6.3 Analyzing bootkit and boot ransomware

As you know, reverse engineering is beyond the scope of this book, but here are some hints for readers who want to explore more on bootkits.

The first step in analyzing bootkits is to extract the boot sector of the disk after infecting the system with a bootkit. There are a number of hex editor tools that can be used to extract the boot sector. Hex workshop is one of them. After launching hex workshop, you can go to disk | open drive | select. In the select dropdown, you can select all drives:

Then, you can select Physical disk in the drop-down menu:

Fig shows the first sector of the disk

You can save the boot sector to some file and use ida pro with a bochs (emulator) to understand the workings of boot sector code. For a better understanding, readers can explore MBR structure and VBR further.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.15.153.69