secureboot-bypass

Native UEFI/EFI utility for Intel CPU power management (2nd-15th Gen). Direct MSR/MMIO access for undervolting, power limits, and V/F curves. Features built-in NVRAM patching (CFG/OC Lock) for Plundervolt research and Secure Boot SelfEnroll with embedded root CA. Bare-metal, self-contained, and driven by UnderVolter.ini. No OS required.

This repository discloses a critical vulnerability in Apple’s A16 Bionic chip, where debug logic is executed on production-fused devices (dev-fused=0, debug=0x0). Logs show SecureROM and co-processor debug paths active without jailbreak or user tampering—violating the silicon-level trust model.

RINGW0RM is Ring0 rootkit and UEFI bootkit plugin formatted for PulsarRAT as a plugin, which was built upon a customized Chaos and Elysium combination (this was not planned to be dropped lol)

Researching and exploiting UEFI boot chain attack surfaces to bypass Secure Boot and achieve pre-OS code execution on Windows and Linux.

Analysis and exploit for CVE-2026-25250, a Secure Boot bypass in Horizon DataSys Reboot Restore where shdloader.efi loads Shield.efi without verification.

A journey through recovery bootloaders, rescue media, and trusted pre-OS environments, documenting the attack surfaces discovered along the way.

🔍 Expose a critical flaw in Apple A16 Bionic, enabling unauthorized debug access on iPhone 14 Pro Max without jailbreak, impacting device security.