BochsでMBR debugging

今回は前回取り出したPetyaに書き換えられてしまったMBRをBochsで動かしてみよう。
https://ja.wikipedia.org/wiki/Bochs

Bochsはここから入手できる。
http://bochs.sourceforge.net/getcurrent.html

Bochsも前に出てきたVMware同様PCエミュレータなのだけど、
こいつはMBRのdebugができてしまうんだ。
OSが起動するより前のコードを追えるってわけだね。
そりゃ面白そうだ～笑

キモは設定ファイルの書き方くらいかなと。
サンプルの設定ファイルがあるのでチェックしてみて。
Bochs-2.6.9\bochsrc-sample.txt 

多分もっとシンプルにもできるんだと思うんだけど、、
筆者のはこんな感じ。
romimage: file=$BXSHARE/BIOS-bochs-latest
vgaromimage: file=$BXSHARE/VGABIOS-lgpl-latest
megs: 16
ata0: enabled=1, ioaddr1=0x1f0, ioaddr2=0x3f0, irq=14
ata0-master: type=disk, path="petya.img", mode=flat, cylinders=1, heads=16, spt=63
boot: disk
vga: extension=vbe
mouse: enabled=0
log: nul
logprefix: %t%e%d
panic: action=fatal
error: action=report
info: action=report
debug: action=ignore 

こいつをファイル名を変えてbochsrcとして保存。.txtもいらない。
Bochs-2.6.9\bochsrc

設定ファイルのポイントは赤文字のところ！！
path=""
には取り出したMBRのパスを記入する。

そして、もうひとつ重要なのが、Bochsに読み込ませるディスクイメージのサイズは512の倍数でなければいけないんだ。
どういうこっちゃ？？なのだけど、、
切り出したMBRをバイナリエディタで読み込ませてみよう。
petya.imgのサイズはきっかり0x7E000になってる。








10進に直すと516,096だ。512*1008。※

※Windowsに付いている電卓で16進<->10進の計算ができる

設定ファイルのcylinders, heads, spt(sectors per track)でディスクイメージのサイズを表してる。
https://en.wikipedia.org/wiki/Cylinder-head-sector

img size = cylinders * heads * spt * 512
516,096 = 1 * 16 * 63 * 512

筆者の環境に合わせなくても、近い数値で上記の数式通りになってればOK！
（逆に設定ファイルとイメージのサイズが合ってないとエラーでて全く動かない。。）

さて準備ができたらbochsdbg.exeを実行、
Bochs Start MenuのStartボタンで動く。



こんな感じの画面で止まるはず。
このBochs for Windows - Console で、"c"押下、でEnter。

Bochs for Windows - Display
でドクロピカピカが表示されていれば成功！だ。

Comments

Post a Comment

Popular posts from this blog

Firmware dumping via SPI

Image
I tried firmware dumping via SPI with Attify badge and Attify OS. Target camera is this one.. This camera seems to be famous among the IoT hackers. You would find many IoT hacking blogs about this camera. After the preview, I have extracted board. This time, I'd like to focus on Flash memory. It looks mxic mx25l12835f. From model number, we can find data-sheet. MX25L12835F . Now, let's connect flash memory pin and Attify Badge. Attify badge pin layout is.. D0 : SCK D1 : MISO  D2 : MOSI  D3 : CS  I have connected flash memory and Attify badge like this. D0 - SCLK(6) D1 - SI(5)  D2 - SO(2)  D3 - CS(1)  GND - GND(4)  3.3V - VCC(8)  3.3V - RESET(7)  3.3V - WP(3)  We dont need to connect power plug to camera. It is supplied via badge. For testing, trying spiflash.py and -i parameter. According to the python code, it returns ChipID. This command can be used for connectivity tesingt. "00 00 00" or "FF FF...
Read more

BLE sniffing with UbertoothOne

Image
This time, I'd like to try monitoring smartlock's BLE packets with Ubertooth One. Smartlock  use this dongle and Ubertooth One Find BLE device  check BLE dongle is connected. ➜ ~ sudo hciconfig hci0: Type: BR/EDR Bus: USB BD Address: 00:1A:7D:DA:71:13 ACL MTU: 310:10 SCO MTU: 64:8 UP RUNNING PSCAN RX bytes:622 acl:0 sco:0 events:38 errors:0 TX bytes:952 acl:0 sco:0 commands:38 errors:0 Let's find BLE devices ➜ ~ sudo hcitool lescan LE Scan ... 30:F8:3F:06:4F:6F (unknown) 30:F8:3F:06:4F:6F (unknown) 30:F8:3F:06:4F:6F (unknown) 18:62:E4:46:60:AB (unknown) Then, trying gatttool. Peripheral is defined by service and characteristic. Each service contains charateristics which contains data. ➜ ~ sudo gatttool -I -b 18:62:E4:46:60:AB [ ][18:62:E4:46:60:AB][LE]> connect [CON][18:62:E4:46:60:AB][LE]> primary [CON][18:62:E4:46:60:AB][LE]> attr handle: 0x0001, end grp handle: 0x0008 uuid: 0000fee7-0000-1000-8000-00805f9b34fb attr handle: 0x0009, en...
Read more

MOVAPS triggered ACCESS_VIOLATION....

Image
Hi, I met a malware which has a decryption code in it. I tried unpack on debugger but it is stucked in mid of decryption. movaps instruction triggered ACCESS_VIOLATION exception in decryption code. I doubted it might be a anti debugging technique but it seem to be not. (they are found in Windows shared libraries too) I searched about this issue.. movaps instruction is explained like this  but I don't understand the difference between the situations which can be passed or not. MOVAPS--Move Aligned Packed Single-Precision Floating-Point Values > the operand must be aligned on a 16-byte boundary http://qcd.phys.cmu.edu/QCDcluster/intel/vtune/reference/vc181.htm It is also,  > To move packed single-precision floating-point numbers to or from unaligned memory locations, use the MOVUPS instruction.    Anyway, the difference seem to be aligned/unaligned.  16 byte boundary alignment is the answer..   > which generally means...
Read more