cisco-talos / mbrfilter Goto Github PK

View Code? Open in Web Editor NEW

333.0 49.0 72.0 30 KB

Cisco Talos MBR Filter Driver

Home Page: https://talosintelligence.com/mbrfilter

License: GNU General Public License v2.0

C++ 24.49% C 75.51%

mbrfilter's Introduction

MBRFilter

This is a simple disk filter based on Microsoft's diskperf and classpnp example drivers.

The goal of this filter is to prevent writing to Sector 0 on disks.
This is useful to prevent malware that overwrites the MBR like Petya.

This driver will prevent writes to sector 0 on all drives. This can cause an
issue when initializing a new disk in the Disk Management application. Hit
'Cancel' when asks you to write to the MBR/GPT and it should work as expected.
Alternatively, if OK was clicked, then quitting and restarting the application
will allow partitoning/formatting.

To install: right click the inf file, select 'install' and reboot when prompted.
To access sector 0 on drive 0: boot into Safe Mode.
To compile: make sure to set:
MBRFilter properties -> Configuration properties -> Driver Signing -> General
Sign mode: Test Sign
Test certificate: generate or select one from your store.

To remove MBRFilter, follow these steps:

- Remove the line MBRFilter from the UpperFilters registry key in (only
remove MBRFilter, there might be other disk drivers here):

HKLM\System\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}

- Reboot

AccessMBR

Simple program to read sector 0 on Physical drive 0 and write that sector back.
Used as a testing program for MBRFilter. This overwrites your MBR, it will
restore it once it's done.
Nevertheless: USE WITH CAUTION.

MBRFilter and AccessMbr Written by Yves Younan, Cisco Talos
SCSI passthrough part of AccessMBR written by Andrea Alleivi, Cisco Talos

Thanks to Andrea Alleivi for suggested fixes.
Thanks to Aaron Adams and Ilja Van Sprundel for reviewing the code.

No warranty: use at your own risk.

mbrfilter's People

Contributors

Stargazers

Watchers

mbrfilter's Issues

Error : The file 'MBRFilter.sys' on Cisco Talos MBR Filter is needed. This issue seems to be on both win 7 and 10.

My computer is telling me it needs a file called MBRFilter.sys to proceed with the install I looked in both directories but didn't find it from the Git Hub download is this normal or a glitch/bug?

ChkDsk is not working properly on usb devices

If I have MBRFilter running and connect an USB drive, a popup says "drive need to be scanned for errors".

When I choose "check and fix errors", the dialog says the error is fixed and I close the dialog.

After a short amount of time, the "drive need to be scanned for errors" dialog popups again.

Log denial requests (not just the message box)

Add process name/path to message

Translations

Hi,

is there a plan to translate the few strings of MBRFilter to other languages? I could do this for German.

Best regards,
Ettore

Compiled version

Could you provide an up-to-date release for people that don't like having to install visual studio just to compile one app. Your last (only) release is from August.

Do not write usb flash device bootable Windows

Do not write usb flash device bootable Windows, utility - yumi multi boot or rufus.
Eror write. Win 7 x64

Build error

Hi
thanks for this solution its really logical and effective.

just i did clone from github but when i try to buid solution am getting this error

error C2065: 'SCSIOP_WRITE_LONG16' : undeclared identifier

can u hlp me for this problem how can i fix it this ?

have nice day

Erdem

Blue screen after install driver

Error: DRIVER_POWER_STATE_FAILURE

Option to choose which drive is protected

I like to have an option to choose which drive is protected by MBRFilter.

I like to have only my Windows drive protected by MBRFilter.

.inf file missing in download

.inf file missing when I download MBRFilter or i'm not downloading right zip file. can you please direct me to right link or can you make a direct download link to make it easier for people to download.

windows 10 write failed

Accessing: \.\PhysicalDrive2
Disk bootable
Trying regular write
Regular write failed trying SCSI passthrough write
Write failed on PhysicalDrive 2

Reports of startup repair

Receiving reports that some people are having issues with startup repair running after installing this driver.

Person was not running secure boot
Ruled out incompatibility with Kaspersky and Malwarebytes (driver runs without issues when these are installed).

Freezes on Windows 7 SP1

The 64-bit version of it caused the OS to freeze at the Windows Logo when starting up. I think it is an issue with it and the RAM Disk driver that I have installed (which is Ultra RAMDisk - http://www.ultraramdisk.com).

cisco-talos / mbrfilter Goto Github PK

mbrfilter's Introduction

mbrfilter's People

Contributors

Stargazers

Watchers

Forkers

mbrfilter's Issues

Recommend Projects

Recommend Topics

Recommend Org