Awesome-Bootkits-Rootkits-Development
A curated compilation of extensive resources dedicated to bootkit and rootkit development.
https://github.com/TheMalwareGuardian/Awesome-Bootkits-Rootkits-Development
Last synced: 5 days ago
JSON representation
-
***BIOS UEFI***
-
***Basics***
- Web Wikipedia: Booting - > In computing, booting is the process of starting a computer as initiated via hardware such as a button on the computer or by a software command
- Web OsDev: UEFI - > UEFI is a specification for x86, x86-64, ARM, and Itanium platforms that defines a software interface between the operating system and the platform firmware/BIOS.
- Blog: Programming for EFI - > Tech-savvy individuals know the Extensible Firmware Interface (EFI) and its newer variant, the Unified EFI (UEFI) as a replacement for the older Basic Input/Output System (BIOS) on PCs and other computers. What you may not be aware of is that EFI is a complex software environment, comparable in size and features to a simple OS such as DOS. As such, EFI can host a variety of programs—but those programs can't spring into existence fully-formed, like Athena from Zeus' head. Rather, they must be written by individuals.
-
***Specifications***
- Web UEFI: Specifications - > Unified Extensible Firmware Interface Forum.
- Web UEFI: UEFI Specification Version 2.11 - > This Unified Extensible Firmware Interface (UEFI) Specification describes an interface between the operating system (OS) and the platform firmware.
- Web UEFI: UEFI Shell Specification Version 2.2
- Web UEFI: UEFI Platform Initialization Specification 1.9 - > This specification defines the core code and services that are required for an implementation of the Pre-EFI Initialization (PEI) phase of the Platform Initialization (PI) specifications (hereafter referred to as the "PI Architecture").
-
***Tools***
- Github: UEFITool - UEFI firmware image viewer and editor - > UEFITool is a cross-platform open source application written in C++/Qt, that parses UEFI-compatible firmware image into a tree structure, verifies image's integrity and provides a GUI to manipulate image's elements. Project development started in the middle of 2013 because of the lack of cross-platform open source utilities for tinkering with UEFI images.
- Github: CHIPSEC - Platform Security Assessment Framework - > CHIPSEC is a framework for analyzing the security of PC platforms including hardware, system firmware (BIOS/UEFI), and platform components. It includes a security test suite, tools for accessing various low level interfaces, and forensic capabilities. It can be run on Windows, Linux, Mac OS X and UEFI shell. Instructions for installing and using CHIPSEC can be found in the manual.
- Github: CHIPSEC - Training, Writing Modules & Tools
- Presentation: CHIPSEC - BlackHat USA 2014
- Github: UEFI Firmware Parser - > The UEFI firmware parser is a simple module and set of scripts for parsing, extracting, and recreating UEFI firmware volumes. This includes parsing modules for BIOS, OptionROM, Intel ME and other formats too.
- Github: FwHunt Community Scanner - > Tools for analyzing UEFI firmware and checking UEFI modules with FwHunt rules.
- Github: FwHunt Rules - > The Binarly Firmware Hunt (FwHunt) rule format was designed to scan for known vulnerabilities in UEFI firmware.
- Github: Kraft Dinner - > Tool to dump UEFI runtime drivers implementing runtime services for Windows.
- Github: Flashrom - > It is a utility for detecting, reading, writing, verifying and erasing flash chips. It is often used to flash BIOS/EFI/coreboot/firmware images in-system using a supported mainboard, but it also supports flashing of network cards (NICs), SATA controller cards, and other external devices which can program flash chips.
- Web Ghidra SRE: Software Reverse Engineering framework - > A software reverse engineering (SRE) suite of tools developed by NSA's Research Directorate in support of the Cybersecurity mission
- Web Hex Rays: IDA Free - > This (completely!) free version of IDA offers a privilege opportunity to see IDA in action. This light but powerful tool can quickly analyze the binary code samples and users can save and look closer at the analysis results.
-
***Videos***
- Youtube Video: BIOS and UEFI As Fast As Possible - > What fundamental things does a computer BIOS do, and what are the important differences between the traditional BIOS and the newer UEFI?
- Youtube Video: BIOS, CMOS, UEFI - > This video explains the difference between the BIOS, CMOS, and UEFI. It also explains what the purpose of the CMOS battery. What is the BIOS? What is UEFI? What is CMOS?
- Youtube Video: PC BIOS Settings - > BIOS / UEFI settings, including boot options, secure boot, enabling XMP memory profiles, and BIOS passwords. Also information on the differences between a legacy BIOS and a UEFI BIOS, and how to enter the BIOS.
- Youtube Video: ThatOsDev - EFI based Bootloader - > EFI Explained.
- Youtube Video: UEFIForum - Best Practices for UEFI Secure Boot Customization - > UEFI Secure Boot helps provide an effective defense against boot malware, but following today's best practices in its implementation, deployment and configurability can help its increase its effectiveness against increasingly sophisticated exploits.
- Youtube Video: Techsavvy - Mastering UEFI, Your Essential Guide to Hardware-Firmware and Boot-Chain Security - > This comprehensive guide breaks down the essentials of UEFI, exploring its functionality, the significance of SPI flash, and the various boot phases. We'll compare open-source and proprietary firmware solutions like Phoenix and AMI, and address the ongoing challenges vendors face against malicious software.
-
***Vulnerabilities***
- Presentation: BlackHat USA 2009 - Attacking Intel Bios
- Youtube Video: BlackHat USA 2009 - Attacking Intel Bios - > We demonstrate how to permanently reflash Intel BIOSes on the latest Intel Q45-based systems. In contrast to a previous work done by other researches a few months earlier, who targeted totally unprotected low-end BIOSes, we focus on how to permanently reflash one of the most secure BIOSes out there, that normally only allow a vendor's digitally signed firmware to be flashed.
