Notes for YouTube Video: https://www.youtube.com/watch?v=KguyjVDlH1o

Scanlime Reverse Engineering for Beginners Notes

https://www.youtube.com/watch?v=KguyjVDlH1o

## Master Boot Record

copy image of flash card
move to ubunutu
full disc image so has MBR
MBR tells about partitions, code to boot bootloader (512 bytes)
> xxd file.img | less
> xxd -g1
(seperates bytes)
error message at beginning, 0x55AA at end (ways to tell it's a 1st stage bootloader)
https://en.wikipedia.org/wiki/Master_boot_record

> sudo apt install nasm

> ndisasm -b 16 file.img
(included with nasm)
setting bit width

code that bios moves into memory and runs
0x7C00 - MBR location

this code moves itself (the MBR) to 0x6000, then the 2nd stage bootloader overwrites the original data at 

0x7c00

https://wiki.osdev.org/Expanded_Main_Page

uses xxd to find where data begins (the text of the file: Invalid...) and code ends 

http://www.ctyme.com/intr/int.htm

code:
int 0x18 ; just a boot hook: http://www.ctyme.com/intr/rb-2241.htm
; WRONG: but uses data in AX (AX=0 from above) xoring itself generates a 0 (xor ax,ax)
; so it's keyboard - get stroke (that doesn't seem right...???)
; legacy boot to ROM BASIC?
(interupt 18, go to page above and see that interrupt)

int 0x10 ; ah=0xe, teletype out with options

int 0x13 ; ax=0201, 02 = read sectors into memory, 01 = 1 sector
int 0x13 ; ax=00, recalibrate drive heads


## Extract partition

# mount file for VM:
> losetup ; set up and control loop devices
> mount -o loop file.img /mnt

> sudo losetup -f ; find unused loop devices
responds with /dev/loop0
> sudo losetup /dev/loop0 -P -r file.img; partitioned, read only

> dmesg	; check device driver messages?
> ls -l /dev/loop0	; tab autocomplete, shows partition table was mounted (now a loop0p1)

> sudo fdisk /dev/loop0 	 ; now able to see partition table (same as we were looking at in hex editor)

## Mount filesystem:
> mkdir mnt
> sudo mount /dev/loop0p1 mnt
> cd mnt
> ls -al	; viewing contents 
> tar zcvpf archive-fs.tar.gz mnt	; archive the folder


> sudo xxd /dev/loop0	; exactly the same as looking at hex dump from before


> sudo xxd /dev/loop0p1	| less; look at first partition
ends with 0x55AA at 0x200. this is a PSOS bootloader, not a DOS bootloader
PSOS is an old RTOS
this data is a partition boot record, not a MBR, but can look at it using the same method

> sudo dd if=/dev/loop0p1 of=partitionboot.img bs=512 count=1 ; copy single 512 byte block

> xxd partitionboot.img
> ndisasm -b 16 partitionboot.img > partitionboot.asm
> xxd -g1 partitionboot.img >> partititonboot.asm ; append hexdump to end of asm file

disassembler automatically assumed wrong instructions
1st instruction in code jumps to 0x2b, which is disassembled as the middle of an instruction
need to fix this

> ndisasm -b 16 -e 0x2b -o 0x7c2b  partitionboot.img	; -e moves to start point (where the first 

instruction jumped to). and origin to 0x7c2b - 0x7c00 is start point, plus 0x2b offset
; looks alright now, try to disassemble again
> ndisasm -b 16 partitionboot.img > partitionboot.asm

calling a function: example:
"call word 0x1234"
then go to that address
and it will end with
"ret"

lgdt	; load Global Descriptor Table - tells processor how memory is set up

https://en.wikipedia.org/wiki/Global_Descriptor_Table


loops in place, error condition (halt loop)
sti	; enable interrupts
hlt	; sleep until next interrupt
jmp	; jumps to the sti intstuction



# Disassemble the files from the filesystem

> xxd RAM.ABS | less	; expect it to be a mix of data and x86 code
find an application (code and data structures that code would point to)


> nsdisasm -b 32 RAM.ABS | less


# filesystem info

BIOS & MBR, partititon boot record -> 512 bytes sitting at the front of the disc
PSOSBOOT.SYS & RAM.ABS -> inside FAT filesystem


## x86 architexture reference
https://en.wikipedia.org/wiki/Control_register#CR0
looking at:
mov eax,cr0
or eax, 0x60000000
bits 30, 29 being set -> cache disable, not write thru (globally turning off cache)
-> "about to do serious business with the processor"

lidt [0x123]
lgdt [0x123]
Load Global/Interrupt Descriptor Table
	loading these with absolute address

assumption was that these addresses were inside data
but the total file size is 0x1c..and idt is at 0x22 which is past the end

## assuming that the ABS file starts at 1MB offset
(based on the above assumptions about the interrupt table's location)
> nsdisasm -b 32 -o 0x100000 RAM.ABS | less


in less: /term to search

create symbolic link (shortcut)
> ln -sf orig.file new.location


# Binary Ninja

needs python script to correctly format hex file as code (view of partial code at 2:55:38)
viewing log seems to be helpul

could find strings (in hex view) and then go back and try to find a related print function
strings with 0x00 between characters are 16 bit strings on 32 bit system


4:14:00

Binary Ninja

8:28:35

## booting from hard disk
qemu-system-i386 -hda tmp.img
or can do -hdb for 2nd hdd

qemu-system-i386 -kernal RAM.ABS


## custom bootloader

git clone github.com/scanlime/metalkit
cd metalkit/examples/scanpci
make

	generates scanpci.img

qemu-system-i386 -fda scanpci.img
fda is floppy


hex editor software: https://www.sweetscape.com/010editor/


multiboot is interface between bootloader and linux kernel