BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot


garlin said:
Your PC has revoked the PCA 2011 certificate, but is behind on Windows boot manager versions. A later boot manager offers more security than an outdated one.

Run these commands as Admin:
Code: 
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x300 /f
powershell Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
Click to expand...

Thank you garlin. Looks like that has done the trick.

Code: 
Current UEFI DBX
2025-10-14 (v1.6.0) : SUCCESS: 431 successes detected
Windows Bootmgr SVN : 12.0
Windows cdboot SVN  : 3.0
Windows wdsmgfw SVN : 3.0
 

My Computer My Computer

At a glance

Windows 11 Pro 26H2 26300.9818Intel Core i9 13900F2 x Kingston Fury 32gb DDR5 5600 BeastGigabyte Eagle (Nvidia) RTX 3060
OS
Windows 11 Pro 26H2 26300.9818
Computer type
PC/Desktop
Manufacturer/Model
Local shop built (KC Computers Ltd)
CPU
Intel Core i9 13900F
Motherboard
Gigabyte Z690 Gaming X (rev. 1.0/1.1) - (BIOS: F32 09 18 2025)
Memory
2 x Kingston Fury 32gb DDR5 5600 Beast
Graphics Card(s)
Gigabyte Eagle (Nvidia) RTX 3060
Sound Card
Chord Async USB 44.1kHz - 384kHz 2Qute DAC
Monitor(s) Displays
Gigabyte AORUS FO32U2 32” OLED Flat Gaming Monitor, 0.03ms, KVM, 250 cd/m2, FreeSync Premium Pro, HDR True Black 400
Screen Resolution
3840 x 2160 (UHD), 240Hz
Hard Drives
1 x KINGSTON NVMe M.2 SSDSKC3000D2048G 2TB
1 x Samsung SSD 870 EVO 250GB
2 x Crucial CT4000MX500SSD1 4TB
2 x Crucial CT2000MX500SSD1 2TB
1 x Crucial CT250MX500SSD1 250.0 GB
PSU
Gigabyte 750w
Case
Fractal Torrent
Cooling
Stock Intel CPU, 2 x Fractal 180mm PWM (front), 3 x Fractal 140mm PWM (bottom)
Keyboard
Logitech MX Mechanical Wireless Illuminated Performance Keyboard
Mouse
Logitech MX Master 3S Wireless Performance Mouse
Internet Speed
900 Mbps/900 Mbps Trooli FTTP
Browser
Firefox
Antivirus
Eset Nod32
Ghot said:

Before running these commands, read post #4 just below




To add the “Windows Production PCA 2011” certificate to the Secure Boot UEFI Forbidden List (DBX).
Open a Command Prompt window as an Administrator, type these two commands separately, and then press Enter:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x80 /f

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"
Click to expand...
Does this work on HP computers, considering Sure Start?
 

My Computer My Computer

At a glance

Windows 10
OS
Windows 10

My Computers My Computers

System One System Two

  • At a glance

    Win 11 Home 26H2 26300.9818AMD Ryzen 7 3700XG.Skill (F4-3200C14D-16GTZKW)EVGA RTX 2070 (08G-P4-2171-KR)
    OS
    Win 11 Home 26H2 26300.9818
    Computer type
    PC/Desktop
    Manufacturer/Model
    Built by Ghot® [May 2020]
    CPU
    AMD Ryzen 7 3700X
    Motherboard
    Asus Pro WS X570-ACE (BIOS 5302)
    Memory
    G.Skill (F4-3200C14D-16GTZKW)
    Graphics Card(s)
    EVGA RTX 2070 (08G-P4-2171-KR)
    Sound Card
    Realtek ALC1220P / ALC S1220A
    Monitor(s) Displays
    Dell U3011 30"
    Screen Resolution
    2560 x 1600
    Hard Drives
    2x Samsung 860 EVO 500GB,
    WD 4TB Black FZBX - SATA III,
    WD 8TB Black FZBX - SATA III,
    DRW-24B1ST CD/DVD Burner
    PSU
    PC Power & Cooling 750W Quad EPS12V
    Case
    Cooler Master ATCS 840 Tower
    Cooling
    CM Hyper 212 EVO (push/pull)
    Keyboard
    Ducky DK9008 Shine II Blue LED
    Mouse
    Logitech Optical M-100
    Internet Speed
    300/300
    Browser
    Firefox (latest)
    Antivirus
    Bitdefender Total Security
    Other Info
    Speakers: Klipsch Pro Media 2.1

