CVE-2022-21894

baton drop CVE-2022-21894: Secure Boot Security Feature Bypass Vulnerability Windows Boot Applications allow the truncatememory setting to remove blocks of memory containing "persistent" ranges of serialised data from the memory map, leading to Secure Boot bypass. The truncatememory BCD element...

initroot

initroot: Motorola Bootloader Kernel Cmdline Injection Secure Boot & Device Locking Bypass CVE-2016-10277 By Roee Hay / Aleph Research, HCL Technologies First stage exploit: Tethered jailbreak This exploit gains an ephemeral unrestricted root access on the device. For example, on cedric some...

incus-os

Introduction IncusOS is an immutable OS image dedicated to running Incus. It's based on Debian 13 and built using mkosi. IncusOS can be installed on modern amd64 x8664 and arm64 systems. This aims at providing a very fast, safe and reliable way to run an Incus server. It's got a strong focus on...

Super-UEFIinSecureBoot-Disk

Super UEFIinSecureBoot Disk Super UEFIinSecureBoot Disk is a proof-of-concept not actively maintained or enhanced bootable image with GRUB2 bootloader designed to be used as a base for recovery USB flash drives. Key feature: disk is fully functional with UEFI Secure Boot mode activated. It can...

edk2

============== EDK II Project A modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications from www.uefi.org. .. image::...

CVE-2025-0690

CVE-2025-0690: Integer Overflow Vulnerability in GRUB2 🛡️ Overview CVE-2025-0690 is a critical integer overflow vulnerability in the GRUB2 boot loader, allowing arbitrary code execution and Secure Boot bypass. This flaw affects systems that rely on GRUB2 for secure boot, exposing the system before...

virt-firmware

Tools for ovmf / armvirt firmware volumes This is a small collection of tools for edk2 firmware images. They support decoding and printing the content of firmware volumes. Variable stores OVMFVARS.fd can be modified, for example to enroll secure boot certificates. virt-fw-dump Decodes and prints...

rp2350_hacking_challenge

RP2350 Hacking Challenge Welcome to the Raspberry Pi RP2350 hacking challenge and bug bounty! Watch our quick explainer video: Update Jan 14th 2025 Congatulations to the 4 winners! Read about them allhere. A huge thank you to Thomas Roth and the team at Hextree.io for helping us develop and launc...

test_avb_key

On Almost Signing Android Builds Introduction An error sometimes encountered by NCC Group consultants is signing Android builds with known private keys. This leaves the device manufacturers and in turn their users vulnerable, even on devices where secure boot is enabled. This blog post has two...

shim-review

This repo is for review of requests for signing shim. To create a request for review: clone this repo preferably fork it edit the template below add the shim.efi to be signed add build logs add any additional binaries/certificates/SHA256 hashes that may be needed commit all of that tag it with a...

secureboot_objects

Secure Boot Objects This repository is used to hold the secure boot objects recommended by Microsoft. For documentation visit our Wiki! Versioning This repository follows semantic versioning .., which is a versioning scheme that conveys meaning about the underlying changes. Version Components Maj...

CVE-2026-8863

CVE-2026-8863 Collection of the signed UEFI Secure Boot shim binaries affected by CVE-2026-8863, with the embedded shim version, Authenticode signer and revocation hashes of each image. Releases that ship the byte-identical signed shim are collapsed onto a single row — one Authenticode hash is on...

secure-boot-cert-servicing

Secure Boot Certificate Rollover — assessment and servicing A single, self-contained PowerShell script that assesses a Windows machine's Secure Boot certificate posture for the 2011 → 2023 rollover CVE-2023-24932 / KB5025885 and, only when you explicitly ask it to, opts that machine in to the...

BootHoleFix

Boot Hole Fix This script will remediate the BootHole bug identified in CVE-2020-25632 and/or CVE-2021-20233. On July 29, 2020, Microsoft published security advisory 200011 that describes a new vulnerability that's related to Secure Boot. Devices that trust the Microsoft third-party Unified...

CVE-2024-7344

🐞 CVE-2024-7344: Improper PE Image Loading This repository contains research material related to CVE-2024-7344, a Secure Boot bypass vulnerability affecting UEFI systems. It centralizes technical analysis of the vulnerability, attack flow documentation, and recreated applications designed to...

CVE-2025-47827

CVE-2025-47827 Proof-of-concept and vulnerability report for CVE-2025-47827. Contents Description Disclosure Impact Detection Mitigation Binaries Proof of Concept Resources Description In IGEL OS before v11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a...

CVE-2026-25250

🕷️ CVE-2026-25250: Improper Trusted Bootloader Chain Validation A Microsoft-signed third-party bootloader that loads a secondary EFI binary with no signature or integrity verification, collapsing the Secure Boot chain of trust from within. 📑 Table of Contents Research Context Official References...

CVE-2020-14372

CVE-2020-14372: Bypassing not so Secure Boot with one "simple trick" Vulnerability details One day I typed "help" into GRUB2's console and saw some really "fun" commands: readbyte ADDR: Read 8-bit value from ADDR writebyte ADDR VAL: Write 8-bit value VAL to ADDR I immediately thought I found the...

dubiousdisk

dubious disk - the porygon-z that's super effective against secure boot! CVE-2022-30203, CVE-2023-21560, CVE-2023-28269, CVE-2023-28249, and more... Overly permissive code in the Windows boot environment allows for overwriting arbitrary memory, and therefore, arbitrary code execution. Exploitro...

BitUnlocker

BitUnlocker Downgrade Attack A proof of concept for accessing BitLocker-encrypted disks in under 5 minutes on fully patched Windows 11 machines through a boot manager downgrade attack, leveraging the SDI vulnerability originally documented as CVE-2025-48804. The July 2025 patch fixes this in...