Basics***","***Structures***","***Bootkits (Development)***","***Specifications***","***Analysis***","***Vulnerabilities***","***Videos***","***Source Code***","***Techniques***","***PoCs***","***Windows Kernel (Debugging)***"],"readme":"# ***🏴‍☠️ Awesome Bootkits \u0026 Rootkits Development***\n\n![DEF CON 33 Main Stage Talk](https://img.shields.io/badge/DEF%20CON%2033-Main%20Stage%20Talk-informational?style=for-the-badge\u0026logo=hackaday) ![La Villa Hacker](https://img.shields.io/badge/DEF%20CON%2034-La%20Villa%20Hacker-red?style=for-the-badge\u0026logo=hackaday)\n\nA curated compilation of extensive resources dedicated to bootkit and rootkit development.\n\n\u003cp align=\"center\"\u003e\n\t\u003cimg src=\"Images/Logo_Awesome_Bootkits_Rootkits_Development.png\"\u003e\n\u003c/p\u003e\n\n\n\n---\n---\n---\n\n\n\n## Table of Contents\n\n\u003cul\u003e\n\t\u003cli\u003e\u003ca href=\"#themalwareguardian\"\u003eTheMalwareGuardian\u003c/a\u003e\u003c/li\u003e\n\t\u003cli\u003e\u003ca href=\"#bios-uefi\"\u003eBIOS UEFI\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\u003cul\u003e\n\t\t\u003cli\u003e\u003ca href=\"#bios-uefi-specifications\"\u003eSpecifications\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#bios-uefi-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#bios-uefi-videos\"\u003eVideos\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#bios-uefi-windows-boot\"\u003eWindows Boot\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#bios-uefi-vulnerabilities\"\u003eVulnerabilities\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#bios-uefi-tools\"\u003eTools\u003c/a\u003e\u003c/li\u003e\n\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\u003cli\u003e\u003ca href=\"#edk2\"\u003eEDK2\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\u003cul\u003e\n\t\t\u003cli\u003e\u003ca href=\"#edk2-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#edk2-videos\"\u003eVideos\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#edk2-pocs\"\u003ePoCs\u003c/a\u003e\u003c/li\u003e\n\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\u003cli\u003e\u003ca href=\"#bootkits\"\u003eBootkits\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\u003cul\u003e\n\t\t\u003cli\u003e\u003ca href=\"#bootkits-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#bootkits-videos\"\u003eVideos\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#bootkits-analysis\"\u003eAnalysis\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#bootkits-source-code\"\u003eSource Code\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\u003cul\u003e\n\t\t\u003cli\u003e\u003ca href=\"#bootkits-source-code-windows\"\u003eWindows\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#bootkits-source-code-linux\"\u003eLinux\u003c/a\u003e\u003c/li\u003e\n\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\u003cli\u003e\u003ca href=\"#windows-kernel\"\u003eWindows Kernel\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\u003cul\u003e\n\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-videos\"\u003eVideos\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-structures\"\u003eStructures\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-debugging\"\u003eDebugging\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\u003cul\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-debugging-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-debugging-commands\"\u003eCommands\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-debugging-scripting\"\u003eScripting\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\t\u003cul\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-debugging-scripting-classic\"\u003eClassic\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-debugging-scripting-javascript\"\u003eJavaScript\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-debugging-scripting-python\"\u003ePython\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-debugging-scripting-powershell\"\u003ePowershell\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-debugging-scripting-extensions\"\u003eExtensions\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-security\"\u003eProtection Mechanisms\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\u003cul\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-security-dse\"\u003eDriver Signature Enforcement (DSE)\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\t\u003cul\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-security-dse-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-security-dse-bypasses\"\u003eBypasses\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-security-vbs\"\u003eVirtualization Based Security (VBS)\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\t\u003cul\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-security-vbs-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-security-vbs-videos\"\u003eVideos\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-security-kpp\"\u003eKernel Patch Protection (KPP) / PatchGuard\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\t\u003cul\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-security-kpp-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-security-kpp-videos\"\u003eVideos\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-security-kpp-bypasses\"\u003eBypasses\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-drivers\"\u003eDrivers\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\u003cul\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-drivers-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-drivers-wdk\"\u003eWDK\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-drivers-videos\"\u003eVideos\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-drivers-source-code\"\u003eSource Code\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-drivers-reversing\"\u003eReversing\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\t\u003cul\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-drivers-reversing-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-drivers-reversing-videos\"\u003eVideos\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-drivers-fuzzing\"\u003eFuzzing\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\t\u003cul\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-drivers-fuzzing-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-drivers-fuzzing-videos\"\u003eVideos\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-drivers-fuzzing-tools\"\u003eTools\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-drivers-exploitation\"\u003eExploitation\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\t\u003cul\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-drivers-exploitation-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-drivers-exploitation-videos\"\u003eVideos\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-drivers-exploitation-lab\"\u003eLab\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-drivers-exploitation-pocs\"\u003ePoCs\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\u003cli\u003e\u003ca href=\"#windows-kernel-tools\"\u003eTools\u003c/a\u003e\u003c/li\u003e\n\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\u003cli\u003e\u003ca href=\"#rootkits\"\u003eRootkits\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\u003cul\u003e\n\t\t\u003cli\u003e\u003ca href=\"#rootkits-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#rootkits-videos\"\u003eVideos\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#rootkits-analysis\"\u003eAnalysis\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#rootkits-source-code\"\u003eSource Code\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\u003cul\u003e\n\t\t\u003cli\u003e\u003ca href=\"#rootkits-source-code-windows\"\u003eWindows\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#rootkits-source-code-linux\"\u003eLinux\u003c/a\u003e\u003c/li\u003e\n\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques\"\u003eTechniques\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\u003cul\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-ioctls-irps\"\u003eI/O control codes (IOCTLs) / I/O request packets (IRPs)\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\t\u003cul\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-ioctls-irps-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-dkom\"\u003eDirect Kernel Object Modification (DKOM)\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\t\u003cul\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-dkom-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-dkom-pocs\"\u003ePoCs\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-keylogger\"\u003eKeyboard Filter (Keylogger)\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\t\u003cul\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-keylogger-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-wfp\"\u003eWindows Filtering Platform (WFP)\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\t\u003cul\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-wfp-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-wfp-pocs\"\u003ePoCs\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-wsk\"\u003eWinSock Kernel (WSK)\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\t\u003cul\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-wsk-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-wsk-pocs\"\u003ePoCs\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-minifilter\"\u003eMinifilter\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\t\u003cul\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-minifilter-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-minifilter-pocs\"\u003ePoCs\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-callbacks\"\u003eRemove Callbacks\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\t\u003cul\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-callbacks-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-callbacks-pocs\"\u003ePoCs\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-certificates\"\u003eForge Signature Timestamps\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\t\u003cul\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-certificates-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-idthooking\"\u003eInterrupt Descriptor Table (IDT) Hooking\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\t\u003cul\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-idthooking-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-idthooking-pocs\"\u003ePoCs\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-ssdthooking\"\u003eSystem Service Descriptor Table (SSDT) Hooking\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\t\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\t\t\u003cul\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-ssdthooking-basics\"\u003eBasics\u003c/a\u003e\u003c/li\u003e\n\t\t\t\t\u003cli\u003e\u003ca href=\"#rootkits-techniques-ssdthooking-pocs\"\u003ePoCs\u003c/a\u003e\u003c/li\u003e\n\t\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\t\u003cli\u003e\u003ca href=\"#rootkits-tools\"\u003eTools\u003c/a\u003e\u003c/li\u003e\n\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\u003cli\u003e\u003ca href=\"#environment\"\u003eEnvironment\u003c/a\u003e\u003c/li\u003e\n\u003cdetails\u003e\n\t\u003csummary\u003e📂\u003c/summary\u003e\n\t\u003cul\u003e\n\t\t\u003cli\u003e\u003ca href=\"#environment-bootkits-development\"\u003eBootkits (Development)\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#environment-windows-kernel-debugging\"\u003eWindows Kernel (Debugging)\u003c/a\u003e\u003c/li\u003e\n\t\t\u003cli\u003e\u003ca href=\"#environment-rootkits-development\"\u003eRootkits (Development)\u003c/a\u003e\u003c/li\u003e\n\t\u003c/ul\u003e\n\u003c/details\u003e\n\t\u003cli\u003e\u003ca href=\"#cybersecurity-resources\"\u003eCybersecurity Resources\u003c/a\u003e\u003c/li\u003e\n\t\u003cli\u003e\u003ca href=\"#books\"\u003eBooks\u003c/a\u003e\u003c/li\u003e\n\t\u003cli\u003e\u003ca href=\"#courses\"\u003eCourses\u003c/a\u003e\u003c/li\u003e\n\t\u003cli\u003e\u003ca href=\"#mastersdegree\"\u003eMaster's Degree\u003c/a\u003e\u003c/li\u003e\n\t\u003cli\u003e\u003ca href=\"#contact\"\u003eContact\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\n\n---\n---\n---\n\n\n\n\u003cdiv id='themalwareguardian'/\u003e\n\n## ***TheMalwareGuardian***\n\nWhoami\n\n* [Web LinkedIn: Alejandro Vazquez Vazquez (TheMalwareGuardian)](https://www.linkedin.com/in/vazquez-vazquez-alejandro/) -\u003e My LinkedIn profile.\n* [Web LinkedIn: Maria San Jose (drkrysSrng)](https://www.linkedin.com/in/mariasanjose) -\u003e Maria's LinkedIn profile.\n* [Github: Awesome Bootkits \u0026 Rootkits Development](https://github.com/TheMalwareGuardian/Awesome-Bootkits-Rootkits-Development) -\u003e A curated compilation of extensive resources dedicated to bootkit and rootkit development.\n* [Github: Bootkits \u0026 Rootkits Development Environment](https://github.com/TheMalwareGuardian/Bootkits-Rootkits-Development-Environment) -\u003e Automated environment setup for Bootkit \u0026 Rootkit development.