MBR debugging with Bochs

I've tried Bochs for debugging MBR which is infected Petya just for fun.

First of all, prepare disk image.

$ dd if=xx.raw of=petya.img bs=512k count=20

(I've run petya on VM and convert .vmdk image into .raw image.)


Setup bochsrc file like following.

romimage: file=$BXSHARE/BIOS-bochs-latest
vgaromimage: file=$BXSHARE/VGABIOS-lgpl-latest
megs: 16
ata0: enabled=1, ioaddr1=0x1f0, ioaddr2=0x3f0, irq=14
ata0-master: type=disk, path="petya.img", mode=flat, cylinders=1, heads=16, spt=63
boot: disk
vga: extension=vbe
mouse: enabled=0
log: nul
logprefix: %t%e%d
panic: action=fatal
error: action=report
info: action=report
debug: action=ignore

Wrong cylinders, heads, spt value may be a glitch on setting up debugging environment.



Now, my petya.img size is 0x7E000 bytes.
(Disk image size must be multiples of 512.)

0x7E000 = 516,096 = 512*1008

It is addressed by following formula.

img size = cylinders * heads * spt * 512
516,096 = 1 * 16 * 63 * 512

You need to change each values to match your saved disk image.


Then, start Bochs execute bochsdbg.exe.
If it starts without error, it works.
Flashing skull will be displayed.