[Tigzy]

MaxSS was not supposed to alter only partition table?

[EP_X0FF]

MaxSS was not supposed to alter only partition table?

Only in current version.

[Tigzy]

Well, I need to review my classics :D
Ok. Will implement something to decrypt MBR. Some of you got a TDL4 dump for testing purpose? I only got VMs at work, so can't infect a physical machine.

[EP_X0FF]

Some of you got a TDL4 dump for testing purpose? I only got VMs at work, so can't infect a physical machine.

Take any dropper from TDL4 dedicated thread (Alureon.DX, not Alureon.FE) and infect VM. It should work.

[Tigzy]

I tried many "new" samples that were VM aware. Will try old ones.
Thanks

EDIT: Gotcha! :)

TDL4.txt

(512 Bytes) Downloaded 38 times

[rkhunter]

TDL4 MBR from WinXP SP3 infected.

[Tigzy]

A little help for decryption?

I got the key (0x147 and the begin offset 0x2A).
How the ROR is done? do we shift any byte 0x47 times (don't think so) or do we take all bytes shifted 0x47 times?

[rkhunter]

A little help for decryption?

I got the key (0x147 and the begin offset 0x2A).
How the ROR is done? do we shift any byte 0x47 times (don't think so) or do we take all bytes shifted 0x47 times?

What tool you are using for decryption?

[Tigzy]

None, I try to do it miself, as this is quite simple.

[EP_X0FF]

A little help for decryption?

I got the key (0x147 and the begin offset 0x2A).
How the ROR is done? do we shift any byte 0x47 times (don't think so) or do we take all bytes shifted 0x47 times?

Intel® 64 and IA-32 Architectures Software Developer’s Manual Volume 1: Basic Architecture