Record · corpus.blog/posts/01a0872e-ce07-7283-b976-78c6ba6b8ef0

Guntior - the story of an advanced bootkit that doesn't rely on Windows disk drivers

artemonsecurity.blogspot.com · published 14 April 2024

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at artemonsecurity.blogspot.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 59
Words captured: 3,935

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqZkBSuurDZojHBUOHRKJm67rG9wU6lDnTuXSAteusfwcME-deVboDo2RPQ1Ixx2T6F1POLq2mEVfjC1CfjeE_JguZ-yUT-PWWG3-chPGfBTJC2XuFlDANe0e7a6aHJ5bbkaaSX4Lc7njMlvMmhOdTN0e5CSx_yTtSpaJzFslI0reSdcSB_WuTfXigA9jb/s800/1695990907551.jpg

blogger.googleusercontent.com

https://www.kernelmode.info/forum/

kernelmode.info

https://en.wikipedia.org/wiki/Kernel_Patch_Protection

en.wikipedia.org

https://learn.microsoft.com/en-us/windows-hardware/drivers/install/driver-signing

learn.microsoft.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzqSxRFcuXQUFx5l_l2j7G5N5FYucfgsuowDd3WXZo9VnDJzD_gxxdUBXAfPkjN1Nurow95cKlNR2fsmGKUnt_raN_m7IuGXBvRJcoZrXwTnpgRfO_eLsEODXWd_2b0gfKEubmCLH1yt5hlGAXsNonQYcfu7T5bzm9ImoYLd4ifEYk3FJ74zjkteBWN6Jn/s1155/1695995180347.jpg

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgy7UUC6SKkPChmSoZ5tSS8RUy52kgFSi32TykN6hsDyDKMwAbmLVRfaU6ElBrt_9lOkYBEB5cCTEHCamhca43PcFUt1ZrQve77wv1XHYYzcuYtHs6N4Du63Ehh9wr62YP9I6oAWziXbtZdjirffBTipq3mxrF0geywyHcuWITeZAkGtqoJs2oOElp5DNof/s705/1696272068580.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZXOvSgu_vWIaUbOCxmVJj0DKNG3-7I3_YjjYYTd9YBwEPj4IBUqQFfe8ZRISB067mnrKF8VJfg5IyzUXlJhlBz55e2mxcvZTrf8VirMjfKeW2W0x8FdB8d_tYWhcjXBH30y_hhJxHxzZI3jHHOOP5PbbNO2UCARsh9MrYQFwAADBSmCYjw84t5tuGKusP/s763/1696191835609.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyswOAjUY0-9gAZd-7U4bFE4d9Vgwzzdz9CtQptaAYWgsnE91UhyphenhyphenpKEsR62pL0oj5IipkbTawnlGNJY9JbnXCM5aFpA0Xh2ISvvmi0t2lk1nWO0DSJQr5GJLUgwNRjr5-5oUzV8X5kz4Fx1g2UFhPNkCLMNT13TUJJUXPuHmorVkSbjGWEupUMkNfMu3cn/s600/1696001126346.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHu5rQGZi5Ek8qc_fhfAmBJWNCuC8G_y_CROq6xI26bjKM6T5_9dNEztJSjJmiNpU_jmXTlS9FoDEAzXl0PIpJCtPD-pGUV1XoSXgqzvLcAutX9Z0ht6a5O6-FWnzerSvqxhX8TUmPP50q94-FDETED56rbEh2HuJZ1Cx_Gjc1XML6o3utybpgntOZFITP/s1632/1696191674186.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLFnvr41XwHQUUBX94lUV2NXw0ic6jKWY8mOMum8Y6Qkz5nqIstpWUwrkIYnmgk7-p5mo8-JO9B8sjDrkq8UIK2AdCZqI1WOQ-ax48jaOntGYZwRJbNTVzQB1Q57OqMOFURYo3zRl9Il0e2aG9FmmMdD8AptWCXDXToV9xSd_R2sY5P_Uqir1H1b9Bt-p-/s656/1696271163316.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgsNdndHekxxyOhp6FxKth2pi41By87Yf8sRTeE8Hic6icH1ImdNDgVSaA1o9_ChY9e0dkE2LI79iIOoe02pu8mMj2yiX2dr6rscVT-LNuay1O9E5PN_zyUrQed5az5IfX3FfAoTd1VZOBlshk8e6vircXNp4tyOGarIxSGTTDZyFtVOfAfCh0j3mmjFOXj/s712/1699798867651.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8kkFCCAphqWcgqPm827Kq4Ogy3IbEiwH2d110xY4fl9BvE8dBGxNPs4q26QlgBnMq-uHJZyEmZvJFO_e-zSE5yHHTiJLnl4F3hWvD0byo2zDYvIkOQktRgGmjh2A7zE91nY2xQuD47qaAiiFIRVY8RdAJpKYGsI_x6C55W5k1yLCXARPCw9JN_Mm-8L9O/s1096/1696263341399.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhieti4aJsekii6zt79aYEZHW903b3EqHj7QFe4bz67YzO1lOZvp5xM_AYrd26BP12yRzFz_7XYczNlanbG63npF3CdqHiz5K8NzxwnezGgW9Duj5qB51lUyrEDHNQ8epZhGa1euTOlEqrDJylINTsOxpI_7CiOngZXlo_2MJQ3klFwwiDdpnxEwweqvsQC/s878/1696270420311.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEinmEFTAZnpcLh7doDXMyDuK7Sv5gXqYw-h2z_j1_FJSd0JTMJ_lrYKLXT3zQuioTY6woQ9oKhT-IFoy9pZiET8lmIHFwjGCKpF5ZiZP13F7x_OSZMKiv6WwePkZFb3ZE8M0ifnRuSzdfRRJAp2AhJtPug1yIAsIbu47Lh5zF4LehWJTaWfOw3VQP4Sx4p5/s594/1696270796589.jpg

