Debugging the MBR with IDA Pro and Bochs

Analyzing the MBR is sometimes required during a forensic process, if you suspect a malicious activity that is not detected on-line. With static analysis, you may see if an obvious corruption happened, but you will need to debug to learn more.

Prerequisite :

  • IDA Pro (6.0) with the IDA Python plug-in (1.4.3)

Steps :

  1. Prepare your forensic disk image.
    In general, it is that simple :

    $ dd if=<source> of=disk.img bs=65536 conv=noerror

    Or :

    $ ddrescue -n <source> <dest> file.log

    Check the disk geometry using :

    $ fdisk -luc disk.img

    These values will be useful for step 5.
    However, if you have an exotic disk, it may be much trickier. For example, I got some geometry errors with a flash disk when using Bochs at step 11. Special thanks to Gene Cumm from the bochs-developpers mailing list who gave me the tip to specify the geometry to dd :

    $ dd if=input of=output bs=2064384 count=507
  2. Refer to CHS if you wonder how to get these values.

  3. Extract the MBR from the disk or from the image you just took.
    $ dd if=<source> of=mbr.dump bs=512 count=5
  4. Download and install the Bochs x86-64 emulator, which comes with a debugger that will work nicely with IDA.
  5. Download this archive from Hexblog (IDA Pro’s blog). We will use two files from there : bochrc, wich is the configuration file for Bochs, and mbr.py which a python file helpful from preparing the debugging environment.
  6. Copy bochrc in your working directory and edit the following line to match your disk image geometry :
    ata0-master: type=disk, path="sdb.img", mode=flat, cylinders=507, heads=64, spt=63

    Before going on, you may test that Bochs can use the image with these settings :

    C:\>"c:\Program Files\Bochs-2.4.5\bochsdbg.exe" -f bochsrc -q
  7. In the same directory, copy mbr.py and edit the following settings :
    # Some constants
    SECTOR_SIZE = 512
    BOOT_START  = 0x7C00
    BOOT_SIZE   = 0x7C00 + SECTOR_SIZE * 4
    BOOT_END    = BOOT_START + BOOT_SIZE
    SECTOR2     = BOOT_START + SECTOR_SIZE
    MBRNAME    = "mbr.img"
    IMGNAME     = "sdb.img"
  8. Now open a console and type :
    C:\> mbr update
  9. With IDA Pro, open the boshrc file. IDA should recognize the format and set the proper settings.
  10. From the menu, open File/Script File and select mbr.py. It will close IDA after execution.
  11. Open again your *.idb file, set a breakpoint at 0x7C00.
  12. Start the debugger.

You should now be able to go ahead and debug the MBR step by step.

References :

6 thoughts on “Debugging the MBR with IDA Pro and Bochs

  1. abhijit

    Hi I was trying to debug the mbr using the method u have described.but IDA is only showing up a messagebox”running” with a suspend button on it and nothing else is happening.

  2. phocean Post author

    Hi abhijit. Is Bochs working well itself ? It should open a DOS window while starting. Or maybe you just forgot to set the breakpoint…

  3. abhijit mohanta

    bochs is working by itself.I have set breakpoint too.i prepared the image using hexblog***?p=103 i .I got a large of 4 gb image.Is there a way to create smaller image.

  4. phocean Post author

    If you use my dd command, with count=507, you get only on very small image containing only what matters for your analysis, the MBR.

  5. phocean Post author

    There is dd for Windows, I believe. You will have to search more by yourself if you want to get somewhere with this stuff.

Leave a comment

Your email address will not be published. Required fields are marked *