UEFI Resident Motion Detection

MdrSentinel.efi is a UEFI DXE driver that runs during the Driver Execution Environment phase of the boot lifecycle, before the OS bootloader loads. It establishes memory CRC baselines across key firmware regions, plants canary pages, measures RDTSC timing to detect hidden SMM execution, and hooks the SetVariable service to intercept unauthorized UEFI variable writes. MdrSentinelSmm.efi is a separate SMM driver that runs inside System Management Mode itself — the highest CPU privilege level. It counts SMI frequency on a 100ms interval, establishes a baseline rate, and detects spikes that indicate hidden SMM activity.

System Management Mode is the highest privilege level on x86 hardware. Code running in SMM is invisible to the OS and to all OS-layer security tools. Nation-state firmware implants use SMM to hide their activity. MdrSentinelSmm.efi runs at the same privilege level as those implants — it monitors from inside the same environment the implants use, making evasion structurally harder.

The DXE driver writes to three named UEFI runtime variables under MDR_SENTINEL_VENDOR_GUID: MdrSentinelStatus (confirms the module is active), MdrSentinelBaseline (timing and region data from baseline establishment), and MdrSentinelAlert (forensic payload when motion is detected). The MDRwatchdog Windows Rust agent polls MdrSentinelAlert every 500ms via GetFirmwareEnvironmentVariable. When the variable contains an alert payload, the agent reads it, seals it to the Quantum Audit Chain™ with Ed25519 and ML-DSA-87 signatures, and clears the variable.

The modules were tested in QEMU with OVMF firmware before hardware deployment. The QEMU serial output confirms: memory baseline established across 12 regions, canary pages planted, timing baseline measured, SetVariable hook installed, periodic check timer armed at 500ms, and the SMM module armed at 100ms interval inside SMM. The build process uses EDK2 with GCC5 targeting x86_64 and produces MdrSentinel.efi and MdrSentinelSmm.efi as PE32+ executables.

Eclypsium and similar platforms run inside the OS and scan firmware binaries for known vulnerabilities. They operate after the OS loads, from above the firmware layer. MDRwatchdog Patent #10 operates inside the firmware itself during the DXE phase — before the OS bootloader executes. The baseline is established before any OS code runs, making it inaccessible to OS-layer attackers. The SMM module runs at Ring -2, below the OS entirely.

The priority date is September 8, 2026, established by public disclosure of the MdrSentinel.c and MdrSentinelSmm.c source code, the MdrSentinel.dsc EDK2 package descriptor, and the BUILD.md documentation on that date, corroborated by the PQC-sealed MDRwatchdog audit ledger (Block #1, 24,432 records, sealed September 7, 2026).