Exposing Bootkits with BIOS Emulation
summary
Claims a practical detector that reads true disk sectors via the signed miniport dispatch routine (recovered by recursive disassembly), boots those sectors inside a custom BIOS emulation, and flags anomalies like deobfuscation loops, reads from unexpected end-of-disk sectors, or an interrupt 13 hook. Detection uses simple metrics: mem-compare of boot manager bytes, counting executions of address 0x7C00 (three vs two), and intact IVT; the same emulation can recover original MBR/VBR and write back to disable a bootkit.
AI-written summary · about
chapters (16)
- 0:00Start
- 6:32Bootkits: Common Denominators
- 8:43Modifying BIOS Boot Sequence
- 14:45Using Miniport's Dispatch Routine
- 16:21The Challenge of Hooks
- 18:01Overcoming Function Pointer Hooks
- 19:56Obtaining RVA of Dispatch Routine
- 22:13Searching for the Dispatch Routine
- 23:52Overcoming Inline hooks
- 25:21Interfacing with the Dispatch Routine
- 26:46Emulating the Boot Sequence
- 28:08BIOS Implementation
- 38:39Patching bootmgr
- 39:44MBR Replacement Anomaly
- 41:57Retrieving Original Boot Sector Contents
- 45:13Conclusion
related talks
01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized Packers
01h 04mAnalyzing UEFI BIOSes from Attacker & Defender Viewpoints
49mBreaking Hardware-Enforced Security With Hypervisors
42mUEFI Bootkits and Where UEFI Security Fails
31mBypassing Anti-Debugging: A Hybrid Real-Simulated Approach to Rootkit Analysis
27mBreaking the Chain of Trust
44mLogoFAIL: Security Implications of Image Parsing During System Boot
39mTOCTOU Attacks Against Secure Boot And BootGuard