MTV Reboot — my Super Sweet 16-bit malware...
summary
Deep reverse engineering of MS-DOS malware shows actual techniques: hooking the IVT to install TSR payloads, infecting COM files (max ~63 KB), and saving/spoofing the original MBR for stealth. Examples include Crash and Cuckoo (VGA-buffer locks), Stoned (MBR bootkit that displays “your PC is now stoned” one in eight runs), Tequila (multi-stage payload requiring user input), and Marine (logic‑bomb that encrypts drives in June). Analysis uses r2 with a custom plugin, Cutter, IDA Free 5.0, QEMU/Bochs, DOSBox, and VX‑Underground sources.
AI-written summary · about
chapters (23)
- 0:00Introduction to talk
- 1:26What this talk covers
- 2:55Presentation structure
- 3:58Motivations for project
- 5:03Malware definitions
- 7:28MS-DOS architecture overview
- 9:56Key MS-DOS interrupts
- 11:26Interrupt Vector Table
- 12:52TSR programs explained
- 14:37TSR demo walkthrough
- 16:00COM program structure
- 18:30Greatest hits of MS-DOS malware
- 20:56Malware sample sources
- 22:2016-bit malware reversing method
- 25:07Malware sample: Crash
- 26:16Malware sample: Cuckoo
- 27:20Malware sample: Verdem
- 28:44Malware sample: Stoned
- 30:57Malware sample: Tequila
- 32:22Malware sample: Marine
- 35:38Why study old OS malware
- 41:32Where to go next
- 43:10Q&A session
related talks
01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized Packers
25mCommSec D1 - A Deep Dive Into Malicious Documents
45m"Advanced Malware Threat: handling obfuscated code using..."
40mAnalyzing Windows Malware on Linux: Getting Started Tips and Examples
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
57mHiding In Plain Sight - Advances In Malware Covert Communication Channels
59mThe Less Hacked Path
01h 06mComputrace Backdoor Revisited