mandiant / capa-rules

Standard collection of rules for capa: the tool for enumerating the capabilities of programs
https://github.com/mandiant/capa/
Apache License 2.0
514 stars 157 forks source link

delete drive layout via IOCTL #877

Closed williballenthin closed 6 months ago

williballenthin commented 6 months ago

execute the Windows API function DeviceIoControl with the control code IOCTL_DISK_DELETE_DRIVE_LAYOUT, the effect of which would be to remove the boot signature from the master boot record, so that the disk will be formatted from sector zero to the end of the disk.

also references here:

IOCTL_DISK_DELETE_DRIVE_LAYOUT 0x7c100 Removes the boot signature from the master boot record, so that the disk will be formatted from sector zero to the end of the disk. Partition information is no longer stored in sector zero.

williballenthin commented 6 months ago

image