EfiGuard UEFI Bootkit for Windows Kernel Security Research

EfiGuard is an experimental UEFI bootkit designed to modify parts of the Windows startup process. It patches the Windows boot manager, boot loader, and kernel during startup to demonstrate how security mechanisms such as Kernel Patch Protection (PatchGuard) and Driver Signature Enforcement (DSE) can be bypassed.

The project is primarily relevant to Windows kernel research, UEFI security analysis, and controlled driver-development testing. Because it interferes with protections that help prevent unauthorised kernel code execution, it should only be examined in an isolated test environment with explicit authorisation.

How EfiGuard Works

EfiGuard operates as a UEFI DXE driver. Rather than modifying Windows kernel or boot-loader files directly, it intercepts relevant boot-time activity and applies patches as Windows components are loaded.

Its architecture uses runtime instruction decoding through the Zydis disassembler library. This approach helps the project identify relevant instructions without relying entirely on fixed byte signatures, which can become unreliable after Windows updates.

The driver works passively and responds when the firmware boot manager loads the Windows boot manager. If another operating system starts instead, EfiGuard can unload itself.

Key Features

• UEFI-based operation: Works during the firmware boot process rather than relying on modifications to Windows system files.
• Multiple boot stages: Supports patching across the boot manager, boot loader, and Windows kernel stages.
• PatchGuard research: Demonstrates how Kernel Patch Protection can be affected by boot-time kernel modifications.
• DSE research: Includes mechanisms designed to interfere with Windows Driver Signature Enforcement.
• Diagnostic output: Can provide debugging information during different stages of the boot process.
• Failure handling: Reports patching errors and provides an opportunity to continue booting or restart.
• UEFI shell support: Supports an alternative driver-loading approach for systems where the standard loader does not work.

PatchGuard and Driver Signature Enforcement

PatchGuard protects critical Windows kernel structures from unauthorised modification. Driver Signature Enforcement checks whether kernel-mode drivers meet Windows signing requirements. Both mechanisms play an important role in maintaining operating system integrity.

EfiGuard demonstrates how modifying the boot process can affect these protections. Its DSE-related research includes different approaches to changing how driver integrity checks behave. The project also includes a companion utility, EfiDSEFix, associated with its DSE research functionality.

These capabilities are security-sensitive. Disabling kernel protections can expose a system to unsigned drivers, malicious kernel code, rootkits, and other forms of low-level compromise.

Limitations and Compatibility

The original project documentation describes support for EFI-compatible x64 Windows releases available at the time, including versions from Windows Vista SP1 through Windows Server 2019. This historical compatibility claim should not be treated as confirmation of support for current Windows releases.

• HVCI limitations: EfiGuard cannot disable Hypervisor-enforced Code Integrity. HVCI can invalidate the practical effect of its DSE bypass methods.
• Checked kernels: Checked Windows kernels are not supported because their initialization and protection code differs from standard builds.
• Firmware compatibility: The original loader may not boot directly on certain hardware configurations. UEFI shell support is documented as an alternative.
• Version sensitivity: Changes to Windows boot components and kernel internals can affect patch compatibility.

Building and Project Requirements

The original source uses the EDK II development environment to compile its UEFI components. The documented build process requires an EDK II workspace, the EfiGuard source package, and a supported compiler toolchain.

The companion EfiDSEFix application has a separate Visual Studio build requirement. Developers researching the source should consult the repository’s current build documentation rather than assume that the original 2019 instructions remain compatible with modern development environments.

Security Research Considerations

EfiGuard provides a useful case study for understanding the relationship between UEFI firmware, Windows startup components, kernel integrity, and driver-signing protections. However, its bootkit functionality can undermine important operating system security controls.

Researchers should use disposable virtual machines or dedicated test hardware, maintain recovery media, and avoid deploying modified boot components on everyday systems. Security teams can also use the project’s architecture as a reference when studying boot-chain integrity and detecting unauthorised changes to startup components.

For additional security research resources, explore our guide to open-source security and OSINT tools.

Project Resources

• EfiGuard source repository (verify the correct project repository before using this link).
• EDK II development environment
• Zydis disassembler library