Barzakh - Ring -4 to Ring 0: offense-defense firmware resear

项目说明

Project Barzakh (برزخ)

<di="center">

> *"Barzakh" (برزخ) — a barrier between two realms; the unseen boundary separating the living world from the world of spirits. Here it stands for the barrier between offense and defense, between and detection.*

The most comprehensi UEFI firmware security research platform

*Offense emulation from Ring 0 to Ring -4 | 122 detection engines | Closed-loop ad *

![CI]()

</div>

---

> ⚠️ ACADEMIC RESEARCH PROJECT — DEFENSI ONLY
>
> This platform exists to study firmware threats and build defenses against them. It contains li emulations with hardware-rooted kill-switches. By accessing this repository, you agree to use it solely for legitimate security research and educational purposes.

---

📋 What Is Barzakh?

Barzakh is a full-stack firmware security research platform that models real-world bootkit TTPs across every pri ring — from UEFI DXE drivers (Ring 0) down through SMM, Intel ME, AMD PSP, platform DMA controllers (Ring -3), and CPU microarchitectural threats (Ring -4). It pairs each offense technique with a corresponding detection engine, creating a closed-loop system where every attack is both reproducible and detectable.

Key capabilities:

Reference Ad Modeled

| Threat | Technique | Barzakh Co |
|--------|-----------|-----------------|
| BlackLotus (C) | Secure Boot bypass shim | blacklotus detector + blacklotus_mok payload |
| LogoFAIL (C) | Image parser o in UEFI firmware | logofail detector + logofail_image payload |
| PixieFail (C+) | Network stack buffer o in EDK2 | pixiefail detector + pixiefail_dhcp payload |
| CosmicStrand | SPI flash DXE persistence | F + SPI region + persistence detector |
| LoJax | First in-the-wild SPI implant | ME/SPI detector + flash descriptor analysis |
| MoonBounce | Modified core DXE in SPI flash | Boot Services hook + firmware diffing |
| MosaicRegressor | UEFI persistence framework | Multi-stage: F + PE inject + trampoline |
| Hacking Team (RCS) | UEFI rootkit with Option ROM | Option ROM detector + PCI expansion analysis |
| FinSpy | UEFI bootloader modification | ExitBootServices interception + memory scanning |
| Bootkitty (2024) | First Linux UEFI bootkit, GRUB signature bypass | linux_bootchain detector + bootkitty_grub_patch payload |
| C | Signed reloader loads unsigned PE payloads | reloader detector + secureboot_reloader payload |
| C/1018 | TPM 2.0 reference implementation buffer o | tpm_command detector + tpm_ref_o payload |

---

🏗️ Architecture

<di="center">
<img src="docs/architecture.svg" alt="Barzakh Architecture" width="820">
</div>

---

🧩 Core Components

1. BootkitPkg — Offense Emulation (C11, EDK II)

31 modules across 4 architectures emulating every known firmware persistence technique:

<details>
<summary><b>x86_64 Core (17 modules)</b></summary>

| Module | Ring | Technique |
|--------|------|-----------|
| DxeInject | 0 | DXE phase dri with kill-switches |
| ExitBootHook | 0 | ExitBootServices interception + MSR hooking |
| LoadImageHook | 0 | Boot Services LoadImage/StartImage redirection |
| Set | 0 | NVRAM manipulation |
| F | 0 | Firmware implant persistence |
| SpiFlashEmulator | -1 | SPI controller register emulation |
| SpiChipsetEmulator | -1 | Chipset-level SPI interface simulation |
| SmmPersistence | -1 | SMM handler installation and SMRAM persistence |
| CapsuleHijack | -1 | UEFI capsule update mechanism abuse |
| AcpiTableInject | -2 | ACPI table injection for kernel memory access |
| | -2 | EFI Runtime Services hooking |
| PciOptionRom | -2 | PCI Option ROM implantation |
| MeSpiManipulation | -3 | Intel ME SPI flash region manipulation |
| HeciIntercept | -3 | Host-ME communication channel interception |
| MeDmaAttack | -3 | ME-initiated DMA to host memory |
| AmtSolChannel | -3 | AMT Serial-o covert channel |
| FtpmCommandForge | -3 | AMD fTPM command forgery via PSP mailbox |

