Grub for DoS

Before getting started, let's take a look at the differences between grub for DOS series.

Grub for DOS 0.0.x series is a version that does not have any disk simulation Extension function. It is equivalent to GNU grub. The GNU grub has the disk ing function. Disk ing is a special disk simulation. Disk ing can only map one BIOS disk number to another BIOS disk number. That is to say, it can only simulate the entire disk and cannot simulate another disk with one file on the disk. This version is also the most secure and reliable. It can be considered that GNU grub is more secure than grub for DOS 0.0.x.

Grub for DOS 0.1.x series has all the functions of 0.0.x, in addition to the floppy disk simulation extension. However, you can only use an IMG file on the hard disk to simulate a 1.44 m floppy disk, and write the image of the floppy disk. That is to say, the software is prohibited from writing the image of the floppy disk through the int13 interface. This version has no known security issues.

The grub for DOS 0.2.x series provides simulation functions for floppy disks and hard disks of any specification. It is a fully functional version. The biggest difference between it and the 0.1.x series is that it no longer protects the simulated disk image by default. To obtain functions equivalent to 0.1.x, you must add the -- Read-Only parameter to the map command. [Note: The 0.1.x series also supports the -- Read-Only parameter, but even if this parameter is not provided, the 0.1.x series automatically protects Disk Images from being written .]

Although version 0.2.x supports writing Virtual Disk Images, The int13/AH = 05 h function for formatting Virtual Disk Images is not fully implemented. When formatting the track, grub for DOS 0.2.x does not really take any substantive formatting action, that is, it does not change the content of any sector in the virtual disk, instead, only the message "formatted successfully" (similar to the false message of fake write) is returned to the caller immediately. This is not a big problem. Note only one thing: when you want to format a virtual disk in DOS/Win98, you must first run the DELETE command instead of issuing the format command, delete all the files and directories in the root directory of the virtual disk to an empty disk, and then issue the formatting command. In this way, the formatted Virtual Disk can be used normally. Otherwise, the junk directory items before formatting remain, which affects the normal use of the virtual disk.

Because version 0.2.x supports writing data to a virtual disk, checking the Virtual Disk boundary is an essential step. The program has already protected this. When you try to read or write the sectors that exceed the Virtual Disk boundary, the int13 interface will return the error message "the sector is not found", instead of actually reading or writing (!!) The content of the slice following the virtual disk image on the hard disk. [There is no substantial danger to read these out-of-bounds sectors. However, writing these out-of-bounds sectors will cause a disaster to the hard disk. Therefore, this protection is required .]

For more information about grub for DOS 0.0.x, see:Fix startup failure with grub. EXE in DOS

For more information about grub for DOS 0.1.x, see:Use grub to guide the floppy disk image-saving the disk media

Download grub for DOS from here:

Http://newdos.yginfo.net/grubdos.htm(English homepage, thank you wengier !)

FTP: // 211.100.7.71/incoming/That is:Ftp://ftp.cosoft.org.cn/incoming/

Next, this article will only discuss the new functions of grub for DOS 0.2.x series.

First, consider security. In version 0.1.x, because only a floppy disk is simulated and accessed in read-only mode, security issues are not very important. However, 0.2.x is quite different. It can not only write to a floppy disk, but also enable this function by default. Therefore, if you do not pay attention to it, you may encounter problems. There are roughly the following situations:

1. If your program (or virus) needs to be written into a floppy disk, your floppy disk image may change the content, which may not be the result you want.

2. If you simulate the hard disk, after entering windows98, the hard disk number may be misplaced [for example, the BIOS disk 0x81 is changed to 0x82, and so on ]. At this time, if a hard disk image is written, another real hard disk may be damaged. We can see that if the -- Read-Only parameter is added, the security can still be well guaranteed.

3. Even if read-only parameters are added as described in "2", there are still some security risks. The reason is, win98 treats our int13 simulation program as a virus [search for mbrint13 in www.google.com to find this type of information]. Therefore, win98 may intentionally generate some errors to disrupt our int13 operation. So far, we have not found that "Win98 still damages the disk image after the read-only parameter is added", but it cannot guarantee absolute security.

