Find malware hiding below your operating system.
What it does
Investigates suspected bootkits and rootkits and produces findings on boot-sector integrity, firmware implants, kernel hooks, and persistence.
When to use it
Use when compromise survives OS reinstallation, antivirus or EDR misses evident infection, Secure Boot integrity fails, or memory forensics reveals rootkit behavior.
How to use it
Give it suspected boot-sector, firmware, and memory evidence; it returns a report covering integrity, rootkit artifacts, persistence, and remediation.
What you provide
- Your files
Uses
Latest review
What you need · 8
Requires UEFITool for firmware-volume analysis and module extraction.
Requires chipsec for hardware-level firmware security assessment.
Access · 5
This skill
/dev/sda
Read
Reads raw disk boot sectors
/dev/sda1
Read
Reads partition boot data