New 2023 petya

**New 2023 petya** was a theoretical petya variation concept that involves infecting real chkdsk with fake chkdsk.

## Infecting chkdsk

New 2023 petya replaces real chkdsk with fake chkdsk so that whenever chkdsk is ran, whether in booted Windows or during the boot, instead of repairing partition it encrypts it. After infecting chkdsk, New 2023 petya schedules all partitions of all connected disks to be checked by chkdsk. The infected chkdsk supports encrypting FAT, exFAT, and MFT, along with infecting MBR or GPT. Whenever infected chkdsk encounters a filesystem other than FAT, exFAT, or NTFS, it forwards that partition to real chkdsk. The infected chkdsk keeps track of how many FAT or MFT clusters were encrypted in each FAT or MFT in sector 34, with 32 bytes for each FAT or MFT (4 bytes for currently encrypted clusters, 4 bytes for total length in clusters, 8 bytes for position first sector of first cluster, 4 bytes for unique identifier and/or drive letter of FAT or MFT and special information, 4 bytes for checksum of last encrypted cluster, 4 bytes for checksum of first non-encrypted cluster, and 4 bytes for checksum of next encrypted cluster as the first non-encrypted cluster after encryption). Whenever the FAT or MFT has more than 4294967295 clusters, its size is stored as 4294967295, and the first 4294967295 clusters are encrypted. The sector 34 stores information for up to 15 FATs or MFTs, if there are more than 15, it dynamically allocates a new sector to store information for next 15 FATs or MFTs and stores the sector number in last 8 bytes of sector 34. The sector 34 is therefore the start of a linked list of information of FATs or MFTs.

## Encryption

The encryption is done in Win32 in the infected chkdsk, encrypting with salsa20. When infected chkdsk receives partition as an input, it locates all FATs or MFTs in that partition and locates them in the sector 34 list by their identifier, if it is not in the list it initializes it by setting number of encrypted clusters to 0, filling in the length, position, identifier, checksum of first cluster, checksum of first cluster after encryption, and inserts the information to the list. The fake chkdsk keeps track of the location of the information of the current FAT or MFT being encrypted. The encryption starts by checking the checksum of first non-encrypted cluster. If it matches, it encrypts the cluster on disk, encrypts next cluster in memory, and writes checksums and increments count, otherwise, it checks if the encrypted checksum matches instead, if so, it assumes the cluster is already encrypted, encrypts next cluster in memory, and writes checksums and increments count. Then the loop starts: write encrypted cluster from memory to disk, compute checksum of it, load next cluster to memory, compute checksum, encrypt cluster in memory, compute checksum of it, then increment count and update information on disk, and repeat until all sectors are encrypted. After all sectors are encrypted, fake chkdsk moves on to next FAT or MFT of the partition.

## Decryption

The decryption is done in protected mode in 32-bit petya kernel, and it occurs in reverse order of encryption. Petya identifies the end of the list of informations of encrypted FATs and MFTs, and starts decrypting last FAT or MFT. It attempts to identify the FAT or MFT on the disk, if it fails, it skips it and keeps it in the list. Within each FAT or MFT, it decrypts the sectors in reverse order, with the count decrementing instead of incrementing. It starts by checking the checksum of first non-encrypted cluster, if it matches, it computes checksums of last encrypted cluster before and after decryption and decrements the count of encrypted cluster and writes decrypted cluster to disk, otherwise, if it matches the checksum of next encrypted cluster, it assumes the cluster is already encrypted and decrypts it. The loop then proceeds by loading last encrypted cluster to memory, computing checksum of it, decrypting the cluster in memory, computing checksum of it, computing checksum of the cluster before that, decrementing count and updating information to disk, then writing decrypted sector to disk, and repeating until all sectors are decrypted. After fully decrypting the FAT or MFT, its information is set to all 0x00 bytes, and if all 15 slots of the sector are set to all 0x00 bytes, it deallocates the sector by moving the next sector pointer to previous sector and setting the sector to all 0x00 bytes.

## Error correction codes

New 2023 petya uses error correction codes in its personal decryption key. Whenever janus receives misspelled personal decryption key, it can be automatically bugfixed.