- Presentation: REcon 2015 - Attacking and Defending BIOS
- Youtube Video: REcon 2015 - Attacking and Defending BIOS - > In this presentation we will demonstrate multiple types of recently discovered BIOS vulnerabilities. We will detail how hardware configuration is restored upon resume from sleep and how BIOS can be attacked when waking up from sleep using "S3 resume boot script" vulnerabilities. Similarly, we will discuss the impact of insufficient protection of persistent configuration data in non-volatile storage and more.
- Presentation: Defcon 22 - Summary of Attacks Against BIOS
- Youtube Video: Defcon 22 - Summary of Attacks Against BIOS - > A variety of attacks targeting platform firmware have been discussed publicly, drawing attention to the pre-boot and firmware components of the platform such as secure boot, OS loaders, and SMM. Windows 8 Secure Boot provides an important protection against bootkits by enforcing a signature check on each boot component.
- Presentation: BlackHat Europe 2014 - Analyzing UEFI BIOSes from Attacker & Defender Viewpoints
- Youtube Video: BlackHat Europe 2014 - Analyzing UEFI BIOSes from Attacker & Defender Viewpoints - > In 2013, MITRE released Copernicus 1, a best-effort system to capture a raw dump of the BIOS and whether it appears to be possible for an attacker to write to it. In 2014, we released Copernicus 2 to combat the ability of an attacker to subvert not just Copernicus 1, but all other BIOS capture systems. While these free tools are a good way to get a copy of your BIOS, analyzing it to detect malicious changes is still an open problem in need of further investigation before defenders can feel confident that they have un-infected BIOS. You can't just compare the MD5s from two BIOS dumps and get a valid comparison. This is a problem that leads to firmware-level malware going under-reported and under-analyzed due to not enough people with the background to jump into this area.
- Presentation: BlackHat USA 2017 - Betraying the BIOS, Where the Guardians of the BIOS are Failing
- Youtube Video: BlackHat USA 2017 - Betraying the BIOS, Where the Guardians of the BIOS are Failing - > For UEFI firmware, the barbarians are at the gate -- and the gate is open. On the one hand, well-intentioned researchers are increasingly active in the UEFI security space; on the other hand, so are attackers. Information about UEFI implants -- by HackingTeam and state-sponsored actors alike -- hints at the magnitude of the problem, but are these isolated incidents, or are they indicative of a more dire lapse in security?
- Presentation: BlackHat USA 2017 - Firmware is the New Black, Analyzing Past Three Years of BIOS/UEFI Security Vulnerabilities
- Youtube Video: BlackHat USA 2017 - Firmware is the New Black, Analyzing Past Three Years of BIOS/UEFI Security Vulnerabilities - > In recent years, we witnessed the rise of firmware-related vulnerabilities, likely a direct result of increasing adoption of exploit mitigations in major/widespread operating systems - including for mobile phones.
- Presentation: BlackHat Europe 2023 - LogoFAIL, Security Implications of Image Parsing During System Boot
- Youtube Video: BlackHat Europe 2023 - LogoFAIL, Security Implications of Image Parsing During System Boot - > Enter LogoFAIL, our latest research revealing significant security vulnerabilities in the image parsing libraries used by nearly all BIOS vendors to display logo images during boot. Our research highlights the risks associated with parsing complex file formats at such a delicate stage of the platform startup. During this talk, we will show how some UEFI BIOSes allow attackers to store custom logo images, which are parsed during boot, on the EFI system partition (ESP) or inside unsigned sections of a firmware update. We also shed light on the implications of these vulnerabilities, which extend beyond mere graphical rendering. In fact, successful exploitation of these vulnerabilities allows attackers to hijack the execution flow and achieve arbitrary code execution. LogoFAIL vulnerabilities can compromise the security of the entire system rendering "below-the-OS" security measures completely ineffective (e.g., Secure Boot). Finally, our talk will include a detailed explanation of how we successfully escalate privileges from OS to firmware level by exploiting a real device vulnerable to LogoFAIL...
- Presentation: BlackHat Europe 2020 - efiXplorer, Hunting for UEFI Firmware Vulnerabilities at Scale with Automated Static Analysis
- Youtube Video: BlackHat Europe 2020 - efiXplorer, Hunting for UEFI Firmware Vulnerabilities at Scale with Automated Static Analysis - > Existing UEFI analysis instruments lack systemic approach to firmware vulnerability research focused on specifics of x86-based systems. No publicly known tools available for UEFI firmware vulnerabilities research focused on static analysis. Most of the common reversing tools focused on...
- Presentation: Coreboot 2017 - Exploring Your System Deeper with CHIPSEC is Not Naughty
- Youtube Video: Coreboot 2017 - Exploring Your System Deeper with CHIPSEC is Not Naughty - > You wanted to explore deep corners of your system but didn't know how? System boot firmware, ROMs on expansion cards, I/O devices and their firmware, microprocessors, embedded controllers, memory devices, low-level hardware interfaces, virtualization and hypervisors. You could discover if any of these have known vulnerabilities, configured insecurely or even discover new vulnerabilities and develop proof-of-concept exploits to test these vulnerabilities. Ultimately, you can verify security state of platform components of your system and how effective are the platform security defenses: hardware or virtualization based TEE, secure or trusted boot, firmware anti-tampering mechanisms, hypervisor based isolation... Or maybe you just want to explore hardware and firmware components your system has. CHIPSEC framework can help you with all of that. Since releasing it three years ago at CanSecWest 2014 significant improvements have been made in the framework - from making it easy to install and use to adding lots of new security capabilities. We'll go over certain representative examples of what you can do with it such as finding vulnerabilities in SMM firmware, analyzing UEFI firmware vulnerabilities, testing hardware security mechanisms of the hypervisors, finding backdoors in UEFI images and more.
- Web Rapid7: How To Hunt For UEFI Malware Using Velociraptor - > UEFI threats have historically been limited in number and mostly implemented by nation state actors as stealthy persistence. However, the recent proliferation of Black Lotus on the dark web, Trickbot enumeration module (late 2022), and Glupteba (November 2023) indicates that this historical trend may be changing.
- Github: Velociraptor - Endpoint visibility and collection tool - > Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language (VQL) queries.
