3 ms·

> I want to make a persistent implant/malware that survives OS reinstalls. You want to look into something called "Windows Platform Binary Table" [1]. Figure o

> I want to make a persistent implant/malware that survives OS reinstalls. You want to look into something called "Windows Platform Binary Table" [1]. Figure out a way to reflash the BIOS or the UEFI firmware for your target device ad-hoc and there you have your implant. [1] https://news.ycombinator.com/item?id=19800807 https://news.ycombinator.com/item?id=19800807

ronsor 9mo ago
Only works if the target is running Windows (paranoid people might be on Linux), so you'd probably want to slip in a malicious UEFI driver directly. Tools like UEFITool can be used to analyze and modify the filesystem of a UEFI firmware image.
baby_souffle 9mo ago
> You want to look into something called "Windows Platform Binary Table" [1]. Is this how various motherboard manufacturers are embedding their system control software? I was helping a family friend with some computer issues and we could not figure out where the `armoury-crate` (asus software for controlling RGB leds on motherboard :() program kept coming from
- Nextgrid 9mo ago
  That most likely comes from Windows Update though. It now has the ability to download "drivers". It actually had said ability for a long time (back from Vista days if I remember right) but back then it was only downloading the .inf file and associated .sys files/etc, where as nowadays it actually downloads and runs the full vendor bloatware.
- BobbyTables2 9mo ago
  Likely so. I think that’s actually the intended use of this “feature”
- phatskat 9mo ago
  Have your friend grab https://github.com/seerge/g-helper https://github.com/seerge/g-helper which can disable armory crate. It’s also a lot lighter on your system - I was having constant gradual frame drops (games would start find and performance would slowly degrade) until I tried this and used the option to disable the AC processes.

ronsor 9mo ago

Only works if the target is running Windows (paranoid people might be on Linux), so you'd probably want to slip in a malicious UEFI driver directly. Tools like UEFITool can be used to analyze and modify the filesystem of a UEFI firmware image.

baby_souffle 9mo ago

> You want to look into something called "Windows Platform Binary Table" [1]. Is this how various motherboard manufacturers are embedding their system control software? I was helping a family friend with some computer issues and we could not figure out where the `armoury-crate` (asus software for controlling RGB leds on motherboard :() program kept coming from

Nextgrid 9mo ago
That most likely comes from Windows Update though. It now has the ability to download "drivers". It actually had said ability for a long time (back from Vista days if I remember right) but back then it was only downloading the .inf file and associated .sys files/etc, where as nowadays it actually downloads and runs the full vendor bloatware.
BobbyTables2 9mo ago
Likely so. I think that’s actually the intended use of this “feature”
phatskat 9mo ago
Have your friend grab https://github.com/seerge/g-helper https://github.com/seerge/g-helper which can disable armory crate. It’s also a lot lighter on your system - I was having constant gradual frame drops (games would start find and performance would slowly degrade) until I tried this and used the option to disable the AC processes.