PoC EFI runtime driver for memory r/w & kdmapper fork
Efi-memory is a proof-of-concept EFI runtime driver for reading and writing to virtual memory. It uses EfiGuards method of hooking SetVariable to communicate with the user-mode process. Here is an example how it works.
driver/ - EFI driver itself
client/efi-mapper/ - kdmapper fork that uses efi-memory to manual map any Windows driver
Compiling any of the example client programs is pretty simple. Open the solution file in Visual Studio and compile the project with it's default settings.
Compiling the driver is also pretty simple. First you need a working Linux install (or you can use Linux subsystem for Windows) and install gnu-efi (commands for Ubuntu 20.04):
sudo apt install gnu-efi build-essentialThat's all you need to install. Package manager (in the example apt) should take care of all the depencies for you. Once the installation is complete, clone this repo (make sure you have git installed):
git clone https://github.com/SamuelTulach/efi-memoryThan navigate to the driver folder and compile the driver with make:
cd efi-memory cd driver makeIf the compile was successful, you should now see memory.efi in the driver folder.
In order to use the efi-memory driver, you need to load it. First, obtain a copy of memory.efi (compile it or download it from release section) and a copy of EDK2 efi shell. Now follow these steps:
USB:. │ memory.efi │ └───EFI └───Boot bootx64.efi
FS0: ls
load memory.efi
exitto start standard boot procedure (while Windows is booting the screen should go blue with confirmation text)
I would like to thank @z175 for kdmapper project since that is a masterpiece. @Mattiwatti for EfiGuard project and the idea of SetVariable hooking. Roderick W. Smith for rodsbooks.com (really useful site to read about EFI basics).
This repo is licensed under MIT if not stated otherwise in subfolders.