4. When the full disk ing is added with the -- Read-Only parameter, the simulated disk is read-only in DOS, but not read-only in Win98. This is because Win98 implements "32-bit disk access" for "full disk ing" [this should be called "disk access in Protected Mode"] and does not use BIOS, therefore, it does not know that we have added the -- Read-Only parameter, so it will be written to the disk. Therefore, do not use the -- Read-Only parameter in the case of full disk ing. [of course, using the -- Read-Only parameter has no harm ].

5. If the hard disk is not simulated, that is, the simulation command of a floppy disk similar to map destination (fd0) is used, it should be safer in DOS. However, if you want to run Win98 after simulation, pay attention to this order: first run with map -- read-only destination (fd0, after you confirm that Win98 can read the content of the simulated floppy disk normally, you can not add the -- Read-Only parameter when running the map command next time. If you cannot read the contents of a simulated floppy disk, it indicates that the read location is incorrect [the sector on another disk may be read], which indicates that writing a simulated floppy disk will cause a disaster. Therefore, we recommend that you use the -- Read-Only parameter to confirm when running Win98 to ensure security.

For version 0.2.x, if a problem only causes a "crash", this is not considered a security issue. Security issues are counted only when a disk sector is damaged.

There are many scenarios where floppy disk simulation is used. Therefore, the disk simulation command usage is described in the example of floppy disk simulation.

1. Simulate a drive letter (such as C :) on the hard disk as a:, and boot Win98 from drive C:

Map -- read-only (hd0, 0) + 1 (fd0)
Chainloader (hd0, 0) + 1
Rootnoverify (hd0)
Boot

The above (hd0, 0) is the C: disk under Win98. After entering Win98, we can find that the content of disk A is exactly the same as that of disk C. If you delete a file on a: disk at will, the C: disk will also delete the file, which may cause a fault (such as a crash ).

In the map command, (HDM, n) + 1 is interpreted as representing the entire (HDM, n) partition, not just the first sector of the partition. In contrast, in other places, (HDM, n) + 1 still only represents the first sector of the partition.

2. Simulate a drive letter (such as C :) on the hard disk as a:, and boot Win98 from disk:

Map -- read-only (hd0, 0) + 1 (fd0)
Map -- hook
Chainloader (fd0) + 1
Rootnoverify (fd0)
Boot

Use the map -- hook command to activate a: Local disk simulation. If there is no map-hook command, then the subsequent chainloader (fd0) + 1 command will look for the content on the actual floppy disk media of the soft drive, rather than the content on the desired virtual disk.
The last rootnoverify (fd0) tells the boot program that we started the machine from a floppy disk.

3. Simulate an IMG file on the hard disk as a:, and boot Win98 from the C: Disk

Map -- read-only (hd0, 0)/file. IMG (fd0)
Chainloader (hd0, 0) + 1
Rootnoverify (hd0)
Boot

4. Simulate an IMG file on the disk as a:, and use the File dos. IMG In the IMG image to guide the machine:

Map -- read-only (hd0, 0)/file. IMG (fd0)
Map -- hook
Chainloader (fd0)/DOS. img
Rootnoverify (fd0)
Boot

Here, file. IMG is a C: floppy disk image file on the disk, which contains a file called DOS. IMG. If you do not need the map -- hook command (the local simulation function is enabled for this command), you cannot access the DOS. IMG file in the subsequent grub command line. This example only describes the functions of the map-hook command. We usually do not use the methods in this example.

In the above command, the floppy disk can be of any specification or size.

The following is an example of Hard Disk simulation, but it is best not to start Win98, but only to start DoS:

Map -- read-only (hd2, 6) + 1 (hd0)
Map -- hook
Chainloader (hd0, 0) + 1
Rootnoverify (hd0)
Boot

Here (hd2, 6) + 1 is a logical DOS partition on the third hard disk. The "map (hd2, 6) + 1 (hd0)" command simulates extended DoS partitions as BIOS hard disks 0x80. After the local simulation [map -- hook] is activated, (hd0, 0) + 1 in "chainloader (hd0, 0) + 1" is the virtual 0x80 hard disk partition after simulation, instead of simulating the previous hard disk partition 0x80. [Here (hd0, 0) + 1 is actually the (hd2, 6) + 1 before simulation ]. You must ensure that DOS exists in the partition, otherwise the boot will fail. If you do not start Win98, you do not need the -- Read-Only parameter. If you try to start Win98, the boot usually fails.