</details>

<details>
<summary><b>AArch64 / Apple Silicon (7 modules)</b></summary>

| Module | Technique |
|--------|-----------|
| Aarch64DxeInject | ARM64 DXE injection with EL-aware payloads |
| Exception | exception table relocation |
| El3SecureMonitor | EL3 Secure Monitor call interception |
| TzascManipulation | TrustZone Address Space Controller bypass |
| De | Device Tree Blob modification for persistence |
| IbootTrustChain | Apple iBoot chain-of-trust sub |
| SepMailboxIntercept | Apple SEP (Secure Encla interception |

</details>

<details>
<summary><b>RISC-V (1 module)</b></summary>

| Module | Technique |
|--------|-----------|
| Risc | M-mode firmware injection on RISC- |

</details>

All offense modules ship with SIMULATION_MODE = TRUE — they model behavior without executing real hardware operations. See docs/LAB_TESTING.md for the controlled path to real hardware testing.

---

2. Barzakh Scanner — Detection Engine (Rust)

105 specialized detectors organized by attack surface:

<details>
<summary><b>Full Detector List</b></summary>

| # | Detector | Category | What It Finds |
|---|----------|----------|---------------|
| 1 | pcr | TPM | PCR value anomalies indicating measurement tampering |
| 2 | pcr_replay | TPM | PCR replay attack artifacts |
| 3 | pcr_oracle | TPM | PCR prediction/oracle patterns |
| 4 | attestation | TPM | Remote attestation integrity failures |
| 5 | hook | Memory | Boot Services / Runtime Services table hooks |
| 6 | memory | Memory | Suspicious memory region patterns |
| 7 | runtime | Memory | Runtime service pointer manipulation |
| 8 | introspection | Memory | Self-modifying code and anti-analysis |
| 9 | smm | Memory | SMRAM boundary and handler anomalies |
| 10 | firmware_ | Structure | F/checksum corruption |
| 11 | spi_integrity | Structure | SPI flash image structural |
| 12 | differ | Structure | Binary diffing against known-good baseline |
| 13 | mbr | Structure | MBR/ detection |
| 14 | entropy | Structure | Abnormal entropy indicating encrypted payloads |
| 15 | e | Structure | TCG Event Log manipulation |
| 16 | secureboot | Chain | Secure Boot integrity |
| 17 | self_erasure | Beha | Post-execution cleanup patterns |
| 18 | timetravel | Beha | Timestamp manipulation artifacts |
| 19 | symexec | Beha | Symbolic execution of suspicious code paths |
| 20 | smm_timing | Ring -3 | SMM handler timing anomalies + TSEG lock status |
| 21 | s3_bootscript | Ring -3 | S3 resume boot script DISPATCH abuse |
| 22 | me_spi | Ring -3 | Intel ME/SPI flash descriptor manipulation |
| 23 | acpi_integrity | Ring -3 | ACPI table checksum + AML injection detection |
| 24 | heci | Ring -3 | HECI bus communication anomalies |
| 25 | amt | Ring -3 | AMT/SOL pro and channel abuse |
| 26 | ftpm | Ring -3 | AMD fTPM command/response forgery |
| 27 | me_dma | Ring -3 | ME-initiated DMA transaction detection |
| 28 | spi_region | Ring -3 | SPI flash region boundary |
| 29 | optionrom | Ring -3 | Malicious PCI Option ROM injection |
| 30 | n | Ring -3 | NVRAM capsule anomaly detection |
| 31 | logofail | Boot Process | Malicious BMP/image parser o (C) |
| 32 | pixiefail | Network/PXE | DHCPv6/PXE stack exploits (C+) |
| 33 | blacklotus | Boot Process | BlackLotus bootkit MOK/BCD manipulation |
