xsh3llsh0ck/MilkBox
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
Tool to dump EFI runtime drivers.
2 commits 1 branch 0 tags 100 KiB
  • C 100%
Find a file
Exact
____SKVLLZ c28e9c2f36 Exit from PoC state 
I thought I needed to get out of the PoC state and added a utility to fix the dumps.

The code is now documented, added a Doxyfile for anyone who wants to generate documentation.

Added an example of a dumped and fixed driver.
2024-02-23 03:15:26 +02:00
Example Exit from PoC state 2024-02-23 03:15:26 +02:00
MilkBox Exit from PoC state 2024-02-23 03:15:26 +02:00
MilkBoxClient Exit from PoC state 2024-02-23 03:15:26 +02:00
MilkFix Exit from PoC state 2024-02-23 03:15:26 +02:00
.gitignore Exit from PoC state 2024-02-23 03:15:26 +02:00
Doxyfile Exit from PoC state 2024-02-23 03:15:26 +02:00
LICENSE Public Release (20H2+) 2023-12-17 16:05:45 +02:00
MilkBox.sln Exit from PoC state 2024-02-23 03:15:26 +02:00
README.md Exit from PoC state 2024-02-23 03:15:26 +02:00

README.md

MilkBox

MilkBox - PoC of dumping EFI runtime drivers.

Demo

You can watch it here.

Usage

rtd - Locate runtime drivers (should be performed firstly)
wd - Write dump to binary file, dump location - "C:\MilkBox\"
ud - Uninstall driver
ex - Exit from program

Compilation

The MilkBox driver is compiled by any WDK designed for Windows 10 and above. The client is compiled with MSVC v143 or higher.

Restrictions

Since the driver is test signed only, you will need to disable DSE (Driver Signature Enforcement) while the driver is in use. PoC was only tested on a virtual machine. Although theoretically everything should be fine, but be careful if you use the driver on a physical machine.

Acknowledgments

Alex Ionescu, Satoshi Tandasat (for some tricks with physical memory which I implemented too).

Credits

0x00Alchemist (2023 - 2024)