Rootkits and Bootkits
Alex Matrosov, Eugene Rodionov, and Sergey Bratus
The book I hand people when they ask why the kernel still believes the firmware. Boot path, UEFI, and the malware that lives underneath the OS you thought you were analyzing.
Open PDF↗- Title
- Rootkits and Bootkits
- Authors
- Alex Matrosov, Eugene Rodionov, and Sergey Bratus
- Year
- 2019
- Publisher
- No Starch Press
- Tags
- rootkits, bootkits, uefi, windows, firmware
I keep this one on the desk for the same reason I keep a flashlight in a drawer I do not open often: when I need it, I need it immediately. Publisher page: No Starch Press.
Matrosov, Rodionov, and Bratus walk the Windows boot path like a crime scene - firmware, UEFI, boot managers, kernel callbacks, the places a rootkit sits so the rest of your toolkit is already lying to you. If you have only ever lived in user-mode dumps, this is the book that explains why the dump was polite.
I do not treat it as a cookbook. I treat it as a map of floors below the one I am standing on. User-mode is a lobby. The interesting theft happens in the basement, and sometimes in the concrete under the basement. The labs are where the flashlight actually gets used.
When a sample “survives” a reimage, stop blaming the SOC. Open this. Then go look at the firmware you assumed was furniture.