\n* [Github: Abyss Windows UEFI Bootkit](https://github.com/TheMalwareGuardian/Abyss) -\u003e Abyss is a Windows UEFI bootkit that hijacks the boot chain from the very first EFI application, intercepting the Windows Boot Manager and patching ntoskrnl.exe in memory before the operating system takes control. A full-chain implementation that achieves pre-OS persistence and kernel-level subversion, presented at DEF CON 33.\n* [Github: Antarctic Linux UEFI Bootkit](https://github.com/TheMalwareGuardian/Antarctic) -\u003e Antarctic is the first publicly released UEFI bootkit framework targeting Linux, bringing bootkit research to the Linux ecosystem through a complete open-source implementation. It demonstrates the full compromise of the Linux boot chain, from GRUB interception and vmlinuz decompression to direct vmlinux patching before the kernel begins execution. By providing a complete end-to-end implementation, Antarctic establishes a practical foundation for understanding, researching, and developing modern Linux UEFI bootkits.\n* [Github: Bootkits Development Starter Pack](https://github.com/TheMalwareGuardian/Bootkits-Development-Starter-Pack) -\u003e Starter pack for learning how to develop UEFI bootkits: basic proof-of-concepts, development environment configuration, and step-by-step resources to begin coding low-level bootkit components from scratch.\n* [Github: Benthic Windows Kernel Rootkit](https://github.com/TheMalwareGuardian/Benthic) -\u003e Benthic is a Windows kernel-mode rootkit that takes full control of the system from ring 0 through multiple attack vectors: Direct Kernel Object Manipulation for process hiding and token abuse, keyboard filtering for keylogging, minifilter drivers for filesystem interception, Windows Filtering Platform for network traffic manipulation, and Winsock Kernel for covert kernel-level communications. A comprehensive framework that demonstrates how a single kernel driver can subvert every layer of the operating system.\n* [Github: Gillyweed Linux LKM Rootkit](https://github.com/TheMalwareGuardian/Gillyweed) -\u003e Gillyweed dives into the internals of the Linux kernel through loadable kernel modules, implementing syscall hooking, process hiding, and stealth persistence mechanisms. A hands-on framework for understanding how LKM-based rootkits operate at the deepest level of a running Linux system.\n* [Github: Liminalis Linux eBPF Rootkit](https://github.com/TheMalwareGuardian/Liminalis) -\u003e Liminalis explores the offensive potential of eBPF, turning a technology designed for observability and performance monitoring into a stealthy rootkit framework. By leveraging eBPF programs attached to kernel hooks, Liminalis demonstrates how modern Linux security boundaries can be subverted without ever loading a traditional kernel module.\n* [Github: Rootkits Development Starter Pack](https://github.com/TheMalwareGuardian/Rootkits-Development-Starter-Pack) -\u003e Starter pack for learning how to develop Kernel-Mode rootkits: basic proof-of-concepts, development environment configuration, and step-by-step resources to begin coding low-level rootkit components from scratch.\n* [Book: Bootkits \u0026 Rootkits Development](https://github.com/TheMalwareGuardian/Book-Bootkits-and-Rootkits-Development-Infecting-The-Boot-to-Own-the-Kernel) -\u003e A comprehensive open-source book dedicated to the research, design, and development of modern bootkits and kernel rootkits. Initially focused on Windows and the research publicly presented at DEF CON 33, the project documents every stage of the boot compromise chain, from UEFI firmware internals, boot managers, and kernel loading, to pre-OS persistence, kernel patching, and post-exploitation techniques. The book combines architectural explanations, reverse engineering, implementation details, proof-of-concepts, debugging methodologies, and practical code examples to provide a complete understanding of offensive development beneath the operating system.\n* [Github: Awesome Bring Your Own Vulnerable UEFI Application](https://github.com/TheMalwareGuardian/Awesome-Bring-Your-Own-Vulnerable-UEFI-Application) -\u003e Collection of resources associated with a technique used to install UEFI bootkits on modern systems. It focuses on the technique itself and the vulnerabilities commonly abused to achieve bootkit installation, including vulnerable UEFI binaries, exploits, and external research material such as blogs, videos, and related repositories.\n* [Github: UEFI Vulnerability Research and Exploit Development](https://github.com/TheMalwareGuardian/UEFI-Vulnerability-Research-and-Exploit-Development) -\u003e Research-oriented repository that aggregates detailed information about multiple real-world vulnerabilities affecting UEFI and early-boot components. For each vulnerability, the repository provides technical documentation, analysis, exploits and debugging notes, along with the vulnerable binary when available (when the original component is not accessible an equivalent UEFI component is intentionally reimplemented). Overall, it offers a complete hands-on environment for researching vulnerabilities that affect components executed during the system boot process.\n* [Github: Debugging UEFI Applications for Vulnerability Research and Malware Analysis](https://github.com/TheMalwareGuardian/Debugging-UEFI-Applications-for-Vulnerability-Research-and-Malware-Analysis) -\u003e Practical guide to debugging UEFI applications and drivers in real-world research scenarios, covering QEMU and VMware environments, early-boot execution, entry point discovery, and runtime analysis of benign and malicious UEFI components.\n* [Github: VMware Workstation Secure Boot Custom Keys](https://github.com/TheMalwareGuardian/VMware-Secure-Boot-Custom-Keys) -\u003e How to modify Secure Boot keys (PK, KEK, DB, DBX) in a virtual machine created with VMware Workstation (finally explained properly).\n* [Github: QEMU UEFI Research Environment](https://github.com/TheMalwareGuardian/VMware-Secure-Boot-Custom-Keys) -\u003e A fully customizable UEFI research environment for Windows using QEMU. Includes Secure Boot key generation, OVMF setup, EFI utility signing, and a complete lab for testing UEFI applications, bootloaders, and bootkits.\n* [Github: PKfail](https://github.com/TheMalwareGuardian/PKfail) -\u003e PKfail is a summary and proof-of-concept project demonstrating how UEFI Secure Boot can be bypassed on platforms configured with test-signing keys as the Platform Key (PK), exposing a common misconfiguration that undermines platform integrity.\n* [Github: UEFI Firmware Analysis](https://github.com/TheMalwareGuardian/UEFI-Firmware-Analysis) -\u003e A set of personal notes and practical steps to guide you through analyzing the UEFI firmware of your own hardware, including techniques to inspect, dump, and review firmware images for misconfigurations or potential weaknesses.\n* [Github: Hello WinDbg Scripting](https://github.com/TheMalwareGuardian/WinDbg_Scripting) -\u003e This repository serves as a starting point for scripting in WinDbg, covering WinDbg native scripting, JavaScript, and PyKD (Python).\n\n\n\n---\n---\n---\n\n\n\n\u003cdiv id='bios-uefi'/\u003e\n\n## ***BIOS UEFI***\n\nDeep dive into BIOS UEFI.\n\n\n\u003cdiv id='bios-uefi-specifications'/\u003e\n\n### ***Specifications***\n\nReturn here once you have developed a better grasp of the subject.\n\n* [Web UEFI: Specifications](https://uefi.org/specifications) -\u003e Unified Extensible Firmware Interface Forum.\n* [Web UEFI: UEFI Specification Version 2.11](https://uefi.org/specs/UEFI/2.11/) -\u003e This Unified Extensible Firmware Interface (UEFI) Specification describes an interface between the operating system (OS) and the platform firmware.\n* [Web UEFI: UEFI Shell Specification Version 2.2](https://uefi.org/sites/default/files/resources/UEFI_Shell_2_2.pdf)\n* [Web UEFI: UEFI Platform Initialization Specification 1.9](https://uefi.org/specs/PI/1.9/) -\u003e This specification defines the core code and services that are required for an implementation of the Pre-EFI Initialization (PEI) phase of the Platform Initialization (PI) specifications (hereafter referred to as the \"PI Architecture\").\n\n\n\u003cdiv id='bios-uefi-basics'/\u003e\n\n### ***Basics***\n\nThis should be your starting point.\n\n* [Web Wikipedia: Booting](https://en.wikipedia.org/wiki/Booting) -\u003e In computing, booting is the process of starting a computer as initiated via hardware such as a button on the computer or by a software command.\n* [Web OsDev: UEFI](https://wiki.osdev.org/UEFI) -\u003e UEFI is a specification for x86, x86-64, ARM, and Itanium platforms that defines a software interface between the operating system and the platform firmware/BIOS.\n* [Blog: Programming for EFI](https://www.rodsbooks.com/) -\u003e Tech-savvy individuals know the Extensible Firmware Interface (EFI) and its newer variant, the Unified EFI (UEFI) as a replacement for the older Basic Input/Output System (BIOS) on PCs and other computers. What you may not be aware of is that EFI is a complex software environment, comparable in size and features to a simple OS such as DOS. As such, EFI can host a variety of programs—but those programs can't spring into existence fully-formed, like Athena from Zeus' head. Rather, they must be written by individuals.\n\n\n\u003cdiv id='bios-uefi-videos'/\u003e\n\n### ***Videos***\n\nFamiliarize yourself with UEFI watching these videos.\n\n* [Youtube Video: BIOS and UEFI As Fast As Possible](https://www.youtube.com/watch?v=zIYkol851dU) -\u003e What fundamental things does a computer BIOS do, and what are the important differences between the traditional BIOS and the newer UEFI?\n* [Youtube Video: BIOS, CMOS, UEFI](https://www.youtube.com/watch?v=LGz0Io_dh_I) -\u003e This video explains the difference between the BIOS, CMOS, and UEFI. It also explains what the purpose of the CMOS battery. What is the BIOS? What is UEFI? What is CMOS?\n* [Youtube Video: PC BIOS Settings](https://www.youtube.com/watch?v=ezubjTO7rRI\u0026t=10s) -\u003e BIOS / UEFI settings, including boot options, secure boot, enabling XMP memory profiles, and BIOS passwords. Also information on the differences between a legacy BIOS and a UEFI BIOS, and how to enter the BIOS.\n* [Youtube Video: ThatOsDev - EFI based Bootloader](https://www.youtube.com/watch?v=_98PUTJc9Yk\u0026list=PLwH94sFU_ljPi2ClIcWIvuc1GdLT81uuH\u0026index=4) -\u003e EFI Explained.\n* [Youtube Video: UEFIForum - Best Practices for UEFI Secure Boot Customization](https://www.youtube.com/watch?v=WBemkwMHLJM) -\u003e UEFI Secure Boot helps provide an effective defense against boot malware, but following today's best practices in its implementation, deployment and configurability can help its increase its effectiveness against increasingly sophisticated exploits.\n* [Youtube Video: Techsavvy - Mastering UEFI, Your Essential Guide to Hardware-Firmware and Boot-Chain Security](https://www.youtube.com/watch?v=pazWRQt-IUE) -\u003e This comprehensive guide breaks down the essentials of UEFI, exploring its functionality, the significance of SPI flash, and the various boot phases. We'll compare open-source and proprietary firmware solutions like Phoenix and AMI, and address the ongoing challenges vendors face against malicious software.\n\n\n\u003cdiv id='bios-uefi-windows-boot'/\u003e\n\n### ***Windows Boot***\n\nGain an understanding of the Windows boot process and the existing protection mechanisms at startup.\n\n* [Presentation: UEFI Plugfest - Windows Boot Environment](https://uefi.org/sites/default/files/resources/UEFI-Plugfest-WindowsBootEnvironment.pdf) -\u003e High-level description of Windows boot process and Windows UEFI services usage.\n* [Web Microsoft: Secure boot](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-secure-boot) -\u003e Secure boot is a security standard developed by members of the PC industry to help make sure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM).\n* [Web Microsoft: Secure the Windows boot process](https://learn.microsoft.com/en-us/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process) -\u003e Running Windows 10 or Windows 11 on a PC with Unified Extensible Firmware Interface (UEFI) support ensures that Trusted Boot safeguards your PC against malware right from the moment you power it on.\n* [Youtube Video: Boot Up with Confidence Windows 10/11 Secure Boot Demystified](https://www.youtube.com/watch?v=ZF1xGdhyUyw\u0026t=45s) -\u003e How secure boot works in Windows 10/11. Secure boot allows protection from \"root-kit\" attacks on both clients and servers.\n* [Youtube Video: Compare Windows 7 and Windows 8-10 boot process](https://www.youtube.com/watch?v=_DQlaFUhCyM) -\u003e A comparison of the boot process of Windows 7 and Windows 8/10.\n\n\n\u003cdiv id='bios-uefi-vulnerabilities'/\u003e\n\n### ***Vulnerabilities***\n\nExplore BIOS vulnerabilities, it's fine if it appears challenging at this moment.