Because the 63 sectors before the logical partition of the MS-DOS store a "partition table of the extended partition", it is possible to use it to simulate a hard disk. The boot records in the extended partition table are all 00 bytes. Grub for DOS 0.2.x made some modifications when reading the partition table, making the table look like a legal hard disk primary partition table. Grub for DOS does not write data to this sector, because the default safeboot function works. This is safe. In this case, the -- unsafe-boot option should not be added, because Win98 will write the Boot Sector of the virtual disk at will, which will lead to misplacement of the partition table information, the extension partition is not accessible because the content is still there, but the extension partition table is not accessible due to an error. Manual modification to the extended partition table can solve this problem, but requires accurate calculation ].

If the above hard disk simulation example is changed to the following method, this will fail:

Map -- read-only (hd2, 6) + 1 (hd0)
Chainloader (hd2, 6) + 1
Rootnoverify (hd0)
Boot

The dos Boot Record of a partition (hd2, 6) contains an "hidden sector" field, which must be modified. If the map -- hook command is not run, the field is not modified correctly, and the boot fails. The program that modifies this field is in the interrupt processing program of int13, therefore, you need to map-hook and then read the content of this slice. [the content of this slice has been properly modified ]. After map -- hook, chainloader (hd0, 0) + 1 should be used to load (hd2, 6) + 1 before simulation, and chainloader (hd2, 6) should be used directly) + 1 is incorrect [directly use the chainloader (hd2, 6) + 1 result, so that this sector cannot use the int13 interrupt handler for necessary modifications, which will cause boot failure ]. Note that int13 only works on disks (hd0) and does not work on (hd2) Because map -- read-only (hd2, 6) + 1 (hd0) the command only simulates (hd0), but does not simulate other disks, including (hd2. Therefore, the int13 program will modify (hd0, 0) + 1 but not (hd2, 6) + 1.

Also, the above "modification" does not occur on the disk, but in the memory. Therefore, the content of the sector on the disk will not change. That is to say, when reading this slice, you need to modify the read sector to ensure that the content of the slice is available. When writing the slice, because the default safeboot is working, no write action is performed, and a false "Write successful" message is directly returned.

As explained above, safeboot only protects the primary Boot Sector of the hard disk MBR and the first sector of the first primary partition of the hard disk (usually the DOS Boot Sector)-only protects these two sectors, other sectors are not protected.

Grub for DOS 0.2.0 also includes the bootgrub and grldr files [they are called "grub for ntldr "]. These two files are used to directly start grub from the boot menu of Windows NT/2000/XP/2003. The usage is to copy bootgrub and grldr to C: root directory of Windows NT/2000/XP/2003 [C: root directory should have hidden ntldr and boot. INI file, and then modify the boot. INI file, usually in Boot. add a line similar to the following at the end of the INI file:

C:/bootgrub = "Start Grub"

Restart the machine and select the corresponding menu to go to grub.

Security suggestions (this was previously written, but it is still retained, maybe this is a good way to attract attention ):
1. If you use grub for DOS, try to use version 0.0.x instead of higher.
2. If you do not need 0.0.x, try to use version 0.1.x instead of higher.
3. If you do not need 0.1.x, try to use version 0.2.x instead of higher.
4. If you use version 0.2.x, do not use disk simulation commands such as map.
5. If you use version 0.2.x and the map command, try to test and run it in the virtual machine.
6. If version 0.2.x has been tested on your virtual machine, try to run it with parameters such as -- read-only on the real machine.
7. Although you have added parameters such as -- read-only to the map command, do not start Windows.
8. If you want to start Windows, try not to place the IMG image used for simulation on the (hd0) Drive.
9. If you have started windows, even if the simulated disk image is not on the (hd0) Drive, you have to make the worst plan: First, if the simulation image is destroyed, do not be surprised; second, if a real disk is all destroyed, you should not feel unacceptable; third, if all your hard disks are decommissioned, you should not feel too strange.
10. The simulation technology after version 0.2.x is used by skilled computer players for research purposes, rather than for common users.
11. It is best for players to share experiences with each other, study failures of others during use, and read the instructions in detail to avoid unnecessary losses.