- Web IEEXplore: Finding SMM Privilege-Escalation Vulnerabilities in UEFI Firmware with Protocol-Centric Static Analysis - > The Unified Extensible Firmware Interface (UEFI) provides a specification of the software interface between an OS and its underlying platform firmware. The runtime services provided are seemingly secure as they reside in System Management Mode (SMM) at ring -2, assuming a higher privilege than the OS kernel at ring 0. However, their software vulnerabilities are known to be exploitable to launch ring 0 to ring -2 privilege escalation, i.e., SMM privilege escalation attacks.In this paper, we introduce an effective static analysis framework for detecting SMM privilege escalation vulnerabilities in UEFI firmware. We present a systematic study of such vulnerabilities and identify their root causes as being two types of references that can escape from the SMRAM, legacy references and unintentional references.
- Web Binary Defense: Running Malware Below the OS, The State of UEFI Firmware Exploitation - > Usually when we think of malware infections, we think of malicious programs running on top of the operating system, usually Windows. These programs might use techniques like privilege escalation, running in memory only, injecting code into other processes, and obfuscating their code and activities. All of these techniques are used with the end goal of compromising a system, achieving persistence, and remaining undetected.
- Web SentinelLabs: Moving From Common-Sense Knowledge About UEFI To Actually Dumping UEFI Firmware
- Web SentinelLabs: Moving From Manual Reverse Engineering of UEFI Modules To Dynamic Emulation of UEFI Firmware
- Web SentinelLabs: Moving From Dynamic Emulation of UEFI Modules To Coverage-Guided Fuzzing of UEFI Firmware
- Web SentinelLabs: Adventures From UEFI Land: the Hunt For the S3 Boot Script
- Web Margin Research: Emulating and Exploiting UEFI Firmware - > Dynamically inspecting software becomes harder the lower the level of abstraction you go; while there are many resources for debugging userspace programs, there is less information out there for kernels, bootloaders, and system firmware.
- Github: One Bootloader to Load Them All, Mickey Shkatov and Jesse Michael - > One Bootloader to Load Them All - Research materials, Code , Etc. This repository contains as much information as possible to help in understanding the issues we found.
- Presentation: DEF CON 30 - One Bootloader to Load Them All, Mickey Shkatov and Jesse Michael
- Youtube Video: DEF CON 30 - One Bootloader to Load Them All, Mickey Shkatov and Jesse Michael - > Introduced in 2012, Secure Boot - the OG trust in boot - has become a foundational rock in modern computing and is used by millions of UEFI-enabled computers around the world due to its integration in their BIOS. The way Secure Boot works is simple and effective, by using tightly controlled code signing certificates, OEMs like Microsoft, Lenovo, Dell and others secure their boot process, blocking unsigned code from running during boot. But this model puts its trust in developers developing code without vulnerabilities or backdoors; in this presentation we will discuss past and current flaws in valid bootloaders, including some which misuse built-in features to inadvertently bypass Secure Boot. We will also discuss how in some cases malicious executables can hide from TPM measurements used by BitLocker and remote attestation mechanisms. Come join us as we dive deeper and explain how it all works, describe the vulnerabilities we found and walk you through how to use the new exploits and custom tools we created to allow for a consistent bypass for secure boot effective against every X86-64 UEFI platform.
- Web Basic Input/Output: Reverse Engineering UEFI with Ghidra - > Dynamically inspecting software becomes harder the lower the level of abstraction you go; while there are many resources for debugging userspace programs, there is less information out there for kernels, bootloaders, and system firmware.
-
***Windows Boot***
- Presentation: UEFI Plugfest - Windows Boot Environment - > High-level description of Windows boot process and Windows UEFI services usage.
- Web Microsoft: Secure boot - > Secure boot is a security standard developed by members of the PC industry to help make sure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM).
- Web Microsoft: Secure the Windows boot process - > Running Windows 10 or Windows 11 on a PC with Unified Extensible Firmware Interface (UEFI) support ensures that Trusted Boot safeguards your PC against malware right from the moment you power it on.
- Youtube Video: Boot Up with Confidence Windows 10/11 Secure Boot Demystified - > How secure boot works in Windows 10/11. Secure boot allows protection from "root-kit" attacks on both clients and servers.
- Youtube Video: Compare Windows 7 and Windows 8-10 boot process - > A comparison of the boot process of Windows 7 and Windows 8/10.
- Youtube Video: Boot Up with Confidence Windows 10/11 Secure Boot Demystified - > How secure boot works in Windows 10/11. Secure boot allows protection from "root-kit" attacks on both clients and servers.
-
-
***Books***
-
***Rootkits (Development)***
- Rootkits and Bootkits: Reversing Modern Malware and Next Generation Threats - Matrosov, A., Rodionov, E., & Bratus, S. - No Starch Press. (≈$45) - > Rootkits and Bootkits will teach you how to understand and counter sophisticated, advanced threats buried deep in a machine's boot process or UEFI firmware.
- Windows Internals - Russinovich, M., Solomon, D., Ionescu, A. & Yosifovich, P. - Microsoft Press. (Part 1: ≈$50, Part 2: ≈$50) - > Architecture and core internals of Windows.
- Windows Kernel Programming - Pavel Yosifovich. (≈$40) - > There is nothing like the power of the kernel in Windows - but how do you write kernel drivers to take advantage of that power? This book will show you how.The book describes software kernel drivers programming for Windows. These drivers don't deal with hardware, but rather the system itself: processes, threads, modules, Registry and more. Kernel code can monitor important events, preventing some from occurring if needed. Various filters can be written that can intercept calls that a driver may be interested in. The second edition expands on existing topics, and adds chapters on advanced programming techniques, and the Windows Filtering Platform.
- The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System - Blunden, B. - Jones & Bartlett Learning. (≈$100) - > While forensic analysis has proven to be a valuable investigative tool in the field of computer security, utilizing anti-forensic technology makes it possible to maintain a covert operational foothold for extended periods, even in a high-security environment. Adopting an approach that favors full disclosure, the updated Second Edition of The Rootkit Arsenal presents the most accessible, timely, and complete coverage of forensic countermeasures.
