UEFI Bootkit Development: Persistence Below the Operating System

Understanding UEFI bootkits is essential for both offensive and defensive security professionals. This research-oriented guide explores firmware-level persistence mechanisms.

UEFI Architecture Refresher

The Unified Extensible Firmware Interface (UEFI) is a sophisticated operating system that runs before your OS boots. Understanding its driver model, protocol interfaces, and boot flow is critical.

Key Areas

• **DXE Driver Development**: Writing UEFI drivers in C with EDK II
• **Boot Chain Analysis**: From SEC → PEI → DXE → BDS → TSL → RT phases
• **Secure Boot Internals**: How Secure Boot validates binaries and common bypass techniques
• **SPI Flash Programming**: Reading and writing firmware storage
• **Defensive Strategies**: Boot Guard, Intel TXT, and measured boot with TPM

⚠️ This is for security research only. Unauthorized firmware modification is illegal.