🔒 Windows Boot Manager Reconstructed Project

Welcome to the Windows Boot Manager Reconstructed Project. This repository contains a high-fidelity, complete C++ reconstruction of the secure boot sequence execution, Code Integrity verification, and BitLocker orchestration logic inside the Windows UEFI Boot Manager (bootmgr).

Based on low-level reverse engineering of modern boot security binaries, this repository demonstrates how Windows coordinates Secure Boot policies, validates firmware configurations, manages volume unlocking, and establishes the trust anchor handed off to the Operating System kernel.

---

🏗️ Repository Architecture

The project is structured into three clean, industry-standard directories to separate definitions, implementation modules, and original decompiled source files:

├── .gitignore             # Standard Git Ignore patterns
├── CMakeLists.txt         # C++ CMake build orchestration
├── LICENSE                # MIT License file
├── README.md              # Visual repository documentation
├── include/               # Public Header Files
│   ├── bcd.hpp            # Strongly typed BCD Options mapping
│   └── bootdefs.hpp       # Binary-packed EFI & BL library structures
├── src/                   # Implementation Modules
│   ├── bootmgr.cpp        # High-fidelity runtime OS decision engine
│   ├── sipolicy.cpp       # Code Integrity verification engine
│   └── policy_runtime.cpp # C++ Boot Policy Orchestrator runtime
└── decompiled/            # Original IDA Pseudocode Reference
    ├── pseudo.c           # Initial decompiler pseudocode export
    └── pseudo2.c          # Supplementary decompiled boot library reference

---

⚙️ Core Security Subsystems

1. High-Level Runtime Policy Orchestrator

Defined in policy_runtime.cpp via BootPolicyOrchestrator, this module handles the high-level declarative state machine:

• BootDecisionState: Models boot transitions through explicit execution status codes (BOOT_CONTINUE, BOOT_RECOVERY, BOOT_MENU, BOOT_FAIL, BOOT_FVE_UNLOCK_REQUIRED, BOOT_POLICY_BLOCKED).
• BCD Chaining: Reads system options directly from the BCD (Boot Configuration Data) to parse telemetry parameters and parent/child inheritance hierarchies.
• Image-to-Policy Binding: Enforces strict version rules by cryptographic signature checks and PE resource verification (BlResourceFindVersionFromImage).

2. Low-Level Execution Pipeline (BmTransferExecution)

Defined in bootmgr.cpp, this is a 100% low-level binary-equivalent reconstruction of the original boot transfer execution pipeline:

• Bitmask Decision Mapping: Maps executionParams[8] flags back into *OutTransitionReason codes with exact parity.
• Boot Retry Loop: Implements multi-device load fallbacks using automatic UEFI device enumeration (BlFwEnumerateDevice).
• Secure Boot Overlay: Merges active OS security policies with firmware UEFI key database configurations (db, dbx, KEK, PK) based on range-based version thresholds.

3. Code Integrity Policy Engine (SIPolicy)

Defined in sipolicy.cpp, this validates and parses active Code Integrity policy descriptor sets:

• SIPolicyIsSignedPolicyRequired: Assesses signed CI requirement parameters using persistent UEFI variables and session lock settings.
• BlSIPolicyCheckPolicyOnDevice: Validates legacy/new policies on system boot devices, sorting them and committing final states to transition control.

---

🔄 Reconstructed Boot Flow Lifecycle

The diagram below outlines the secure execution stages orchestrated by the runtime:

graph TD
    A[Boot Entry Loaded] --> B[Initialize Runtime]
    B --> C{BitLocker Active?}
    C -- Yes --> D[EvaluateVolumeDecryption]
    C -- No --> E[Load Security Policies]
    D -->|Unlock Success| E
    D -->|Unlock Required| F[State: BOOT_FVE_UNLOCK_REQUIRED]
    E --> G[Merge Firmware Secure Boot DB]
    G --> H[Classify Target Application]
    H --> I[Validate Image-Policy Binding]
    I -->|Verification Pass| J[Launch OS Loader]
    I -->|Blocked| K[State: BOOT_POLICY_BLOCKED]
    J --> L[Finalize Kernel Trust Activation]
    L --> M[Handoff to OS Kernel]

Loading

---

🛠️ Building & Configuring

The project includes a fully featured CMake project configuration. You can easily build it as a static runtime library:

1. Prerequisites

• A C++17 compliant compiler (MSVC 2019+, GCC 9+, or Clang 9+).
• CMake (Version 3.15 or newer).

2. Execution Steps

# Clone the repository
git clone https://github.com/hACKCASCAC/loader-reconstructed.git
cd loader-reconstructed

# Configure the build directory
cmake -B build -DCMAKE_BUILD_TYPE=Release

# Build the runtime library
cmake --build build

---

⚠️ Educational Disclaimer

This repository is created solely for educational, reverse-engineering, and security analysis purposes. The code does not contain proprietary Windows source code; it is a custom high-fidelity C++ reconstruction written to explain modern operating system secure boot flows and defensive trust validation pipelines.