- Rootkits: Subverting the Windows Kernel - Hoglund, G., & Butler, J. - Addison-Wesley. (≈$50) - > It's imperative that everybody working in the field of cyber-security read this book to understand the growing threat of rootkits.
- Beyond BIOS: Developing with the Unified Extensible Firmware Interface - Marisetty, S., Rothman, M., & Zimmer, V. - Intel Press. (≈$70) - > This book provides an overview of modern boot firmware, including the Unified Extensible Firmware Interface (UEFI) and its associated EFI Developer Kit II (EDKII) firmware.
- Windows Security Internals: A Deep Dive into Windows Authentication, Authorization, and Auditing - James Forshaw - No Starch Press. (≈$50) - > This book provides an overview of modern boot firmware, including the Unified Extensible Firmware Interface (UEFI) and its associated EFI Developer Kit II (EDKII) firmware.
- Evading EDR: The Definitive Guide to Defeating Endpoint Detection Systems - Matt Hand - No Starch Press. (≈$50) - > EDR, demystified! Stay a step ahead of attackers with this comprehensive guide to understanding the attack-detection software running on Microsoft systems-and how to evade it.
-
-
***Bootkits***
-
***Analysis***
- Web WeLiveSecurity: BlackLotus UEFI bootkit - Myth confirmed - > The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality.
- Web Binarly: The Untold Story of the BlackLotus UEFI Bootkit - > My experience with the analysis and detection of rootkits and bootkits goes back more than 20 years. In the early 2000s, the main challenge was dealing with infected machines when rootkits and bootkits modified the operating system kernel to conceal malicious components. It was such a fun time reverse engineering advanced threats in the good old days that I co-wrote "Rootkits and Bootkits: Reversing Modern Malware and Next Generation Threats", a book full of the most interesting stories of our time going down the rabbit hole of advanced malware.
- Web WeLiveSecurity: UEFI threats moving to the ESP - Introducing ESPecter bootkit - > ESET research discovers a previously undocumented UEFI bootkit with roots going back all the way to at least 2012.
- Web Palo Alto: Diving Into Glupteba's UEFI Bootkit - > Glupteba is advanced, modular and multipurpose malware that, for over a decade, has mostly been seen in financially driven cybercrime operations. This article describes the infection chain of a new campaign that took place around November 2023. We will focus on one intriguing and previously undocumented feature: a Unified Extensible Firmware Interface (UEFI) bootkit.
- Web SecureList: FinSpy - Unseen findings - > FinSpy, also known as FinFisher or Wingbird, is an infamous surveillance toolset. Kaspersky has been tracking deployments of this spyware since 2011.
- Web SecureList: CosmicStrand - The discovery of a sophisticated UEFI firmware rootkit - > FinSpy, also known as FinFisher or Wingbird, is an infamous surveillance toolset. Kaspersky has been tracking deployments of this spyware since 2011.
- Web SecureList: MosaicRegressor - Lurking in the Shadows of UEFI - > UEFI has become a prominent technology that is embedded within designated chips on modern day computer systems. Replacing the legacy BIOS, it is typically used to facilitate the machine's boot sequence and load the operating system, while using a feature-rich environment to do so. At the same time, it has become the target of threat actors to carry out exceptionally persistent attacks.
- Web WeLiveSecurity: LoJax - First UEFI rootkit found in the wild, courtesy of the Sednit group - > ESET researchers have shown that the Sednit operators used different components of the LoJax malware to target a few government organizations in the Balkans as well as in Central and Eastern Europe.
- Web Twitter X: ESETresearch - Malicious EFI samples - > ESETresearch identified multiple malicious EFI bootloader samples. The malware displays a ransom message and prevents the computer from booting. It can compromise computers with disabled UEFI Secure Boot feature.
- Web VMWare: Detecting UEFI Bootkits in the Wild - > Threat actors are continually looking for ways to improve the persistence of their malware and implants. Bootkits, meaning rootkits running at the firmware level, have been utilized for this purpose. Once bootkits are installed, it can be extremely difficult to detect or remove versus OS-level rootkits as they are executed prior to the actual OS boot process.
- Web Binarly: UEFI Bootkit Hunting: In-Depth Search for Unique Code Behavior - > Firmware threats such as bootkits and implants have become increasingly prevalent due to their persistence and ability to evade detection compared to traditional OS-level malware. Attackers favor these threats because they can remain undetected even when conventional security measures are in place, especially if UEFI Secure Boot is disabled. Detecting unknown bootkits under these circumstances is a critical challenge in cybersecurity. Mostly, the publicly known UEFI implants and bootkits have been detected after successful deployment, which points to the limitations of the existing security solutions.
- Web WeLiveSecurity: Introducing HybridPetya: Petya/NotPetya copycat with UEFI Secure Boot bypass - > UEFI copycat of Petya/NotPetya exploiting CVE-2024-7344 discovered on VirusTotal.
-
***Basics***
- Web Kaspersky: Bootkit - > A bootkit is a malicious program designed to load as early as possible in the boot process, in order to control all stages of the operating system start up, modifying system code and drivers before anti-virus and other security components are loaded. The malicious program is loaded from the Master Boot Record (MBR) or boot sector. In effect, a bootkit is a rootkit that loads before the operating system.
- Web CrowdStrike: Bootkit - Definition, Prevention, and Removal - > A strong cybersecurity strategy should not only include reactive approaches to cyberattacks, but should also include proactive prevention methods for infections such as bootkit. Mitigating the consequences of a bootkit infection and removing the infection are valuable tools for your cybersecurity team. Bootkits are stealthy, and understanding how they work and how to combat them can help keep your business safe from threat actors.
- Web Positive Technologies: Bootkits: evolution and detection methods - > Bootkits were previously thought to exist mainly in proof-of-concept form, and not used in real attacks. However, only two years separated the appearance of the first PoC and the first bootkit attack.
