Rainbow

Rainbow is a bootkit like HWID spoofer for Windows. It abuses several hooks in EFI runtime services and uses clever DKOM to hide hardware serials before any boot-time drivers are even started.

Screenshots

Video

Usage

In order to use rainbow spoofer, you need to load it. First, obtain a copy of rainbow.efi and a copy of EDK2 efi shell. Now follow these steps:

Extract downloaded efi shell and rename file Shell.efi (should be in folder UefiShell/X64) to bootx64.efi
Format some USB drive to FAT32
Create following folder structure:

USB:.
 │   rainbow.efi
 │
 └───EFI
      └───Boot
              bootx64.efi

Boot from the USB drive
An UEFI shell should start, change directory to your USB (FS0 should be the USB since we are booting from it) and list files:

FS0:
ls

You should see file rainbow.efi, if you do, load it:

load rainbow.efi

Now you should see output from rainbow. If it was successful, exit and boot into Windows (change to Windows boot media - usually FS1 - and run \EFI\Boot\bootx64.efi)

Download

Check out UnknownCheats.

Compiling