NotPetya\Petya : Overwriting System MBR
This post will cover technical details of how NotPetya\Petya overwrite system MBR and copy its own custom boot loader to encrypt Master File Table Data run lists clusters. NotPetya\Petya has its own MBR and custom code (called by its MBR) embedded in its binary. Below instruction copies MBR bytes in NotPetya\Petya binary to memory allocated by HeapAlloc API. MBR bytes in NotPetya\Petya binary. MBR bytes Below instruction copies custom code bytes in NotPetya\Petya binary to memory allocated by HeapAlloc API.Size of custom code is 0x22B1(dwBytes). Custom code bytes in NotPetya\Petya binary. custom loader bytes Before overwriting system MBR bytes it copies below information from System MBR into its own MBR bytes it copied to memory. 1.Disk Signature 2.Partition Table entries. Below is the set of instructions performing above operation. Next step is to overwrite System MBR with its own MBR and custo...