-
***Source Code***
- Github: EfiGuard - > Portable x64 UEFI bootkit that patches the Windows boot manager, boot loader and kernel at boot time in order to disable PatchGuard and Driver Signature Enforcement (DSE).
- Github: BlackLotus - > An innovative UEFI Bootkit designed specifically for Windows. It incorporates a built-in Secure Boot bypass and Ring0/Kernel protection to safeguard against any attempts at removal. This software serves the purpose of functioning as an HTTP Loader.
- Github: DmaBackdoorBoot - > UEFI DXE driver intended for executing of kernel mode and user mode payloads under the Windows operating system by having an arbitrary code execution at early boot stage during DXE phase of the platform initialization.
- Github: Bootlicker - > A generic UEFI bootkit used to achieve initial usermode execution.
- Github: Bootkit Showcase - > Real-World Examples of Infrastructure Security Threats.
- Github: SandboxBootkit - > Bootkit tested on Windows Sandbox to patch ntoskrnl.exe and disable DSE/PatchGuard.
- Github: UEFI-Bootkit - > A small bootkit designed to use zero assembly.
- Github: PeiBackdoor - > This project implements early stage firmware backdoor for UEFI based firmware. It allows to execute arbitrary code written in C during Pre EFI Init (PEI) phase of Platform Initialization (PI).
- Github: Vector EDK - > EFI Development Kit.
- Github: Dreamboot - > UEFI bootkit.
- Github: UEFIBootkit - > Simple PoC for a bootkit written as a UEFI Option ROM Driver.
- Web Back Engineering: Voyager - A Hyper-V Hacking Framework For Windows 10 x64 (AMD & Intel) - > Voyager is a project designed to offer module injection and vmexit hooking for both AMD & Intel versions of Hyper-V. This project works on all versions of Windows 10-x64 (2004-1507).
- Github: Efi-Memory - PoC EFI runtime driver for memory r/w & kdmapper fork - > Efi-memory is a proof-of-concept EFI runtime driver for reading and writing to virtual memory. It uses EfiGuards method of hooking SetVariable to communicate with the user-mode process.
- Github: EFI Driver Access - > Efi Driver Access is a simply project to load a driver during system boot with the idea to give the user kernel access for read/write memory without restrictions.
- Github: BlackIris - > BlackIris is a full-scale, modular UEFI rootkit with physical memory mapping, runtime persistence, remote command control, file encryption, and a keyserver backend. It executes below the OS using real UEFI Runtime Services and survives Secure Boot bypass.
- Github: Calypso - > A lightweight UEFI Bootkit with user-mode communication.
- Github: Resilience - > Another UEFI bootkit that drops payload in RT phase of OS.
- Github: Insomnia - > UEFI Bootkit that infects kernel with backdoor using SSDT hook.
- Github: UEFI Rootkit - > Bachelor thesis about a UEFI Rookit communicating witht the TPM module in an effort to gain trusted information from the windows boot process.
- Github: SmmBackdoorNg - > Updated version of System Management Mode backdoor for UEFI based platforms.
-
***Videos***
- Presentation: BlackHat USA 2013 - Detecting OSX and Windows bootkits with RDFU
- Youtube Video: BlackHat USA 2013 - Detecting OSX and Windows bootkits with RDFU - > UEFI has recently become a very public target for rootkits and malware. To combat this new threat, we developed a Rootkit Detection Framework for UEFI ("RDFU") that incorporates a unified set of tools that address this problem across a wide spectrum of UEFI implementations.
- Presentation: HackInTheBox 2013 - Dreamboot
- Youtube Video: HackInTheBox 2013 - Dreamboot - > This presentation is a study of the overall architecture of UEFI from a security point of view with a focus on a bootkit implementation for Windows 8 x64 which exploits the UEFI firmware: Dreamboot. Dreamboot has two specific payloads: Privilege escalation and Windows local authentication bypass. DreamBoot comes in the form of a bootable ISO, to use preferably as part of a physical attack (i.e. when the attacker has physical access to the machine peripherals: DVD or USB ports). It is also fully functional in virtualized environments like VMWare Workstation or ESX.
- Paper: Virus Bulletin 2014 - Bootkits past, present & future
- Youtube Video: Virus Bulletin 2014 - Bootkits past, present & future - > Bootkit threats have always been a powerful weapon in the hands of cybercriminals, allowing them to establish persistent and stealthy presence in their victims' systems. The most recent notable spike in bootkit infections was associated with attacks on 64-bit versions of the Microsoft Windows platform, which restrict the loading of unsigned kernel-mode drivers. However, these bootkits aren't effective against UEFI-based platforms. So, are UEFI-based machines immune against bootkit threats (or would they be)?
- Paper: BlackHat USA 2014 - Exposing Bootkits with BIOS Emulation
- Youtube Video: BlackHat USA 2014 - Exposing Bootkits with BIOS Emulation - > Stealth and persistency are invaluable assets to an intruder. You cannot defend against what you cannot see. This talk discusses techniques to counter attempts at subverting modern security features, and regain control of compromised machines, by drilling down deep into internal structures of the operating system to battle the threat of bootkits.
- Youtube Video: Nullcon 2022 - A UEFI firmware bootkit in the wild - > Despite the advanced capabilities they provide, low-level implants such as bootkits and rootkits are only deployed by the most sophisticated attackers due to the risk they pose to the victim system's stability. In recent years, Kaspersky has however observed a number of new low-level malware, such as MosaicRegressor, MoonBounce, and the object of this talk, CosmicStrand.
- Presentation: RSA Conference - ESPecter, Showing the Future of UEFI Threats
- Youtube Video: RSA Conference - ESPecter, Showing the Future of UEFI Threats - > In recent years, it's become clear that UEFI threats are real and have been deployed in the wild. UEFI implants such as LoJax and MosaicRegressor have used the lowest level of persistence, SPI flash, but is it worth it? Actors behind ESPecter bootkit think that compromising the bootloader is the way. This session will explain why and how to protect against this and similar threats.