  • At a glance

    Windows XP Pro 32bit w/SP3AMD Athlon 64 X2 5000+ (OC'd @ 3.2Ghz)TWIN2X2048-6400C4DHX (2 x 1GB, DDR2 800)EVGA 256-P2-N758-TR GeForce 8600GT SSC
    Operating System
    Windows XP Pro 32bit w/SP3
    Computer type
    PC/Desktop
    Manufacturer/Model
    Built by Ghot® (not in use)
    CPU
    AMD Athlon 64 X2 5000+ (OC'd @ 3.2Ghz)
    Motherboard
    ASUS M2N32-SLI Deluxe Wireless Edition
    Memory
    TWIN2X2048-6400C4DHX (2 x 1GB, DDR2 800)
    Graphics card(s)
    EVGA 256-P2-N758-TR GeForce 8600GT SSC
    Sound Card
    Onboard
    Monitor(s) Displays
    ViewSonic G90FB Black 19" Professional (CRT)
    Screen Resolution
    up to 2048 x 1536
    Hard Drives
    WD 36GB 10,000rpm Raptor SATA
    Seagate 80GB 7200rpm SATA
    Lite-On LTR-52246S CD/RW
    Lite-On LH-18A1P CD/DVD Burner
    PSU
    PC Power & Cooling Silencer 750 Quad EPS12V
    Case
    Generic Beige case, 80mm fans
    Cooling
    ZALMAN 9500A 92mm CPU Cooler
    Keyboard
    Logitech Classic Keybooard 200
    Mouse
    Logitech Optical M-BT96a
    Internet Speed
    300/300
    Browser
    Firefox 3.x ??
    Antivirus
    Symantec (Norton)
    Other Info
    Still assembled, still runs. Haven't turned it on for 15 years?
Anibor_11 said:
Does this work on HP computers, considering Sure Start?
Click to expand...
From garlin's README.TXT

PARTIAL LIST OF PC's WITH KNOWN PROBLEMS
========================================

HP has a special update script for commercial PC's:

HP EliteBook 830 G5
HP EliteBook 836 G5
HP EliteBook 840 G5
HP EliteBook 846 G5
HP EliteBook 850 G5
 

My Computer My Computer

At a glance

Windows 11 Pro 26H2
OS
Windows 11 Pro 26H2
Computer type
Laptop
Manufacturer/Model
Toshiba
Antivirus
Defender
KevTech said:
Need to remove #comments from the end of the URL.
Click to expand...
Unfortunately, I can no longer edit the post.

I'll see if a mod can.

Update: Mod fixed the URL.

Thanks for pointing it out.
 
Last edited:

My Computer My Computer

At a glance

Windows 11 Pro 26H2
OS
Windows 11 Pro 26H2
Computer type
Laptop
Manufacturer/Model
Toshiba
Antivirus
Defender
That's for a different issue, installing the pre-requisite KEK CA 2023 on specific HP "business class" PC's. Banning the PCA 2011 happens after you've passed that hurdle, and should work the same regardless of the PC model and BIOS version.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
garlin said:
That's for a different issue, installing the pre-requisite KEK CA 2023 on specific HP "business class" PC's. Banning the PCA 2011 happens after you've passed that hurdle, and should work the same regardless of the PC model and BIOS version.
Click to expand...
I have a HP business class HP ProBook 450 G6 laptop. This has the new 2023 certifcates but the 2011 certificate hasn't been revoked yet. I'm hoping Windows Update revoves the old certifcate soon since I'm wary of breaking something.
 

My Computer My Computer

At a glance

Windows 11 ProCore i7-13700K64 GB Kingston Fury Beast DDR5Gigabyte GeForce RTX 2060 Super Gaming OC 8G
OS
Windows 11 Pro
Computer type
PC/Desktop
Manufacturer/Model
Self build
CPU
Core i7-13700K
Motherboard
Asus TUF Gaming Plus WiFi Z790
Memory
64 GB Kingston Fury Beast DDR5
Graphics Card(s)
Gigabyte GeForce RTX 2060 Super Gaming OC 8G
Sound Card
Realtek S1200A
Monitor(s) Displays
Viewsonic VP2770 & Dell (secondary)
Screen Resolution
2560 x 1440
Hard Drives
Kingston KC3000 2TB NVME SSD & SATA HDDs & SSD
PSU
EVGA SuperNova G2 850W
Case
Nanoxia Deep Silence 1
Cooling
Noctua NH-D14
Keyboard
Microsoft Digital Media Pro
Mouse
Logitech Wireless
Internet Speed
80 Mb / s
Browser
Chrome
Antivirus
Defender, Malwarebytes Free & AdwCleaner
You must log in or register to reply here.

Latest Support Threads

Latest Tutorials

Back
Top Bottom