Project Barzakh (برزخ)

"Barzakh" (برزخ) — a barrier between two realms; the unseen boundary separating the living world from the world of spirits. Here it stands for the barrier between offense and defense, between vulnerability and detection.

The most comprehensive open-source UEFI firmware security research platform

Offense emulation from Ring 0 to Ring -4 | 132 detection engines | Closed-loop adversary validation

⚠️ ACADEMIC RESEARCH PROJECT — DEFENSIVE SECURITY ONLY

This platform exists to study firmware threats and build defenses against them. It contains live offense emulations with hardware-rooted kill-switches. By accessing this repository, you agree to use it solely for legitimate security research and educational purposes.

📋 What Is Barzakh?

Barzakh is a full-stack firmware security research platform that models real-world bootkit TTPs across every privilege ring — from UEFI DXE drivers (Ring 0) down through SMM, Intel ME, AMD PSP, platform DMA controllers (Ring -3), and CPU microarchitectural threats (Ring -4). It pairs each offense technique with a corresponding detection engine, creating a closed-loop system where every attack is both reproducible and detectable.

Key capabilities:

21 EDK II offense modules spanning x86_64, AArch64/Apple Silicon, and RISC-V architectures
132 specialized detectors with firmware-specific heuristics and structural analysis (spanning UEFI, Intel/AMD, ARM, RISC-V, Android, Apple/iOS, wireless, telecom baseband, and satellite firmware)
Threat-intelligence integration — IOC feeds, a YARA-subset rule engine (wildcards, jumps, boolean conditions), MISP event export, and MITRE ATT&CK mapping
Machine-learning analysis — isolation-forest anomaly detection and a logistic-regression malicious/benign classifier, trainable on the adversary corpus
Scan history & knowledge base — SQLite-backed scan history with diffing/trends, and a shareable (anonymizable) firmware knowledge base
Dashboard & REST API — barzakh-server serves a web dashboard and JSON API (port 8420) with scheduled scans and risk-score trends
Continuous monitoring — barzakh-agent watches firmware targets, records history, and forwards findings to SIEMs (Elastic ECS, ArcSight CEF, QRadar LEEF) or webhooks
127 adversary payload generators for automated true-positive validation
Full Ring -4 coverage — CPU microcode, speculative execution, thermal/power covert channels, voltage glitching, debug interfaces, rowhammer
Hardware lab testing path — documented progression from simulation to real silicon

Reference Adversaries Modeled

Threat	Technique	Barzakh Coverage
BlackLotus (CVE-2023-24932)	Secure Boot bypass via vulnerable shim	`blacklotus` detector + `blacklotus_mok` payload
LogoFAIL (CVE-2023-40238)	Image parser overflow in UEFI firmware	`logofail` detector + `logofail_image` payload
PixieFail (CVE-2023-45229+)	Network stack buffer overflows in EDK2	`pixiefail` detector + `pixiefail_dhcp` payload
CosmicStrand	SPI flash DXE persistence	FV integrity + SPI region + persistence detector
LoJax	First in-the-wild SPI implant	ME/SPI detector + flash descriptor analysis
MoonBounce	Modified core DXE in SPI flash	Boot Services hook + firmware volume diffing
MosaicRegressor	UEFI persistence framework	Multi-stage: FV tamper + PE inject + trampoline
Hacking Team (RCS)	UEFI rootkit with Option ROM	Option ROM detector + PCI expansion analysis
FinSpy	UEFI bootloader modification	ExitBootServices interception + memory scanning
Bootkitty (2024)	First Linux UEFI bootkit, GRUB signature bypass	`linux_bootchain` detector + `bootkitty_grub_patch` payload
CVE-2024-7344	Signed reloader loads unsigned PE payloads	`reloader` detector + `secureboot_reloader` payload
CVE-2023-1017/1018	TPM 2.0 reference implementation buffer overflow	`tpm_command` detector + `tpm_ref_overflow` payload

🏗️ Architecture

🧩 Core Components

1. BootkitPkg — Offense Emulation (C11, EDK II)

21 EDK II modules across 3 architectures (x86_64, AArch64, RISC-V) emulating every known firmware persistence technique:

x86_64 Core (13 modules)

Module	Ring	Technique
`DxeInject`	0	DXE phase driver injection — LoadImage/StartImage + SetVariable hooks, FV persistence, SPI flash emulator with FVB2/Boot Guard backends, kill-switches
`ExitBootHook`	0	ExitBootServices interception + MSR hooking
`SpiChipsetEmulator`	-1	Chipset-level SPI interface simulation
`SmmPersistence`	-1	SMM handler installation and SMRAM persistence
`CapsuleHijack`	-1	UEFI capsule update mechanism abuse
`AcpiTableInject`	-2	ACPI table injection for kernel memory access
`VirtualAddressMapHook`	-2	EFI Runtime Services hooking
`PciOptionRom`	-2	PCI Option ROM implantation
`MeSpiManipulation`	-3	Intel ME SPI flash region manipulation
`HeciIntercept`	-3	Host-ME communication channel interception
`MeDmaAttack`	-3	ME-initiated DMA to host memory
`AmtSolChannel`	-3	AMT Serial-over-LAN covert channel
`FtpmCommandForge`	-3	AMD fTPM command forgery via PSP mailbox

AArch64 / Apple Silicon (7 modules)

Module	Technique
`Aarch64DxeInject`	ARM64 DXE injection with EL-aware payloads
`ExceptionVectorHook`	VBAR_EL1 exception table relocation
`El3SecureMonitor`	EL3 Secure Monitor call interception
`TzascManipulation`	TrustZone Address Space Controller bypass
`DeviceTreeInject`	Device Tree Blob modification for persistence
`IbootTrustChain`	Apple iBoot chain-of-trust subversion
`SepMailboxIntercept`	Apple SEP (Secure Enclave) mailbox interception

RISC-V (1 module)

Module	Technique
`RiscVDxeInject`	M-mode firmware injection on RISC-V platforms

All offense modules ship with SIMULATION_MODE = TRUE — they model behavior without executing real hardware operations. See docs/LAB_TESTING.md for the controlled path to real hardware testing.

2. Barzakh Scanner — Detection Engine (Rust)

132 specialized detectors organized by attack surface, plus runtime-extensible detection via TOML rules, IOC feeds, YARA-subset rules, and ML models:

Full Detector List

Barzakh

Most Popular