Alejandro Vazquez and Maria San Jose delivered a DEF CON 33 presentation (published 2025-10-10) that combined lecture and live demo to reveal a complete, documented UEFI bootkit and a Windows kernel-mode rootkit. The session was hands-on in tone: the speakers explained high-level concepts of the boot chain (UEFI/ESP, boot manager, OS loader, kernel), the protective mechanisms commonly encountered (Secure Boot, driver signature enforcement), and then showed a vulnerable Lenovo laptop where their UEFI component installed during early boot and delivered a kernel resident payload. The talk included two demo tracks: one where the UEFI boot application drops a kernel driver into memory, and a second where a DXE runtime driver is also loaded to provide a persistent runtime backdoor capability. Throughout the talk they emphasized that the materials they were releasing are complete and usable and that their aim is to accelerate legitimate research and red-team capability development.

The released corpus—exposed via QR codes during the talk—contains multiple repositories: a UEFI bootkit project (UEFI application, DXE runtime driver, configuration tools and encrypted config schema), a separate full-featured kernel-mode rootkit repository with user-mode communication tools and dozens of PoCs, and a larger collection of ~400+ resources for firmware and kernel research. They also provided automation scripts to set up development/test environments and notes for installing/analyzing on physical hardware. The rootkit examples implement six broad capability classes (communication, kernel-object manipulation, keystroke capture, network filtering, kernel-level C2, and filesystem filtering) and are accompanied by standalone PoCs for each technique. The presenters framed their release as a resource for defenders and offensive teams to study and emulate advanced threats, while offering substantial documentation so practitioners can analyze, test, and adapt these techniques in controlled environments.