\n\n* [Github: Awesome Bring Your Own Vulnerable UEFI Application](https://github.com/TheMalwareGuardian/Awesome-Bring-Your-Own-Vulnerable-UEFI-Application)\n* [Github: One Bootloader to Load Them All, Mickey Shkatov and Jesse Michael](https://github.com/HackingThings/OneBootloaderToLoadThemAll) -\u003e One Bootloader to Load Them All - Research materials, Code , Etc. This repository contains as much information as possible to help in understanding the issues we found.\n* [Presentation: DEF CON 30 - One Bootloader to Load Them All, Mickey Shkatov and Jesse Michael](https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Mickey%20Shkatov%20%20%20Jesse%20Michael%20-%20One%20Bootloader%20to%20Load%20Them%20All.pdf)\n* [Youtube Video: DEF CON 30 - One Bootloader to Load Them All, Mickey Shkatov and Jesse Michael](https://www.youtube.com/watch?v=99t7wEYs8h0) -\u003e Introduced in 2012, Secure Boot - the OG trust in boot - has become a foundational rock in modern computing and is used by millions of UEFI-enabled computers around the world due to its integration in their BIOS. The way Secure Boot works is simple and effective, by using tightly controlled code signing certificates, OEMs like Microsoft, Lenovo, Dell and others secure their boot process, blocking unsigned code from running during boot. But this model puts its trust in developers developing code without vulnerabilities or backdoors; in this presentation we will discuss past and current flaws in valid bootloaders, including some which misuse built-in features to inadvertently bypass Secure Boot. We will also discuss how in some cases malicious executables can hide from TPM measurements used by BitLocker and remote attestation mechanisms. Come join us as we dive deeper and explain how it all works, describe the vulnerabilities we found and walk you through how to use the new exploits and custom tools we created to allow for a consistent bypass for secure boot effective against every X86-64 UEFI platform.\n* [Presentation: REcon 2015 - Attacking and Defending BIOS](https://recon.cx/2015/slides/recon2015-09-yuriy-bulygin-oleksandr-bazhaniuk-Attacking-and-Defending-BIOS-in-2015.pdf)\n* [Youtube Video: REcon 2015 - Attacking and Defending BIOS](https://www.youtube.com/watch?v=rGkymhurzM8) -\u003e In this presentation we will demonstrate multiple types of recently discovered BIOS vulnerabilities. We will detail how hardware configuration is restored upon resume from sleep and how BIOS can be attacked when waking up from sleep using \"S3 resume boot script\" vulnerabilities. Similarly, we will discuss the impact of insufficient protection of persistent configuration data in non-volatile storage and more.\n* [Presentation: DEF CON 22 - Summary of Attacks Against BIOS](https://defcon.org/images/defcon-22/dc-22-presentations/Bulygin-Bazhaniul-Furtak-Loucaides/DEFCON-22-Bulygin-Bazhaniul-Furtak-Loucaides-Summary-of-attacks-against-BIOS-UPDATED.pdf)\n* [Youtube Video: DEF CON 22 - Summary of Attacks Against BIOS](https://www.youtube.com/watch?v=QDSlWa9xQuA) -\u003e A variety of attacks targeting platform firmware have been discussed publicly, drawing attention to the pre-boot and firmware components of the platform such as secure boot, OS loaders, and SMM. Windows 8 Secure Boot provides an important protection against bootkits by enforcing a signature check on each boot component.\n* [Presentation: BlackHat Europe 2014 - Analyzing UEFI BIOSes from Attacker \u0026 Defender Viewpoints](https://www.blackhat.com/docs/eu-14/materials/eu-14-Kovah-Analyzing-UEFI-BIOSes-From-Attacker-And-Defender-Viewpoints.pdf)\n* [Youtube Video: BlackHat Europe 2014 - Analyzing UEFI BIOSes from Attacker \u0026 Defender Viewpoints](https://www.youtube.com/watch?v=CGBpil0S5NI) -\u003e In 2013, MITRE released Copernicus 1, a best-effort system to capture a raw dump of the BIOS and whether it appears to be possible for an attacker to write to it. In 2014, we released Copernicus 2 to combat the ability of an attacker to subvert not just Copernicus 1, but all other BIOS capture systems. While these free tools are a good way to get a copy of your BIOS, analyzing it to detect malicious changes is still an open problem in need of further investigation before defenders can feel confident that they have un-infected BIOS. You can't just compare the MD5s from two BIOS dumps and get a valid comparison. This is a problem that leads to firmware-level malware going under-reported and under-analyzed due to not enough people with the background to jump into this area.\n* [Presentation: BlackHat USA 2017 - Betraying the BIOS, Where the Guardians of the BIOS are Failing](https://www.blackhat.com/docs/us-17/wednesday/us-17-Matrosov-Betraying-The-BIOS-Where-The-Guardians-Of-The-BIOS-Are-Failing.pdf)\n* [Youtube Video: BlackHat USA 2017 - Betraying the BIOS, Where the Guardians of the BIOS are Failing](https://www.youtube.com/watch?v=Dfl2JI2eLc8) -\u003e For UEFI firmware, the barbarians are at the gate -- and the gate is open. On the one hand, well-intentioned researchers are increasingly active in the UEFI security space; on the other hand, so are attackers. Information about UEFI implants -- by HackingTeam and state-sponsored actors alike -- hints at the magnitude of the problem, but are these isolated incidents, or are they indicative of a more dire lapse in security?\n* [Presentation: BlackHat USA 2017 - Firmware is the New Black, Analyzing Past Three Years of BIOS/UEFI Security Vulnerabilities](https://github.com/rrbranco/BlackHat2017/blob/master/BlackHat2017-BlackBIOS-v0.13-Published.pdf)\n* [Youtube Video: BlackHat USA 2017 - Firmware is the New Black, Analyzing Past Three Years of BIOS/UEFI Security Vulnerabilities](https://www.youtube.com/watch?v=MONgHW2rpY8) -\u003e In recent years, we witnessed the rise of firmware-related vulnerabilities, likely a direct result of increasing adoption of exploit mitigations in major/widespread operating systems - including for mobile phones.\n* [Presentation: BlackHat Europe 2023 - LogoFAIL, Security Implications of Image Parsing During System Boot](https://i.blackhat.com/EU-23/Presentations/EU-23-Pagani-LogoFAIL-Security-Implications-of-Image_REV2.pdf)\n* [Youtube Video: BlackHat Europe 2023 - LogoFAIL, Security Implications of Image Parsing During System Boot](https://www.youtube.com/watch?v=ch0t2_yjQJQ) -\u003e Enter LogoFAIL, our latest research revealing significant security vulnerabilities in the image parsing libraries used by nearly all BIOS vendors to display logo images during boot. Our research highlights the risks associated with parsing complex file formats at such a delicate stage of the platform startup. During this talk, we will show how some UEFI BIOSes allow attackers to store custom logo images, which are parsed during boot, on the EFI system partition (ESP) or inside unsigned sections of a firmware update. We also shed light on the implications of these vulnerabilities, which extend beyond mere graphical rendering. In fact, successful exploitation of these vulnerabilities allows attackers to hijack the execution flow and achieve arbitrary code execution. LogoFAIL vulnerabilities can compromise the security of the entire system rendering \"below-the-OS\" security measures completely ineffective (e.g., Secure Boot). Finally, our talk will include a detailed explanation of how we successfully escalate privileges from OS to firmware level by exploiting a real device vulnerable to LogoFAIL...\n* [Presentation: BlackHat Europe 2020 - efiXplorer, Hunting for UEFI Firmware Vulnerabilities at Scale with Automated Static Analysis](https://i.blackhat.com/eu-20/Wednesday/eu-20-Labunets-efiXplorer-Hunting-For-UEFI-Firmware-Vulnerabilities-At-Scale-With-Automated-Static-Analysis.pdf)\n* [Youtube Video: BlackHat Europe 2020 - efiXplorer, Hunting for UEFI Firmware Vulnerabilities at Scale with Automated Static Analysis](https://www.youtube.com/watch?v=Sa779TGX3wY) -\u003e Existing UEFI analysis instruments lack systemic approach to firmware vulnerability research focused on specifics of x86-based systems. No publicly known tools available for UEFI firmware vulnerabilities research focused on static analysis. Most of the common reversing tools focused on...\n* [Presentation: Coreboot 2017 - Exploring Your System Deeper with CHIPSEC is Not Naughty](https://www.c7zero.info/stuff/csw2017_ExploringYourSystemDeeper_updated.pdf)\n* [Youtube Video: Coreboot 2017 - Exploring Your System Deeper with CHIPSEC is Not Naughty](https://www.youtube.com/watch?v=H4P5cCj1K7o) -\u003e You wanted to explore deep corners of your system but didn't know how? System boot firmware, ROMs on expansion cards, I/O devices and their firmware, microprocessors, embedded controllers, memory devices, low-level hardware interfaces, virtualization and hypervisors. You could discover if any of these have known vulnerabilities, configured insecurely or even discover new vulnerabilities and develop proof-of-concept exploits to test these vulnerabilities. Ultimately, you can verify security state of platform components of your system and how effective are the platform security defenses: hardware or virtualization based TEE, secure or trusted boot, firmware anti-tampering mechanisms, hypervisor based isolation... Or maybe you just want to explore hardware and firmware components your system has. CHIPSEC framework can help you with all of that. Since releasing it three years ago at CanSecWest 2014 significant improvements have been made in the framework - from making it easy to install and use to adding lots of new security capabilities. We'll go over certain representative examples of what you can do with it such as finding vulnerabilities in SMM firmware, analyzing UEFI firmware vulnerabilities, testing hardware security mechanisms of the hypervisors, finding backdoors in UEFI images and more.\n* [Presentation: BlackHat USA 2009 - Attacking Intel Bios](https://www.blackhat.com/presentations/bh-usa-09/WOJTCZUK/BHUSA09-Wojtczuk-AtkIntelBios-SLIDES.pdf)\n* [Youtube Video: BlackHat USA 2009 - Attacking Intel Bios](https://www.youtube.com/watch?v=CRjcKv-xiqw) -\u003e We demonstrate how to permanently reflash Intel BIOSes on the latest Intel Q45-based systems. In contrast to a previous work done by other researches a few months earlier, who targeted totally unprotected low-end BIOSes, we focus on how to permanently reflash one of the most secure BIOSes out there, that normally only allow a vendor's digitally signed firmware to be flashed.\n* [Web Rapid7: How To Hunt For UEFI Malware Using Velociraptor](https://www.rapid7.com/blog/post/2024/02/29/how-to-hunt-for-uefi-malware-using-velociraptor/) -\u003e UEFI threats have historically been limited in number and mostly implemented by nation state actors as stealthy persistence. However, the recent proliferation of Black Lotus on the dark web, Trickbot enumeration module (late 2022), and Glupteba (November 2023) indicates that this historical trend may be changing.\n* [Github: Velociraptor - Endpoint visibility and collection tool](https://github.com/Velocidex/velociraptor) -\u003e Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language (VQL) queries.\n* [Web IEEXplore: Finding SMM Privilege-Escalation Vulnerabilities in UEFI Firmware with Protocol-Centric Static Analysis](https://ieeexplore.ieee.org/document/9833723) -\u003e The Unified Extensible Firmware Interface (UEFI) provides a specification of the software interface between an OS and its underlying platform firmware. The runtime services provided are seemingly secure as they reside in System Management Mode (SMM) at ring -2, assuming a higher privilege than the OS kernel at ring 0. However, their software vulnerabilities are known to be exploitable to launch ring 0 to ring -2 privilege escalation, i.e., SMM privilege escalation attacks.In this paper, we introduce an effective static analysis framework for detecting SMM privilege escalation vulnerabilities in UEFI firmware. We present a systematic study of such vulnerabilities and identify their root causes as being two types of references that can escape from the SMRAM, legacy references and unintentional references.\n* [Web Binary Defense: Running Malware Below the OS, The State of UEFI Firmware Exploitation](https://www.binarydefense.com/resources/blog/running-malware-below-the-os-the-state-of-uefi-firmware-exploitation/) -\u003e Usually when we think of malware infections, we think of malicious programs running on top of the operating system, usually Windows. These programs might use techniques like privilege escalation, running in memory only, injecting code into other processes, and obfuscating their code and activities. All of these techniques are used with the end goal of compromising a system, achieving persistence, and remaining undetected.