Original sentence: This bootkit, currently written for Win32 platforms, can be used in two types of attack scenarios: in the first one, the user must launch the bootkit with administrative privileges once the PC has already booted; in the second one, analogously to hardware keyloggers, a malicious person needs physical access (legally as in the case of law enforcement agencies, or illegally as in the case of industrial espionage activities) to the user's Truecrypt-encrypted hard disk: in this circumstance this is needed to modify the user's Truecrypt MBR with the Stoned's one (ie, with a hex editor), and then place the hard disk back on the unknowing user's PC, so that when the user boots the PC and type his/her Truecrypt's password on boot, the "Stoned" bootkit intercepts it thereafter
Edited sentence: , with a hex editor), and then place the hard disk back on the unknowingly user's PC, so that when the user boots the PC and types his/her Truecrypt password on boot, the "Stoned" bootkit intercepts it thereafter because, from that moment on, the Stoned bootkit is loaded before Truecrypt's MBR in the boot sequence.Two types of attack scenarios exist in which it is possibile to maliciously take advantage of this bootkit, currently written for Win32 platforms only: in the first one, the user is required to launch the bootkit with administrative privileges once the PC has already booted into Windows; in the second one, analogously to hardware keyloggers, a malicious person needs physical access (legally as in the case of law enforcement agencies, or illegally as in the case of industrial espionage activities) to the user's Truecrypt-encrypted hard disk: in this context this is needed to modify the user's Truecrypt MBR with the Stoned's one (i