PoC EFI runtime driver for memory r/w & kdmapper fork
Efi-memory is a proof-of-concept EFI runtime driver for reading and writing to virtual memory. It uses EfiGuards method of hooking SetVariable to communicate with the user-mode process. Here is an example how it works.
driver/ - EFI driver itself
client/efi-mapper/ - kdmapper fork that uses efi-memory to manual map any Windows driver
Compiling any of the example client programs is pretty simple. Open the solution file in Visual Studio and compile the project with it's default settings.
Compiling the driver is also pretty simple. First you need a working Linux install (or you can use Linux subsystem for Windows) and install gnu-efi (commands for Ubuntu 20.04):
sudo apt install gnu-efi build-essentialThat's all you need to install. Package manager (in the example apt) should take care of all the depencies for you. Once the installation is complete, clone this repo (make sure you have git installed):
git clone https://github.com/SamuelTulach/efi-memoryThan navigate to the driver folder and compile the driver with make:
cd efi-memory cd driver makeIf the compile was successful, you should now see memory.efi in the driver folder.
USB:. │ memory.efi │ └───EFI └───Boot bootx64.efi
exitto start standard boot procedure (while Windows is booting the screen should go blue with confirmation text)
I would like to thank @z175 for kdmapper project since that is a masterpiece. @Mattiwatti for EfiGuard project and the idea of SetVariable hooking. Roderick W. Smith for rodsbooks.com (really useful site to read about EFI basics).
This repo is licensed under MIT if not stated otherwise in subfolders.