Unedited output from a GGFW offline engagement against a real OEM notebook BIOS image. The heuristic PE/DXE triage flagged one high-interest module; analyst identification confirms it as a firmware-resident anti-theft persistence agent (Absolute Computrace / LoJack) — a legitimate OEM feature that behaves, technically, like an implant.
$ ggfw --engagement bios.bin --offline-only --yara tools/yara GGSec Firmware Toolkit v0.6.5 Beta Module: offline SPI image analysis File: <oem-notebook-bios>.bin Size: 2949120 bytes (2.81 MiB) SHA-256: 04a38ff56c5a086d89d74a013c64ca14e20e98ea3980b68eeffad8e3a61a1a50 [WARN] Intel Flash Descriptor signature not found at 0x10 — content-only analysis [OK] Primary firmware family: insyde_h2o (confidence=medium) Intel FIT / microcode scan [OK] Intel microcode scan: validated=9 unverified=2 (0x306Ax Sandy/Ivy Bridge family) UEFI firmware volumes [OK] Inferred FV payload coverage 0x000000–0x220000; nested FFS files=223 exec=188 UEFI PE/DXE module risk scan [INFO] Heuristic implant triage — not signature AV, not a clean/malware verdict scanned: volumes=3 files=225 executables=188 pe_te=188 findings: high=1 medium=1 low=0 info=0 interesting_modules=1 Interesting PE/DXE modules (triage priority) [WARN] #1 score=53 guid=9E69ABDE-A749-4BD5-97DD-C60F666D96B6 type=APPLICATION pe=PE32+ reasons=pe_suspicious_string,pe_host_injection_api hot_imports=CreateRemoteThread, VirtualAllocEx, WriteProcessMemory imports=ntdll.dll KERNEL32.dll ADVAPI32.dll WININET.dll WSOCK32.dll USERENV.dll entropy=6.31 entry_rva=0x1B60 payload_sha256=32e2795f2158… PE/TE extract (YARA / AV triage) [OK] extracted=1 skipped=187 hit_files=1 pe_hits/00562170_9E69ABDE…_APPLICATION_PE32_.HIT [OK] YARA scan complete: GGFW_HostImplant_ApiStrings (1 match) ── analyst identification ────────────────────────────────────── The firmware module embeds a full Windows userland agent. Extracted strings: Computrace V90.915 rpcnetp.exe \SystemRoot\System32\AUTOCHK.EXE:BAK \svchost.exe \Registry\Machine\System\CurrentControlSet\Services\rpcnetp HttpSendRequestA · HttpOpenRequestA · wininet.dll (HTTP C2) CreateRemoteThread · VirtualAllocEx · WriteProcessMemory (svchost injection) signed: VeriSign / Absolute Software Boot chain: BIOS DXE app → patches autochk.exe (AUTOCHK.EXE:BAK) at boot → drops rpcnetp.exe → injects svchost.exe → phones home over HTTP
A legitimate factory OEM feature, not third-party malware. Technically it is indistinguishable from a firmware
implant: it survives OS reinstall, runs a Windows agent via autochk.exe hijacking, injects into
svchost.exe, and calls out over unauthenticated HTTP — behaviour documented by Kaspersky
(“Absolute Computrace Revisited”, SAS 2014) as a hijackable persistence surface.
Action for the asset owner: confirm the anti-theft service is intended and enabled, or have it disabled in firmware setup. GGFW surfaces it in seconds; without triage it hides among ~188 legitimate DXE modules.
GGFW heuristic PE/DXE triage and YARA integration flagged the module automatically; the identification above is analyst-led. Heuristic triage is not signature AV and offline analysis does not prove runtime activation. Image vendor anonymised; the module is a widely-shipped OEM component present across many notebook brands.