\n* [Web SentinelLabs: Moving From Common-Sense Knowledge About UEFI To Actually Dumping UEFI Firmware](https://www.sentinelone.com/labs/moving-from-common-sense-knowledge-about-uefi-to-actually-dumping-uefi-firmware/)\n* [Web SentinelLabs: Moving From Manual Reverse Engineering of UEFI Modules To Dynamic Emulation of UEFI Firmware](https://www.sentinelone.com/labs/moving-from-manual-reverse-engineering-of-uefi-modules-to-dynamic-emulation-of-uefi-firmware/)\n* [Web SentinelLabs: Moving From Dynamic Emulation of UEFI Modules To Coverage-Guided Fuzzing of UEFI Firmware](https://www.sentinelone.com/labs/moving-from-dynamic-emulation-of-uefi-modules-to-coverage-guided-fuzzing-of-uefi-firmware/)\n* [Web SentinelLabs: Adventures From UEFI Land, the Hunt For the S3 Boot Script](https://www.sentinelone.com/labs/adventures-from-uefi-land-the-hunt-for-the-s3-boot-script/)\n* [Web Margin Research: Emulating and Exploiting UEFI Firmware](https://margin.re/2023/09/emulating-and-exploiting-uefi-firmware/) -\u003e Dynamically inspecting software becomes harder the lower the level of abstraction you go; while there are many resources for debugging userspace programs, there is less information out there for kernels, bootloaders, and system firmware.\n* [Web Basic Input/Output: Reverse Engineering UEFI with Ghidra](https://www.basicinputoutput.com/2023/10/reverse-engineering-uefi-with-ghidra.html) -\u003e Dynamically inspecting software becomes harder the lower the level of abstraction you go; while there are many resources for debugging userspace programs, there is less information out there for kernels, bootloaders, and system firmware.\n\n\n\u003cdiv id='bios-uefi-tools'/\u003e\n\n### ***Tools***\n\nAnalyze, test, and modify UEFI firmware.\n\n* [Github: UEFITool - UEFI firmware image viewer and editor](https://github.com/LongSoft/UEFITool) -\u003e UEFITool is a cross-platform open source application written in C++/Qt, that parses UEFI-compatible firmware image into a tree structure, verifies image's integrity and provides a GUI to manipulate image's elements. Project development started in the middle of 2013 because of the lack of cross-platform open source utilities for tinkering with UEFI images.\n* [Github: CHIPSEC - Platform Security Assessment Framework](https://github.com/chipsec/chipsec) -\u003e CHIPSEC is a framework for analyzing the security of PC platforms including hardware, system firmware (BIOS/UEFI), and platform components. It includes a security test suite, tools for accessing various low level interfaces, and forensic capabilities. It can be run on Windows, Linux, Mac OS X and UEFI shell. Instructions for installing and using CHIPSEC can be found in the manual.\n* [Github: CHIPSEC - Training, Writing Modules \u0026 Tools](https://raw.githubusercontent.com/wiki/chipsec/chipsec/files/training/OSFC_2018_CHIPSEC_Workshop.pdf)\n* [Presentation: CHIPSEC - BlackHat USA 2014](https://www.blackhat.com/docs/us-14/materials/arsenal/us-14-Bulygin-CHIPSEC-Slides.pdf)\n* [Github: UEFI Firmware Parser](https://github.com/theopolis/uefi-firmware-parser) -\u003e The UEFI firmware parser is a simple module and set of scripts for parsing, extracting, and recreating UEFI firmware volumes. This includes parsing modules for BIOS, OptionROM, Intel ME and other formats too.\n* [Github: FwHunt Community Scanner](https://github.com/binarly-io/fwhunt-scan) -\u003e Tools for analyzing UEFI firmware and checking UEFI modules with FwHunt rules.\n* [Github: FwHunt Rules](https://github.com/binarly-io/FwHunt) -\u003e The Binarly Firmware Hunt (FwHunt) rule format was designed to scan for known vulnerabilities in UEFI firmware.\n* [Github: Kraft Dinner](https://github.com/tandasat/kraft_dinner) -\u003e Tool to dump UEFI runtime drivers implementing runtime services for Windows.\n* [Github: Flashrom](https://github.com/flashrom/flashrom) -\u003e It is a utility for detecting, reading, writing, verifying and erasing flash chips. It is often used to flash BIOS/EFI/coreboot/firmware images in-system using a supported mainboard, but it also supports flashing of network cards (NICs), SATA controller cards, and other external devices which can program flash chips.\n* [Web Hex Rays: IDA Free](https://hex-rays.com/ida-free/) -\u003e This (completely!) free version of IDA offers a privilege opportunity to see IDA in action. This light but powerful tool can quickly analyze the binary code samples and users can save and look closer at the analysis results.\n* [Web Ghidra SRE: Software Reverse Engineering framework](https://ghidra-sre.org/) -\u003e A software reverse engineering (SRE) suite of tools developed by NSA's Research Directorate in support of the Cybersecurity mission\n\n\n\n---\n---\n---\n\n\n\n\u003cdiv id='edk2'/\u003e\n\n## ***EDK2***\n\nStudy the development of applications and drivers (bootkit components) in the UEFI environment.\n\n\n\u003cdiv id='edk2-basics'/\u003e\n\n### ***Basics***\n\nConfigure the required development environment.\n\n* [Github: EDK II Project](https://github.com/tianocore/edk2) -\u003e A modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications from www.uefi.org.\n* [Github: Getting Started with EDK II](https://github.com/tianocore/tianocore.github.io/wiki/Getting-Started-with-EDK-II) -\u003e Steps for downloading EDK II from GitHub and compiling projects under various OS/compiler environments.\n* [Github: Getting Started Writing Simple Application with EDK II](https://github.com/tianocore/tianocore.github.io/wiki/Getting-Started-Writing-Simple-Application) -\u003e How to Write a Simple EDK II UEFI Application.\n* [Web Basic Input/Output: \"Hello World\" Quick Start with EDK II](https://www.basicinputoutput.com/2019/10/hello-world-quick-start-with-edk2.html) -\u003e Setup the EDK on a system and configure it to build a basic \"Hello, World\" type program.\n* [Github: UEFI Pratical Programming](https://github.com/luobing/uefi-practical-programming)\n* [GitHub: EDK II Driver Writer's Guide](https://github.com/tianocore-docs/edk2-UefiDriverWritersGuide/blob/master/EXAMPLES.md)\n* [Web LinkedIn: Understanding and Exploiting UEFI Secure Boot with Intel's EDK2](https://www.linkedin.com/pulse/understanding-exploiting-uefi-secure-boot-intels-edk2-jose-crespo?trk=portfolio_article-card_title)\n* [Blog Medium: A hitchhiker's guide to UEFI programming in Windows](https://medium.com/d-classified/a-hitchhikers-guide-to-uefi-programming-in-windows-7449994a0486) -\u003e Wang Mingjie unpacks the entire process of developing UEFI programs, covering everything from building to deployment on actual systems with Secure Boot enabled. While not a technical deep-dive, his guide provides engineers-at-large with a grasp of different elements of the UEFI environment, and understand its impact on the execution and deployment of UEFI programs. Mingjie also includes various practical considerations to assist readers in evaluating different deployment options.\n\n\n\u003cdiv id='edk2-videos'/\u003e\n\n### ***Videos***\n\nCheck out these videos to learn advanced development techniques.\n\n* [Youtube Video: UEFIForum - Driver Development with EDKII](https://www.youtube.com/watch?v=PX4HaWQNrlo) -\u003e The world of UEFI is unlike OS-based software ecosystems in several aspects and the difference can be daunting to a developer who is starting to write UEFI device drivers.\n* [Youtube Video: Queso Fuego - UEFI Programming in C](https://www.youtube.com/watch?v=t3iwBQg_Gik\u0026list=PLT7NbkyNWaqZYHNLtOZ1MNxOt8myP5K0p) -\u003e Intro, setup, and hello world program to start programming for x86_64 EFI applications. We'll be writing a program to make GPT disk images with an EFI system partition and basic data partition, and an OS loader EFI application for an operating system bootloader. Everything will follow official specifications and documentation for UEFI, ACPI, FAT32, etc. as much as possible.\n\n\n\u003cdiv id='edk2-pocs'/\u003e\n\n### ***PoCs***\n\nUEFI applications and drivers.\n\n* [Github: Bootkits Development Starter Pack](https://github.com/TheMalwareGuardian/Bootkits-Development-Starter-Pack) -\u003e Starter pack for learning how to develop UEFI bootkits: basic proof-of-concepts, development environment configuration, and step-by-step resources to begin coding low-level bootkit components from scratch.\n* [Github: EDK2 - MdeModulePkg Applications](https://github.com/tianocore/edk2/tree/master/MdeModulePkg/Application/) -\u003e Sample applications of     MdeModulePkg package.\n* [Github: UEFI Lessons](https://github.com/Kostr/UEFI-Lessons) -\u003e Lessons to get to know UEFI programming in Linux with the help of EDKII.\n* [Github: Shim - A first-stage UEFI bootloader](https://github.com/rhboot/shim) -\u003e Shim is a trivial EFI application that, when run, attempts to open and execute another application. It will initially attempt to do this via the standard EFI LoadImage() and StartImage() calls. If these fail (because Secure Boot is enabled and the binary is not signed with an appropriate key, for instance) it will then validate the binary against a built-in certificate. If this succeeds and if the binary or signing key are not forbidden then shim will relocate and execute the binary.\n* [Github: Memory Dump UEFI](https://github.com/NoInitRD/Memory-Dump-UEFI) -\u003e A UEFI application for dumping the contents of RAM. Intended to be flashed onto a USB connected device and booted live. It comes with a UEFI shell to facilitate navigation and use.\n* [Github: Super UEFIinSecureBoot Disk](https://github.com/ValdikSS/Super-UEFIinSecureBoot-Disk) -\u003e Super UEFIinSecureBoot Disk is a proof-of-concept (not actively maintained or enhanced) bootable image with GRUB2 bootloader designed to be used as a base for recovery USB flash drives. Key feature: disk is fully functional with UEFI Secure Boot mode activated. It can launch any operating system or .efi file, even with untrusted, invalid or missing signature.\n* [Github: TcpTransport](https://github.com/vinxue/TcpTransport) -\u003e A UEFI application to receive TCP network packets.\n* [Github: UefiVarMonitor](https://github.com/tandasat/UefiVarMonitor) -\u003e The runtime DXE driver monitoring access to the UEFI variables by hooking the runtime service table.\n* [Github: UefiVarTool](https://github.com/GeographicCone/UefiVarTool) -\u003e Scriptable tool to read and write UEFI variables from EFI shell. View, save, edit and restore hidden UEFI (BIOS) Setup settings faster than with the OEM menu forms.\n* [Github: FakeSecureBoot](https://github.com/Shmurkio/FakeSecureBoot) -\u003e UEFI DXE driver to fake Secure Boot. Hooks the gRT-\u003eGetVariable function to always return enabled if Secure Boot state is queried.\n* [Github: Simple UEFI Bootloader](https://github.com/KunYi/Simple-UEFI-Bootloader) -\u003e This bootloader is like a much simpler version of GRUB/Elilo/Windows Boot Manager, but mainly meant for writing your own operating system-less 64-bit programs, kernels, or full operating systems. It supports Windows, Linux, and Mac executable binaries (PE32+, 64-bit ELF, and 64-bit Mach-O formats). It also supports... Well, I'll let you figure that one out yourself.\n* [Github: Signed UEFI Shell](https://github.com/HackingThings/SignedUEFIShell) -\u003e Information about a signed UEFI Shell that can be used when Secure Boot is enabled.\n\n\n\n---\n---\n---\n\n\n\n\u003cdiv id='bootkits'/\u003e\n\n## ***Bootkits***\n\nThe most advanced malware that infects the boot process, which remains undetectable.\n\n\n\u003cdiv id='bootkits-basics'/\u003e\n\n### ***Basics***\n\nWhat is a bootkit exactly? Are they the elements you can develop with EDK2?\n\n* [Web Kaspersky: Bootkit](https://encyclopedia.kaspersky.com/glossary/bootkit/) -\u003e A bootkit is a malicious program designed to load as early as possible in the boot process, in order to control all stages of the operating system start up, modifying system code and drivers before anti-virus and other security components are loaded. The malicious program is loaded from the Master Boot Record (MBR) or boot sector. In effect, a bootkit is a rootkit that loads before the operating system.\n* [Web CrowdStrike: Bootkit - Definition, Prevention, and Removal](https://www.crowdstrike.com/cybersecurity-101/malware/bootkit/) -\u003e A strong cybersecurity strategy should not only include reactive approaches to cyberattacks, but should also include proactive prevention methods for infections such as bootkit. Mitigating the consequences of a bootkit infection and removing the infection are valuable tools for your cybersecurity team. Bootkits are stealthy, and understanding how they work and how to combat them can help keep your business safe from threat actors.\n* [Web Positive Technologies: Bootkits: evolution and detection methods](https://global.ptsecurity.com/analytics/bootkits-evolution-and-methods-of-detection) -\u003e Bootkits were previously thought to exist mainly in proof-of-concept form, and not used in real attacks. However, only two years separated the appearance of the first PoC and the first bootkit attack.\n\n\n\u003cdiv id='bootkits-videos'/\u003e\n\n### ***Videos***\n\nWatch these videos to learn what a bootkit is and the techniques used in its development.