I'm new to reversing UEFI Malware. There is a UEFI rootkit called MoonBounce which I'm trying to analyze dynamically; It's an EFI driver.

I tried a tool called efi_dxe_emulator but it needs an NVRAM file that I don't know exactly how to get it.

enter image description here

Is there a better way to dynamically analyze this EFI file?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.