sudo apt update && sudo apt install -y efibootmgr python3-pip nodejs npm

python3 -m venv venv
source venv/bin/activate
pip install cryptography requests pydantic

npm init -y
npm install typescript ts-node @types/node axios dotenv
npx tsc --init

import hashlib
import os
import logging
from typing import List, Dict
from dataclasses import dataclass

# Configure logging for production traceability
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
logger = logging.getLogger(__name__)

@dataclass
class VulnerabilityReport:
    bootloader_path: str
    is_vulnerable: bool
    detected_hash: str
    severity: str = "N/A"

class BootloaderAuditor:
    """
    Engine to verify UEFI bootloader integrity against known vulnerable signatures.
    """
    def __init__(self, vulnerable_hashes: List[str]):
        # In a real scenario, this list would be pulled from a remote CVE database
        self.vulnerable_hashes = vulnerable_hashes

    def calculate_sha256(self, file_path: str) -> str:
        """Computes SHA256 hash of a file using buffered reading for large binaries."""
        sha256_hash = hashlib.sha256()
        try:
            with open(file_path, "rb") as f:
                # Read in 4KB chunks to prevent memory exhaustion
                for byte_block in iter(lambda: f.read(4096), b""):
                    sha256_hash.update(byte_block)
            return sha256_hash.hexdigest()
        except FileNotFoundError:
            logger.error(f"File not found: {file_path}")
            return ""
        except PermissionError:
            logger.error(f"Permission denied: {file_path}. Run with elevated privileges.")
            return ""

    def audit_bootloader(self, path: str) -> VulnerabilityReport:
        """Performs the audit check."""
        logger.info(f"Auditing bootloader at: {path}")
        
        current_hash = self.calculate_sha256(path)
        if not current_hash:
            return VulnerabilityReport(path, False, "ERROR")

        is_vulnerable = current_hash in self.vulnerable_hashes
        severity = "CRITICAL" if is_vulnerable else "NONE"
        
        if is_vulnerable:
            logger.warning(f"VULNERABILITY DETECTED: {path} matches a known vulnerable bootloader.")
        else:
            logger.info(f"Integrity Check Passed for {path}")

        return VulnerabilityReport(path, is_vulnerable, current_hash, severity)

# --- EXECUTION ---
if __name__ == "__main__":
    # Mock database of vulnerable bootloader hashes (e.g., old GRUB versions)
    VULNERABLE_DB = [
        "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", # Example hash
    ]

    # Common bootloader path on many Linux systems
    TARGET_PATH = "/boot/efi/EFI/ubuntu/grubx64.efi"

    auditor = BootloaderAuditor(VULNERABLE_DB)
    report = auditor.audit_bootloader(TARGET_PATH)

    print(f"\n--- AUDIT REPORT ---")
    print(f"Target: {report.bootloader_path}")
    print(f"Status: {'⚠️ VULNERABLE' if report.is_vulnerable else '✅ SECURE'}")
    print(f"Hash:   {report.detected_hash}")
    print(f"Level:  {report.severity}")

import * as fs from 'fs/promises';
import * as crypto from 'crypto';
import * as path from 'path';

interface AuditResult {
    filePath: string;
    hash: string;
    isVulnerable: boolean;
    timestamp: string;
}

class BootloaderSecurityService {
    private vulnerableHashes: Set<string>;

    constructor(hashes: string[]) {
        // Using a Set for O(1) lookup performance
        this.vulnerableHashes = new Set(hashes);
    }

    /**
     * Generates a SHA256 hash for a given file path
     */
    private async calculateHash(filePath: string): Promise<string> {
        try {
            const fileBuffer = await fs.readFile(filePath);
            const hashSum = crypto.createHash('sha256');
            hashSum.update(fileBuffer);
            return hashSum.digest('hex');
        } catch (error) {
            throw new Error(`Failed to read file: ${error instanceof Error? error.message : 'Unknown error'}`);
        }
    }

    /**
     * Audits a bootloader and returns a structured report
     */
    public async audit(filePath: string): Promise<AuditResult> {
        const absolutePath = path.resolve(filePath);
        const hash = await this.calculateHash(absolutePath);
        const isVulnerable = this.vulnerableHashes.has(hash);

        return {
            filePath: absolutePath,
            hash: hash,
            isVulnerable: isVulnerable,
            timestamp: new Date().toISOString()
        };
    }
}

// --- EXECUTION ---
async function runAudit() {
    // Simulated CVE database
    const KNOWN_VULNERABLE_HASHES = ['5e884898da28047151d0e56f8dc6300302037c22630304010e13b4415133e647'];
    
    const service = new BootloaderSecurityService(KNOWN_VULNERABLE_HASHES);

    try {
        console.log("🚀 Starting Secure Boot Blind Spot Audit...");
        const result = await service.audit('/boot/efi/EFI/BOOT/BOOTX64.EFI');
        
        if (result.isVulnerable) {
            console.error(`❌ ALERT: Vulnerable bootloader detected!`);
            console.error(`Hash: ${result.hash}`);
        } else {
            console.log(`✅ Success: Bootloader integrity verified.`);
        }
    } catch (err) {
        console.error(`Critical Error during audit: ${err}`);
    }
}

runAudit();

# List of SHA256 hashes of known vulnerable bootloaders
VULNERABLE_HASHES=e3b0c44298fc1c149afbf4c8996fb92427e41e4649b934ca495991b7852b855,5e884898da28047151d0e56f8dc6300302037c22630304010e13b4415133e647

# The primary path to scan
BOOTLOADER_PATH=/boot/efi/EFI/debian/grubx64.efi

# API Key for external CVE lookups (e.g., NIST NVD)
CVE_API_KEY=your_api_key_here