\n\n* [Presentation: DEF CON 33 - Infecting the Boot to Own the Kernel - Alejandro Vazquez, Maria San Jose](https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Alejandro%20Vazquez%20Vazquez%20Maria%20San%20Jose%20-%20Infecting%20the%20Boot%20to%20Own%20the%20Kernel%20Bootkits%20and%20Rootkits%20Development%20Presentation.pdf)\n* [Youtube Video: DEF CON 33 - Infecting the Boot to Own the Kernel - Alejandro Vazquez, Maria San Jose](https://www.youtube.com/watch?v=iS0XJVyxA3M) -\u003e Bootkits and Rootkits represent some of the most complex and stealthy forms of malware, capable of achieving full system control before and after the OS is loaded. While often discussed in theory, their actual construction, interaction, and execution flow remain mostly hidden from public view. This talk sheds light on how these implants are built and how their components interact across boot stages and kernel space. We'll explore the internals of a fully functional UEFI Bootkit and Kernel-mode Rootkit, examining their modular design, runtime interactions, and the mechanisms used to hook critical parts of the Windows boot chain. Attendees will see how these implants operate across pre-boot and post-boot phases, including early internet connectivity from firmware, dynamic payload delivery, runtime service hooking, deep kernel control, and advanced capabilities like hiding files, processes, and network activity, blocking traffic, capturing keystrokes, and maintaining command and control directly from kernel space. Everything shown on stage will be yours to explore: a complete Bootkit and Rootkit framework, fully customizable and ready to simulate real threats, test defenses, or build something even stealthier.\n* [Youtube Video: Off By One Security - Emulating APTs, Building and Deploying Bootkits \u0026 Rootkits](https://www.youtube.com/watch?v=8Uw6Tq4rw2s) -\u003e When we talk about truly advanced malware, the kind that only state-level or highly resourced APTs are capable of developing and deploying end-to-end, we're referring to what are known as bootkits and rootkits. In the first session we did on the Off-By-One Security YouTube channel, we introduced how to start developing these implants, mapping them to their programmable components, and we shared malware examples, proofs of concept, and various resources for you to develop your own. In this follow-up, we'll go deeper into the source code (including the kinds of changes required to adapt implants across multiple OS versions) and deployment process with live demonstrations in isolated virtual machines where Next-Generation Antivirus and EDR solutions are installed, showing live how these solutions often fail to detect this kind of activity because it originates from as deep as the boot process, where exhaustive monitoring is not possible.\n* [Youtube Video: Off By One Security - UEFI Bootkits and Kernel-Mode Rootkits Development with Alejandro Vazquez](https://www.youtube.com/watch?v=oa2i7JsGOHo) -\u003e Bootkits and Rootkits represent some of the most complex and stealthy forms of malware, capable of achieving full system control before and after the OS is loaded. While often discussed in theory, their actual construction, interaction, and execution flow remain mostly hidden from public view. This talk sheds light on how these implants are built and how their components interact across boot stages and kernel space. We'll explore the internals of a fully functional UEFI Bootkit and Kernel-mode Rootkit, examining their modular design, runtime interactions, and the mechanisms used to hook critical parts of the Windows boot chain. Attendees will see how these implants operate across pre-boot and post-boot phases, including early internet connectivity from firmware, dynamic payload delivery, runtime service hooking, deep kernel control, and advanced capabilities like hiding files, processes, and network activity, blocking traffic, capturing keystrokes, and maintaining command and control directly from kernel space. Everything shown on stage will be yours to explore: a complete Bootkit and Rootkit framework, fully customizable and ready to simulate real threats, test defenses, or build something even stealthier.\n* [Presentation: OffensiveCon18 - Alex Ionescu Advancing the State of UEFI Bootkits](http://publications.alex-ionescu.com/OffensiveCon/OffensiveCon%202018%20-%20Advancing%20the%20state%20of%20UEFI%20Boot%20Kits.pdf)\n* [Youtube Video: OffensiveCon18 - Alex Ionescu Advancing the State of UEFI Bootkits](https://www.youtube.com/watch?v=dpG97TBR3Ys) -\u003e Persistence in the Age of PatchGuard and Windows 10.\n* [Presentation: RSA Conference - ESPecter, Showing the Future of UEFI Threats](https://static.rainfocus.com/rsac/us22/sess/1628600566532001BQMV/finalwebsite/2022_USA22_HT-M01_01_ESPecter-Showing-the-Future-of-UEFI-Threats_1654098813782001estI.pdf)\n* [Youtube Video: RSA Conference - ESPecter, Showing the Future of UEFI Threats](https://www.youtube.com/watch?v=rpfE78x7dD4) -\u003e In recent years, it's become clear that UEFI threats are real and have been deployed in the wild. UEFI implants such as LoJax and MosaicRegressor have used the lowest level of persistence, SPI flash, but is it worth it? Actors behind ESPecter bootkit think that compromising the bootloader is the way. This session will explain why and how to protect against this and similar threats.\n* [Presentation: RSA Conference - UEFI Bootkits and Where UEFI Security Fails](https://static.rainfocus.com/rsac/us24/sess/1697270793852001dpne/finalwebsite/2024_USA24_HTA-T09_01_UEFI-Bootkits-and-Where-UEFI-Security-Fails_1713983196427001MzOd.pdf)\n* [Youtube Video: RSA Conference - UEFI Bootkits and Where UEFI Security Fails](https://www.youtube.com/watch?v=X3YOKkTdj_k) -\u003e The BlackLotus UEFI bootkit bypassed UEFI Secure Boot on Windows systems that were fully updated, by exploiting an old vulnerability that has been known and patched for over a year. How is that possible? Are there other such vulnerabilities? Join this session for a tour of UEFI threats, vulnerabilities, and issues with UEFI security, and learn what you can do to protect your systems.\n* [Youtube Video: Nullcon 2022 - A UEFI firmware bootkit in the wild](https://www.youtube.com/watch?v=lSpOFUCzFdk) -\u003e Despite the advanced capabilities they provide, low-level implants such as bootkits and rootkits are only deployed by the most sophisticated attackers due to the risk they pose to the victim system's stability. In recent years, Kaspersky has however observed a number of new low-level malware, such as MosaicRegressor, MoonBounce, and the object of this talk, CosmicStrand.\n* [Paper: Virus Bulletin 2014 - Bootkits past, present \u0026 future](https://www.virusbulletin.com/virusbulletin/2014/11/paper-bootkits-past-present-amp-future)\n* [Youtube Video: Virus Bulletin 2014 - Bootkits past, present \u0026 future](https://www.youtube.com/watch?v=jN34P4EdIUw) -\u003e Bootkit threats have always been a powerful weapon in the hands of cybercriminals, allowing them to establish persistent and stealthy presence in their victims' systems. The most recent notable spike in bootkit infections was associated with attacks on 64-bit versions of the Microsoft Windows platform, which restrict the loading of unsigned kernel-mode drivers. However, these bootkits aren't effective against UEFI-based platforms. So, are UEFI-based machines immune against bootkit threats (or would they be)?\n* [Paper: BlackHat USA 2014 - Exposing Bootkits with BIOS Emulation](https://www.blackhat.com/docs/us-14/materials/us-14-Haukli-Exposing-Bootkits-With-BIOS-Emulation-WP.pdf)\n* [Youtube Video: BlackHat USA 2014 - Exposing Bootkits with BIOS Emulation](https://www.youtube.com/watch?v=siMj4bFx5nI) -\u003e Stealth and persistency are invaluable assets to an intruder. You cannot defend against what you cannot see. This talk discusses techniques to counter attempts at subverting modern security features, and regain control of compromised machines, by drilling down deep into internal structures of the operating system to battle the threat of bootkits.\n* [Presentation: BlackHat USA 2013 - Detecting OSX and Windows bootkits with RDFU](https://cdn2.hubspot.net/hubfs/3375217/Reversing_Labs_November%202018/File/Presentation-BlackHat-Vegas-2013.pdf)\n* [Youtube Video: BlackHat USA 2013 - Detecting OSX and Windows bootkits with RDFU](https://www.youtube.com/watch?v=7UsdRzsue-g) -\u003e UEFI has recently become a very public target for rootkits and malware. To combat this new threat, we developed a Rootkit Detection Framework for UEFI (\"RDFU\") that incorporates a unified set of tools that address this problem across a wide spectrum of UEFI implementations.\n* [Presentation: HackInTheBox 2013 - Dreamboot](https://archive.conference.hitb.org/hitbsecconf2013ams/materials/D2T1%20-%20Sebastien%20Kaczmarek%20-%20Dreamboot%20UEFI%20Bootkit.pdf)\n* [Youtube Video: HackInTheBox 2013 - Dreamboot](https://www.youtube.com/watch?v=KvTUE5P-Yhs) -\u003e This presentation is a study of the overall architecture of UEFI from a security point of view with a focus on a bootkit implementation for Windows 8 x64 which exploits the UEFI firmware: Dreamboot. Dreamboot has two specific payloads: Privilege escalation and Windows local authentication bypass. DreamBoot comes in the form of a bootable ISO, to use preferably as part of a physical attack (i.e. when the attacker has physical access to the machine peripherals: DVD or USB ports). It is also fully functional in virtualized environments like VMWare Workstation or ESX.\n* [Youtube Video: (Spanish) RootedCON 2024 - In the Roots of Evil, A Deep Dive into UEFI Bootkit Development (ES)](https://www.youtube.com/watch?v=NfhVqgiJSs4)\n* [Youtube Video: (Spanish) ViconGal 2024 - The New Age of Bootkits, Persistence and Evasion from the Kernel (ES)](https://www.youtube.com/watch?v=cDqh6LMlja4)\n\n\n\u003cdiv id='bootkits-analysis'/\u003e\n\n### ***Analysis***\n\nGain a true understanding of this malware by reading its analyses.\n\n* [Web WeLiveSecurity: BlackLotus UEFI bootkit - Myth confirmed](https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/) -\u003e The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality.\n* [Web Binarly: The Untold Story of the BlackLotus UEFI Bootkit](https://www.binarly.io/blog/the-untold-story-of-the-blacklotus-uefi-bootkit) -\u003e My experience with the analysis and detection of rootkits and bootkits goes back more than 20 years. In the early 2000s, the main challenge was dealing with infected machines when rootkits and bootkits modified the operating system kernel to conceal malicious components. It was such a fun time reverse engineering advanced threats in the good old days that I co-wrote \"Rootkits and Bootkits: Reversing Modern Malware and Next Generation Threats\", a book full of the most interesting stories of our time going down the rabbit hole of advanced malware.\n* [Web WeLiveSecurity: UEFI threats moving to the ESP - Introducing ESPecter bootkit](https://www.welivesecurity.com/2021/10/05/uefi-threats-moving-esp-introducing-especter-bootkit/) -\u003e ESET research discovers a previously undocumented UEFI bootkit with roots going back all the way to at least 2012.\n* [Web WeLiveSecurity: Introducing HybridPetya: Petya/NotPetya copycat with UEFI Secure Boot bypass](https://www.welivesecurity.com/en/eset-research/introducing-hybridpetya-petya-notpetya-copycat-uefi-secure-boot-bypass/) -\u003e UEFI copycat of Petya/NotPetya exploiting CVE-2024-7344 discovered on VirusTotal.\n* [Web Palo Alto: Diving Into Glupteba's UEFI Bootkit](https://unit42.paloaltonetworks.com/glupteba-malware-uefi-bootkit/) -\u003e Glupteba is advanced, modular and multipurpose malware that, for over a decade, has mostly been seen in financially driven cybercrime operations. This article describes the infection chain of a new campaign that took place around November 2023. We will focus on one intriguing and previously undocumented feature: a Unified Extensible Firmware Interface (UEFI) bootkit.\n* [Web Binarly: UEFI Bootkit Hunting: In-Depth Search for Unique Code Behavior](https://www.binarly.io/blog/uefi-bootkit-hunting-in-depth-search-for-unique-code-behavior) -\u003e Firmware threats such as bootkits and implants have become increasingly prevalent due to their persistence and ability to evade detection compared to traditional OS-level malware. Attackers favor these threats because they can remain undetected even when conventional security measures are in place, especially if UEFI Secure Boot is disabled. Detecting unknown bootkits under these circumstances is a critical challenge in cybersecurity. Mostly, the publicly known UEFI implants and bootkits have been detected after successful deployment, which points to the limitations of the existing security solutions.