| 34 | amd_psp | Platform | AMD PSP directory/firmware tampering |
| 35 | boot_guard | Platform | Intel Boot Guard ACM/KM/BPM policy bypass |
| 36 | auth_ | Chain | UEFI authenticated (PK/KEK/db) rollback |
| 37 | dxe_dispatcher | Boot Process | DXE dependency expression hijacking |
| 38 | pei_implant | Boot Process | PEI Core/PEIM phase rootkit implants |
| 39 | capsule_update | Structure | Firmware capsule update header abuse |
| 40 | cxl_device | Hardware/Bus | CXL.mem DMA attacks against system memory |
| 41 | arm_trustzone | ARM/TrustZone | OP-TEE TA tampering, SMC call injection, IMG4 bypass |
| 42 | opensbi | RISC- extension table hooking, mt, M-mode escalation |
| 43 | pmp_bypass | RISC-V | PMP misconfiguration, CSR write sequences, M-mode RWX regions |
| 44 | linux_bootchain | Boot Process | Linux UEFI bootkit detection (Bootkitty GRUB patches) |
| 45 | reloader | Boot Process | C signed UEFI app loading unsigned payloads |
| 46 | sbat | Chain | SBAT re counter rollback detection |
| 47 | esp_integrity | Structure | ESP partition rootkit persistence patterns |
| 48 | confidential_vm | Platform | Intel TDX / AMD SEV-SNP measurement manipulation |
| 49 | bmc_spi | Ring -3 | BMC-to-host lateral mo via SPI flash |
| 50 | http_boot | Network/PXE | UEFI HTTP Boot MITM with embedded PE payloads |
| 51 | tpm_command | TPM | C/1018 TPM 2.0 command buffer o |
| 52 | arm_tbbr | ARM/TrustZone | ARM Trusted Board Boot Requirements chain bypass |
| 53 | wifi_dxe | Hardware/Bus | Intel CN DXE firmware injection |
| 54 | pluton | Platform | Microsoft Pluton security processor interception |
| | secureboot_chain | Chain | Full Secure Boot chain-of-trust |
| 55 | microcode_injection | Ring -4 | Malicious/unauthorized CPU microcode update detection |
| 56 | spectre_gadgets | Ring -4 | Spectre/Meltdown gadget chains and missing barriers |
| 57 | thermal_covert | Ring -4 | Thermal/power covert channel patterns (RAPL MSR abuse) |
| 58 | | Ring -4 | fault injection (Plundervolt/CLKscrew) setup |
| 59 | debug_interface | Ring -4 | Unauthorized debug port enablement (DCI/JTAG/DAP) |
| 60 | rowhammer | Ring -4 | Rowhammer exploitation patterns and TRR bypass |
| 61 | asus_nvram | Platform | ASUS EZ Flash NVRAM update URL redirect and signature bypass |
| 62 | idrac_spi | Ring -3 | Dell iDRAC BMC-to-host SPI flash lateral mo |
| 63 | insyde_smm | Ring -2 | Insyde H2O IHISI SMM handler exploitation (C) |
| 64 | l | Chain | L metadata spoofing and Jcat signature forgery |
| 65 | arm_tbbr_chain | ARM/TrustZone | ARM TBBR certificate chain bypass with zeroed hashes |
| 66 | risc | RISC- PMP/ePMP bypass with mstatus manipulation |
| 67 | android_pkvm | Android | pK (AVF) — pvmfw signature forgery, EL2 shellcode |
| 68 | android_dice | Android | DICE attestation chain — CDI forgery, UDS tampering |
| 69 | android_gki_boot | Android | GKI boot.img v4/v5 — AVB hash mismatch, ramdisk tampering |
| 70 | android_rkp | Android | Remote Key Pro — EEK certificate chain spoofing |
| 71 | android_binary_transparency | Android | Pixel Binary Transparency — Merkle inclusion proof forgery |
| 72 | android_trusty | Android | Trusty TEE — signature bypass, entry point patching |
| 73 | android_bootctrl | Android | Boot Control HAL — A/B slot poisoning, retry exhaustion |
