SamuelTulach/rainbow

Stars
270
Rank 152,189 (Top 3 %)
Language
C
Created over 3 years ago
Updated over 3 years ago

SamuelTulach/rainbow

SamuelTulach

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Hide SMBIOS/disk/NIC serials from EFI bootkit

Rainbow

Rainbow is a bootkit like HWID spoofer for Windows. It abuses several hooks in EFI runtime services and uses clever DKOM to hide hardware serials before any boot-time drivers are even started.

Screenshots

Video

Usage

In order to use rainbow spoofer, you need to load it. First, obtain a copy of rainbow.efi and a copy of EDK2 efi shell. Now follow these steps:

Extract downloaded efi shell and rename file Shell.efi (should be in folder UefiShell/X64) to bootx64.efi
Format some USB drive to FAT32
Create following folder structure:

USB:.
 │   rainbow.efi
 │
 └───EFI
      └───Boot
              bootx64.efi

Boot from the USB drive
An UEFI shell should start, change directory to your USB (FS0 should be the USB since we are booting from it) and list files:

FS0:
ls

You should see file rainbow.efi, if you do, load it:

load rainbow.efi

Now you should see output from rainbow. If it was successful, exit and boot into Windows (change to Windows boot media - usually FS1 - and run \EFI\Boot\bootx64.efi)

Download

Check out UnknownCheats.

Compiling

See VisualEfi. Please note that I've made some changes to the EDK2 directory.

VirusTotalUploader

C# Open-Source Winforms application for uploading files to VirusTotal

mutante

Kernel-mode Windows HWID spoofer

efi-memory

PoC EFI runtime driver for memory r/w & kdmapper fork

negativespoofer

PoC HWID spoofer that runs in EFI

LightHook

Single-header, minimalistic, cross-platform hook library written in pure C

RwxMeme

State of the art DLL injector that took 20 minutes to make

tpm-spoofer

Simple proof of concept kernel mode driver hooking tpm.sys dispatch to randomize any public key reads

nullmap

Using CVE-2023-21768 to manual map kernel mode driver

memhv

Minimalistic AMD-V/SVM hypervisor with memory introspection capabilities

meme-rw

Archive R/W into any protected process by changing the value of KTHREAD->PreviousMode

OverlayCord

Simple proof of concept showing how you can abuse Discord's in-game internal module to draw on top of the game (even if the game is in fullscreen) from an external application without modifying any Discord files or loading its modules.

SecureFakePkg

Simple EFI runtime driver that hooks GetVariable function and returns data expected by Windows to make it think that it's running with secure boot enabled (faking secure boot)

BetterTiming

PoC TSC offsetting in KVM

PwnedBoot

Using Windows' own bootloader as a shim to bypass Secure Boot

voidmap

Using CVE-2021-40449 to manual map kernel mode driver

CanetisRadar

Open-source application for detecting sound direction using 7.1 audio device in games

PatchBoot

Guide for patching AMI Aptio V UEFI firmware to circumvent Secure Boot checks

windowhide

Hide external overlay by using SetWindowDisplayAffinity

DirectPageManipulation

A basic demonstration of directly overwriting paging structures for physical memory r/w and interprocess memory copy

ImGui-AppKit

Project template for single-window GUI apps using Dear ImGui

eac_cr3_shuffle

ida-unity-pdb-downloader

Simple IDA Pro plugin to download Unity debug symbols from their symbol server

EfiDump

PoC EFI runtime driver for direct Windows interprocess memory copy

InjectMouseInputExample

C/C++ example of InjectMouseInput function

MemoryGuard

Experiment with PAGE_GUARD protection to hide memory from other processes

human-mouse

Adopted SRL-6 mouse movement to C++

memdrv

GetDeviceInterfacesMemoryLeak

Small memory leak PoC that is happening in IopGetDeviceInterfaces

SaberHighlight

Beat Saber mod enabling NVIDIA Highlights functionality

be_shellcode_dump

December 2023 BattlEye shellcode dump

SoundReplacer

BSIPA mod for replacing hit sounds, menu music, click sounds and much more!

EvilKaspersky

vmcheck

OcuFix

Simple mod to automatically disable ASW and change services/runtime priority

RecoilTime

A simple program made in C# for reducing recoil in games under Windows environment

EasyUefi

Visual Studio template for GNU-EFI

eft-profile-api

Reversing the newly added EFT feature that allows you to view other players' stats

EmuAuth

KeyAuth server emulator

DiscordLeech

Read Discord user info from process memory

esea-control

Simple program to temporarly disable ESEA anti-cheat

lrdp

InactiveTitlebarPatch

Simple registry patch to turn inactive title bar color dark

ByeMouse

obs-dda

EasyDump

PowerControl

MapPasswordTool

TM2020 tool to remove password lock for editing from maps

virtmgr

OneplusDebloat

Remove crappy useless apps in Oxygen OS (both 3rd party and Google)

NekoSwap