<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Analyzing Bootkit Infections — API Reference

## dd — Raw Disk Access

```bash
# Dump MBR (sector 0)
dd if=/dev/sda bs=512 count=1 of=mbr.bin

# Dump VBR (first sector of partition)
dd if=/dev/sda1 bs=512 count=1 of=vbr.bin

# Dump IPL (Initial Program Loader — sectors 0-15)
dd if=/dev/sda bs=512 count=16 of=ipl.bin

# Dump full boot area (first track — 63 sectors)
dd if=/dev/sda bs=512 count=63 of=boot_track.bin

# Restore known-good MBR
dd if=clean_mbr.bin of=/dev/sda bs=446 count=1  # Bootstrap only
```

## xxd / hexdump

```bash
xxd mbr.bin | head -32          # Hex dump
xxd -s 510 -l 2 mbr.bin        # Check 0x55AA signature
xxd -s 446 -l 64 mbr.bin       # Partition table
hexdump -C mbr.bin | head -32  # Canonical hex dump
```

## Volatility 3 — Boot Analysis

```bash
vol3 -f memory.dmp windows.mbrscan     # MBR analysis
vol3 -f memory.dmp windows.driverscan  # Early-load drivers
vol3 -f memory.dmp windows.callbacks   # Boot callbacks
vol3 -f memory.dmp windows.ssdt        # SSDT modifications
```

## UEFITool

```
# GUI analysis of UEFI firmware dumps
# Key areas to inspect:
# - DXE drivers (look for unknown/unsigned)
# - UEFI volume structure modifications
# - Embedded PE files in firmware volumes

# Command-line extraction
UEFIExtract firmware.rom all  # Extract all firmware components
```

## flashrom

```bash
flashrom -p internal -r spi_dump.bin    # Dump SPI flash
flashrom -p internal -w clean.bin       # Write clean firmware
flashrom -p internal --verify clean.bin # Verify write
flashrom -p internal -E                  # Erase chip
```

## Secure Boot Verification

```bash
# Check Secure Boot status
mokutil --sb-state

# List enrolled keys
mokutil --list-enrolled

# Verify EFI binary signatures
sbverify --cert /path/to/cert.pem /boot/efi/EFI/Microsoft/Boot/bootmgfw.efi
pesign -S -i /boot/efi/EFI/Microsoft/Boot/bootmgfw.efi
```

## Ghidra — 16-bit Real Mode Analysis

```
# Import MBR as raw binary:
# Language: x86:LE:16:Real Mode
# Base Address: 0000:7C00 (BIOS loads MBR here)
# File Offset: 0x0
# Length: 512 bytes (0x200)
```