| 74 | android_ | Android | — unsigned kernel module injection |
| 75 | android_bootconfig | Android | Bootconfig parameter injection — init o, SELinux disable |
| 76 | iommu_dmar | DMA/IOMMU | VT-d DMAR / AMD I of DRHD/I — pre-boot DMA exposure (Thunderspy/PCILeech) |
| 77 | secureboot_dbx | Secure Boot | dbx re list emptied/rolled back — re-enables revoked loaders (BlackLotus-class) |
| 78 | apple_img4 | Apple | Img4/IM4M manifest with CPRO/CSEC disabled or zeroed boot nonce — permissive SEP boot policy |
| 79 | windows_bootchain | Windows | BCD nointegritychecks/testsigning, missing ELAM — unsigned boot-dri |
| 80 | android_avb | Android | Boot /HASHTREE disabled + rollback-index reset |
| 81 | android_fastboot | Android | Bootloader unlocked/unlockable — unsigned image flashing |
| 82 | android_keymint | Android | Key attestation downgraded to SOFTWARE level / Un boot state |
| 83 | wifi_firmware | Wireless | WLAN controller firmware (brcmfmac) with injected code stub past signed image |
| 84 | network_boot | Network | iPXE boot script chainloads an external attacker-controlled image (PXE redirect) |
| 85 | bluetooth_firmware | Wireless | BT controller patchram Write_RAM/Launch_RAM implant (Broadcom/Cypress) |
| 86 | ios_trustcache | iOS | Injected AMFI Trust Cache authorizes ad-hoc cdhash — unsigned code execution |
| 87 | ios_amfi | iOS | Code-signing enforcement disabled (amfi_get_out_of_my_way / cs_enforcement_disable) |
| 88 | ios_ktrr | iOS | KTRR/CTRR (AMCC) kernel-text lockdown not engaged — kernel patch protection bypass |
| 89 | ios_sep_downgrade | iOS | Secure Encla nonce zeroed — replayable APTicket / SEP downgrade |
| 90 | baseband_firmware | Telecom | Cellular baseband firmware implant detection (Shannon/Exynos/MediaTek) |
| 91 | baseband_rtos | Telecom | Baseband RTOS (ThreadX/Nucleus/REX/QuRT) I and task injection |
| 92 | fi | Telecom | 5G RAN gNodeB firmware tampering — O-RAN split manipulation |
| 93 | ims_firmware | Telecom | IMS/VoLTE core firmware SIP header injection and RTP interception |
| 94 | open_ran_du | Telecom | Open RAN Distributed Unit eCPRI/F1 interface tampering |
| 95 | sim_toolkit | Telecom | SIM Toolkit applet injection — STK command interception |
| 96 | small_cell | Telecom | Small cell/femtocell firmware backdoors — rogue eNodeB detection |
| 97 | | Telecom | VoLTE/VoNR modem DSP firmware implant and codec interception |
| 98 | ccsds_telecommand | Satellite | CCSDS telecommand auth bypass — SDLS encryption/MAC forgery |
| 99 | gnss_firmware | Satellite | GNSS recei spoofing — ephemeris/P |
| 100 | satellite_bus | Satellite | Satellite bus (I2C/SpaceWire/MIL-STD-1553) command injection |
| 101 | satellite_modem | Satellite | VSAT/DVB-S2 modem firmware code injection and traffic mirroring |
| 102 | space_debris_tracking | Satellite | Space situational awareness firmware — TLE/conjunction manipulation |
| 103 | starlink_terminal | Satellite | LEO terminal (Starlink/OneWeb/Kuiper) bootloader bypass and beam manipulation |
| 104 | transponder_firmware | Satellite | Satellite transponder firmware — frequency plan and power manipulation |
| 105 | | Satellite | VSAT terminal management interface backdoors and config tampering |

