Analyzing Bootkit and Rootkit Samples

When to Use

• A system shows signs of compromise that persist through OS reinstallation
• Antivirus and EDR are unable to detect malware despite clear evidence of compromise
• UEFI Secure Boot has been disabled or shows integrity violations
• Memory forensics reveals rootkit behavior (hidden processes, hooked system calls)
• Investigating nation-state level threats known to deploy bootkits (APT28, APT41, Equation Group)

Do not use for standard user-mode malware; bootkits and rootkits operate at a fundamentally different level requiring specialized analysis techniques.

Prerequisites

• Disk imaging tools (dd, FTK Imager) for acquiring MBR/VBR sectors
• UEFITool for UEFI firmware volume analysis and module extraction
• chipsec for hardware-level firmware security assessment
• Ghidra with x86 real-mode and 16-bit support for MBR code analysis
• Volatility 3 for kernel-level rootkit artifact detection
• Bootable Linux live USB for offline system analysis

Workflow

Step 1: Acquire Boot Sectors and Firmware

Extract MBR, VBR, and UEFI firmware for offline analysis:

# Acquire MBR (first 512 bytes of disk)
dd if=/dev/sda of=mbr.bin bs=512 count=1

# Acquire first track (usually contains bootkit code beyond MBR)
dd if=/dev/sda of=first_track.bin bs=512 count=63

# Acquire VBR (Volume Boot Record - first sector of partition)
dd if=/dev/sda1 of=vbr.bin bs=512 count=1

# Acquire UEFI System Partition
mkdir /mnt/efi
mount /dev/sda1 /mnt/efi
cp -r /mnt/efi/EFI /analysis/efi_backup/

# Dump UEFI firmware (requires chipsec or flashrom)
# Using chipsec:
python chipsec_util.py spi dump firmware.rom

# Using flashrom:
flashrom -p internal -r firmware.rom

# Verify firmware dump integrity
sha256sum firmware.rom

Step 2: Analyze MBR/VBR for Bootkit Code

Examine boot sector code for malicious modifications:

# Disassemble MBR code (16-bit real mode)
ndisasm -b16 mbr.bin > mbr_disasm.txt