Mattiwatti/EfiGuard

Health v2 · maintenance only

Adoption not part of the score

2523 stars · 410 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

EfiGuard is a portable x64 UEFI bootkit that patches the Windows boot manager, boot loader, and kernel at boot time to disable PatchGuard and Driver Signature Enforcement. It supports all EFI-compatible x64 Windows versions from Vista SP1 to Windows 11 and can be booted from a USB stick or the EFI partition.

Use cases

• disable patchguard on windows at boot
• bypass driver signature enforcement to load unsigned drivers
• boot windows with kernel patches from a usb stick
• load unsigned kernel drivers on windows 11
• research windows boot process and secure boot internals

When to choose

• you need to load unsigned kernel drivers for research or testing on any x64 EFI Windows version
• you want a passive bootkit that unloads itself when a non-Windows OS is booted
• you need debuggable, graceful-failure boot-time patching with kernel debugger output

When to avoid

• you need a production or end-user security solution rather than a research tool
• your system uses secure boot with third-party CA enforcement that cannot be disabled
• you only need to disable DSE at runtime without rebooting

Facets

cli-tool · maturity active

security reverse-engineering security operating-systems windows windows cpp uefi-bootkit patchguard driver-signature-enforcement kernel dse-bypass bootkit

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Mattiwatti/EfiGuard")