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZp2ZuYgB-Ud-39mRZvHTkJpvcTEprl48wYAmH9Tt88vjflcPsSP_VThEl_cCEqHIfb_uL-RxhJGLeFaKnR4V5B0HrpC8OoYydNq3Jr_ZjIyxLj_XztO2oLQXq1eU9bKhVMH580iB6VKfZAe3Frp67jsoVzk7zZj7hCw6q79_FOxGp_Lw5otPJDdfXBL6z/s827/1696771096563.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUfb4JlbakqSxC_jNpiws4ZdnpmbgXJMdoIaVipiCgLjzeEfHd4iR9rz1KnFiapClah8AfY6nBSXgF9LXHYOf1CK8_rxxO3Y3JyZqk4_eO6v3oOTaIB7Lla6MY15cLBRMSUcf9d-Z18LkBgqv1ICis1djxFGwSzl2TKne9UYY72qvh8y-8XHepoX9U3uLm/s655/Screenshot%202024-04-14%20204609.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbj8W_VW67F0eTOcUSSZPfbedbjp1waSLAMOsF9lQvgfMv8uQYjrYPdccO-j7t0odqJoceLdhIUuLNZuJaOj0BA6-KpPIZB1QfHFAtH6gBsdzG5XanWyLzxKQK5hq-gkqpogSN9AR2OMeqYTyY5y_uXdT54diPhi9NZVLk79ImuugpzySkmyWIr1rVjCxU/s815/1696431676794.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgubXkHEO3kiwswxyeZgIv33Q-J7oOdKCRKw8iZ0JmslfuzlgEdad1dzEI9DywbEHPynXkC860JF3IZOgiGv_-zoR3vnvmpD0cWV5y6Gremgj3pImELxPJCLI1O6G9pIYomDWqHespBnWNQALUvrY-f9b-Q_GCn3q1BdSWyXjWGjnGdEeRkFhJuYk2RjkBG/s694/Screenshot%202024-04-14%20204902.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIQDCG2nAXtoNP8g4QpxvbqG-J1sd1pVcscIhYcUSWDHfTTRP-MTW9xxczbSjU6N541uIM-ffs-B16b7vqNvVF_pCVj0XJTnB5QvLdEh-R_K6kCL-PfAEvR1b9hLbGgmW8Uaqf2NiI51VzLREHDzmcOfsqC3DTRkG5GfoZkwGsPoUlvIBuPeYVViKIE-ae/s809/1696769041842.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgd5emurILKuPkOmOj6aI-3TaJg7LWT1fNmg2A4i4xhfTpUj1nzY8W58dp5CxECj1NhV8bD3Dpi75hJm0PqB5LmJuQKMa2ut5t_cxiDpxHTaJoPkIeov4nE9vXJdgTsPkTlsqTcXx9sm4nkxQ1j96tRc60KlqOwknUisEPhbdAJlMpw47K22Ne2mC-ej3qA/s1097/1698678190908.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhp5wVxQ7nMeLPKTGQjXzbkBYrHEPm6bjsQQiZ9fBJL87MehRoOYuiglGWof-0PPqlXEE296xQsQpM91ZZr028PjSLDypIEHFZJ8YhyDbfjqftu9Dk4SbdWwq3zHymB0V7M-Aq1CO7Y4TowWuGMyqAclGbIXcMKEk1I-OhhcdAyqUqe-ilQ4Rce8QVsW_cy/s983/Screenshot%202024-04-14%20205918.