In the initial test, many problems were exposed and many hard disks were damaged. Therefore, I would like to give a special notice here and write out the above precautions.

The new functions of map commands are risky. We recommend that you first test them in a virtual machine such as VMware or virtual PC. Run the map command with the -- read-only or -- fake-write parameters first. This is a test in the read-only status, which is safer. After the read-only test is complete for a period of time, complete the test. During the test, install DOS/Win9x/me on the Virtual Disk simulated by grub. Do not use other operating systems. Even if all tests are successful, this simulation technology still has its inherent risks. This is BIOS-based simulation, not all-round simulation. For example, when formatting a disk, you must understand whether the disk is simulated? And the formatting software you use is bios? Or use the disk I/O port for read/write? The BIOS formatting software is safe under simulation. Use the disk I/O port formatting software. When formatting a simulated disk, it will actually format your real hard disk in the worst case, the hard disk on which this dangerous misoperation occurs depends on the map command set used (refer to the "technical details and implementation methods" section below ). For further testing, please report the DOS format command, Windows Resource Manager formatting command, and disk fragmentation command, and third-party production tools such as HD-COPY software in the formatting operation is safe.

Technical details and implementation methods:

Grub for DOS 0.2.x will support disk images of various specifications. Because the simulation of the hard disk is similar, it is also necessary to provide support for the IMG of the hard disk. In addition, grub for DOS 0.2.x should also be enabled for writing to a virtual disk (writing to a virtual disk is a dangerous operation, because we actually write it to the IMG file on the hard disk, in case of a bug in the simulation program of grub for DOS 0.2.x, writing data to other sectors of the hard disk may cause serious problems such as data damage and startup failure !).

For floppy disk specifications: the technical problem to be solved is how to properly handle the Three-dimensional Geometric address, that is, the common description of CHS (c -- Magnetic Track cylinder number; h -- head number; S -- fan area number ). These specifications are available for both the actual software drive and the floppy disk. However, the IMG file after simulation cannot represent these specifications. For example, for a 1.44 m unformatted IMG file, all the data in the file is 00. How can we determine its CHS value?

When the IMG file has been formatted by DOS, use the BPB table in the first sector of the floppy disk to determine the CHS value. If the format is not dos formatted, or the BPB table is found to be incorrect, the CHS value is determined based on the IMG file size. For standard (or commonly used) floppy disk IMG sizes, such as 1.44 m, 1.2 m, 2.88 M, etc., the known CHS value is used. The supported floppy disk size can even be any (non-standard), such as a floppy IMG file of 10 m, 50 m, or 500 m. At this time, if the BPB table does not have a valid CHS value, you need to use the map command line parameter to manually set the CHS value. If the command line does not specify the CHS value, an error message is displayed, and simulation is rejected. When both the BPB table on the floppy disk and the map command line have the CHS specification, the command line is used as the standard. If the two are different, a warning is given.

Disk Type list (Anti-copy encrypted floppy disk with a sector size not equal to 512 bytes is not supported ):

Floppy disk capacity, number of tracks per plane, number of sectors, number of cores or number of disks
----------------------------------------------------------------
0160 K (standard) 40 08 1
0180 K (standard) 40 09 1
0200 K 40 05 2
0250 K 50 (temporary) 10 (temporary) 1
0320 K 80 08 1
0320 K (standard) 40 08 2
0360 K (standard) 40 09 2
0400 K (priority) 40 10 2
0400 K 80 05 2
0420 K 42 10 2
0500 K 50 (temporary) 10 (temporary) 2
0640 K 80 08 2
0720 K (standard) 80 09 2
0729 K 81 09 2
0738 K 82 09 2
0747 K 83 09 2
0756 K 84 09 2
0800 K 80 10 2
0810 K 81 10 2
0820 K 82 10 2
0830 K 83 10 2
0840 K 84 10 2
0902 K ** 82 11 2
0984 K ** 82 12 2
1066 K ** 82 13 2
1200 K (standard) 80 15 2
1215 K 81 15 2
1230 K 82 15 2
1245 K 83 15 2
1260 K 84 15 2
1360 K 80 17 2
1377 K 81 17 2
1394 K 82 17 2
1411 K 83 17 2
1428 K 84 17 2
1440 K (standard) 80 18 2
1458 K 81 18 2
1476 K 82 18 2
1494 K 83 18 2
1512 K 84 18 2
1558 K ** 82 19 2
1600 K 80 20 2
1620 K 81 20 2
1640 K 82 20 2
1660 K 83 20 2
1680 K 84 20 2
1680 K (priority) 80 21 2
1701 K 81 21 2
1722 K 82 21 2
1743 K 83 21 2
1764 K 84 21 2
1804 K ** 82 22 2
1886 K ** 82 23 2
2880 K (standard) 80 36 2
3198 K 82 39 2
3608 K ** 82 44 2
3690 K ** 82 45 2
3772 K ** 82 46 2