\n* [Web VMWare: Detecting UEFI Bootkits in the Wild](https://blogs.vmware.com/security/2021/06/detecting-uefi-bootkits-in-the-wild-part-1.html) -\u003e Threat actors are continually looking for ways to improve the persistence of their malware and implants. Bootkits, meaning rootkits running at the firmware level, have been utilized for this purpose. Once bootkits are installed, it can be extremely difficult to detect or remove versus OS-level rootkits as they are executed prior to the actual OS boot process.\n* [Web SecureList: FinSpy - Unseen findings](https://securelist.com/finspy-unseen-findings/104322/) -\u003e FinSpy, also known as FinFisher or Wingbird, is an infamous surveillance toolset. Kaspersky has been tracking deployments of this spyware since 2011.\n* [Web SecureList: CosmicStrand - The discovery of a sophisticated UEFI firmware rootkit](https://securelist.com/cosmicstrand-uefi-firmware-rootkit/106973/) -\u003e FinSpy, also known as FinFisher or Wingbird, is an infamous surveillance toolset. Kaspersky has been tracking deployments of this spyware since 2011.\n* [Web SecureList: MosaicRegressor - Lurking in the Shadows of UEFI](https://securelist.com/mosaicregressor/98849/) -\u003e UEFI has become a prominent technology that is embedded within designated chips on modern day computer systems. Replacing the legacy BIOS, it is typically used to facilitate the machine's boot sequence and load the operating system, while using a feature-rich environment to do so. At the same time, it has become the target of threat actors to carry out exceptionally persistent attacks.\n* [Web WeLiveSecurity: LoJax - First UEFI rootkit found in the wild, courtesy of the Sednit group](https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/) -\u003e ESET researchers have shown that the Sednit operators used different components of the LoJax malware to target a few government organizations in the Balkans as well as in Central and Eastern Europe.\n* [Web Twitter X: ESETresearch - Malicious EFI samples](https://x.com/ESETresearch/status/1275770256389222400) -\u003e ESETresearch identified multiple malicious EFI bootloader samples. The malware displays a ransom message and prevents the computer from booting. It can compromise computers with disabled UEFI Secure Boot feature.\n\n\n\u003cdiv id='bootkits-source-code'/\u003e\n\n### ***Source Code***\n\nObserve that the components shown in the source code are the applications and drivers you can develop with EDK2.\n\n\n\u003cdiv id='bootkits-source-code-windows'/\u003e\n\n#### ***Windows***\n\n* [Github: Abyss Windows UEFI Bootkit](https://github.com/TheMalwareGuardian/Abyss) -\u003e Abyss is a Windows UEFI bootkit that hijacks the boot chain from the very first EFI application, intercepting the Windows Boot Manager and patching ntoskrnl.exe in memory before the operating system takes control. A full-chain implementation that achieves pre-OS persistence and kernel-level subversion, presented at DEF CON 33.\n* [Github: RedLotus](https://github.com/memN0ps/bootkit-rs) -\u003e Windows UEFI Bootkit in Rust designed to facilitate the manual mapping of a driver manual mapper before the kernel (ntoskrnl.exe) is loaded, effectively bypassing Driver Signature Enforcement (DSE).\n* [Github: EfiGuard](https://github.com/Mattiwatti/EfiGuard) -\u003e Portable x64 UEFI bootkit that patches the Windows boot manager, boot loader and kernel at boot time in order to disable PatchGuard and Driver Signature Enforcement (DSE).\n* [Github: Bootlicker](https://github.com/realoriginal/bootlicker) -\u003e A generic UEFI bootkit used to achieve initial usermode execution.\n* [Github: Bootkit Showcase](https://github.com/hardenedvault/bootkit-samples) -\u003e Real-World Examples of Infrastructure Security Threats.\n* [Github: SandboxBootkit](https://github.com/thesecretclub/SandboxBootkit) -\u003e Bootkit tested on Windows Sandbox to patch ntoskrnl.exe and disable DSE/PatchGuard.\n* [Github: Umap](https://github.com/btbd/umap/) -\u003e Windows UEFI bootkit that loads a generic driver manual mapper without using a UEFI runtime driver.\n* [Github: UEFI-Bootkit](https://github.com/ajkhoury/UEFI-Bootkit) -\u003e A small bootkit designed to use zero assembly.\n* [Github: BlackLotus](https://github.com/ldpreload/BlackLotus) -\u003e An innovative UEFI Bootkit designed specifically for Windows. It incorporates a built-in Secure Boot bypass and Ring0/Kernel protection to safeguard against any attempts at removal. This software serves the purpose of functioning as an HTTP Loader.\n* [Github: PeiBackdoor](https://github.com/Cr4sh/PeiBackdoor) -\u003e This project implements early stage firmware backdoor for UEFI based firmware. It allows to execute arbitrary code written in C during Pre EFI Init (PEI) phase of Platform Initialization (PI).\n* [Github: Rovnix](https://github.com/m0n0ph1/Win64-Rovnix-VBR-Bootkit) -\u003e Volume Boot Record Bootkit.\n* [Github: Vector EDK](https://github.com/hackedteam/vector-edk) -\u003e EFI Development Kit.\n* [Github: Dreamboot](https://github.com/quarkslab/dreamboot) -\u003e UEFI bootkit.\n* [Github: UEFIBootkit](https://github.com/gfoudree/UEFIBootkit) -\u003e Simple PoC for a bootkit written as a UEFI Option ROM Driver.\n* [Web Back Engineering: Voyager - A Hyper-V Hacking Framework For Windows 10 x64 (AMD \u0026 Intel)](https://git.back.engineering/_xeroxz/voyager) -\u003e Voyager is a project designed to offer module injection and vmexit hooking for both AMD \u0026 Intel versions of Hyper-V. This project works on all versions of Windows 10-x64 (2004-1507).\n* [Github: Efi-Memory - PoC EFI runtime driver for memory r/w \u0026 kdmapper fork](https://github.com/SamuelTulach/efi-memory) -\u003e Efi-memory is a proof-of-concept EFI runtime driver for reading and writing to virtual memory. It uses EfiGuards method of hooking SetVariable to communicate with the user-mode process.\n* [Github: EFI Driver Access](https://github.com/TheCruZ/EFI_Driver_Access) -\u003e Efi Driver Access is a simply project to load a driver during system boot with the idea to give the user kernel access for read/write memory without restrictions.\n* [Github: BlackIris](https://github.com/aitorfirm/BlackIris) -\u003e BlackIris is a full-scale, modular UEFI rootkit with physical memory mapping, runtime persistence, remote command control, file encryption, and a keyserver backend. It executes below the OS using real UEFI Runtime Services and survives Secure Boot bypass.\n* [Github: Calypso](https://github.com/3a1/Calypso) -\u003e A lightweight UEFI Bootkit with user-mode communication.\n* [Github: Resilience](https://github.com/xsh3llsh0ck/ResilienceKit) -\u003e Another UEFI bootkit that drops payload in RT phase of OS.\n* [Github: Insomnia](https://github.com/3a1/Insomnia/) -\u003e UEFI Bootkit that infects kernel with backdoor using SSDT hook.\n* [Github: UEFI Rootkit](https://github.com/killvxk/uefi-rootkit) -\u003e Bachelor thesis about a UEFI Rookit communicating witht the TPM module in an effort to gain trusted information from the windows boot process.\n* [Github: DmaBackdoorBoot](https://github.com/Cr4sh/s6_pcie_microblaze/tree/master/python/payloads/DmaBackdoorBoot) -\u003e UEFI DXE driver intended for executing of kernel mode and user mode payloads under the Windows operating system by having an arbitrary code execution at early boot stage during DXE phase of the platform initialization.\n* [Github: SmmBackdoorNg](https://github.com/Cr4sh/SmmBackdoorNg) -\u003e Updated version of System Management Mode backdoor for UEFI based platforms.\n\n\n\u003cdiv id='bootkits-source-code-linux'/\u003e\n\n#### ***Linux***\n\n* [Github: Antarctic Linux UEFI Bootkit](https://github.com/TheMalwareGuardian/Antarctic) -\u003e Antarctic is the first publicly released UEFI bootkit framework targeting Linux, bringing bootkit research to the Linux ecosystem through a complete open-source implementation. It demonstrates the full compromise of the Linux boot chain, from GRUB interception and vmlinuz decompression to direct vmlinux patching before the kernel begins execution. By providing a complete end-to-end implementation, Antarctic establishes a practical foundation for understanding, researching, and developing modern Linux UEFI bootkits.\n\n\n\n---\n---\n---\n\n\n\n\u003cdiv id='windows-kernel'/\u003e\n\n## ***Windows Kernel***\n\nExplore the heart of Windows.\n\n\n\u003cdiv id='windows-kernel-basics'/\u003e\n\n### ***Basics***\n\nThe essentials for learning how Windows operates beneath the surface.\n\n* [Web Microsoft: User mode and kernel mode](https://learn.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/user-mode-and-kernel-mode) -\u003e A processor in a computer running Windows operates in two different modes: user mode and kernel mode. The processor switches between these modes depending on the type of code it's executing. Applications operate in user mode, while core operating system components function in kernel mode. Although many drivers operate in kernel mode, some can function in user mode.\n* [Github: System Internals of Windows](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/sysinternals.md#windows-internals) -\u003e System architecture, processes, threads, memory management, and more.\n* [Web RedTeamNotes: Internals](https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals) -\u003e Everything you need to know about Windows kernel.\n* [Web SamsClass Info: Windows Internals CTF](https://samsclass.info/126/WI2021.htm) -\u003e Sam Bowne.\n* [Blog: Mysteries of the Windows Kernel - Processes \u0026 Objects](https://medium.com/@amitmoshel70/mysteries-of-the-windows-kernel-pt-1-processes-objects-d677a5afcd9b) -\u003e I've decided to start a series of Windows Internals articles which at the beginning will not directly be related to security, but after the series will cover some important Windows Internals topics, I'll start connecting the material into some aspects related to security. During the course, I'll show the practical aspects using WinDbg (kernel debugging) and Process Explorer.\n* [Blog: Mysteries of the Windows Kernel - Threads Scheduling \u0026 CPUs](https://medium.com/@amitmoshel70/mysteries-of-the-windows-kernel-pt-2-threads-scheduling-cpus-30125fbb46a3) -\u003e In this article we'll learn about what is a Thread, what a Thread is consisted off, How Threads are related to the CPU and how they are being scheduled when running on CPU cores.\n* [Blog: Mysteries of the Windows Kernel - Memory Management \u0026 Address Translation](https://medium.com/@amitmoshel70/mysteries-of-the-windows-kernel-pt-3-memory-management-address-translation-5c3501ac7723) -\u003e In this article I'll talk about the following topics related to \"Memory Management\".\n\n\n\u003cdiv id='windows-kernel-videos'/\u003e\n\n### ***Videos***\n\nWatch these videos to gain a deeper understanding of Windows' core components.\n\n* [Youtube Video: Pavel Yosifovich - Native Applications What, Why, and How?](https://www.youtube.com/watch?v=EKBvLTuI2Mo) -\u003e Normally, native applications are built by Microsoft only. Examples include Smss.exe (the session manager), CSrss.exe (the Windows subsystem process), and UserInit.exe (normally executed by WinLogon.exe on a successful login).\n* [Youtube Video: ACCU 2019 - Windows Native API](https://www.youtube.com/watch?v=a0KozcRhotM) -\u003e Many programmers are familiar with the Windows \"Win32\" API that provides access to a large variety of services, from user interface to memory management; but far fewer have much idea about the Windows \"Native\" API which is the mechanism used to access the operating system services located in the kernel.\n* [Youtube Video: BlackhHat 2015 - Battle Of The SKM And IUM, How Windows 10 Rewrites OS Architecture](https://www.youtube.com/watch?v=LqaWIn4y26E) -\u003e In Windows 10, Microsoft is introducing a radical new concept to the underlying OS architecture, and likely the biggest change to the NT design since the decision to move the GUI in kernel-mode. In this new model, the Viridian Hypervisor Kernel now becomes a core part of the operating system and implements Virtual Secure Machines (VSMs) by loading a true microkernel - a compact (200kb) NT look-alike with its own drivers called the Secure Kernel Mode (SKM) environment, which then uses the Hypervisor to hook and intercept execution of the true NT kernel. This creates a new paradigm where the NT Kernel, executing in Ring 0, now runs below the Secure Kernel, at Ring ~0 (called Virtual Trust Level 1).\n* [Youtube Video: Windows IT Pro - Sysinternals Overview (Microsoft, tools, utilities, demos)](https://www.youtube.com/watch?v=6RqFPrCcWfY) -\u003e Learn about the tools that security, developer, and IT professionals rely on to analyze, diagnose, troubleshoot, and optimize Windows from creator Mark Russinovich. Find out which utilities will help you optimize any Windows system's reliability, efficiency, performance, and security.\n* [Youtube Video: DotNext - Pavel Yosifovich, Windows 10 internals for .NET developers](https://www.youtube.com/watch?v=h6BXMcRqYhA) -\u003e The .NET Framework provides some level of abstraction over the Windows OS, but understanding the way Windows works can make you a better .NET developer. Windows 10 is progressing at a faster cadence than in the past. Some of its features are not exposed to .NET developers directly.