CVE-2022-21894

baton drop CVE-2022-21894: Secure Boot Security Feature Bypass Vulnerability Windows Boot Applications allow the truncatememory setting to remove blocks of memory containing "persistent" ranges of serialised data from the memory map, leading to Secure Boot bypass. The truncatememory BCD element...

initroot

initroot: Motorola Bootloader Kernel Cmdline Injection Secure Boot & Device Locking Bypass CVE-2016-10277 By Roee Hay / Aleph Research, HCL Technologies First stage exploit: Tethered jailbreak This exploit gains an ephemeral unrestricted root access on the device. For example, on cedric some...

shim

shim, a first-stage UEFI bootloader shim is a trivial EFI application that, when run, attempts to open and execute another application. It will initially attempt to do this via the standard EFI LoadImage and StartImage calls. If these fail because Secure Boot is enabled and the binary is not sign...

edk2

============== EDK II Project A modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications from www.uefi.org. .. image::...

Orchestrated-Powershell-for-CVE-2023-24932

Secure Boot Orchestrator CVE-2023-24932 Automates the full Secure Boot mitigation for CVE-2023-24932 BlackLotus. Handles all registry changes, reboots, and verification automatically. Requirements Windows 10/11 or Server 2016+ Administrator privileges Secure Boot enabled Cumulative Update = July...

Orchestrated-Powershell-for-CVE-2023-24932-en

Secure Boot Mitigation Orchestrator Script Overview This PowerShell script automates the Secure Boot mitigation steps for CVE-2023-24932 , as outlined in the Microsoft Security Guidance. It handles the entire process, including registry updates, reboots, and event log validation, to ensure your...

rp2350_hacking_challenge

RP2350 Hacking Challenge Welcome to the Raspberry Pi RP2350 hacking challenge and bug bounty! Watch our quick explainer video: Update Jan 14th 2025 Congatulations to the 4 winners! Read about them allhere. A huge thank you to Thomas Roth and the team at Hextree.io for helping us develop and launc...

BitUnlocker

BitUnlocker Downgrade Attack A proof of concept for accessing BitLocker-encrypted disks in under 5 minutes on fully patched Windows 11 machines through a boot manager downgrade attack, leveraging the SDI vulnerability originally documented as CVE-2025-48804. The July 2025 patch fixes this in...

virt-firmware

Tools for ovmf / armvirt firmware volumes This is a small collection of tools for edk2 firmware images. They support decoding and printing the content of firmware volumes. Variable stores OVMFVARS.fd can be modified, for example to enroll secure boot certificates. virt-fw-dump Decodes and prints...

shim-review

This repo is for review of requests for signing shim. To create a request for review: clone this repo preferably fork it edit the template below add the shim.efi to be signed add build logs add any additional binaries/certificates/SHA256 hashes that may be needed commit all of that tag it with a...

incus-os

Introduction IncusOS is an immutable OS image dedicated to running Incus. It's based on Debian 13 and built using mkosi. IncusOS can be installed on modern amd64 x8664 and arm64 systems. This aims at providing a very fast, safe and reliable way to run an Incus server. It's got a strong focus on...

secureboot_objects

Secure Boot Objects This repository is used to hold the secure boot objects recommended by Microsoft. For documentation visit our Wiki! Versioning This repository follows semantic versioning .., which is a versioning scheme that conveys meaning about the underlying changes. Version Components Maj...

test_avb_key

On Almost Signing Android Builds Introduction An error sometimes encountered by NCC Group consultants is signing Android builds with known private keys. This leaves the device manufacturers and in turn their users vulnerable, even on devices where secure boot is enabled. This blog post has two...

dubiousdisk

dubious disk - the porygon-z that's super effective against secure boot! CVE-2022-30203, CVE-2023-21560, CVE-2023-28269, CVE-2023-28249, and more... Overly permissive code in the Windows boot environment allows for overwriting arbitrary memory, and therefore, arbitrary code execution. Exploitro...

CVE-2020-14372

CVE-2020-14372: Bypassing not so Secure Boot with one "simple trick" Vulnerability details One day I typed "help" into GRUB2's console and saw some really "fun" commands: readbyte ADDR: Read 8-bit value from ADDR writebyte ADDR VAL: Write 8-bit value VAL to ADDR I immediately thought I found the...

secure-boot-cert-servicing

Secure Boot Certificate Rollover — assessment and servicing A single, self-contained PowerShell script that assesses a Windows machine's Secure Boot certificate posture for the 2011 → 2023 rollover CVE-2023-24932 / KB5025885 and, only when you explicitly ask it to, opts that machine in to the...

CVE-2025-0690

CVE-2025-0690: Integer Overflow Vulnerability in GRUB2 🛡️ Overview CVE-2025-0690 is a critical integer overflow vulnerability in the GRUB2 boot loader, allowing arbitrary code execution and Secure Boot bypass. This flaw affects systems that rely on GRUB2 for secure boot, exposing the system before...

CVE-2025-3052

🐞 CVE-2025-3052: IhisiParamBuffer Memory Corruption This repository centralizes research material related to CVE-2025-3052, a memory corruption vulnerability in a UEFI module signed with Microsoft's third-party certificate that allows an attacker to corrupt security-critical firmware structures,...

CVE-2025-47827

CVE-2025-47827 Proof-of-concept and vulnerability report for CVE-2025-47827. Contents Description Disclosure Impact Detection Mitigation Binaries Proof of Concept Resources Description In IGEL OS before v11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a...

CVE-2022-34301

🕷️ CVE-2022-34301 - Eurosoft Boot Loader Vulnerability Eurosoft Pc-Check UEFI Diagnostics Shell - Bring Your Own Vulnerable UEFI Application BYOVUA - Secure Boot bypass via signed UEFI Shell and gSecurity2 corruption. 📑 Table of Contents Overview Background Bring Your Own Vulnerable UEFI...