</details>

Detection targets:

| Metric | Target | Method |
|--------|--------|--------|
| True Positive Rate | ≥ 85% | corpus |
| False Positive Rate | < 5% | Measured against clean firmware baselines |
| ROC-AUC | ≥ 0.92 | Aggregated across all detector categories |
| Scan Latency | < 500ms | Per-image, full 105-detector sweep |

---

3. Barzakh Ad — Red-Team Payload Generator (Rust)

Standalone binary: barzakh-ad | 116 payload generators that produce realistic tampered firmware images for detection :

| Payload | Target Detector | Technique |
|---------|----------------|-----------|
| signature_plant | hook | Plants Boot Services hook signatures |
| f | firmware_ | Corrupts F/checksums |
| boot_ser | hook, memory | Injects BS table redirections |
| pe_inject | differ, entropy | Embeds PE payloads in firmware |
| trampoline | runtime, self_erasure | Installs runtime trampolines |
| me_spi_region | me_spi | Manipulates flash descriptor regions |
| amt_sol | amt | Injects AMT SOL pro artifacts |
| ftpm_forge | ftpm | Forges fTPM command sequences |
| me_dma_inject | me_dma | Creates ME DMA transaction patterns |
| spi_region_tamper | spi_region | SPI region boundaries |
| smm_timing_anomaly | smm_timing | Plants SMM handler anomalies |
| optionrom_inject | optionrom | Embeds malicious Option ROMs |
| acpi_backdoor | acpi_integrity | Injects AML OperationRegions targeting kernel space |
| heci_traffic | heci | Generates suspicious HECI patterns |
| n | n | Creates anomalous NVRAM capsule entries |
| s3_bootscript_inject | s3_bootscript | Injects S3 DISPATCH opcodes |
| secureboot_bypass | secureboot_chain | Simulates Secure Boot tampering |
| logofail_image | logofail | Crafted BMP with integer o triggers |
| pixiefail_dhcp | pixiefail | Malformed DHCPv6 with buffer o options |
| blacklotus_mok | blacklotus | MOK manipulation + revoked bootloader hashes |
| psp_tamper | amd_psp | AMD PSP directory corruption + o entries |
| boot_guard_bypass | boot_guard | ACM/KM/BPM with S + empty IBB |
| auth_ | auth_ | Authenticated monotonic counter rollback |
| dxe_depex_hijack | dxe_dispatcher | Invalid DEPEX opcodes + stack o |
| pei_core_patch | pei_implant | PEI Core entry point redirection + encrypted RAW |
| capsule_tamper | capsule_update | Invalid capsule headers + absurd payload counts |
| cxl_dma_attack | cxl_device | CXL DVSEC with DMA ranges in SMM/runtime memory |
| arm_trustzone | arm_trustzone | OP-TEE TA header with suspicious load address |
| arm_iboot | arm_trustzone | Apple IMG4 with null IV KBAG + empty SHSH certificate |
| arm_scm | arm_trustzone | Qualcomm SCM call injection (SMC #0 with non-standard service IDs) |
| risc | opensbi | OpenSBI extension table with redirected ecall handlers |
| risc | opensbi, memory | RISC-V UEFI boot flow M-mode escalation |
| risc | pmp_bypass | PMP all-permissi with full-range address match |
| bootkitty_grub_patch | linux_bootchain | Linux GRUB signature NOP sled |
| secureboot_reloader | reloader | C signed PE with embedded unsigned payload |
| sbat_rollback | sbat | SBAT generation counter downgrade attack |
