Hide SMBIOS/disk/NIC serials from EFI bootkit

Last update: Jan 6, 2023

Related tags

Overview

Rainbow

Rainbow is a bootkit like HWID spoofer for Windows. It abuses several hooks in EFI runtime services and uses clever DKOM to hide hardware serials before any boot-time drivers are even started.

Screenshots

Video

Usage

In order to use rainbow spoofer, you need to load it. First, obtain a copy of rainbow.efi and a copy of EDK2 efi shell. Now follow these steps:

Extract downloaded efi shell and rename file Shell.efi (should be in folder UefiShell/X64) to bootx64.efi
Format some USB drive to FAT32
Create following folder structure:

USB:.
 │   rainbow.efi
 │
 └───EFI
      └───Boot
              bootx64.efi

Boot from the USB drive
An UEFI shell should start, change directory to your USB (FS0 should be the USB since we are booting from it) and list files:

FS0:
ls

You should see file rainbow.efi, if you do, load it:

load rainbow.efi

Now you should see output from rainbow. If it was successful, exit and boot into Windows (change to Windows boot media - usually FS1 - and run \EFI\Boot\bootx64.efi)

Download

Check out UnknownCheats.

Compiling

See VisualEfi. Please note that I've made some changes to the EDK2 directory.

Hide a process,port,self under Linux using the ld_preload

vbackdoor 中文 Hide a process,port,self under Linux using the LD_PRELOAD rootkit. compile the library git clone https://github.com/veo/vbackdoor.git cd

107 Dec 31, 2022

Graphs the disk IO in a linux terminal.

diskgraph Monitor for disk IO Introduction The diskgraph tool will graph disk IO under linux, in a terminal. Examples: $ ./diskgraph /dev/nvme0n1 $ ./

184 Nov 14, 2022

Microcontroller based switchless ROM switcher for the Commodore 1541-II disk drive

Retroninja 1541-II Switchless Multi-ROM A microcontroller based switchless ROM switcher for the Commodore 1541-II disk drive. Switch between stock CBM

5 Sep 3, 2022

A small proof-of-concept for using disk devices for DMA on Windows.

ddma A small proof-of-concept for using disk devices for DMA on Windows. Why Some native hypervisors (i.e. Hyper-V) allow the guest unvirtualized devi

55 Dec 30, 2022

A method from GH on how to stream a dll without touching disk, TAGS: fortnite cheat fortnite injector dll injector

dll-encryptor People who make pay hacks typically have down syndrome and are incapable of using their brains in any fashion, and yet these bath salt s

2 Nov 24, 2021

ImDisk Virtual Disk Driver

ImDisk Virtual Disk Driver for Windows NT/2000/XP/2003/Vista/7/8/8.1/10. This driver emulates harddisk partitions, floppy drives and CD/DVD-ROM d

135 Jan 6, 2023

Tools to read Dragon32 VDK disk image files

Quick and dirty UNIX port of ddosutils This is originally an MSDOS tool to read Dragon 32 floppy disks. This version is crudely converted to operate o

3 Sep 20, 2022

Creates a virtual disk in memory and provides the user a shell to interact with it

Tiny-File-System Creates a virtual disk in memory and provides the user a shell to interact with it Known bugs with Export missing chars at the end of

2 Oct 7, 2022

Comparing data of module exports from disk and memory, then caching any differences.

Inline-PatchFinder Need to see if the process you're reversing/analyzing is patching/hooking any loaded module's exports? Well, look no further. Inlin

14 Oct 15, 2022

Comments

I get a BlueScreen when booting windows 20H2 after loading this bootkit

Like said in the title, I get an SYSTEM_THREAD_EXCEPTION_NOT_HANDLED BSOD when booting Windows 10 20H2 (19042.985) with the driver loaded. I have no idea from which part of the bypass this comes. If you need any information to debug this, let me know, and I will send them.

opened by louga31 0