Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed spacing, linked blog announcement #4

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 30 additions & 27 deletions README.txt
Original file line number Diff line number Diff line change
@@ -1,48 +1,51 @@
MBRFilter
MBRFilter

This is a simple disk filter based on Microsoft's diskperf and classpnp example drivers.
A simple disk filter based on Microsoft's diskperf and classpnp example drivers.

The goal of this filter is to prevent writing to Sector 0 on disks.
This is useful to prevent malware that overwrites the MBR like Petya.
The goal of this filter is to prevent writing to Sector 0 on disks.
This is useful to prevent malware that overwrites the MBR like Petya.

This driver will prevent writes to sector 0 on all drives. This can cause an
issue when initializing a new disk in the Disk Management application. Hit
'Cancel' when asks you to write to the MBR/GPT and it should work as expected.
Alternatively, if OK was clicked, then quitting and restarting the application
will allow partitoning/formatting.
This driver will prevent writes to sector 0 on all drives. This can cause an
issue when initializing a new disk in the Disk Management application. Hit
'Cancel' when asks you to write to the MBR/GPT and it should work as expected.
Alternatively, if OK was clicked, then quitting and restarting the application
will allow partitoning/formatting.


To install: right click the inf file, select 'install' and reboot when prompted.
To access sector 0 on drive 0: boot into Safe Mode.
To compile: make sure to set:
MBRFilter properties -> Configuration properties -> Driver Signing -> General
Sign mode: Test Sign
Test certificate: generate or select one from your store.
To install: right click the inf file, select 'install' and reboot when prompted.
To access sector 0 on drive 0: boot into Safe Mode.
To compile: make sure to set:

MBRFilter properties -> Configuration properties -> Driver Signing -> General
Sign mode: Test Sign
Test certificate: generate or select one from your store.

To remove MBRFilter, follow these steps:

- Remove the line MBRFilter from the UpperFilters registry key in (only
remove MBRFilter, there might be other disk drivers here):
remove MBRFilter, there might be other disk drivers here):

HKLM\System\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}

- Reboot

AccessMBR

Simple program to read sector 0 on Physical drive 0 and write that sector back.
Used as a testing program for MBRFilter. This overwrites your MBR, it will
restore it once it's done.
Nevertheless: USE WITH CAUTION.
AccessMBR

Simple program to read sector 0 on Physical drive 0 and write that sector back.
Used as a testing program for MBRFilter. This overwrites your MBR, it will
restore it once it's done.
Nevertheless: USE WITH CAUTION.


MBRFilter and AccessMbr Written by Yves Younan, Cisco Talos
SCSI passthrough part of AccessMBR written by Andrea Alleivi, Cisco Talos
MBRFilter and AccessMbr Written by Yves Younan, Cisco Talos
SCSI passthrough part of AccessMBR written by Andrea Alleivi, Cisco Talos

Copyright (C) 2016 Cisco Systems Inc
Learn more at http://blog.talosintel.com/2016/10/mbrfilter.html

Thanks to Andrea Alleivi for suggested fixes.
Thanks to Aaron Adams and Ilja Van Sprundel for reviewing the code.
Copyright (C) 2016 Cisco Systems Inc

No warranty: use at your own risk.
Thanks to Andrea Alleivi for suggested fixes.
Thanks to Aaron Adams and Ilja Van Sprundel for reviewing the code.

No warranty: use at your own risk.