Technical Analysis : NotPetya\Petya MBR
This post will cover technical details of custom boot loader of NotPetya\Petya. It starts with copying disk sectors (overwritten by malware) 1 to 32 at address 0x8000. Below is the set of instruction performing above operation. To read sectors from disk it use INT13 BIOS interrupt call.Below is an example of INT 13 interrupt. DAP AH 42h = function number for extended read DL 80h = drive index (e.g. 1st HDD = 80h) DS:SI 7BDCh = segment:offset pointer to the DAP, see below DAP : Disk Address Packet offset range size value description 00h 1 byte 10h size of DAP (set this to 10h) 01h 1 byte 00h unused, should be zero 02h..03h 2 bytes 01h number of sectors to be read 04h..07h 4 bytes 0x8000h segment:offset pointer to the memory buffer to which ...