Lion Cipher Lab

Trace your own boot chain: firmware, bootloader, kernel, init, login — and check Secure Boot

• Foundations
• Intermediate
• ~70 min
• Free · no account required

Why it matters

Everything that runs before your operating system is code your antivirus never sees. Your endpoint agent, your firewall, your EDR, your antivirus — every one of them is a program, and a program can only run once there is an operating system to run it. Firmware, the bootloader and the early kernel all execute before any of that exists. That is not a footnote; it is precisely why attackers want that layer. Malware that loads before Windows or Linux does can hide from every tool you own, survive a reinstall, and lie to the operating system about its own presence. Microsoft's own boot-security…

What you'll learn

• following a machine's boot from firmware to login screen
• telling UEFI from legacy BIOS on a real machine
• finding and reading the EFI System Partition
• checking Secure Boot state on Windows (msinfo32, Confirm-SecureBootUEFI) and Linux (mokutil --sb-state)
• reading firmware boot entries safely with bcdedit /enum firmware and efibootmgr -v
• reading the kernel command line the bootloader handed over (/proc/cmdline)
• measuring where boot time actually went with systemd-analyze blame and critical-chain
• reading the earliest kernel and init messages (dmesg, journalctl -b)
• explaining the chain of trust, and what Secure Boot does and does not protect against
• telling verified boot apart from measured boot, and TPM/PCRs from Secure Boot

Steps in this lab

1. The layer your antivirus cannot see
2. SAFETY FIRST: read-only means read-only, and know where your recovery key is
3. The whole chain in plain English, with every word defined
4. WINDOWS — Stage 1: is this machine UEFI or legacy BIOS, and is Secure Boot on?
5. WINDOWS — Confirm it from PowerShell, and meet the TPM
6. WINDOWS — Stage 2: read the firmware's boot entries (READ-ONLY)
7. WINDOWS — Stages 3-5: find out how long the machine took to reach login
8. LINUX — first, the WSL warning, because this is where people fool themselves
9. LINUX — Stage 1: UEFI or BIOS, and is Secure Boot on?
10. LINUX — Stage 2: the EFI System Partition and the firmware's boot entries (READ-ONLY)
11. LINUX — Stage 3: what the bootloader handed the kernel
12. LINUX — Stages 3-4: the earliest kernel messages, and this boot's log
13. LINUX — Stage 4-5: where did the time actually go?
14. JUDGMENT — what Secure Boot actually stops, and what it does not
15. JUDGMENT — verified boot versus measured boot, and why the second one is what catches things
16. JUDGMENT — 'just turn Secure Boot off' is advice with a price tag
17. JUDGMENT — the three things that only work as a set
18. What you learned, and why the bootkit labs look where they look

Open the full interactive lab →