Suppose you have a system whose OS drive is encrypted with bitlocker and uses TPM + PIN authentication to authenticate the boot path against tampering. As I understand it, this setup theoretically protects against bootkits that otherwise could surreptitiously log the password or key used to decrypt the OS drive. That is, it protects against this type of "evil maid attack".
Is there a way to reliably simulate boot path tampering to test whether boot path authentication is actually working?
I know about this implementation of the evil maid attack but it was designed to attack truecrypt, not bitlocker.