# Bootkit Analysis Guide

## Boot Process Overview

### Legacy BIOS Boot
1. BIOS POST → MBR (sector 0) → VBR → Bootloader → OS Kernel
2. Bootkits can infect MBR, VBR, or bootloader stages

### UEFI Boot
1. SEC → PEI → DXE → BDS → OS Loader → OS Kernel
2. UEFI implants target DXE drivers or modify boot manager

## MBR Bootkit Analysis

### Acquisition
```bash
# Linux
dd if=/dev/sda bs=512 count=1 of=mbr.bin

# Windows (admin PowerShell)
# Use FTK Imager or Arsenal Image Mounter
```

### Analysis Steps
1. Compare against known-good MBR (Windows default: 446 bytes boot code + 64 bytes partition table + 2 bytes signature)
2. Check for modified boot code (first 446 bytes)
3. Look for hidden partitions in partition table
4. Trace execution flow of modified boot code

### Known MBR Bootkits
| Family | Key Characteristics |
|--------|-------------------|
| TDL4 | Encrypted hidden filesystem, VBR hook |
| Rovnix | VBR modification, IPL patching |
| Olmasco | MBR replacement with encrypted payload |
| Gapz | VBR infector, advanced stealth |

## UEFI Bootkit Analysis

### Tools
- **UEFITool**: Parse and extract UEFI firmware volumes
- **CHIPSEC**: Intel firmware security assessment
- **uefi-firmware-parser**: Python-based UEFI analysis

### Analysis Steps
1. Dump UEFI firmware (CHIPSEC or hardware programmer)
2. Extract firmware volumes with UEFITool
3. Identify all DXE drivers and compare against known-good
4. Check for unsigned or unexpected DXE drivers
5. Analyze suspicious drivers with Ghidra/IDA

### Known UEFI Implants
| Family | Year | Description |
|--------|------|-------------|
| LoJax | 2018 | First in-the-wild UEFI rootkit (APT28) |
| MosaicRegressor | 2020 | Chinese-speaking threat actor, modular framework |
| FinSpy UEFI | 2021 | Commercial spyware UEFI bootkit |
| ESPecter | 2021 | EFI System Partition bootkit |
| CosmicStrand | 2022 | Firmware-level implant in UEFI images |
| BlackLotus | 2023 | First UEFI bootkit bypassing Secure Boot |

### Secure Boot Bypass Detection
- Check Secure Boot status: `mokutil --sb-state` (Linux)
- Verify boot chain integrity
- Check for enrolled unauthorized certificates
- Analyze dbx (forbidden signatures database) for gaps

## Detection Strategies

1. **Integrity monitoring**: Regular comparison of boot sectors against known-good baselines
2. **Measured Boot**: TPM-based boot measurement (PCR values)
3. **Firmware scanning**: Periodic UEFI firmware extraction and analysis
4. **Behavioral detection**: Monitor for boot-time hooking activity