A boot-stage foothold runs before the operating system — and before most of what defends it. That is exactly why defenders study it. This lab traces the mechanism with non-operational markers, then proves it can detect the change and roll it back. Nothing here installs, patches, or persists anything.
Every handoff in the boot chain is a place code can be swapped in to run first and survive a reboot. Knowing the locations is what lets you baseline and watch them — it is the map a defender needs.
.efi runs unless Secure Boot rejects its signature.The common thread: it runs early, and it comes back. So a defender's job is to know the baseline, detect the drift, and roll it back — the three things the rest of this lab does.
ChainLoader's charter is enforced in code and declared in its manifests. The "installer" is non-operational by construction — it emits evidence phases and a list of the actions it will never take.
Each assembly "stage" returns a pointer to a constant string and nothing else — allowed_side_effects: [memory-only-marker].
; the entire "MBR stage" bks_mbr_stage_marker: lea rax, "SIM-MBR-STAGE-MARKER-V1" ret ; returns a string. that's it.
The same four preconditions every scenario declares, in order. Step through them — each shows the evidence the runner writes, not an action it takes.
A controlled-drift run is the point of the exercise: it should fire the detections you expect, and a recovery-validation run should confirm the rollback. The verdict is a process result — the lab did its job — and the base image's hash is unchanged.
On the SOC side, detection-lab rule R6 fires on a new LaunchAgent/Daemon or login item that was not in the baseline.
"scenario_id": "win11-uefi-sb-off", "mode": "controlled-drift", "verdict": "PASS", "alerts": [ "detected:boot-entry-drift-alert", "detected:esp-file-drift-alert" ], "rollback_confirmed": true, "base_image": // hash identical pre/post
The lesson: you traced the mechanism, you fired the detections, and you confirmed the machine returned to its baseline — without ever arming the thing you were studying. That is the whole move.
ChainLoader/MASTER.md — the full teaching guide and safety boundary.
ChainLoader/bootkitstudio/manifests/Mock-Installer-Manifest.yaml — the non-operational phases + prohibited actions.
ChainLoader/Risk-Register.yaml — each boot-stage risk mapped to a defensive control.
ChainLoader/IR-Boot-Chain-Runbook.md — triage, containment, recovery, closure for a real drift alert.