Black Hat USA 2025 | BitUnlocker: Leveraging Windows Recovery to Extract BitLocker Secrets

Why It Matters

Because WinRE can now be weaponized to bypass BitLocker, organizations risk data breaches even when disks are encrypted, compelling immediate remediation and revisiting of physical‑security controls.

Key Takeaways

• WinRE can be manipulated to bypass BitLocker encryption
• Vulnerability allows loading arbitrary WIM image via SDI offset
• Modified recovery XML enables execution of signed tools for data extraction
• Researchers disclosed fixes and recommended hardening recovery environment
• Physical attackers can now retrieve secrets without BitLocker key

Summary

At Black Hat USA 2025, Microsoft’s Storm team unveiled “Bit Unlocker,” a proof‑of‑concept that abuses the Windows Recovery Environment (WinRE) to extract BitLocker keys and decrypt protected volumes.

The researchers explained that WinRE runs from a separate recovery partition and loads a trusted WIM image (winre.wim) into RAM. Design changes—moving winre.wim to an unencrypted volume, introducing a hash‑based “trusted‑wim” check, and auto‑unlocking the OS volume unless a risky tool is invoked—create a narrow but powerful attack surface. By manipulating the SDI boot file’s offset, an attacker can append an untrusted WIM that passes the hash check yet executes arbitrary code while the OS volume remains unlocked.

A live demo showed a locked machine being rebooted into WinRE, the exploit loading a malicious WIM, and the OS volume instantly reporting “unlocked” while BitLocker protection stayed enabled, exposing all files. The team also identified a second vector in the recovery‑agent XML, where scheduled offline‑scan operations can be redirected to signed utilities such as TTTracer, which can then trace and launch cmd.exe to harvest secrets.

These findings demonstrate that pre‑OS components can defeat full‑disk encryption, forcing enterprises to patch WinRE, enforce stricter signing policies, and consider additional hardware‑based protections. Microsoft has already issued mitigations, but the research underscores the need for continuous hardening of boot‑time environments.

Original Description

In Windows, the cornerstone of data protection is BitLocker, a Full Volume Encryption technology designed to secure sensitive data on disk. This ensures that even if an adversary gains physical access to the device, the data remains secure and inaccessible.

One of the most critical aspects of any data protection feature is its ability to support recovery operations in case of failure. To enable BitLocker recovery, significant design changes were implemented in the Windows Recovery Environment (WinRE). This led us to a pivotal question: did these changes introduce any new attack surfaces impacting BitLocker?

In this talk, we will share our journey of researching a fascinating and mysterious component: WinRE. Our exploration begins with an overview of the WinRE architecture, followed by a retrospective analysis of the attack surfaces exposed with the introduction of BitLocker. We will then discuss our methodology for effectively researching and exploiting these exposed attack surfaces. Our presentation will reveal how we identified multiple 0-day vulnerabilities and developed fully functional exploits, enabling us to bypass BitLocker and extract all protected data in several different ways.

Notably, the findings described reside entirely in the software stack, not requiring intrusive hardware attacks to be exploited.

After identifying these vulnerabilities as attackers, we then took on the role of defenders. We will share the insights Microsoft gained from this research and explain our approach to hardening and further securing WinRE, which in turn strengthens BitLocker.

By:

Alon Leviev | Security Researcher, Microsoft

Netanel Ben Simon | Senior Security Researcher, Microsoft

Yair Netzer | Principal Security Research Manager, Microsoft

Amit Dori | Senior Security Research Manager, MORSE Team, Microsoft

Full Presentation Materials Available at:

https://blackhat.com/us-25/briefings/schedule/?#bitunlocker-leveraging-windows-recovery-to-extract-bitlocker-secrets-45638