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgS1TmhM_VuNYDux-kg06fj8IBk0EAoGk8JMTqKWbk8h9tKsnMw9h8f60DQ6TzUbsGary4rUA3uYDocr62PS-URnELYPAyncU3D0PNgP-kbn_yqCbcDJO3L3h-HeMZXuq_36WgdwGHkkQA1sLa6HtbU-qkMBNlPClBGTkJxD9taAvK6-hA8XWSGV8HRWwYc/s807/1698234807104.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAFgxjBemCYGs_vxh6EcSjkKDcAmmAWtU7JdC_OeZ2LjEmbLU5hyphenhyphen3jXFmXiorDfxrerwtut4_PjPzAmfjNpSU6fCqFnOPaLu-wyXe2f5nm4fLRd0Qo8NtqA2rqiE7aXvs2IFsW7jDo9-ssZAgl1UivCtAZmbwVbbiI2BvMqHyc9LJKNT3KK4IKpuCUNrM_/s1899/Screenshot%202024-04-14%20210249.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHv6mRtxwLN-DhcOJKV3Yyc-0Xmte9FRbJXuyMEB6SPWJ2wTjFTeu1RIxiBLmju_X-chE35PH-IXad7qpQ1srinh6g-vNkAjoWURaN2cRb6qMzonkhHRtXEouIPTUZa-HYFZKYfCZB5Py6WH_uiZeMqOWYbum_8OHmsyl-Ts2Z_TpflC-y-E1fXxd1QNiw/s1024/1698264585102.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhURnSmfJT8hBW9ZT16SYBv-m1BByBTEVcie8qEVEiPVYGtBJvGGKrZlbe8bJqc756k0EZT2C5fyHKceyWwoHz1EjttYLbhNt5AapSlxfv1fM9eifnOmmWzZ3Axa6PhfapfiGWCYWlS5u32J9EZRAJjyixV73JCNdZ5aDU-ViWvIXXzP7PxPvWSdOLVLjJY/s675/Screenshot%202024-04-14%20210733.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEHepvCc_VoWdD0HHjSL4iWL04dp2PrAouZtmT1w_C9k1KgFF1vrKXRGs3PvASQgUlyrJJz_3bfvczlvDdoCanFc5xLumnBr2Czj1d5RbEhJ2QC5lsortaKWG2z4_2raRIsVMvkOFgqTgP6PB8EC9C7AI29nVmKGC-gP40QY9KYJpnUFtHO7gHp-4GxgzV/s864/1698341059812.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjxZOIJv1dYt28VJa7ncIV0qsYMis1E6wQyAxe0WYJ0heVWUrEZOpQi2gp9JRECXvD18Qw9nSJmaV_tczDLmTRz9LpQfQPNr531PRY_tYrrC9JxR4sXvE8Pvnmnvu2mvYoVKzYMwH8cAMfeMZR3XGwvAGNDlS4OwEe_8fPgcIN2nr3etaPOcB7Vz_MoZonK/s1629/1698224375453.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1va_Wx6yaof_zjyEnluRWRZn36DKaRvC2b1wfjtXMJR68qGzHBNIV42Vor0IYjBlmqbpVITLOvXD4U3ywM-OB91RFGpjbQORxaEvd1-x985qhl22WQ1fsMILuC1OcW31glUqFqyZJyeFH8ETP24SNQvyRdVoZQRjSOnVORjau2-u72eDTguO6SwJ5xXgc/s1200/1698350401783.jpg

