According to the boot process of modern computer systems

whoever boots first will gain control first. Taking advantage of this feature

a malicious code called bootkit can hijack the control before the OS bootloader and bypass security mechanisms in boot process. That makes bootkits difficult to detect or clean up thoroughly. With the improvement of security mechanisms and the emergence of UEFI

the attack and defense techniques for bootkits have constantly been evolving. We first introduce two boot modes of modern computer systems and present an attack model of bootkits by some sophistical samples. Then we discuss some classic attack techniques used by bootkits from their initial appearance to the present on two axes

including boot mode axis and attack phase axis. Next

we evaluate the race to the bottom of the system and the evolution process between bootkits and security mechanisms. At last

we present the possible future direction for bootkits in the context of continuous improvement of OS and firmware security mechanisms.