- Presentation: OffensiveCon18 - Alex Ionescu Advancing the State of UEFI Bootkits
- Youtube Video: OffensiveCon18 - Alex Ionescu Advancing the State of UEFI Bootkits - > Persistence in the Age of PatchGuard and Windows 10.
- Presentation: RSA Conference - UEFI Bootkits and Where UEFI Security Fails
- Youtube Video: RSA Conference - UEFI Bootkits and Where UEFI Security Fails - > The BlackLotus UEFI bootkit bypassed UEFI Secure Boot on Windows systems that were fully updated, by exploiting an old vulnerability that has been known and patched for over a year. How is that possible? Are there other such vulnerabilities? Join this session for a tour of UEFI threats, vulnerabilities, and issues with UEFI security, and learn what you can do to protect your systems.
- Presentation: OffensiveCon18 - Alex Ionescu Advancing the State of UEFI Bootkits
- Presentation: DEF CON 33 - Infecting the Boot to Own the Kernel - Alejandro Vazquez, Maria San Jose
- Youtube Video: DEF CON 33 - Infecting the Boot to Own the Kernel - Alejandro Vazquez, Maria San Jose - > Bootkits and Rootkits represent some of the most complex and stealthy forms of malware, capable of achieving full system control before and after the OS is loaded. While often discussed in theory, their actual construction, interaction, and execution flow remain mostly hidden from public view. This talk sheds light on how these implants are built and how their components interact across boot stages and kernel space. We'll explore the internals of a fully functional UEFI Bootkit and Kernel-mode Rootkit, examining their modular design, runtime interactions, and the mechanisms used to hook critical parts of the Windows boot chain. Attendees will see how these implants operate across pre-boot and post-boot phases, including early internet connectivity from firmware, dynamic payload delivery, runtime service hooking, deep kernel control, and advanced capabilities like hiding files, processes, and network activity, blocking traffic, capturing keystrokes, and maintaining command and control directly from kernel space. Everything shown on stage will be yours to explore: a complete Bootkit and Rootkit framework, fully customizable and ready to simulate real threats, test defenses, or build something even stealthier.
- Youtube Video: Off By One Security - Emulating APTs, Building and Deploying Bootkits & Rootkits - > When we talk about truly advanced malware, the kind that only state-level or highly resourced APTs are capable of developing and deploying end-to-end, we're referring to what are known as bootkits and rootkits. In the first session we did on the Off-By-One Security YouTube channel, we introduced how to start developing these implants, mapping them to their programmable components, and we shared malware examples, proofs of concept, and various resources for you to develop your own. In this follow-up, we'll go deeper into the source code (including the kinds of changes required to adapt implants across multiple OS versions) and deployment process with live demonstrations in isolated virtual machines where Next-Generation Antivirus and EDR solutions are installed, showing live how these solutions often fail to detect this kind of activity because it originates from as deep as the boot process, where exhaustive monitoring is not possible.
- Youtube Video: Off By One Security - UEFI Bootkits and Kernel-Mode Rootkits Development with Alejandro Vazquez - > Bootkits and Rootkits represent some of the most complex and stealthy forms of malware, capable of achieving full system control before and after the OS is loaded. While often discussed in theory, their actual construction, interaction, and execution flow remain mostly hidden from public view. This talk sheds light on how these implants are built and how their components interact across boot stages and kernel space. We'll explore the internals of a fully functional UEFI Bootkit and Kernel-mode Rootkit, examining their modular design, runtime interactions, and the mechanisms used to hook critical parts of the Windows boot chain. Attendees will see how these implants operate across pre-boot and post-boot phases, including early internet connectivity from firmware, dynamic payload delivery, runtime service hooking, deep kernel control, and advanced capabilities like hiding files, processes, and network activity, blocking traffic, capturing keystrokes, and maintaining command and control directly from kernel space. Everything shown on stage will be yours to explore: a complete Bootkit and Rootkit framework, fully customizable and ready to simulate real threats, test defenses, or build something even stealthier.
- Youtube Video: (Spanish) RootedCON 2024 - In the Roots of Evil, A Deep Dive into UEFI Bootkit Development (ES)
- Youtube Video: (Spanish) ViconGal 2024 - The New Age of Bootkits, Persistence and Evasion from the Kernel (ES)
-
-
***Courses***
-
***Rootkits (Development)***
- Course Zero2Auto: Malware Analysis (≈$150) - > Developed for those looking to further enhance their skills in the Malware Analysis/Reverse Engineering field.
- Web Zero Day Engineering: Zero Day Vulnerability Research Training (≈$1600) - > This 4-day intensive training will expose you to full stack essentials of vulnerability research and exploit development, starting from (almost) zero pre-requisites. The training system consolidates all the foundational knowledge and basic skills that you will need to build upon later as you advance and specialize in the field. Created and taught live by a top vulnerability researcher and binary hacker.
- Course ZeroPointSecurity: Offensive Driver Development (≈$55) - > Learn how to set up a development testing environment for writing Windows kernel-mode drivers using Hyper-V, WinDbg, and Visual Studio. Cover the basic anatomy of a driver from loading and unloading, I/O control codes, interaction from userland, and kernel debugging.
- Web Maldev Academy (≈$500) - > Maldev Academy is a comprehensive malware development course that focuses on x64 malware development, providing knowledge from basic to advanced level. The course is primarily designed for individuals in offensive security, but it also caters to beginners who have no prior experience in malware development.
- Web OpenSecurityTraining2: Debuggers, Reverse Engineering, Exploitation (≈$Free)
- Web Zero Day Engineering: Zero Day Vulnerability Research Training (≈$1600) - > This 4-day intensive training will expose you to full stack essentials of vulnerability research and exploit development, starting from (almost) zero pre-requisites. The training system consolidates all the foundational knowledge and basic skills that you will need to build upon later as you advance and specialize in the field. Created and taught live by a top vulnerability researcher and binary hacker.
