Experiment on analyzing fat12/16/32 File System

 

First, analyze the hard disk 0 head 0 cylinder 1 sector, that is, MBR (Main Boot Record). It starts from 0x1be, and 16 bytes is a data structure called partition information, for the specific format, see the following instance program. Generally, there are no more than 4 instances.

The first and last CHS parameters of each partition can be obtained in this data structure to facilitate reading of each partition.

The data volume is small, and the instance program requires ccdos Chinese support. The texture is two fat partitions of my 486 4.3g hard drive.

In the next article, we will establish and analyze the BPB data structure, which is very close to the directory we read and the file... continue to pay attention to it ..

/*
This programme is for read the MBR sector and analyze its content
Writen by lunzi Qingfeng studio 2008/01/07
E-mail: Dragon123321@hotmail.com QQ: 123685049
*/

# Include <stdio. h>
# Include <string. h>
# Include <dos. h>
# Include <mem. h>

# Define uint8 unsigned char
# Define uint16 unsigned short
# Define uint32 unsigned long

Struct mbr_fatinfo
{
Uint8 activemark;
Uint8 parstartheader;
Uint8 parstartsector;
Uint8 parstartcylder;
Uint8 systemmark;
Uint8 parendheader;
Uint8 parendsector;
Uint8 parendcylder;
Uint32 numofaheadsector;
Uint32 numoftotalsector;
};

Void readsector (uint8 buff []);
Void showsector (uint8 buff []);
Int writetofile (uint8 buff []);

Void readsector (uint8 buff [])
{
Union regs INR, outr;

INR. H. Ah = 0x02;/* No 2. fuction */
INR. H. Al = 0x01;/* The number of sectors wanted read */
INR. X. bx = Buff;/* save back buffer address es: BX */
INR. H. Ch = 0x00;/* num of cylder */
INR. H. Cl = 0x01;/* num of sector */
INR. H. DH = 0x00;/* num of header */
INR. H. DL = 0x80;/* num of destnition disk */
Int86 (0x13, & INR, & outr );
}

Void showsector (uint8 buff [])
{
Int I;

For (I = 0; I <512; I ++ ){
If (I % 24 = 0 ){
Printf ("/N ");
Printf ("% 4x:", I );
}

Printf ("% 2x", buff [I]);
}
}

Int writetofile (uint8 buff [])
{
File * FP;
Int I;

If (FP = fopen ("C: // mypro // disksec. bin", "Wat") = NULL)
{
Printf ("error: cocould not create or open the log file./N ");
Fclose (FP );
Return (0 );
}

For (I = 0; I <512; I ++ ){
Fputc (buff [I], FP );
}

Fclose (FP );
Return (1 );

}

/************* Main function *************/
Int main ()
{
Uint8 MBR [512];
Int key_input;

/******/
Struct mbr_fatinfo MFI;
Char * PTR;
Int C = 0;

Readsector (MBR );
/*
Showsector (MBR );

Printf ("/nwrite the content to a log file Press Y or y others for exit! /N ");
Key_input = getch ();
If (key_input = 'y' | key_input = 'y ')
{
If (writetofile (MBR) = 1) printf ("successfully write into the log file! ");
Else printf ("failed write into the log file! ");
}

Printf ("/nanalyze this sector Press Y or y others for exit! /N ");
Key_input = getch ();
If (key_input = 'y' | key_input = 'y ')
{
Printf ("this sector is the MBR sector, more info :");

}

*/
For (C = 0; C <4; C ++ ){
PTR = memcpy (& MFI, & MBR [(0x1be + C * 16)], 16 );
If (PTR)
{
Printf ("/n startup flag: % 2x", MFI. activemark );
Printf ("/n partition start column: % 2x (% d)", MFI. parstartheader, MFI. parstartheader );
Printf ("/T partition start sector: % 2x (% d)", MFI. parstartsector, MFI. parstartsector );
Printf ("/T partition start cylindrical: % 2x (% d)", MFI. parstartcylder, MFI. parstartcylder );
Printf ("/n system flag: % 2x", MFI. systemmark );
Printf ("/n partition end column: % 2x (% d)", MFI. parendheader, MFI. parendheader );
Printf ("/T partition end sector: % 2x (% d)", MFI. parendsector, MFI. parendsector );
Printf ("/T partition end cylindrical: % 2x (% d)", MFI. parendcylder, MFI. parendcylder );
Printf ("/N number of pre-partitions: % u", MFI. numofaheadsector );
Printf ("/n partition sector total: % u", MFI. numoftotalsector );
Printf ("/N ");
}
Else
Printf ("error: Can't copy the memory! ");
}

Return (0 );
}

 

 

During this week in Wuhan, many things have happened, so happy and worried that they have hindered the speed of my article.

