analyzing-bootkit-and-rootkit-samples

1# Analyzing Bootkit and Rootkit Samples
2 
3## When to Use
4 
5- A system shows signs of compromise that persist through OS reinstallation
6- Antivirus and EDR are unable to detect malware despite clear evidence of compromise
7- UEFI Secure Boot has been disabled or shows integrity violations
8- Memory forensics reveals rootkit behavior (hidden processes, hooked system calls)
9- Investigating nation-state level threats known to deploy bootkits (APT28, APT41, Equation Group)
10 
11**Do not use** for standard user-mode malware; bootkits and rootkits operate at a fundamentally different level requiring specialized analysis techniques.
12 
13## Prerequisites
14 
15- Disk imaging tools (dd, FTK Imager) for acquiring MBR/VBR sectors
16- UEFITool for UEFI firmware volume analysis and module extraction
17- chipsec for hardware-level firmware security assessment
18- Ghidra with x86 real-mode and 16-bit support for MBR code analysis
19- Volatility 3 for kernel-level rootkit artifact detection
20- Bootable Linux live USB for offline system analysis
21 
22## Workflow
23 
24### Step 1: Acquire Boot Sectors and Firmware
25 
26Extract MBR, VBR, and UEFI firmware for offline analysis:
27 
28```bash
29# Acquire MBR (first 512 bytes of disk)
30dd if=/dev/sda of=mbr.bin bs=512 count=1
31 
32# Acquire first track (usually contains bootkit code beyond MBR)
33dd if=/dev/sda of=first_track.bin bs=512 count=63
34 
35# Acquire VBR (Volume Boot Record - first sector of partition)
36dd if=/dev/sda1 of=vbr.bin bs=512 count=1
37 
38# Acquire UEFI System Partition
39mkdir /mnt/efi
40…