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjzF0wRSazZXaAi3SiAkx3TjgZxBih1g52buwCMNe1Vslpu1OefwNlSRGA0FmPdrVyTxDERUapItKj5gk9_rVUPTzX3AIt9y6ok1KKY4IrsRVRsuQMBOZrF54MRSh1ouVfLv8hrC0mG8BaTxpC57sSg7kbBfv2pSi9WJEDa-ib8n5GhPcTUTNdU7Kda8uXR/s938/1698763818674.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEigjvd47M1OCUdvZXqx7Rael-zXJTdtWKqMLkCOW7xCJ65ZDVcxr32_Umu_CQdTqVMtdQgqWNiIHpA4AFQAh6nHXZ3_lR6XUejGLm4An26RA5m3wNbv1CWtZgpe74UOxQgd4P6VMVDg_Ig3fwsZWXbXqxpfg_sBYk8KO2ka-5kgh0hbH_dGZFOW0c1Ftp6R/s655/Screenshot%202024-04-14%20211355.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi9Ss531Fkr7oZ5FiauvNl9DSpaleSNacemhzCNvzIfFOH1Ip90hPCFc2sQyMNNvbiyvofn4o5uJK5abS5KKAXxwItk7stG1H0FszCHzyEK5f04AByifi_OGzwyeD3Ka8CuCn3nGexDDnGuhBKJC5UOsusMEd4hnXcy7yCsUEHxQKLhCUudZxEwn15re7_n/s693/Screenshot%202024-04-14%20211455.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4QricMzf-yN73HEhJdD_x8Lpw_NpEk3Oj5UJxv_QFGrOcLs0d80brSI1qRpmYiyTAUdthMMbFxYl3pm64KnInMDtN-VuipkDi02tERXltQkVYXTJwf8VtKhz6LNE_Xx7OxXeSIS8V4Hbcm2FbkD5nhFn0o8qmXVQZvzBEdJ7hwNkbzbErhLRPAXVFLujz/s755/Screenshot%202024-04-14%20211613.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzJAJvLeFy2-aY-nWXCxi-AIPpY-gScgfsYHX6sVELOGdSPTkcb1zLlx_pivXpevnBg8lf6GZY2Ny3OzHO68-f2dNqBVgeCyk-2EM7EA6YcixU1gP7dAYucOBVOgl6V-DBUJ6ZGr9vQ0Fs2OMvMBgja_jecALdtwPjzFLNimRpM9Cwy7dd9zwqYQ_AhiNo/s749/1699800256680.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZtwfZHwXs3uwdei_fDjJ1dMGolQomNZGXr78SlgFErvGCX8-R9rqQE_IuH2qh8NsaQA2v_6ZR-mROXQVOQ8DyNNe4B-DCTWeHUZoP2FbU4DsDS3at99TAkvYEoNhhf6NT0bMCsFbMDilxjP4uprxe38yQEItP81-fZA23ouw1sO8phEHcHiQ1K-5AdEk_/s973/1699651044966.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLxXeOBsJxRx_ek1TZZJL-4VjHkk3yr_PnGeQR3ddG865Jbtckcje-tM8Ki9zHTt8YIgB0YXSsHGmT56CdXYWm6pRQJJ-lefm6HN5wqNd8k1KQcsPCrUU9LB-J-3Lg19NR79WG1JuzMETfjFEDOPIvKRwjHdtfy-wSPdDxAWh9esNf4SYuGmyFDvITncDH/s932/1699720434327.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJa8Y-vInBQrJa39AZ-9Ifa59mEAqrVju6t4WYUeXiVEdfjK22N33saRi3PUBYSnYMbZfbKZEQtwAyPAC93qYLgQaYRVJSQ5KYY8kQBFH_PoArvKhyphenhyphencF8RxhV4XvKdOMO0t2Ao0Xha_Apd8krP5zUVbMx_SMnLE57mZxC32JS6KjB0Y52YfkrF5vmfa3v_/s971/1699652685814.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggPB3yZD-CRba6YF9xr85Zad4gN68IFjQXmz-co06UH399My_XhdknRGb6YNvn8SjIgs12KZXKM2Oc2j92XJA0MwpohdonnwYOo2IeN4sSxrZHl-s0n53vbYbt017xL-5Cxf3liNKQovJ-1phUx5EmiIYHZXdPGBfKG5H3daYqgrMBeveHqXD0XlGkFKxc/s775/Screenshot%202024-04-14%20212255.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUzGqTe5yaxhyphenhyphenkXn5J_VVgyaDqbGcWvq-s875AWJQD2e9XIuBkSqdZOkaFeBdYGqMJfF7sWcs7ahZlIZWJ4oc0Aq5KRyr7K9TuDw2RrF8mtbk1lQjxBS7AioAjOuT2sm0C70iDESm7hvNJZOkj_t6_1s5Ng1v9IzAzNop5cUOLlNVFOIUQs-0R70W0Kw5U/s1209/1699801078478.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRyXwrVp43bsL9xASiRS-Cd8NvvZjhY2LxmBntKvjupHCwdlHHSSvfW8B5xUVuK9z_jUJCNh3Alh2zmNGXJOFYTnBPRH_kk9adWeGk6ha8keWpCI_npAROhDBdRqBnNbCLBNIRfPfUQPYejPdrDrAw4HoAZPkTHQAoUK5nNnusIyFNHPPj17a39xqvHKY-/s1519/1699970841307.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEixFXDgpzEMMsU7HyK0d5eNuJnzJHeiadOXTjwVD-EgnegtJmcz7Y6jAn2ETiuW7_6E3_mZ1C-svvaYiFbsZ-Tg1nW4xip7xH2VMLsgeAwz9pPqMxIgfU5YD8dzwO829q3QpCBhKByd_dV5R7Wp2FUx1dfQj8KgWbvKQ9HiTCojXtj7DyivUGA7ikyZGzbX/s1899/1699971790770.png

