TLDR Tech / InfoSec
Rusty Bootkit - Windows UEFI Bootkit in Rust (Codename: RedLotus)
RedLotus is an educational, Rust-based UEFI bootkit that bypasses Driver Signature Enforcement by hooking the early boot sequence to manually map an unsigned kernel payload into memory before Windows initializes. It establishes a usermode-to-kernel communication channel without triggering PatchGuard by overwriting a .data pointer in the HalDispatchTable. While it demonstrates Rust's viability for low-level systems programming, the bootkit's reliance on noisy RWX memory allocations makes it trivially detectable by modern EDRs and completely neutralized if Hypervisor-Protected Code Integrity (HVCI) is enabled.
Read the full story