- Web White Knight Labs: Offensive Development Practitioner Certification (ODPC) (≈$1000) - > An intermediate-level, on-demand course meticulously crafted for cybersecurity professionals looking to elevate their offensive security skills.
- Web Dark Vortex: Malware On Steroids (≈$2500) - > The Malware On Steroids is the first course which is dedicated to building your own C2 Infrastructure and Payload. There are a lot of courses which focus on exploitation, reversing and other offensive stuff, but none of them focus on how you can build your own Command & Control Infra. This course focuses on a brief introduction towards Windows Internals followed by a full hands-on course on building a Command & Control architecture with different types of Initial Access payloads.
- Web Red Team Leaders: AV/EDR Evasion Practical Techniques (≈$10) - > Advanced techniques to bypass modern Antivirus and EDR solutions through real-world offensive development strategies.
-
-
***Cybersecurity Resources***
-
***Rootkits (Development)***
- Github: Awesome - > Awesome lists about all kinds of interesting topics.
- Github: The Book of Secret Knowledge - > A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.
- Github: Advanced Windows Exploit Development Resources - > Some resources, links, books, and papers related to mostly Windows Internals and anything Windows kernel related.
- Github: Awesome Windows Kernel Security Development - > Some resources related to Windows kernel development.
- Github: Awesome Malware Analysis - > A curated list of awesome malware analysis tools and resources.
- Github: Awesome Reverse Engineering - > Reverse Engineering Resources About All Platforms(Windows/Linux/macOS/Android/iOS/IoT) And Every Aspect! (More than 3500 open source tools and 2300 posts&videos).
- Github: Awesome Linux Rootkits
- Github: Awesome Infosec - > A curated list of awesome infosec courses and training resources.
- Github: Awesome Hacking - > A collection of various awesome lists for hackers, pentesters and security researchers.
- Github: Awesome Penetration Testing - > A collection of awesome penetration testing resources, tools and other shiny things.
- InfoSec Reference - > An Information Security Reference That Doesn't Suck.
- Github: Payloads All The Things - > A list of useful payloads and bypass for Web Application Security and Pentest/CTF.
- Web Red Team Notes - > These are notes about all things focusing on, but not limited to, red teaming and offensive security.
- Github: Awesome RedTeam Cheatsheet - > Red Team Cheatsheet in constant expansion.
- Github: Awesome UEFI Security - > A collection of papers/tools/exploits for UEFI security.
- Web SamsClass Info: Full-Stack Incident Response - > Sam Bowne.
- Github: Awesome EDR Bypass - > EDR bypass technology is not just for attackers. Many malware now have EDR bypass capabilities, knowledge that pentesters and incident responders should also be aware of. This repository is not intended to be used to escalate attacks. Use it for ethical hacking.
- Github: Hooking - > Resources About Hooking. For All Platforms. Currently 300+ Tools And 600+ Posts.
- Github: Awesome Industrial Control System Security - > A curated list of resources related to Industrial Control System (ICS) security.
- Github: Awesome Honeypots - > A curated list of awesome honeypots, plus related components and much more, divided into categories such as Web, services, and others, with a focus on free and open source projects.
- Github: Awesome OSINT - > A curated list of amazingly awesome OSINT.
- Github: Cyber Detective's OSINT tools collection - > A collection of several hundred online tools for OSINT.
- Github: Awesome AWS Security - > A common curated list of links, references, books videos, tutorials (Free or Paid), Exploit, CTFs, Hacking Practices etc. which are obviously related to AWS Security.
- Github: Awesome Azure Penetration Testing - > A collection of resources, tools and more for penetration testing and securing Microsofts cloud platform Azure.
- Github: Awesome Pcap Tools - > A collection of tools developed by other researchers in the Computer Science area to process network traces.
- Github: Awesome Mac - > Here, we collect awesome macOS software and arrange them into various categories.
- Github: Awesome Sysadmin - > A curated list of amazingly awesome open source sysadmin resources inspired by Awesome PHP.
- Github: Awesome Selfhosted - > A list of Free Software network services and web applications which can be hosted on your own servers.
- Github: Hacking Articles - Cyber Security Mindmaps - > This repository will contain many mindmaps for cyber security technologies, methodologies, courses, and certifications in a tree structure to give brief details about them.
- Github: How To Hunt - > Collection of methodology and test case for various web vulnerabilities.
- Github: HackerOne Reports - Top disclosed reports from HackerOne - > Tops of HackerOne reports. All reports' raw info stored in data.csv. Scripts to update this file are written in Python 3 and require chromedriver and Chromium executables at PATH. Every script contains some info about how it works.
- Github: Awesome Interviews - > A curated awesome list of lists of interview questions.
- Web Book HackTricks - > Welcome to the wiki where you will find each hacking trick/technique/whatever I have learnt from CTFs, real life apps, reading researches, and news.
- Github: THC's favourite Tips, Tricks & Hacks (Cheat Sheet) - > A collection of our favourite tricks. Many of those tricks are not from us. We merely collect them. We show the tricks 'as is' without any explanation why they work. You need to know Linux to understand how and why they work.
- Github: PANIX - Persistence Against *NIX - > PANIX is a powerful, modular, and highly customizable Linux persistence framework designed for security researchers, detection engineers, penetration testers, CTF enthusiasts, and more. Built with versatility in mind, PANIX emphasizes functionality, making it an essential tool for understanding and implementing a wide range of persistence techniques.
- Github: EDR & AV Bypass Arsenal - > Comprehensive collection of tools, patches, and techniques for evading modern EDR, AV, and other defenses. All the tools in this repository are a collection that continues to grow, the author's contacts are listed on the inside of each tool if possible.
-
-
***EDK2***
-
***Basics***
- Github: EDK II Project - > A modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications from www.uefi.org.
- Github: Getting Started with EDK II - > Steps for downloading EDK II from GitHub and compiling projects under various OS/compiler environments.
- Github: Getting Started Writing Simple Application with EDK II - > How to Write a Simple EDK II UEFI Application.
