; ****************************************************************

;       Name: Rescue Module
;       Author: Peter Kleissner
;       Version: 1.00
;       Date: 30.07.2007 12:06
;       last 01.03.2008 10:37

;       For: ToasterOS BMS, FLS, Hibernation File Attack, Stoned
;                |
;                +--› MBR Version
;                +-----› Standalone
;                |  |         |
;                |  |         l---› FAT16
;                |  |         l---› FAT32
;                |  |         l---› NTFS
;                |  |
;                |  +--› Live CD Version
;                |
;                +---> Forensic Lockdown Software
;                +---> Black Hat Europe 2009 Version
;                +---> Stoned

;	History:
;	    01.03.2008 10:37
;       Implementation for Forensic Lockdown Software OS
;     02.05.2009 16:01
;       Stoned Bootkit

; ****************************************************************

[bits 16]                                       ; create a 16 Bit Code
CPU 386                                         ; Assemble instructions up to the 386 instruction set

%include "Kernel Storage.asm"

org Rescue_Module





; [previous usage]
; the Rescue Module is called if the System is in Rescue Mode
; 
;   Rescue Mode:
;     
;     - enabled when any Error occurs during boot process
;     
;     - can be totally disabled over Configuration Area
;     
;   The Rescue Mode is used to boot the operating system without
;   Windows Boot System System files. So the Boot Record can operate
;   without System files and is so operating system independent.
;   
;   In Rescue Mode ToasterOS boots only from the active Partition.
;       [althought a small Boot System Interface is planned]



; Error Handlers are in the Bootloader
%define	Boot_Error		Bootloader + 1AFh
%define	Read_Error		Bootloader + 1B2h



; validate the Configuration Area
cmp [Configuration_Area+0],dword 'Toas'
jne Rescue_Module_ret
cmp [Configuration_Area+4],dword 'terO'
jne Rescue_Module_ret
cmp [Configuration_Area+8],dword 'S Ge'
jne Rescue_Module_ret
cmp [Configuration_Area+12],dword 'nuin'
jne Rescue_Module_ret
cmp [Configuration_Area+16],dword 'e   '
jne Rescue_Module_ret

; check if Rescue Mode is global disabled
cmp [Configuration_Area + 77],byte 1
je Rescue_Module_ret

jmp Rescue_Mode_enabled


Rescue_Module_ret:

; jump to the Loader
jmp 0000h:System_Loader




Rescue_Mode_enabled:

; Rescue Mode is enabled by System

; ; clear the Screen
; mov ecx,2000
; xor eax,eax
; mov edi,Textmode_Buffer
; 
; rep stosw



Find_Active_Partition:

; find active partition in loop
mov cx,4
mov si,7C00h + 1BEh

Find_active_Partition_loop:

cmp [si],byte 80h
je Active_Partition_found

add si,16
loop Find_active_Partition_loop


; find Windows NT Partition in loop
mov cx,4
mov si,7C00h + 1BEh

Find_active_Partition_loop2:

cmp [si + 4],byte 07h
je Active_Partition_found

add si,16
loop Find_active_Partition_loop2


; find any Partition in loop
mov cx,4
mov si,7C00h + 1BEh

Find_active_Partition_loop3:

cmp [si + 4],byte 0
jne Active_Partition_found

add si,16
loop Find_active_Partition_loop3


; => Boot Error (no active boot partition found)
jmp Boot_Error


Active_Partition_found:

; read the Bootloader
mov [dap_Count],word 1
mov eax,[si + 8]
mov [dap_LBA_low],dword eax
mov [dap_Buffer],dword 7C00h

mov dl,[Boot_Drive]
mov ah,42h
mov si,disk_address_packet

int 13h
jc Read_Error

mov edx,[Boot_Drive]
mov ebx,[Boot_Drive]
mov sp,0FFFEh
mov eax,0000aa55h
jmp 0000h:7C00h