\n* [Youtube Video: REcon 2019 - The Last Generic Win32K KASLR Defeat in Windows](https://www.youtube.com/watch?v=PTnuwchEci0) -\u003e This talk will describe the final mistake that Microsoft made when 'fixing' the shared heap (desktop heap and session heap) structures that are shared by User and GDI objects in Win32k.sys, which have leaked kernel pointers for over 2 decades to user-mode. I will cover how existing techniques were broken in Fall Creator's Update (RS4), and how this build, and the subsequent (RS5 and 19H1) had a critical implementation flaw which still made KASLR bypasses possible.\n* [Youtube Video: TryHackMe - Windows Internals](https://www.youtube.com/watch?v=k7UDasbkLJw) -\u003e In this video, we begin working through the \"Host Evasion\" module on TryHackMe which is part of the Red Team path.\n\n\n\u003cdiv id='windows-kernel-structures'/\u003e\n\n### ***Structures***\n\nLearn about the opaque structures of Windows, the core code of the kernel.\n\n* [Web CodeMachine: Windows kernel data structures](https://codemachine.com/articles/kernel_structures.html) -\u003e Catalog of key Windows kernel data structures.\n* [Web Vergilius Project: Windows kernel](https://www.vergiliusproject.com/) -\u003e Take a look into the depths of Windows kernels and reveal more than 60000 undocumented structures.\n* [Web Geoff Chappell: Windows kernel](https://www.geoffchappell.com/) -\u003e Because kernel-mode programming, e.g., of device drivers and file system filter drivers, is the commercial specialty that funded this website's early development as a free public resource, it could not easily itself be a subject for the free public resource. Not until 2016 did it start getting serious attention at this website, not even to publish old notes whose commercial value had long passed. Now, however, the Kernel study is well on its way to becoming a resource to reckon with for the functions and structures exposed by the kernel and the HAL.\n* [Web ReactOS](https://www.geoffchappell.com/) -\u003e Imagine running your favorite Windows applications and drivers in an open-source environment you can trust. That's the mission of ReactOS!\n\n\n\u003cdiv id='windows-kernel-debugging'/\u003e\n\n### ***Debugging***\n\nAnalyze and debug critical structures along with the entire kernel.\n\n\n\u003cdiv id='windows-kernel-debugging-basics'/\u003e\n\n#### ***Basics***\n\nDebug the Windows OS.\n\n* [Web Microsoft: WinDbg](https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/) -\u003e WinDbg is a debugger that can be used to analyze crash dumps, debug live user-mode and kernel-mode code, and examine CPU registers and memory.\n* [Web WinDbg Org](http://windbg.org/) -\u003e WinDbg Quick Links, Extensions, Scripts.\n* [Web Microsoft: Setting Up Kernel-Mode Debugging](https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/setting-up-kernel-mode-debugging-in-windbg--cdb--or-ntsd) -\u003e How to start debugging Windows kernel.\n* [Web Microsoft: Local Kernel-Mode Debugging](https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/performing-local-kernel-debugging) -\u003e Debugging Tools for Windows supports local kernel debugging. This is kernel-mode debugging on a single computer. In other words, the debugger runs on the same computer that is being debugged.\n* [Web Microsoft: Remote Debugging Using WinDbg](https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/remote-debugging-using-windbg) -\u003e Remote debugging involves two debuggers running at two different locations. The debugger that performs the debugging is called the debugging server. The second debugger, called the debugging client, controls the debugging session from a remote location. To establish a remote session, you must set up the debugging server first and then activate the debugging client.\n* [Github: Modern Debugging with WinDbg Preview DEFCON 27 workshop](https://github.com/hugsy/defcon_27_windbg_workshop) -\u003e It's 2019 and yet too many Windows developers and hackers alike rely on (useful but rather) old school tools for debugging Windows binaries (OllyDbg, Immunity Debugger). What they don't realize is that they are missing out on invaluable tools and functionalities that come with Microsoft newest WinDbg Preview edition. This hands-on workshop will attempt to level the field, by practically showing how WinDbg has changed to a point where it should be the first tool to be installed on any Windows (10) for binary analysis machine: after a brief intro to the most basic (legacy) commands, this workshop will focus around debugging modern software (vulnerability exploitation, malware reversing, DKOM-based rootkit, JS engine) using modern techniques provided by WinDbg Preview (spoiler alert to name a few, JavaScript, LINQ, TTD).\n* [Web Microsoft: Reading and Filtering Debugging Messages](https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/reading-and-filtering-debugging-messages) -\u003e The DbgPrintEx, vDbgPrintEx, vDbgPrintExWithPrefix, and KdPrintEx routines send a message to the kernel debugger under conditions that you specify. This procedure enables you to filter out low-priority messages.\n* [Web CodeMachine: WinDBG quick start tutorial](https://codemachine.com/articles/windbg_quickstart.html) -\u003e This post goes over the important commands in WinDBG through a step-by-step follow-along style walkthrough to help you get a jump start into using WinDBG and getting familiar with the commonly used commands.\n* [Web WinDbg Info: Common WinDbg Commands](http://windbg.info/doc/1-common-cmds.html) -\u003e Common WinDbg Commands thematically grouped by Robert Kuster.\n\n\n\u003cdiv id='windows-kernel-debugging-basics'/\u003e\n\n#### ***Commands***\n\nKey commands to use in the official Microsoft debugger, WinDbg.\n\n* [Web Microsoft: lm (List Loaded Modules)](https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/lm--list-loaded-modules-) -\u003e The lm command displays the specified loaded modules. The output includes the status and the path of the module.\n* [Web Microsoft: x (Examine Symbols)](https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/x--examine-symbols-) -\u003e The x command displays the symbols in all contexts that match the specified pattern.\n* [Web Microsoft: !process](https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-process) -\u003e The !process extension displays information about the specified process, or about all processes, including the EPROCESS block. This extension can be used only during kernel-mode debugging.\n* [Web Microsoft: .block](https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-block) -\u003e The .block token performs no action; it is used solely to introduce a block of statements.\n* [Web Microsoft: .if](https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-if) -\u003e The .if token behaves like the if keyword in C.\n* [Web Microsoft: .for](https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-for) -\u003e The .for token behaves like the for keyword in C, except that multiple increment commands must be separated by semicolons, not by commas.\n* [Web Microsoft: .while](https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-while) -\u003e The .while token behaves like the while keyword in C.\n* [Web Microsoft: .printf](https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/-printf) -\u003e The .printf token behaves like the printf statement in C.\n* [Web Microsoft: dt (Display Type)](https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/dt--display-type-) -\u003e The dt command displays information about a local variable, global variable or data type. This can display information about simple data types, as well as structures and unions.\n* [Web Microsoft: d, da, db, dc, dd, dD, df, dp, dq, du, dw (Display Memory)](https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/d--da--db--dc--dd--dd--df--dp--dq--du--dw--dw--dyb--dyd--display-memor) -\u003e The d* commands display the contents of memory in the given range.\n* [Web Microsoft: e, ea, eb, ed, eD, ef, ep, eq, eu, ew, eza (Enter Values)](https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/e--ea--eb--ed--ed--ef--ep--eq--eu--ew--eza--ezu--enter-values-) -\u003e The *e* commands enter into memory the values that you specify.\n* [Web Microsoft: bp, bu, bm (Set Breakpoint)](https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/bp--bu--bm--set-breakpoint-) -\u003e The bp, bu, and bm commands set one or more software breakpoints. You can combine locations, conditions, and options to set different kinds of software breakpoints.\n* [Web Microsoft: u, ub, uu (Unassemble)](https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/u--unassemble-) -\u003e The u* commands display an assembly translation of the specified program code in memory.\n\n\n\u003cdiv id='windows-kernel-debugging-scripting'/\u003e\n\n#### ***Scripting***\n\nCreate a script to automate the debugging process.\n\n\n\u003cdiv id='windows-kernel-debugging-scripting-classic'/\u003e\n\n##### ***Classic***\n\n* [Web Microsoft: Debugger Commands](https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/debugger-commands) -\u003e WinDbg Scripting.\n* [Web Microsoft: \\$\u003c, \\$\u003e\u003c, \\$$\u003c, \\$$\u003e\u003c, \\$$ \u003ea\u003c (Run Script File)](https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/debugger-commands) -\u003e The \\$\u003c, \\$\u003e\u003c, \\$$\u003c, \\$$\u003e\u003c, and \\$$\u003ea\u003c commands read the contents of the specified script file and use its contents as debugger command input.\n* [Web KeySight: Debugging Malware with WinDbg](https://www.keysight.com/blogs/tech/nwvs/2020/07/27/debugging-malware-with-windbg) -\u003e We present practical techniques for finding information you may be interested in by stepping through a Locky Ransomware Sample using WinDbg. WinDbg is the debugger of choice by Microsoft, so it should be for us too.\n* [Web DumpAnalysis: Introduction to WinDbg Scripts for C/C++ Users](https://www.dumpanalysis.org/WCDA/WCDA-Sample-Chapter.pdf) -\u003e All debuggers from Debugging Tools for Windows package use the same engine dbgeng.dll. It contains a script interpreter for a special language we call WinDbg scripting language for convenience and we use WDS file extension for WinDbg script files.\n* [Github: WinDbg_Scripts](https://github.com/yardenshafir/WinDbg_Scripts) -\u003e Useful scripts for WinDbg using the debugger data model.\n\n\n\u003cdiv id='windows-kernel-debugging-scripting-javascript'/\u003e\n\n##### ***JavaScript***\n\n* [Web Microsoft: JavaScript Debugger Scripting](https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/javascript-debugger-scripting) -\u003e This topic describes how to use JavaScript to create scripts that understand debugger objects and extend and customize the capabilities of the debugger.\n* [Web Microsoft: Microsoft Github Repo Example Scripts](https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/javascript-debugger-example-scripts) -\u003e This is a collection of extensions and sample scripts for extending WinDbg. We'll be adding more samples and extensions over time.\n* [Github: WinDbg-Scripts](https://github.com/0vercl0k/windbg-scripts) -\u003e A bunch of JavaScript extensions for WinDbg.\n* [GitHub: WinDbg JavaScript Scripts](https://github.com/hugsy/windbg_js_scripts) -\u003e Toy scripts for playing with WinDbg JS API.\n* [GitHub: KasperskyLab - JS scripts for WinDbg](https://github.com/KasperskyLab/WinDbg-JS-Scripts) -\u003e This is a collection of WinDbg JS scripts useful for dumps analysis.\n\n\n\u003cdiv id='windows-kernel-debugging-scripting-python'/\u003e\n\n##### ***Python***\n\n* [Web PyPI: PYKD](https://pypi.org/project/pykd/) -\u003e Python Extension for WinDbg.\n* [Blog: PYKD Tutorial Part 1](https://rayanfam.com/topics/pykd-tutorial-part1/) -\u003e Using windbg script syntax is such annoying thing that almost all reverse engineers have problems dealing with it but automating debugging gives such a power that can't be easily ignored. A good solution to solve this problem is using the power and simplicity of Python and Windbg together.\n* [Blog: PYKD Tutorial Part 2](https://rayanfam.com/topics/pykd-tutorial-part2/) -\u003e Using windbg script syntax is such annoying thing that almost all reverse engineers have problems dealing with it but automating debugging gives such a power that can't be easily ignored. A good solution to solve this problem is using the power and simplicity of Python and Windbg together.\n\n\n\u003cdiv id='windows-kernel-debugging-scripting-powershell'/\u003e\n\n##### ***PowerShell***\n\n* [Web PowerShell Gallery: WinDbg](https://www.powershellgallery.com/packages/WinDbg/1.0) -\u003e Module for automation of Windows Debugging.