99 lines
3.5 KiB
Rust
99 lines
3.5 KiB
Rust
// ============================================================================
|
|
// WARLOCK'S STAVE: Firmware & Hardware Analysis
|
|
// ============================================================================
|
|
//
|
|
// Analyzes UEFI NVRAM variables and ACPI table entries for stealth
|
|
// persistence mechanisms that survive OS-level analysis.
|
|
|
|
use std::path::Path;
|
|
|
|
use crate::polymorphic_ipc::{AdvancedTelemetryEvent, TelemetryEventCategory};
|
|
|
|
/// Analyzes UEFI NVRAM variables and firmware-level indicators
|
|
/// for stealth persistence mechanisms.
|
|
pub struct HardwareFirmwareAnalyzer;
|
|
|
|
impl HardwareFirmwareAnalyzer {
|
|
/// Audits Linux efivarfs for UEFI NVRAM variables that do not
|
|
/// belong to known firmware or OS vendors.
|
|
pub fn audit_uefi_nvram() -> Vec<AdvancedTelemetryEvent> {
|
|
let mut events = Vec::new();
|
|
let nvram_path = Path::new("/sys/firmware/efi/efivars");
|
|
if !nvram_path.exists() {
|
|
return events; // Not UEFI or not Linux
|
|
}
|
|
|
|
// Known vendor GUID prefixes (simplified)
|
|
let known_vendors = [
|
|
"8be4df61", // Microsoft Corporation
|
|
"721c8b66", // Firmware vendor
|
|
"a1f02e8c", // Linux Foundation
|
|
"605dab50", // Intel Corporation
|
|
];
|
|
|
|
if let Ok(entries) = std::fs::read_dir(nvram_path) {
|
|
for entry in entries.flatten() {
|
|
let name = entry.file_name().to_string_lossy().to_string();
|
|
let is_known = known_vendors
|
|
.iter()
|
|
.any(|vendor| name.contains(vendor));
|
|
if !is_known {
|
|
events.push(AdvancedTelemetryEvent {
|
|
category: TelemetryEventCategory::FirmwareAnomaly,
|
|
message: format!(
|
|
"Unauthorized NVRAM variable: {}",
|
|
name
|
|
),
|
|
pid: 0,
|
|
severity: 3,
|
|
});
|
|
}
|
|
}
|
|
}
|
|
events
|
|
}
|
|
|
|
/// Checks for firmware-level sideloading signals by examining
|
|
/// ACPI table entries exported via sysfs. Detects custom ACPI
|
|
/// tables that could be used for bootkit persistence.
|
|
pub fn detect_stealth_sideload_signals() -> Vec<AdvancedTelemetryEvent> {
|
|
let mut events = Vec::new();
|
|
let acpi_path = Path::new("/sys/firmware/acpi/tables");
|
|
if !acpi_path.exists() {
|
|
return events;
|
|
}
|
|
|
|
// Standard ACPI tables
|
|
let standard_tables = [
|
|
"DSDT", "FACP", "APIC", "SSDT", "MCFG", "HPET",
|
|
];
|
|
let mut found_tables = Vec::new();
|
|
|
|
if let Ok(entries) = std::fs::read_dir(acpi_path) {
|
|
for entry in entries.flatten() {
|
|
let name = entry
|
|
.file_name()
|
|
.to_string_lossy()
|
|
.to_string();
|
|
let is_standard = standard_tables
|
|
.iter()
|
|
.any(|&t| name.starts_with(t));
|
|
if !is_standard && !name.starts_with('.') {
|
|
found_tables.push(name);
|
|
}
|
|
}
|
|
}
|
|
|
|
for table in &found_tables {
|
|
events.push(AdvancedTelemetryEvent {
|
|
category: TelemetryEventCategory::FirmwareAnomaly,
|
|
message: format!(
|
|
"Non-standard ACPI table detected: {}", table
|
|
),
|
|
pid: 0,
|
|
severity: 2,
|
|
});
|
|
}
|
|
events
|
|
}
|
|
} |