Yongliang's journey made me feel the terrible reality and pressure of my life again. I hope that he will be safe in Africa and return to the arms of Wuhan people as soon as possible ..

I am so happy that I have found a job .. Many people breathe a sigh of relief, right?

Be happy and worried...

Today, we will send two articles in a row. The following is the reading of the content of the 0-track, 1-column, and 1-sector, which contains the two important data structures DBR and BPB, I have already set up this data structure. Due to the restrictions of my machine environment, I am using the fat16 file system, however, the program can be used to read the BPB of FAT32 with a slight modification (fat16 and FAT32 mentioned in the White Paper are calculated by the program. I want to do it separately-Wait for the driver library to be created, oh, so far away ).

The program still uses Chinese output. Compile and run the program in the ccdos environment.

Calculation of several important parameters is the key of this section:

First, calculate the number of sectors occupied by the root directory: rootdirsectors.
Then calculate the start address of the Data zone: firstdatasector
Then, calculate the root directory sector number firstrootdirsecnum.

In the next section, we will focus on how to calculate the address of the first sector of the first cluster in the logic of the FAT partition by using these parameters and obtain the information of the root directory.

 

/*
This programme is for read the BPB sector and caculate the fat
Writen by lunzi Qingfeng studio 2008/01/07
E-mail: Dragon123321@hotmail.com QQ: 123685049
*/

# Include <stdio. h>
# Include <string. h>
# Include <dos. h>
# Include <mem. h>

# Define uint8 unsigned char
# Define uint16 unsigned short
# Define uint32 unsigned long

Typedef struct bpb_fat16
{
Uint8 bs_drvnum;
Uint8 bs_reserved1;
Uint8 bs_bootsig;
Uint8 bs_volid [4];
Uint8 bs_vollab [11];
Uint8 bs_file1_ype [8];
};

Typedef struct bpb_fat32
{
Uint32 bpb_fatsz32;
Uint16 bpb_extflags;
Uint16 bpb_fsver;
Uint32 bpb_rootclus;
Uint16 bpb_fsinfo;
Uint16 bpb_bkbootsec;
Uint8 bpb_reserved [12];
Uint8 bs_drvnum;
Uint8 bs_reserved1;
Uint8 bs_bootsig;
Uint8 bs_volid [4];
Uint8 bs_filpolicype [19];
};

Typedef struct bpb_info
{
Uint8 bs_jmpboot [3];
Uint8 bs_oemname [8];
Uint16 bpb_bytspersec;
Uint8 bpb_secperclus;
Uint16 bpb_rsvdseccnt;
Uint8 bpb_numfats;
Uint16 bpb_rootentcnt;
Uint16 bpb_totsec16;
Uint8 bpb_media;
Uint16 bpb_fatsz16;
Uint16 bpb_secpertrk;
Uint16 bpb_numheads;
Uint32 bpb_hiddsec;
Uint32 bpb_totsec32;
Union bpb_fats
{
Struct bpb_fat16 fat16;
Struct bpb_fat32 FAT32;
} Bpb_fat;
};

Void readsector (INT cyl, int header, int sec, uint8 buff []);
Void showsector (uint8 buff []);
Int writetofile (uint8 buff []);

Void readsector (INT cyl, int header, int sec, uint8 buff [])
{
Union regs INR, outr;

INR. H. Ah = 0x02;/* No 2. fuction */
INR. H. Al = 0x01;/* The number of sectors wanted read */
INR. X. bx = Buff;/* save back buffer address es: BX */
INR. H. Ch = 0x3a;/* num of cylder */
INR. H. Cl = 0x01;/* num of sector */
INR. H. DH = 0x00;/* num of header */
INR. H. DL = 0x80;/* num of destnition disk */
Int86 (0x13, & INR, & outr );
}

Void showsector (uint8 buff [])
{
Int I;

For (I = 0; I <512; I ++ ){
If (I % 24 = 0 ){
Printf ("/N ");
Printf ("% 4x:", I );
}

Printf ("% 2x", buff [I]);
}
}

Int writetofile (uint8 buff [])
{
File * FP;
Int I;

If (FP = fopen ("C: // mypro // disksec. bin", "WAB") = NULL)
{
Printf ("error: cocould not create or open the log file./N ");
Fclose (FP );
Return (0 );
}

For (I = 0; I <512; I ++ ){
Fputc (buff [I], FP );
}

Fclose (FP );
Return (1 );

