🏴‍☠️ Designing and Implementing UEFI Bootkits to Hijack the Boot Process and Subvert Kernel Integrity on Windows and Linux

Most public resources on UEFI bootkit development are incomplete, inaccurate, or written by people who have never shipped working code. BlackLotus gets reverse engineered but never truly explained. Bootkitty gets celebrated but never properly dissected at the implementation level. The ecosystem around UEFI malware development is full of high-level overviews, recycled slide decks, and blog posts that stop right before the part that actually matters.

This paper exists because we got tired of it. We built Abyss and Antarctic from scratch, two complete, functional UEFI bootkits targeting Windows and Linux respectively, and we documented the process at every layer. Boot flow hijacking. EFI application hooking. Secure Boot bypass strategies. Kernel integrity subversion. The full chain from firmware execution to post-boot persistence, done correctly.

If you have read everything else and still do not understand how any of this actually works, this is where you start.

Citation & Archived Version

The official archived version of this research paper is available on Zenodo and can be cited using its DOI: https://doi.org/10.5281/zenodo.21704955

---

---

---

📑 Table of Contents

• Topics Covered
• Resources
📂
• Research Paper
• Historical Reference
• Development Environments
• Vulnerability Research
• Reference Collections
• Malware Projects
• Starter Packs

---

---

---

📘 Topics Covered

• EFI application hooking and Boot Services interception.
• UEFI boot flow and the DXE/BDS execution environment.
• Secure Boot bypass via bootloader and UEFI-level hook injection.
• Windows boot process subversion from bootmgr through winload.
• Kernel integrity bypass and unsigned module loading on both platforms.
• Post-boot persistence and communication between firmware and kernel-space payloads.
• Linux boot process subversion through GRUB, shim, and the vmlinuz decompression stub.

---

---

---

🗂️ Resources

---

📖 Book

Resource

Description

Book: Bootkits & Rootkits Development

A comprehensive open-source book dedicated to the research, design, and development of modern bootkits and kernel rootkits. Initially focused on Windows and the research publicly presented at DEF CON 33, the project documents every stage of the boot compromise chain, from UEFI firmware internals, boot managers, and kernel loading, to pre-OS persistence, kernel patching, and post-exploitation techniques. The book combines architectural explanations, reverse engineering, implementation details, proof-of-concepts, debugging methodologies, and practical code examples to provide a complete understanding of offensive development beneath the operating system.

---

📜 Research Paper

Repository	Description
Paper - UEFI Bootkit Development: Windows & Linux	This paper.
Paper - UEFI Bootchain Exploitation: Windows & Linux	Companion paper covering CVE exploitation, Secure Boot bypass techniques, and UEFI attack surface.
Paper - UEFI Recovery Bootloaders Under The Microscope	Research journey through the attack surfaces introduced by commercial recovery software.

---

📅 Historical Reference

Repository	Description
Bootkits & Rootkits Timeline	Chronological reference of significant bootkit and rootkit families, from early MBR-era malware through modern UEFI threats, with technical annotations on their relevance to current development.

---

🧪 Development Environments

Repository	Description
Bootkits & Rootkits Development Environment	Automated environment setup for UEFI malware development (scripts to compile bootkits, UEFI applications, and supporting utilities).
QEMU UEFI Research Environment	Automated scripts to build a QEMU-based lab with Secure Boot, custom key enrollment, and UEFI component signing for both Windows and Linux.
VMware Secure Boot Custom Keys	Same environment on VMware (custom Secure Boot key setup, component signing, and analysis workflows).

---

🐞 Vulnerability Research

Repository	Description
UEFI Vulnerability Research and Exploit Development	Central repository of weaponized UEFI vulnerabilities covering documentation, exploits, and supporting material for each case.
Debugging UEFI Applications for Vulnerability Research and Malware Analysis	Methodology, tooling, and documentation for debugging UEFI components in search of vulnerabilities and malware analysis.

---

📚 Reference Collections

Repository	Description
Awesome Bootkits & Rootkits Development	Hundreds of resources covering bootkit and rootkit development, malware analysis, and low-level persistence techniques.
Awesome Bring Your Own Vulnerable UEFI Application	Hundreds of resources covering techniques and vulnerabilities for exploiting UEFI and compromising the boot process.

---

☠️ Malware Projects

Repository	Description
Abyss	UEFI bootkit targeting the Windows boot process.
Benthic	Windows kernel-mode rootkit implementing DKOM, minifilter interception, keyboard filtering, and network manipulation via WFP and WSK.
Antarctic	UEFI bootkit targeting the Linux boot process.
Gillyweed	LKM rootkit with ftrace-based syscall hooking and kernel-userspace IOCTL communication.
Liminalis	eBPF-based framework for process, file, and network interception at the kernel boundary.

---

🎒 Starter Packs

Repository	Description
Bootkits Development Starter Pack	Minimal working PoCs and scaffolding for getting started with UEFI bootkit development on both Windows and Linux.
Rootkits Development Starter Pack	Minimal working PoCs and scaffolding for getting started with kernel rootkit development on both Windows and Linux.

---

---

---

🤝 Research & Collaboration

Working on something similar? Researching UEFI, Kernel security, exploitation, or another interesting security topic? If you need a hand developing an exploit, exploring a technique, or just want to exchange ideas, don't hesitate to reach out. I'm always open to discussing research, helping where I can, and collaborating on interesting projects. Feel free to contact me on LinkedIn.