Analyzing Bootkit And Rootkit Samples

# Acquire MBR (first 512 bytes of disk)dd if=/dev/sda of=mbr.bin bs=512 count=1
# Acquire first track (usually contains bootkit code beyond MBR)dd if=/dev/sda of=first_track.bin bs=512 count=63
# Acquire VBR (Volume Boot Record - first sector of partition)dd if=/dev/sda1 of=vbr.bin bs=512 count=1
# Acquire UEFI System Partitionmkdir /mnt/efimount /dev/sda1 /mnt/eficp -r /mnt/efi/EFI /analysis/efi_backup/
# Dump UEFI firmware (requires chipsec or flashrom)# Using chipsec:python chipsec_util.py spi dump firmware.rom
# Using flashrom:flashrom -p internal -r firmware.rom
# Verify firmware dump integritysha256sum firmware.rom

# Disassemble MBR code (16-bit real mode)ndisasm -b16 mbr.bin > mbr_disasm.txt
# Compare MBR with known-good Windows MBR# Standard Windows MBR begins with: EB 5A 90 (JMP 0x5C, NOP)# Standard Windows 10 MBR: 33 C0 8E D0 BC 00 7C (XOR AX,AX; MOV SS,AX; MOV SP,7C00h)
python3 << 'PYEOF'with open("mbr.bin", "rb") as f:    mbr = f.read()
# Check MBR signature (bytes 510-511 should be 0x55AA)if mbr[510:512] == b'\x55\xAA':    print("[*] Valid MBR signature (0x55AA)")else:    print("[!] Invalid MBR signature")
# Check for known bootkit signaturesbootkit_sigs = {    b'\xE8\x00\x00\x5E\x81\xEE': "TDL4/Alureon bootkit",    b'\xFA\x33\xC0\x8E\xD0\xBC\x00\x7C\x8B\xF4\x50\x07': "Standard Windows MBR (clean)",    b'\xEB\x5A\x90\x4E\x54\x46\x53': "Standard NTFS VBR (clean)",}
for sig, name in bootkit_sigs.items():    if sig in mbr:        print(f"[{'!' if 'clean' not in name else '*'}] Signature match: {name}")
# Check partition table entriesprint("\nPartition Table:")for i in range(4):    offset = 446 + (i * 16)    entry = mbr[offset:offset+16]    if entry != b'\x00' * 16:        boot_flag = "Active" if entry[0] == 0x80 else "Inactive"        part_type = entry[4]        start_lba = int.from_bytes(entry[8:12], 'little')        size_lba = int.from_bytes(entry[12:16], 'little')        print(f"  Partition {i+1}: Type=0x{part_type:02X} {boot_flag} Start=LBA {start_lba} Size={size_lba} sectors")PYEOF

# Extract UEFI firmware components with UEFITool# GUI: Open firmware.rom -> Inspect firmware volumes# CLI:UEFIExtract firmware.rom all
# List all DXE drivers (most common target for UEFI implants)find firmware.rom.dump -name "*.efi" -exec file {} \;
# Compare against known-good firmware module list# Each UEFI module has a GUID - compare against vendor baseline
# Verify Secure Boot configurationpython chipsec_main.py -m common.secureboot.variables
# Check SPI flash write protectionpython chipsec_main.py -m common.bios_wp
# Check for known UEFI malware patternsyara -r uefi_malware.yar firmware.rom

# Memory forensics for rootkit detection# SSDT hook detectionvol3 -f memory.dmp windows.ssdt | grep -v "ntoskrnl\|win32k"
# Hidden processes (DKOM)vol3 -f memory.dmp windows.psscan > psscan.txtvol3 -f memory.dmp windows.pslist > pslist.txt# Diff to find hidden processes
# Kernel callback registration (rootkits register callbacks for filtering)vol3 -f memory.dmp windows.callbacks
# Driver analysisvol3 -f memory.dmp windows.driverscanvol3 -f memory.dmp windows.modules
# Check for unsigned driversvol3 -f memory.dmp windows.driverscan | while read line; do    driver_path=$(echo "$line" | awk '{print $NF}')    if [ -f "$driver_path" ]; then        sigcheck -nobanner "$driver_path" 2>/dev/null | grep "Unsigned"    fidone
# IDT hook detectionvol3 -f memory.dmp windows.idt

# Verify Windows Boot Manager signaturesigcheck -a C:\Windows\Boot\EFI\bootmgfw.efi
# Verify winload.efisigcheck -a C:\Windows\System32\winload.efi
# Verify ntoskrnl.exesigcheck -a C:\Windows\System32\ntoskrnl.exe
# Check Measured Boot logs (if TPM is available)# Windows: BCDEdit /enum firmwarebcdedit /enum firmware
# Verify Secure Boot stateConfirm-SecureBootUEFI  # PowerShell cmdlet
# Check boot configuration for tamperingbcdedit /v
# Look for boot configuration changes# testsigning: should be No# nointegritychecks: should be No# debug: should be Nobcdedit | findstr /i "testsigning nointegritychecks debug"