Home Software Analyze the boot records used by BIOS based systems with bootcode_parser

Analyze the boot records used by BIOS based systems with bootcode_parser

0
0
2,133

bootcode_parser.py is a Python script designed to perform a quick offline analysis of the boot records used by BIOS based systems (UEFI is not supported).

It is intended to help the analyst triaging individual boot record dumps or whole disk images. The latter is preferred since it allows the script to perform additional checks that would not be possible on individual dumps alone.

This script only detects anomalies that have to be manually investigated by an analyst. Because it works with a whitelist mechanism it will be able to detect a wide range of malicious codes, but it will also detect legitimate (encryption software, etc…) or benign modification of the boot records.

Learn more about this DFIR tool at GitHub.

Load More Related Articles
Load More In Software
Comments are closed.