| esp_persistence | esp_integrity | ESP partition rootkit with multi-path persistence |
| runtime_ser | runtime | Runtime Services covert channel |
| tdx_o | confidential_vm | Intel TDX O manipulation |
| bmc_spi_lateral | bmc_spi | BMC IPMI/Redfish SPI flash lateral mo |
| gpu_ | optionrom | GPU Option ROM persistence with DXE stub injection |
| http_boot_mitm | http_boot | UEFI HTTP Boot response with embedded PE payload |
| tpm_ref_o | tpm_command | C/1018 TPM command buffer o |
| arm_tbbr_bypass | arm_tbbr | ARM Trusted Board Boot chain bypass with zeroed hashes |
| wifi_dxe_inject | wifi_dxe | Intel CN DXE firmware injection |
| pluton_intercept | pluton | Microsoft Pluton mailbox interception + DICE tampering |
| se | confidential_vm | AMD SEV-SNP VMPL pri confusion attack |
| asus_n | asus_nvram | ASUS EZ Flash NVRAM URL redirect + signature bypass |
| idrac_spi_lateral | idrac_spi | Dell iDRAC BMC-to-host SPI flash write attack |
| insyde_smm_o | insyde_smm | Insyde H2O capsule SMM buffer o |
| l | l | L spoofing + Jcat signature forgery |
| android_pk | android_pkvm | pK signature forgery + EL2 shellcode |
| android_dice_forge | android_dice | DICE CBOR certificate chain with predictable CDI |
| android_gki_tamper | android_gki_boot | GKI boot.img v4 with invalid AVB hash |
| android_rkp_spoof | android_rkp | RKP pro blob with fake EEK chain |
| android_bt_forge | android_binary_transparency | Fake transparency log + Merkle proof |
| android_trusty_tamper | android_trusty | Trusty OS image with patched entry + disabled sig |
| android_bootctrl_poison | android_bootctrl | A/B boot metadata with both slots unbootable |
| android_dlkm_inject | android_ | EROFS image with unsigned kernel module |
| android_bootconfig_inject | android_bootconfig | Bootconfig with init o + SELinux disable |
| baseband_implant | baseband_firmware | Baseband firmware implant with NOP sled and modem hooks |
| baseband_rtos_hook | baseband_rtos | RTOS IVT hook and spy task injection |
| fi | fi | 5G gNodeB unsigned code section injection |
| ims_firmware_patch | ims_firmware | IMS core firmware SIP header interception |
| open_ran_du_tamper | open_ran_du | O-RAN DU eCPRI non-standard message injection |
| sim_applet_inject | sim_toolkit | SIM Toolkit applet injection with STK hooks |
| small_cell_implant | small_cell | Small cell firmware backdoor with rogue eNodeB |
| | | VoLTE DSP ELF implant + codec path interception |
| ccsds_telecommand_inject | ccsds_telecommand | CCSDS SDLS auth bypass + telecommand injection |
| gnss_firmware_spoof | gnss_firmware | GNSS recei ephemeris spoofing |
| satellite_bus_tamper | satellite_bus | Satellite bus OBC command injection via I2C/SpaceWire |
| satellite_modem_implant | satellite_modem | VSAT modem NOP sled + traffic mirroring |
| satcom_terminal_implant | starlink_terminal | LEO terminal bootloader bypass + beam intercept |
| space_debris_tracking_spoof | space_debris_tracking | SSA firmware TLE/conjunction manipulation |
| transponder_firmware_inject | transponder_firmware | Transponder firmware frequency plan injection |
| | | VSAT terminal management interface backdoor |

