Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
realoriginal authored Feb 26, 2023
1 parent 989a0ad commit 326fcda
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,7 @@ vmvware-bootkit takes its design from the legacy CosmicStrain, MoonBounce, and E
After initial insertion into a UEFI driver firmware using the the [injection utility](scripts/inject.py), the shellcodes [EfiMain](bootkit/EfiMain.c) achieves execution as the host starts up, and inserts a hook into the UEFI firmware's [ExitBootServices routine](bootkit/ExitBootServices.c). The ExitBootServices routine will then, on execution, find the source caller of the function, and if it matches WinLoad.EFI, attempts to find the unexported winload.efi!OslArchTransferToKernel routine, which will allow us to attack the booting kernel before it achieves its initial execution.

Once [OslArchTransferToKernel](bootkit/OslArchTransferToKernel.c) executes, it will search for the ACPI.SYS driver, find the `.rsrc` PE section, and inject a small stager shellcode entrypoint called [DrvMain](bootkit/DrvMain.c) to copy over a larger payload that will act as our kernel implant.

### Resources

Entirely based upon d_olex / cr4sh's [DmaBackdoorBoot](https://github.com/Cr4sh/s6_pcie_microblaze/tree/master/python/payloads/DmaBackdoorBoot)

0 comments on commit 326fcda

Please sign in to comment.