Skip to content
This repository has been archived by the owner on Sep 30, 2024. It is now read-only.
/ rainbow Public archive

Hide SMBIOS/disk/NIC serials from EFI bootkit

Notifications You must be signed in to change notification settings

SamuelTulach/rainbow

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

7 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Rainbow

Rainbow is a bootkit like HWID spoofer for Windows. It abuses several hooks in EFI runtime services and uses clever DKOM to hide hardware serials before any boot-time drivers are even started.

Screenshots

screen0 screen1 screen2

Video

video

Usage

In order to use rainbow spoofer, you need to load it. First, obtain a copy of rainbow.efi and a copy of EDK2 efi shell. Now follow these steps:

  1. Extract downloaded efi shell and rename file Shell.efi (should be in folder UefiShell/X64) to bootx64.efi
  2. Format some USB drive to FAT32
  3. Create following folder structure:
USB:.
 │   rainbow.efi
 │
 └───EFI
      └───Boot
              bootx64.efi
  1. Boot from the USB drive
  2. An UEFI shell should start, change directory to your USB (FS0 should be the USB since we are booting from it) and list files:
FS0:
ls
  1. You should see file rainbow.efi, if you do, load it:
load rainbow.efi
  1. Now you should see output from rainbow. If it was successful, exit and boot into Windows (change to Windows boot media - usually FS1 - and run \EFI\Boot\bootx64.efi)

Download

Check out UnknownCheats.

Compiling

See VisualEfi. Please note that I've made some changes to the EDK2 directory.

About

Hide SMBIOS/disk/NIC serials from EFI bootkit

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published