loop: generate payload → scan with detector → assert finding raised → measure TPR/FPR

---

4. AttestationPkg — Defensi (C11, EDK II)

---

🔒 Security Safeguards

Hardware-Rooted Kill-Switches

Every offense module contains multiple independent kill-switches that prevent execution outside authorized en:

| Kill-Switch | Mechanism | Bypass Difficulty |
|-------------|-----------|-------------------|
| SMBIOS UUID Binding | Cryptographic check against whitelisted UUIDs | Requires hardware reprogramming |
| TPM EK Pinning | Bound to specific TPM Endorsement Keys | Requires TPM replacement |
| Time-Bomb | Hardcoded UTC expiry timestamp | Requires source modification + rebuild |
| Air-Gap Enforcement | Network interface detection at DXE phase | Cannot be bypassed without code change |
| SIMULATION_MODE | Global flag pre real hardware operations | Must be explicitly disabled per-module |

Operational Security

---

🛠️ Technology Stack

| Layer | Technology | Purpose |
|-------|-----------|---------|
| Firmware Framework | EDK II (edk2-stable202405) | UEFI module de |
| Offense Language | C11 (EDK II con) | DXE drivers, SMM handlers |
| Detection Engine | Rust (stable) | Scanner, ad, CLI |
| | QEMU 7.0+ / KVM / OVMF | Isolated test en |
| TPM Emulation | swtpm 0.7+ | Software TPM 2.0 |
| CI/CD | GitHub Actions | Rust tests, clippy, fmt |
| Flash Tools | flashrom, me_cleaner, ifdtool | Hardware lab operations |
| Platform Analysis | chipsec, UEFITool | Security assessment |

---

📁 Repository Structure

---

🚀 Quick Start

Prerequisites

| Requirement | Minimum | Recommended |
|-------------|---------|-------------|
| OS | Ubuntu 22.04+ (Linux host) | Ubuntu 24.04 |
| RAM | 8 GB | 16 GB |
| Storage | 50 GB | 100 GB SSD |
| CPU | x86_64 with VT-x | Intel Skylake+ (for ME testing) |
| QEMU | 7.0+ with KVM | 8.0+ |
| Rust | stable (latest) | stable + nightly for miri |
| Compiler | GCC 11+ or Clang 14+ | GCC 13 |
| TPM | swtpm 0.7+ | swtpm 0.8+ |

1. En Setup

2. Build Barzakh

3. Run in Test En

4. Scan Firmware

5. Detectors (Red-Team Loop)

---

🧪 Testing

For real hardware testing beyond QEMU, see docs/LAB_TESTING.md — a 5-phase progression from non-destructi to li module deployment with full recovery procedures.

---

📝 Documentation

| Document | Purpose |
|----------|---------|
| docs/ARCHITECTURE.md | System architecture, component interactions, data flow |
| docs/ANDROID_BOOT.md | Android boot security — 9 modules co pKVM, DICE, GKI, RKP, Trusty, and more |
| docs/SETUP.md | Complete en setup (EDK II, QEMU, swtpm, Rust) |
| docs/TESTING.md | testing strategy and CI pipeline |
| docs/USECASES.md | Complete catalog of offense/defense techniques with examples |
| docs/LAB_TESTING.md | Real hardware lab guide — equipment, procedures, recovery |
| src/barzakh-scanner-rs/README.md | Scanner architecture, detector API, extending detectors |
| CONTRIBUTING.md | Contribution guidelines and code review process |
| SECURITY.md | Security policy and disclosure |

---

🤝 Contributing

This is a controlled research project. Contributions are limited to:

See CONTRIBUTING.md for detailed guidelines.

---

📜 License

Released under a restricti research license. See LICENSE for full terms.

Key restrictions: Academic/educational use only. No commercial use. No weaponization. Must maintain all safety mechanisms. Must comply with institutional o.

---

🔐 Responsible Disclosure

If you discover a no during research:
1. Immediate embargo — do not disclose publicly
2. Notify PI within 24 hours
3. 90-day coordinated disclosure to affected
4. See SECURITY.md for the full procedure

---

🎓 Research Contributions

This project models real-world threats including BlackLotus, CosmicStrand, LoJax, MoonBounce, MosaicRegressor, FinSpy, and Hacking Team's UEFI rootkit. Key academic contributions:

---

📞 Contact

Principal In: Yasin
Email:

---

⚠️ Disclaimer

This software is provided for academic research purposes only. The authors and affiliated institutions make no warranties regarding fitness for any purpose, accept no liability for misuse, and require strict adherence to institutional o and legal frameworks. Unauthorized use may applicable laws.

USE AT YOUR OWN RISK.

项目信息

开发语言：Rust

Star 数：5

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Ring -4 to Ring 0: offense-defense firmware research platform. We build the bootkits, then we catch them. Closed-loop. Zero trust in silicon.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。