- Web Basic Input/Output: "Hello World" Quick Start with EDK II - > Setup the EDK on a system and configure it to build a basic "Hello, World" type program.
- Github: UEFI Pratical Programming
- GitHub: EDK II Driver Writer's Guide
- Web Linkedin: Understanding and Exploiting UEFI Secure Boot with Intel's EDK2
- Blog Medium: A hitchhiker's guide to UEFI programming in Windows - > Wang Mingjie unpacks the entire process of developing UEFI programs, covering everything from building to deployment on actual systems with Secure Boot enabled. While not a technical deep-dive, his guide provides engineers-at-large with a grasp of different elements of the UEFI environment, and understand its impact on the execution and deployment of UEFI programs. Mingjie also includes various practical considerations to assist readers in evaluating different deployment options.
-
***PoCs***
- Github: EDK2 - MdeModulePkg Applications - > Sample applications of MdeModulePkg package.
- Github: Shim - A first-stage UEFI bootloader - > Shim is a trivial EFI application that, when run, attempts to open and execute another application. It will initially attempt to do this via the standard EFI LoadImage() and StartImage() calls. If these fail (because Secure Boot is enabled and the binary is not signed with an appropriate key, for instance) it will then validate the binary against a built-in certificate. If this succeeds and if the binary or signing key are not forbidden then shim will relocate and execute the binary.
- Github: Super UEFIinSecureBoot Disk - > Super UEFIinSecureBoot Disk is a proof-of-concept (not actively maintained or enhanced) bootable image with GRUB2 bootloader designed to be used as a base for recovery USB flash drives. Key feature: disk is fully functional with UEFI Secure Boot mode activated. It can launch any operating system or .efi file, even with untrusted, invalid or missing signature.
- Github: TcpTransport - > A UEFI application to receive TCP network packets.
- Github: UefiVarMonitor - > The runtime DXE driver monitoring access to the UEFI variables by hooking the runtime service table.
- Github: FakeSecureBoot - > UEFI DXE driver to fake Secure Boot. Hooks the gRT->GetVariable function to always return enabled if Secure Boot state is queried.
- Github: UEFI Lessons - > Lessons to get to know UEFI programming in Linux with the help of EDKII.
- Github: Memory Dump UEFI - > A UEFI application for dumping the contents of RAM. Intended to be flashed onto a USB connected device and booted live. It comes with a UEFI shell to facilitate navigation and use.
- Github: UefiVarTool - > Scriptable tool to read and write UEFI variables from EFI shell. View, save, edit and restore hidden UEFI (BIOS) Setup settings faster than with the OEM menu forms.
- Github: Simple UEFI Bootloader - > This bootloader is like a much simpler version of GRUB/Elilo/Windows Boot Manager, but mainly meant for writing your own operating system-less 64-bit programs, kernels, or full operating systems. It supports Windows, Linux, and Mac executable binaries (PE32+, 64-bit ELF, and 64-bit Mach-O formats). It also supports... Well, I'll let you figure that one out yourself.
- Github: Signed UEFI Shell - > Information about a signed UEFI Shell that can be used when Secure Boot is enabled.
-
***Videos***
- Youtube Video: UEFIForum - Driver Development with EDKII - > The world of UEFI is unlike OS-based software ecosystems in several aspects and the difference can be daunting to a developer who is starting to write UEFI device drivers.
- Youtube Video: Queso Fuego - UEFI Programming in C - > Intro, setup, and hello world program to start programming for x86_64 EFI applications. We'll be writing a program to make GPT disk images with an EFI system partition and basic data partition, and an OS loader EFI application for an operating system bootloader. Everything will follow official specifications and documentation for UEFI, ACPI, FAT32, etc. as much as possible.
-
-
***Environment***
-
***Bootkits (Development)***
- Web Microsoft: Visual Studio 2019 Community - > Free, fully-featured IDE for students, open-source and individual developers.
- Web Git - > Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.
- Web Python: Python 3.9 - > This is the stable release of Python 3.9.0.
- Web NASM: Netwide Assembler - > This is the project webpage for the Netwide Assembler (NASM), an asssembler for the x86 CPU architecture portable to nearly every modern platform, and with code generation for many platforms old and new.
- Web Intel: ACPI Component Architecture Downloads (Windows* Binary Tools) - > The Windows* version of the various tools are zipped in a single file.
- Github: EDK II Project - > A modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications from www.uefi.org.
-
***Rootkits (Development)***
- Web Microsoft: Visual Studio 2022 Community - > Free, fully-featured IDE for students, open-source and individual developers.
- Web Microsoft: Download the Windows Driver Kit (WDK) - > The WDK is used to develop, test, and deploy drivers for Windows.
-
Programming Languages
Categories
Sub Categories
***Drivers***
60
***Rootkits (Development)***
56
***Techniques***
53
***Videos***
44
***Debugging***
43
***Source Code***
37
***Basics***
33
***Protection Mechanisms***
32
***Vulnerabilities***
31
***Tools***
17
***Analysis***
14
***PoCs***
11
***Windows Boot***
6
***Bootkits (Development)***
6
***Specifications***
4
***Structures***
3
***Windows Kernel (Debugging)***
1
Keywords
windows
17
rootkit
15
awesome
15
awesome-list
14
kernel
14
uefi
14
security
12
driver
9
linux
9
reverse-engineering
7
firmware
6
hacking
6
bootkit
5
windbg
5
malware
4
redteam
4
backdoor
4
malware-analysis
4
dse
4
c
4
list
4
penetration-testing
4
kernel-driver
4
patchguard
3
efi
3
malware-research
3
ring0
3
javascript
3
bugbounty
3
intel
3
red-team
3
fuzzing
3
debugging
3
windbg-scripts
3
x64
3
resources
2
windows-kernel
2
abandonware
2
assembly
2
cybersecurity
2
linux-kernel
2
exploit
2
lists
2
loader
2
awesome-lists
2
malware-development
2
kernel-rootkit
2
kernel-mode-driver
2
cheatsheet
2
enumeration
2