(Thanks to Roy for providing a large amount of disk specification information)

Hard Disks are more complex than floppy disks. The first sector of the hard disk is not the DOS boot zone, but the primary Boot Record (MBR). Here there is no BPB table, but a partition table. Therefore, perform the following operations on the hard disk's CHS:

When no partition table or partition table error occurs, you must use the map command line to specify the CHS. Otherwise, simulation is rejected. When a partition table exists, the values of H and s can be determined by any of the four Partition Table items. Use the IMG file length to determine the value of C. [This method can also be used to determine the CHS of a large hard disk .]

Some may be reluctant to give command line CHS parameters. They want grub for DOS to select an appropriate value. The map command provides this option. First, determine the CHS based on the above BPB or partition table. If it fails, use the following method to determine. For a floppy disk, try to use parameters with two heads. For hard disk IMG files, if grub for DOS is selected automatically, 63 sectors and 256 heads are always selected.

Drive_map_slot structure:

Byte: from_drive -- Which BIOS disk number is mapped to another disk number or to another IMG file?
Byte: to_drive -- the disk number mapped. BiOS disk No.: 0, 1 ,...... Floppy disk, 0x80, 0x81 ,...... Hard Disk.
Byte: max_head -- maximum head number. The value range is 0 to 255.

Byte: max_sector -- maximum fan area number. Value Range: 1 to 63.
4 Bytes: start_sector -- the start sector ID of the IMG file mapped.
4 Bytes: sector_count -- total number of slices of the IMG file mapped. Must be an even number.

When the value of max_sector is 0, it indicates that the regular disk read/write interruption is prohibited (for example, int13/AH = 02) [map command line parameter -- disable-CHS-mode ]. Max_sector can be used at most two times. The value of 1 indicates the read-only operation (the command line parameter of map -- read-only or -- fake-write). All data in the sector written to the simulation floppy disk is discarded. If the secondary high value is 1, the disk read/write interruption is prohibited (for example, int13/AH = 42 h). [map command line parameter -- disable-LBA-mode ]. Sector_count is the total number of sectors. This number must be an even number (when it is an odd number, a sector at the end does not participate in simulation ). Therefore, the second bit of sector_count is also used. When this bit is 1 and the maximum bit of max_sector is 1, it indicates that the map command line parameter-fake-write is "disguised as the write Sector" operation ]. The difference between "disguised write" and "read-only" is that "read-only" tells the caller that "Write protection of the disk cannot be written" after throwing away the written sector "; the "disguised write" spoofed the caller program and said, "write successfully. Please continue." [We sometimes need this function ]. When start_sector is 0 and the 31-bit height of sector_count is 0, it indicates that the whole disk (instead of some part of the sector segments) is used to simulate [the second bit of sector_count indicates "disguised write "], this simulation is more efficient [GNU grub's original simulation is like this, and the code is also very simple ].

