I've now googled a lot, but the only information I can find is 'kon-boot hides its code in BIOS memory and changes kernel-code on the fly'...

As far as I understand, UEFI initializes devices and tries to load bootloaders into memory from MBRs. Now if Kon-Boot only manipulated bootloaders, then it wouldn't work in combination with the SecureBoot option in UEFI, as this would identify the manipulated bootloader/kernel - that's why it has to run in BIOS/UEFI memory directly. But how is that achieved?

How is Kon-Boot code copied to UEFI, which functionality is used here where UEFI would load arbitrary code into its own memory that also would get executed at a certain point?

  • You saw this? kon-boot.com/docs/windows_guide
    – schroeder
    Nov 16, 2022 at 10:20
  • yes, but it does not answer the question
    – BlackFlag
    Nov 16, 2022 at 10:27
  • And this? cert-ist.com/public/en/…
    – schroeder
    Nov 16, 2022 at 10:29
  • No, not one single word about secureboot... I could also ask the question in a different way: How can you manipulate the BIOS/UEFI memory? I understand it that the 0x13 interrupt would load the bootloader from the MBR, but that one is protected via SecureBoot, so no way to use that interrupt to inject the code.
    – BlackFlag
    Nov 16, 2022 at 10:38
  • ... you didn't read the Kon Boot link about Secure Boot ...
    – schroeder
    Nov 16, 2022 at 12:00

1 Answer 1


No bypass of SecureBoot is done. The product states in the system requirements that enabled SecureBoot is not supported:

Not supported: Disk encryption, tablets (includes Microsoft Surface hybrid), enabled SecureBoot , multiple operating systems installed on target computer, kernel debuggers, enabled secure boot, enabled virtualization (VMware, QEMU, VirtualBox, etc.), authorization through domain. CD and Floppy versions are deprecated (but still in the package for compatibility reasons).

  • Yes, the product since 3.5 has a Secure Boot bypass feature that they say works sometimes. And they explain that it uses keys (that have been since been revoked in updated BIOS)
    – schroeder
    Nov 16, 2022 at 12:01
  • oh wow. I was too much focused on the wikipedia-articles which say that it can bypass secureboot from 3.5 on, but I didn't know that it's not supported (everywhere) and may not work depending on your UEFI). So now it's clear: Kon-Boot gets loaded via MBR and then modifies the bootloader/kernel. I originally thought it would directly inject itself into the UEFI/BIOS memory/code and do the manipulation "from there"...
    – BlackFlag
    Nov 16, 2022 at 12:47
  • @BlackFlag Read official documentation not wiki articles as your primary source.
    – schroeder
    Nov 16, 2022 at 12:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .