Informatio

This post will cover technical details of custom boot loader of NotPetya\Petya. It starts with copying disk sectors (overwritten by malware) 1 to 32 at address 0x8000. Below is the set of instruction performing above operation. To read sectors from disk it use INT13 BIOS interrupt call.Below is an example of INT 13 interrupt. DAP AH 42h = function number for extended read DL 80h  = drive index (e.g. 1st HDD = 80h) DS:SI 7BDCh = segment:offset pointer to the DAP, see below DAP : Disk Address Packet offset range size value description 00h 1 byte      10h size of DAP (set this to 10h) 01h 1 byte      00h unused, should be zero 02h..03h 2 bytes    01h number of sectors to be read 04h..07h 4 bytes    0x8000h segment:offset pointer to the memory buffer to which ...

This post will explain how to setup Bochs Emulator to debug MBR. I will be taking NotPetya\Petya ransomware MBR as an example. Take dump of Physical Drive whose MBR is overwritten by NotPetya\Petya ransomware by its malicious MBR. dd utility for windows can be used for this purpose.Command to dump the disk is as shown below. dd.exe if=\\?\Device\Harddisk0\DR0 of=<output file path> bs=512k --size --progress if = input file of = output file bs = read and write bytes at a time Configuring Bochs Emulator. Go to installation directory of Bochs Emulator and open file bochsrc and provide below information. 1.Disk Geometry 2.Boot Drive Disk Geometry setting contain Cylinder,Head and Sector (CHS) value of disk. # ATA controller for hard disks and cdroms ata0-master: type=disk, path="winxp0.img", mode=flat, cylinders=124830, heads=16, spt=63 where path is dump of disk taken using dd utility. Boot Drive setting contain bootable drive type. # BOOT: # This de...

This post will cover technical details of how NotPetya\Petya overwrite system MBR and copy its own custom boot loader to encrypt Master File Table Data run lists clusters. NotPetya\Petya has its own MBR and custom code (called by its MBR) embedded in its binary. Below instruction copies MBR bytes in NotPetya\Petya binary to memory allocated by HeapAlloc API. MBR bytes in NotPetya\Petya binary. MBR bytes Below instruction copies custom code bytes in NotPetya\Petya binary to memory allocated by HeapAlloc API.Size of custom code is 0x22B1(dwBytes). Custom code bytes in NotPetya\Petya binary. custom loader bytes Before overwriting system MBR bytes it copies below information from System MBR into its own MBR bytes it copied to memory. 1.Disk Signature 2.Partition Table entries. Below is the set of instructions performing above operation. Next step is to overwrite System MBR with its own MBR and custo...