<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-bootkit-infections
description: >-
  Detect and analyze bootkit infections targeting MBR, VBR, UEFI firmware, and
  boot configuration to achieve pre-OS persistence and stealth.
domain: cybersecurity
subdomain: malware-analysis
tags:
  - bootkit
  - mbr
  - vbr
  - uefi
  - persistence
  - firmware
  - pre-boot
  - malware-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1542"]
---

# Analyzing Bootkit Infections

## Overview

Bootkits infect the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI boot components to execute before the operating system loads, achieving the deepest form of persistence. They can survive OS reinstalls, intercept the boot chain to disable security controls, and hide from runtime detection. Analysis requires offline disk examination, boot sector comparison against known-good values, UEFI firmware extraction, and memory forensics to identify boot-time hooks.

## Prerequisites

- Offline boot media (Linux live USB) for safe analysis
- `dd` / `xxd` for raw disk sector reads
- Volatility 3 with MBR/bootkit plugins
- UEFITool for UEFI firmware analysis
- Ghidra with x86 16-bit real mode support
- Known-good MBR/VBR reference images
- chntpw / fdisk for partition table analysis

## Key Concepts

### Boot Chain Targets

| Target | Location | Persistence Level |
|--------|----------|-------------------|
| MBR | Sector 0 of disk (512 bytes) | Survives OS reinstall |
| VBR | First sector of partition | Survives file-level cleaning |
| UEFI | SPI flash / EFI System Partition | Survives disk replacement |
| bootmgr | Windows Boot Manager | Survives file-level cleaning |
| GRUB | Linux bootloader | Survives file-level cleaning |

### Known Bootkit Families

| Family | Target | Technique |
|--------|--------|-----------|
| TDL4/TDSS | MBR | MBR replacement + hidden partition |
| Rovnix | VBR/IPL | VBR infection with rootkit driver |
| FinFisher | MBR/VBR | MBR hooking + encrypted payload |
| LoJax | UEFI | DXE driver implant in SPI flash |
| MosaicRegressor | UEFI | Modified UEFI firmware modules |
| BlackLotus | UEFI | Secure Boot bypass via CVE-2022-21894 |

## Workflow

### Step 1: Dump Boot Sectors

```bash
# Read MBR (first 512 bytes of disk)
dd if=/dev/sda bs=512 count=1 of=mbr_dump.bin 2>/dev/null

# Read VBR (first sector of first partition)
dd if=/dev/sda1 bs=512 count=1 of=vbr_dump.bin 2>/dev/null

# Read extended boot sectors (sectors 0-62)
dd if=/dev/sda bs=512 count=63 of=boot_sectors.bin 2>/dev/null

# Hex dump for visual inspection
xxd mbr_dump.bin | head -32
xxd vbr_dump.bin | head -32

# Verify MBR signature (must end with 0x55AA)
xxd -s 510 -l 2 mbr_dump.bin
```

### Step 2: Analyze MBR Structure

```python
#!/usr/bin/env python3
"""Parse and validate MBR structure."""
import struct

def parse_mbr(filepath: str) -> dict:
    with open(filepath, "rb") as f:
        data = f.read(512)

    # Bootstrap code: bytes 0-445
    # Partition table: bytes 446-509 (4 entries × 16 bytes)
    # Signature: bytes 510-511 (0x55AA)

    signature = struct.unpack_from("<H", data, 510)[0]
    partitions = []
    for i in range(4):
        offset = 446 + (i * 16)
        entry = struct.unpack_from("<BBBBBBBBII", data, offset)
        partitions.append({
            "boot_flag": hex(entry[0]),
            "type": hex(entry[4]),
            "start_lba": entry[8],
            "size_sectors": entry[9],
            "is_active": entry[0] == 0x80,
        })

    return {
        "signature_valid": signature == 0x55AA,
        "signature": hex(signature),
        "partitions": partitions,
        "bootstrap_entropy": _entropy(data[:446]),
    }

def _entropy(data: bytes) -> float:
    import math
    if not data:
        return 0.0
    freq = [0] * 256
    for b in data:
        freq[b] += 1
    length = len(data)
    return round(-sum(
        (f / length) * math.log2(f / length) for f in freq if f > 0
    ), 2)

import json
print(json.dumps(parse_mbr("mbr_dump.bin"), indent=2))
```