blogger.googleusercontent.com

https://www.kernelmode.info/forum/viewtopicf168-2.html?f=16&t=1765

kernelmode.info

https://wiki.osdev.org/ATA_PIO_Mode

wiki.osdev.org

https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ata/ns-ata-_identify_device_data

learn.microsoft.com

https://wiki.osdev.org/ATA_Command_Matrix

wiki.osdev.org

https://forum.osdev.org/viewtopic.php?f=1&t=30125

forum.osdev.org

https://systemroot.gitee.io/pages/apiexplorer/d5/d3/pci_8h-source.html

systemroot.gitee.io

https://en.wikipedia.org/wiki/DOS_memory_management

en.wikipedia.org

https://doxygen.reactos.org/d4/d45/drivers_2bus_2pcix_2enum_8c_source.html

doxygen.reactos.org

https://www.kernelmode.info/forum/viewtopicf771-3.html?p=14683

kernelmode.info

https://zerosecurity.org/2013/06/guntior-bootkit-upgraded/

zerosecurity.org

https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm

thestarman.pcministry.com

https://thestarman.pcministry.com/asm/mbr/VistaVBR.htm

thestarman.pcministry.com

http://ntfs.com/ntfs-partition-boot-sector.htm

ntfs.com

https://github.com/microsoft/Windows-driver-samples/blob/main/storage/tools/spti/src/spti.c

github.com

https://learn.microsoft.com/en-us/previous-versions/windows/hardware/kernel/ff546644(v=vs.85)

learn.microsoft.com

https://wiki.osdev.org/PCI

wiki.osdev.org

https://codemachine.com/downloads/win71/wdm.h

codemachine.com

https://reactos.org/forum/viewtopic.php?t=14520

reactos.org

https://mybogi.files.wordpress.com/2011/08/interrupt-13h.pdf

mybogi.files.wordpress.com