0/68 VirusTotal. NT AUTHORITY\SYSTEM before the logon screen. No disk writes. No kernel driver. No PCR violations in production builds — BitLocker never prompts. EfiTool demonstrates in-RAM SYSTEM hive patching via a direct gBS->ExitBootServices hook at UEFI level. If the demo is undetectable, assume the armed variants are too. - View it on GitHub