### Step 3: Compare Against Known-Good MBR

```bash
# Generate hash of bootstrap code (excluding partition table)
dd if=mbr_dump.bin bs=1 count=446 2>/dev/null | sha256sum

# Known-good Windows MBR bootstrap hashes (first 446 bytes):
# Windows 7/10 standard MBR:
# Compare against reference from clean install

# Binary diff
radiff2 known_good_mbr.bin mbr_dump.bin

# YARA scan boot sectors
yara -s bootkit_rules.yar mbr_dump.bin boot_sectors.bin
```

### Step 4: UEFI Boot Analysis

```bash
# List EFI System Partition contents
mount /dev/sda1 /mnt/efi
find /mnt/efi -name "*.efi" -exec sha256sum {} \;

# Compare against known-good EFI binaries
# Microsoft bootloader: bootmgfw.efi
sha256sum /mnt/efi/EFI/Microsoft/Boot/bootmgfw.efi

# UEFITool analysis of firmware dump
# Extract SPI flash (requires flashrom or hardware programmer)
flashrom -p internal -r uefi_dump.bin
# Open in UEFITool — look for unknown DXE drivers

# Verify Secure Boot state
mokutil --sb-state
efivar -l | grep SecureBoot
```

### Step 5: Memory Analysis for Boot Hooks

```bash
# Volatility — MBR analysis
vol3 -f memory.dmp windows.mbrscan

# Check for boot-time hooks in kernel
vol3 -f memory.dmp windows.ssdt
vol3 -f memory.dmp windows.callbacks

# Detect bootkit drivers loaded early
vol3 -f memory.dmp windows.driverscan | \
    grep -iE "BOOT|early|unknown"
```

## YARA Rule

```yara
rule Bootkit_MBR_Infection {
    meta:
        description = "Detects modified MBR with bootkit indicators"
        author = "NERF"
        date = "2026-03-17"
        mitre_attack = "T1542.003"
        severity = "critical"
    strings:
        $mbr_sig = { 55 AA }
        $int13 = { CD 13 }                    // BIOS disk interrupt
        $jmp_hidden = { E9 ?? ?? EB ?? 90 }   // Jump to hidden code
        $decrypt = { 80 34 ?? ?? 4? FF C? }   // XOR decryption loop
        $hook = { FA 0F 01 ?? }               // LGDT/LIDT modification
    condition:
        $mbr_sig at 510 and
        $int13 and
        ($decrypt or $hook or $jmp_hidden)
}
```

## Detection

```yaml
title: Bootkit Infections Detection
id: e7fc864f-660a-4a7d-83d6-e98aefec6d3f
status: experimental
description: Detects suspicious activity related to analyzing bootkit infections techniques in malware analysis context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*bootkit*"
  condition: selection
level: high
tags:
  - attack.t1542
  - attack.execution
falsepositives:
  - Sandbox detonation environments analyzing submitted samples
```

## Verification

- [ ] MBR/VBR dumped and compared against known-good reference
- [ ] Bootstrap code entropy and structure validated
- [ ] Partition table integrity verified
- [ ] UEFI EFI System Partition binaries hash-verified
- [ ] Memory analysis checked for boot-time hooks
- [ ] Secure Boot configuration verified
- [ ] Findings mapped to MITRE ATT&CK (T1542.001, T1542.003)

## References

- [MITRE ATT&CK T1542.003 — Bootkit](https://attack.mitre.org/techniques/T1542/003/)
- [MITRE ATT&CK T1542.001 — System Firmware](https://attack.mitre.org/techniques/T1542/001/)
- [ESET — BlackLotus UEFI Bootkit Analysis](https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/)
- [UEFITool — UEFI Firmware Image Viewer](https://github.com/LongSoft/UEFITool)
