NVRAM Configuration

EFI

Configure UEFI bootkit behavior via NVRAM variables that persist across reboots.

Requires Administrator + UEFI

NVRAM access requires administrator privileges and a UEFI system. Legacy BIOS systems do not support NVRAM variables.

Overview

The DioProcess UEFI bootkit reads configuration from NVRAM variables at boot time. These variables are set from the DioProcess UI and persist across reboots until explicitly changed.

NVRAM Variables

Variable Name	Type	Description
DioProcessDseBypass	UINT8	0 = DSE enabled, 1 = DSE bypassed
DioProcessKppBypass	UINT8	0 = KPP enabled, 1 = KPP bypassed

GUID: {D10PR0C5-1337-4242-BEEF-CAFEBABE0001}

Rust API (uefi crate)

crates/uefi/src/nvram.rs

use crate::{UefiConfig, UefiError};
use windows::Win32::System::SystemInformation::*;

/// Read current UEFI configuration from NVRAM
pub fn read_uefi_config() -> Result<UefiConfig, UefiError> {
    let dse = read_nvram_variable("DioProcessDseBypass")?;
    let kpp = read_nvram_variable("DioProcessKppBypass")?;
    
    Ok(UefiConfig {
        dse_bypass: dse != 0,
        kpp_bypass: kpp != 0,
    })
}

/// Write UEFI configuration to NVRAM (takes effect on next boot)
pub fn write_uefi_config(config: &UefiConfig) -> Result<(), UefiError> {
    write_nvram_variable(
        "DioProcessDseBypass",
        if config.dse_bypass { 1 } else { 0 }
    )?;
    
    write_nvram_variable(
        "DioProcessKppBypass", 
        if config.kpp_bypass { 1 } else { 0 }
    )?;
    
    Ok(())
}

fn read_nvram_variable(name: &str) -> Result<u8, UefiError> {
    let name_wide: Vec<u16> = name.encode_utf16().chain(Some(0)).collect();
    let mut buffer = [0u8; 1];
    
    unsafe {
        GetFirmwareEnvironmentVariableW(
            PCWSTR::from_raw(name_wide.as_ptr()),
            PCWSTR::from_raw(GUID_WIDE.as_ptr()),
            Some(buffer.as_mut_ptr() as *mut _),
            buffer.len() as u32
        )
    };
    
    Ok(buffer[0])
}

fn write_nvram_variable(name: &str, value: u8) -> Result<(), UefiError> {
    // Enable SeSystemEnvironmentPrivilege first
    enable_privilege("SeSystemEnvironmentPrivilege")?;
    
    let name_wide: Vec<u16> = name.encode_utf16().chain(Some(0)).collect();
    
    unsafe {
        SetFirmwareEnvironmentVariableW(
            PCWSTR::from_raw(name_wide.as_ptr()),
            PCWSTR::from_raw(GUID_WIDE.as_ptr()),
            Some(&value as *const _ as *const _),
            1
        )
    }?;
    
    Ok(())
}

EFI Driver Reading

Config.c

EFI_GUID gDioProcessVarGuid = {
    0xD10PR0C5, 0x1337, 0x4242,
    {0xBE, 0xEF, 0xCA, 0xFE, 0xBA, 0xBE, 0x00, 0x01}
};

EFI_STATUS ReadConfig(PDIOPROCESS_CONFIG Config) {
    UINTN DataSize = sizeof(UINT8);
    UINT8 Value;
    EFI_STATUS Status;
    
    // Read DSE bypass setting
    Status = gRT->GetVariable(
        L"DioProcessDseBypass",
        &gDioProcessVarGuid,
        NULL,
        &DataSize,
        &Value
    );
    Config->DseBypass = (Status == EFI_SUCCESS && Value == 1);
    
    // Read KPP bypass setting
    Status = gRT->GetVariable(
        L"DioProcessKppBypass",
        &gDioProcessVarGuid,
        NULL,
        &DataSize,
        &Value
    );
    Config->KppBypass = (Status == EFI_SUCCESS && Value == 1);
    
    return EFI_SUCCESS;
}

UI Access

Access via UEFI Bootkit tab → Boot Patches section:

• DSE Bypass toggle — Enable/disable driver signature enforcement bypass
• KPP Bypass toggle — Enable/disable PatchGuard bypass
• Save button — Write settings to NVRAM
• Status display — Shows current NVRAM values

Changes take effect on the next boot — the EFI driver reads NVRAM during the boot process before Windows loads.

Security Considerations

• NVRAM variables persist until changed — settings survive OS reinstalls
• Malicious software could read/write these variables
• Consider clearing variables after testing
• Secure Boot would prevent the EFI driver from loading

Manual NVRAM Management

From an elevated command prompt:

# Check if UEFI (look for Firmware Type: UEFI)
msinfo32

# Variables are managed via SetFirmwareEnvironmentVariable API
# No built-in Windows command for custom NVRAM variables
# Use the DioProcess UI or write a custom tool

Troubleshooting

Error: "Access denied"

• Run as administrator, ensure SeSystemEnvironmentPrivilege is available

Error: "Not supported"

• System is using Legacy BIOS, not UEFI

Settings don't apply after reboot

• EFI driver may not be installed or Secure Boot may be blocking it