When sector_count is an odd number (that is, -- fake-write) and max_sector's highest bit is 0 (that is, -- read-only is not set), it is called safeboot. Although it is allowed to write data to a virtual disk, however, the first sector (BOOT zone) of the Virtual Disk cannot be written ). In addition, if the virtual disk image is a hard disk image, it is not allowed to write the 0th cylindrical 1st head 1st sector (that is, the sector where the logical sector code is LBA = 63, this sector is usually the Boot Sector of the operating system, such as the Boot Record of DoS ). This is for int13/AH = 03 H. The program does not prohibit writing int13/AH = 43 H (extended write disk function. That is to say, you can write any sector with int13/AH = 43 H. Safeboot is enabled by default. You can use the map command line parameter -- unsafe-boot to disable it. [Note: The -- safe-boot option does not exist. By default, safeboot is enabled because the boot zone was damaged by Win98. If you do not want to start Win98, you can add the -- unsafe-boot option to allow int13/AH = 03 h to write the Boot Sector. Obviously, the -- unsafe-boot option is required only when you partition and format the virtual disk or run the DOS sys command .]

The map command also has two command line parameters:

-- Heads-per-cylinder = num_heads

-- Sectors-per-track = num_sectors

The value range of num_heads is 1 to 256; the value range of num_sectors is 1 to 63. However, they can also be 0, which means that the user is allowed to select an appropriate value for grub for DOS. If -- heads-per-cylinder and -- sectors-per-track are not specified in the map command line, when grub for DOS cannot detect an appropriate value from the first sector of the IMG file, it will give an error message and reject the simulation.

Here is a limitation. Grub for DOS extends the GNU grub simulation. The original simulation of GNU grub is a simple simulation. It can only simulate the entire disk and cannot be simulated using a part of the sector. The new simulation can be simulated using part of the sector sequence on the disk. However, the implementation of this function utilizes the new BIOS Logic block addressing (LBA) function, that is, the extended read/write function of the disk. This is invalid for the old BIOS. Therefore, the old BIOS cannot use the new simulation function. Grub for DOS is compatible with GNU grub simulation. Therefore, the old BIOS can still use grub for DOS's "simulate with the entire disk" function, this is the original GNU grub function, and its usage remains unchanged in grub for DOS.

You can use the help map command at the grub> prompt to view the real-time help information.

The following describes the usage of several other map command line parameters.

The map -- status command displays the disk simulation status, which is very useful. In the displayed status title bar, the rightmost HK indicates the meaning of the hook. The value is two binary numbers XY, so there are four types of values. When X is 1, grub is currently using this virtual disk. If X is 0, grub does not use this virtual disk. If y is 1, grub uses the virtual disk after running the map -- rehook command. If y is 0, grub will not use this virtual disk after running the map -- rehook command.

Other State values displayed by the map -- status command are easy to understand. They are all expressed in hexadecimal notation.

The map -- hook command is used to directly use the simulation in grub. Generally, grub does not use simulation. With this command, you can test the simulation results from the grub command line. Cool! The command to disable this function is map -- unhook.

As explained above, map -- unhook disables the Real-Time Simulation Function of grub.

Map -- rehook: when you use the map -- hook command and use the new map command to map disks, you can use the map -- rehook command to activate all these simulations. This command is equivalent to the following two commands that are successively issued:

Map -- unhook
Map -- hook

When canceling disk simulation, it is not enough to only use map -- unhook. You also need to use commands similar to map (fd0) (fd0) to cancel the simulation of (fd0. The "map -- unhook" command only removes the need for simulation under the grub command line. When you use the boot command, it will automatically hook up again. To permanently invalidate a map destination from_drive command, you must use the map from_drive command to unbind it [ing a BIOS disk number to itself means revoking it ]. After you cancel the simulation of some BIOS disk numbers, you usually need to run the map-rehook command. For example, the "map (hd1) (hd1)" command revokes the simulation of (hd1), but it takes effect only after running "map -- rehook.

Some legacy problems:

1. Supports starting from an ISO image file. (Complex and difficult)
2. Supports starting from CDROM. (Complex and difficult)
3. Grub can be run directly under Win98. (High technical difficulty)
4. Automatically detects and restores BIOS interrupt vectors so that grub for DOS supports any real-mode DoS. (Moderate technical difficulty)
5. Grub for DOS can also be run during emm386 (first, switching from protection mode to real mode ). (High technical difficulty)
6. Solve some conflicts between disk simulation and Win98. (High technical difficulty)
7. Added the DOS exit function. (Moderate technical difficulty)
8. Create a tool that can generate "files with contiguous disk sectors.

You are welcome to continue to develop grub for DOS.