ldpreload/BlackLotus

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

2240 stars · 478 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

An open-source UEFI bootkit targeting Windows that implements a Secure Boot bypass, kernel-level persistence, and an HTTP-based C2 loader with a web management panel. It is a proof-of-concept/research implementation of the BlackLotus bootkit, written in C and x86 assembly with no third-party libraries.

Use cases

• study how UEFI bootkits achieve Secure Boot bypass
• research bootkit persistence techniques on Windows
• analyze malware C2 communication patterns
• build defensive detections against UEFI bootkits
• learn UEFI driver development with EDK2
• evaluate EDR bypass and anti-hooking techniques

When to choose

• you are a security researcher studying bootkit internals
• you need a reference implementation for building bootkit detections
• you want to understand Secure Boot and BitLocker bypass mechanics

When to avoid

• you need a legitimate bootloader or system utility
• you lack secure malware analysis infrastructure
• you want production-ready or supported software
• you cannot legally possess offensive tooling in your jurisdiction

Facets

library · maturity maintenance

security reverse-engineering penetration-testing security reverse-engineering operating-systems windows cpp c uefi-bootkit malware secure-boot-bypass rootkit research c2 firmware

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ldpreload/BlackLotus")