}

/************* Main function *************/
Int main (INT argc, char * argv [])
{
Uint8 MBR [512];
Int cyl, SEC, header;
Int key_input;
/* DBR */
Struct bpb_info BPB;
Char * PTR;
Int C;
/* Fat */
Uint16 rootdirsectors;
Uint16 firstdatasector;
Uint16 firstsectorofcluster;
Uint16 fatsz;
/* Fat root dir */
Uint16 firstrootdirsecnum;
/*
If (argc <= 3 ){
Printf ("this programme need three parameters: cylder header sector/N ");
Exit (1 );
}
*/
Cyl = atoi (argv [1]);
Header = atoi (argv [2]);
SEC = atoi (argv [3]);

Readsector (58,0, 1, MBR );
/*
Readsector (CYL, header, SEC, MBR );

Showsector (MBR );

Printf ("/nwrite the content to a log file Press Y others for exit! /N ");
Key_input = getch ();
If (key_input = 'y' | key_input = 'y ')
{
If (writetofile (MBR) = 1) printf ("successfully write into the log file! ");
Else printf ("failed write into the log file! ");
}

Size = 62
Printf ("% d", sizeof (BpB ));
*/

PTR = memcpy (& BPB, & MBR [0], sizeof (BpB ));
If (PTR)
{
Printf ("Startup Code :");
For (C = 0; C <3; C ++) printf ("% 2x", BPB. bs_jmpboot [c]);
Printf ("/toem name :");
For (C = 0; C <8; C ++) printf ("% C", BPB. bs_oemname [c]);
Printf ("/T bytes per sector :");
Printf ("% d", BPB. bpb_bytspersec );

Printf ("/N number of slices per cluster :");
Printf ("% d", BPB. bpb_secperclus );
Printf ("/T number of reserved slices :");
Printf ("% d", BPB. bpb_rsvdseccnt );
Printf ("/t the number of fat tables in this volume :");
Printf ("% d", BPB. bpb_numfats );

Printf ("/N number of directories in the root directory :");
Printf ("% d", BPB. bpb_rootentcnt );
Printf ("/T total number of slice in the volume 16bit :");
Printf ("% d", BPB. bpb_totsec16 );
Printf ("/T storage media type :");
Printf ("0x % 2x", BPB. bpb_media );

Printf ("/n the number of sectors occupied by a fat table :");
Printf ("% d", BPB. bpb_fatsz16 );
Printf ("/T number of sectors per track :");
Printf ("% d", BPB. bpb_secpertrk );
Printf ("/T head number :");
Printf ("% d", BPB. bpb_numheads );

Printf ("/n the number of hidden sectors before the fat table :");
Printf ("% u", BPB. bpb_hiddsec );
Printf ("/T :");
Printf ("% u", BPB. bpb_totsec32 );

Printf ("/n content 16 and 32 are different. The following Program introduces 16 :");

Printf ("/n drive type parameters :");
Printf ("0x % 2x", BPB. bpb_fat.fat16.bs_drvnum );
Printf ("/T reserved (for NTFs ):");
Printf ("% d", BPB. bpb_fat.fat16.bs_reserved1 );
Printf ("/T expansion start flag :");
Printf ("0x % 2x", BPB. bpb_fat.fat16.bs_bootsig );

Printf ("/n disk volume label :");
For (C = 0; C <11; C ++) printf ("% C", BPB. bpb_fat.fat16.bs_vollab [c]);
Printf ("/tfat file system type :");
For (C = 0; C <8; C ++) printf ("% C", BPB. bpb_fat.fat16.bs_file1_ype [c]);

Printf ("/n is the general procedure for fat calculation :");
Rootdirsectors = (BpB. bpb_rootentcnt * 32) + (BpB. bpb_bytspersec)/BPB. bpb_bytspersec;

If (BpB. bpb_fatsz16! = 0)
Fatsz = BPB. bpb_fatsz16;
Else
{
Printf ("error: Your FS isn't fat16, please change this programme./N ");
Exit (0 );
}
Firstdatasector = BPB. bpb_rsvdseccnt + (BpB. bpb_numfats * fatsz) + rootdirsectors;
Firstrootdirsecnum = BPB. bpb_rsvdseccnt + (BpB. bpb_numfats * BPB. bpb_fatsz16 );
Printf ("/N1 first calculates the number of slices occupied by the root directory: % d", rootdirsectors );
Printf ("/N2 and then calculate the data zone start address: % d", firstdatasector );
Printf ("/N3 then calculate the root directory sector number: % d", firstrootdirsecnum );
}
Else
{
Printf ("can't copy the DBR to the memory! /N ");
}

Return (0 );
}