Informatio

This post will explain how to setup Bochs Emulator to debug MBR. I will be taking NotPetya\Petya ransomware MBR as an example. Take dump of Physical Drive whose MBR is overwritten by NotPetya\Petya ransomware by its malicious MBR. dd utility for windows can be used for this purpose.Command to dump the disk is as shown below. dd.exe if=\\?\Device\Harddisk0\DR0 of=<output file path> bs=512k --size --progress if = input file of = output file bs = read and write bytes at a time Configuring Bochs Emulator. Go to installation directory of Bochs Emulator and open file bochsrc and provide below information. 1.Disk Geometry 2.Boot Drive Disk Geometry setting contain Cylinder,Head and Sector (CHS) value of disk. # ATA controller for hard disks and cdroms ata0-master: type=disk, path="winxp0.img", mode=flat, cylinders=124830, heads=16, spt=63 where path is dump of disk taken using dd utility. Boot Drive setting contain bootable drive type. # BOOT: # This de...

This post will cover technical details of how NotPetya\Petya overwrite system MBR and copy its own custom boot loader to encrypt Master File Table Data run lists clusters. NotPetya\Petya has its own MBR and custom code (called by its MBR) embedded in its binary. Below instruction copies MBR bytes in NotPetya\Petya binary to memory allocated by HeapAlloc API. MBR bytes in NotPetya\Petya binary. MBR bytes Below instruction copies custom code bytes in NotPetya\Petya binary to memory allocated by HeapAlloc API.Size of custom code is 0x22B1(dwBytes). Custom code bytes in NotPetya\Petya binary. custom loader bytes Before overwriting system MBR bytes it copies below information from System MBR into its own MBR bytes it copied to memory. 1.Disk Signature 2.Partition Table entries. Below is the set of instructions performing above operation. Next step is to overwrite System MBR with its own MBR and custo...