\n* [Blog: Scripting WinDbg with PowerShell](https://www.leeholmes.com/scripting-windbg-with-powershell/) -\u003e A while back, Roberto Farah published a script library to help control WinDbg through PowerShell. I've been using WinDbg for more debugging lately, and decided (after following one to many object references by hand) that I needed to script my investigations.\n\n\n\u003cdiv id='windows-kernel-debugging-scripting-extensions'/\u003e\n\n##### ***Extensions***\n\n* [GitHub: Awesome WinDbg Extensions](https://github.com/anhkgg/awesome-windbg-extensions)\n* [Github: WDBGARK](https://github.com/swwwolf/wdbgark) -\u003e WinDBG Anti-RootKit extension.\n* [Github: SwishDbgExt](https://github.com/comaeio/SwishDbgExt) -\u003e Incident Response Debugging Extension.\n* [Youtube Video: Creating our first WinDbg extension from scratch](https://www.youtube.com/watch?v=d1uT8tmnhZI) -\u003e In this video I create my very first native WinDbg extension, ever.\n* [Youtube Video: Extend WinDbg to build your own dream debugging tool](https://www.youtube.com/watch?v=tSlFd0CIo0g) -\u003e It's the beginning of a new era. After all those years, Microsoft has finally done what we stopped hoping for: WinDbg has been updated with a brand new UI! Past the \"wow!\" effect, it looks like many of the old WinDbg flaws are still there: a single command window, no history, limited scripting… But fear not, for something has changed: WinDbg now provides a number of extension points (undocumented at this time) that can be used to fully customize the UI and drive the debugging engine. It's up to us to turn this application into our own dream debugging tool!\n\n\n\u003cdiv id='windows-kernel-security'/\u003e\n\n### ***Protection Mechanisms***\n\nHow the core of Windows is secured.\n\n\n\u003cdiv id='windows-kernel-security-dse'/\u003e\n\n#### ***Driver Signature Enforcement (DSE)***\n\nPrevent the use of unsigned drivers.\n\n\n\u003cdiv id='windows-kernel-security-dse-basics'/\u003e\n\n##### ***Basics***\n\n* [Web Microsoft: Signing a Driver](https://learn.microsoft.com/en-us/windows-hardware/drivers/develop/signing-a-driver) -\u003e All drivers running on 64-bit versions of Windows must be signed before Windows will load them. However, driver signing is not required on 32-bit versions of Windows. In order to sign a driver, a certificate is required. You can create your own certificate to sign your driver with during development and testing. However, for a public release you must sign your driver with a certificate issued by a trusted root authority.\n* [Web Microsoft: Introduction to Test-Signing](https://learn.microsoft.com/en-us/windows-hardware/drivers/install/introduction-to-test-signing) -\u003e Drivers should be test-signed with a digital signature during development and test for the following reasons: To facilitate and automate installation, To be able to load kernel-mode drivers on 64-bit versions of Windows Vista and later versions of Windows, To play back certain types of next-generation premium content, all kernel-mode components in Windows Vista and later versions of Windows must be signed.\n* [Web Driver Easy: Disable Driver Signature Enforcement on Windows 10 Easily!](https://www.drivereasy.com/knowledge/disable-driver-signature-enforcement-windows-10-easily/) -\u003e On Windows 8 and Windows 10 (64-bit), Microsoft has included a feature, driver signature enforcement. It is a feature that is designed to ensure that users of Microsoft can only load drivers that have been signed by Microsoft.\n* [Web Make Use Of: How to Disable Driver Signature Enforcement and Install Unsigned Drivers on Windows](https://www.makeuseof.com/disable-driver-signature-enforcement-windows/) -\u003e Sometimes, Windows will block you from installing an unsigned driver, which is a driver you've downloaded elsewhere other than through a Windows Update or the device manufacturer's website. But if you need the driver, and you know it is perfectly safe, you can turn off driver signature enforcement and let it through.\n* [Web How To Geek: How to Disable Driver Signature Verification on 64-Bit Windows 8 or 10](https://www.howtogeek.com/167723/how-to-disable-driver-signature-verification-on-64-bit-windows-8.1-so-that-you-can-install-unsigned-drivers/) -\u003e 64-bit versions of Windows 10 and 8 include a \"driver signature enforcement\" feature. They'll only load drivers that have been signed by Microsoft. To install less-than-official drivers, old unsigned drivers, or drivers you're developing yourself, you'll need to disable driver signature enforcement.\n\n\n\u003cdiv id='windows-kernel-security-dse-bypasses'/\u003e\n\n##### ***Bypasses***\n\n* [Web Code Project: Disable Driver Signature Enforcement with DSE-Patcher](https://www.codeproject.com/Articles/5348168/Disable-Driver-Signature-Enforcement-with-DSE-Patc) -\u003e Driver Signature Enforcement (DSE) was introduced by Microsoft starting with Windows Vista x64. DSE is a security feature of the operating system, which ensures that only valid signed drivers are loaded. To install unsigned drivers, the DSE security feature has to be disabled. DSE-Patcher can be used to disable DSE on all 64-bit operating systems starting with Windows Vista and later. We developed DSE-Patcher to show the interested coder how easy it is to use known vulnerabilities and change memory in kernel address space.\n* [Web Fortinet: The Swan Song for Driver Signature Enforcement Tampering](https://www.fortinet.com/blog/threat-research/driver-signature-enforcement-tampering) -\u003e Code Integrity is a threat protection feature first introduced by Microsoft over 15 years ago. On x64-based versions of Windows, kernel-mode drivers must be digitally signed and checked each time they are loaded into memory. This is also referred to as Driver Signature Enforcement (DSE).\n* [Blog: The dusk of g_CiOptions: circumventing DSE with VBS enabled](blog.cryptoplague.net/main/research/windows-research/the-dusk-of-g_cioptions-circumventing-dse-with-vbs-enabled) -\u003e In this article, we will explore the concept of bypassing Driver Signature Enforcement (DSE) in the Virtualization Based Security (VBS) era with only a write-what-where exploit primitive.\n* [Blog: Offset-free DSE bypass across Windows 11 \u0026 10: utilising ntkrnlmp.pdb](https://blog.cryptoplague.net/main/research/windows-research/offset-free-dse-bypass-across-windows-11-and-10-utilising-ntkrnlmp.pdb) -\u003e Parsing ntkrnlmp.pdb on the target to eliminate the need for static offsetting and thus safely and dynamically bypassing driver signature enforcement across multiple Windows 10 \u0026 11 versions.\n* [Blog: g_CiOptions in a Virtualized World](https://blog.xpnsec.com/gcioptions-in-a-virtualized-world/) -\u003e In this post we will look at a common technique used to disable driver signing enforcement, how VBS has attempted to stop attackers from exploiting this, and how when not partnered with HVCI, just how easy it is to bypass this security control.\n* [Github: DisableDSE](https://github.com/rogxo/DisableDSE) -\u003e A method to Disable DSE using .data ptr hooks.\n* [Github: DSE Hook](https://github.com/emlinhax/dse_hook) -\u003e Load unsigned kernel-driver by patching dse in 248 lines. This project abuses a vulnerable driver called \"winio64.sys\".\n* [Github: DSE \u0026 PG bypass via BYOVD attack](https://github.com/4l3x777/dse_pg_bypass)\n* [Github: PastDSE](https://github.com/utoni/PastDSE) -\u003e It is a Driver Sign Enforcement \"bypass\" using a leaked EV code signing certificate. It is actually not a real bypass since it does only change the date to 01-01-2014 before signing the driver and restores it afterwards. The Kernel driver loader will accept all driver images as long as the code was signed by a extended validation code signing certificate which was not revoked.\n* [Github: Gigabyte Disable DSE](https://github.com/cygnosic/Gigabyte_Disable_DSE) -\u003e Code to disable DSE (Driver Signature Enforcement) using vulnerable gigabyte driver.\n\n\n\u003cdiv id='windows-kernel-security-vbs'/\u003e\n\n#### ***Virtualization Based Security (VBS)***\n\nAssume the kernel can be compromised and create an isolated virtual environment.\n\n\n\u003cdiv id='windows-kernel-security-vbs-basics'/\u003e\n\n##### ***Basics***\n\n* [Web Microsoft: Virtualization-based Security (VBS)](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs) -\u003e Virtualization-based security, or VBS, uses hardware virtualization and the Windows hypervisor to create an isolated virtual environment that becomes the root of trust of the OS that assumes the kernel can be compromised. Windows uses this isolated environment to host a number of security solutions, providing them with greatly increased protection from vulnerabilities in the operating system, and preventing the use of malicious exploits which attempt to defeat protections. VBS enforces restrictions to protect vital system and operating system resources, or to protect security assets such as authenticated user credentials.\n\n\n\u003cdiv id='windows-kernel-security-vbs-videos'/\u003e\n\n##### ***Videos***\n\n* [Presentation: BlackHat USA 2016: Analysis of the Attack Surface of Windows 10 Virtualization-Based Security](https://www.blackhat.com/docs/us-16/materials/us-16-Wojtczuk-Analysis-Of-The-Attack-Surface-Of-Windows-10-Virtualization-Based-Security.pdf)\n* [Youtube Video: BlackHat USA 2016: Analysis of the Attack Surface of Windows 10 Virtualization-Based Security](https://www.youtube.com/watch?v=_646Gmr_uo0) -\u003e In Windows 10, Microsoft introduced virtualization-based security (VBS), the set of security solutions based on a hypervisor. In this presentation, we will talk about details of VBS implementation and assess the attack surface - it is very different from other virtualization solutions. We will focus on the potential issues resulting from the underlying platform complexity (UEFI firmware being a primary example).\n* [Youtube Video: BSidesKC 2022 - No Code Execution? No Problem! - Living The Age of Virtualization-Based Security](https://www.youtube.com/watch?v=OBreVsVK-L8) -\u003e Windows 11 saw the default enablement of some of the most powerful exploit mitigations on the market - many of them falling under the purview of Virtualization-Based Security, or VBS. These exploit mitigations are instrumented through Microsoft's hypervisor, Hyper-V, which provides a \"higher root of trust\" than the Windows kernel itself. With the advent of the default enablement of these mitigations - simply put - the \"old\" way of doing things won't suffice when it comes to kernel exploitation. Hypervisor-Protected Code Integrity (HVCI), one of these hypervisor-based mitigations, works by outright preventing any malicious, unsigned shellcode from running within the Windows kernel. Does this now mean \"game over\" for attackers? This talk investigates how these new, modern mitigations work and how today's attackers must and can adapt to the new bar set by these exploit mitigations.\n\n\n#### ***Kernel Patch Protection (KPP) / PatchGuard***\n\nPrevent alterations to critical components and structures.\n\n\n\u003cdiv id='windows-kernel-security-kpp-basics'/\u003e\n\n##### ***Basics***\n\n* [Web Windows-Internals: Secure Kernel Patch Guard - SKPG Initialization](https://windows-internals.com/hyperguard-secure-kernel-patch-guard-part-1-skpg-initialization/) -\u003e This first part will focus on what SKPG is and how it's being initialized.\n* [Web Windows-Internals: Secure Kernel Patch Guard - SKPG Extents](https://windows-internals.com/hyperguard-secure-kernel-patch-guard-part-2-skpg-extents/) -\u003e This part will start describing the data structure and components of SKPG, and more specifically the way it's activated.\n* [Demystifying PatchGuard: An In-Depth Analysis Through Practical Engineering](https://web.archive.org/web/20230510133129/https://zerocondition.com/posts/demystifying-patchguard/) -\u003e The presence of PatchGuard in the 64-bit Windows operating system is a remarkable security measure that thwarts the efforts of kernel-level rootkits and other malware to manipulate critical system code and structures. Its method of operation is through regular monitoring of the kernel to identify any illicit modifications and counteracting them without delay.\n\n\n\u003cdiv id='windows-kernel-security-kpp-videos'/\u003e\n\n##### ***Videos***\n\n* [Youtube Video: RSA Conference - Windows Kernel Patch Protection](https://www.youtube.com/watch?v=wXRLnp2JoWU) -\u003e This session will look at a critical flaw in the design of Windows Kernel Patch Protection (PatchGuard), a system used to prevent modification to kernel code and other critical structure. The design of PatchGuard will be discussed, along with the design of an attack which uses the flaw in PatchGuard to disable the PatchGuard response entirely.\n\n\n\u003cdiv id='windows-kernel-security-kpp-bypasses'/\u003e\n\n##### ***Bypasses***\n\n* [Web Uninformed: Bypassing Patchguard on Windows](https://web.archive.org/web/20160817134601/http://uninformed.org/index.cgi?v=3\u0026a","projects_url":"https://awesome.ecosyste.ms/api/v1/lists/themalwareguardian%2Fawesome-bootkits-rootkits-development/projects"}