Primary Boot Sector (MBR)

Many of my friends are interested in the MBR (Main Boot Record) and DPT in the primary Boot Sector of the hard disk.
(Disk Partition Table. So I want to write it briefly
Introduction, hoping to be helpful to these friends.

The boot sector exists in each partition, but we often say that * The Main Boot Sector * is a hard disk.
The first physical sector. It consists of two parts: the Master Boot Record MBR and the hard disk partition table DPT. In
In a total of 512 bytes of primary boot partition, MBR occupies 446 bytes (offset 0 -- offset 1bdh), DPT
Occupies 64 bytes (offset 1beh -- offset 1fdh), and the last two bytes "55, AA" (offset 1feh)
Offset 1ffh) is the end mark of the partition. The general structure is as follows:

0000 | ------------------------------------------------ |
|
|
| Main Boot Record |
|
|
| Master Boot Record (446 bytes) |
|
|
|
01bd |
01be | ------------------------------------------------ |
|
01cd | partition information 1 (16 bytes) |
01ce | ------------------------------------------------ |
|
01dd | partition information 2 (16 bytes) |
01de | ------------------------------------------------ |
|
01ed | partition information 3 (16 bytes) |
01ee | ------------------------------------------------ |
|
01fd | partition information 4 (16 bytes) |
| ---------------------------------------------- |
| 01fe | 01ff |
| 55 | AA |
| ---------------------------------------------- |

Figure 1: Structure of the main guide sector

The Master Boot Record contains a series of Hard Disk parameters and a bootProgram. Main Bootstrap program
Is used to guide the operating system on the partition with the activation mark after the system hardware self-check is complete. It executes
Finally, a JMP command jumps to the boot program of the operating system. This is often a boot disease.
Virus injection points are also the injection points of various multi-system boot programs. However
So we can fully determine the legality of the Bootstrap program (see JMP
Command Legality), so it is easy to fix. The command fdisk/MBR can fix MBR and kv300.
This type of software can kill any type of boot virus.

The partition table of the hard disk is composed of 4 16-byte partition information table. For each information table
The structure is as follows:

Meaning of the Offset Length
0-byte partition status: for example, 0 --> inactive partition
80 --> active partition
1 byte starting header of the partition (head)
2. Start slice and start cylinder of the partition
4 bytes this partition type: for example, 82 --> Linux native Partition
83 --> Linux swap Partition
5 bytes of the partition termination header (head)
6 words: Terminate the slice and terminate the cylinder of the partition
8 double-click the start absolute partition of the partition
C: The number of slices in the partition.

The last two flags "55 AA" are the ending flags of the partitioned table. If the two flags are modified
(Some viruses will modify these two marks), then the system will not find a valid Partition Table during boot.

The structure listed above gives you a general understanding of the structure and usage of the primary Boot Sector. Below,
There are some frequently asked questions about the primary Boot Sector:

Q1, Will fdisk/MBR damage the Partition Table of the hard disk?
A: From the above soil, we can see that fdisk/MBR does not affect DPT. Fdisk/
MBR only re-writes the MBR part in the primary boot partition without any damage to DPT.

Q2. in Linux, the following command is used to restore MBR:
Dd If =/boot. NNNN of =/dev/hda BS = 446 COUNT = 1
BS (buffer size) indicates the number of bytes to be overwritten. Why not 512
What about it? Is the primary Boot Sector One slice (512 bytes )?
A: The answer is that we use the following command to fix the primary boot notes that may have been modified by viruses.
Record MBR, or uninstall Lilo, instead of restoring the entire primary Boot Sector. So we
Only the first 446 bytes of the backup file boot. NNNN of the primary Boot Sector are overwritten into the primary Boot Sector.
Boot. NNNN is the backup of the entire primary boot partition before Linux is installed. If we set
Write all the 512 bytes into the Main Boot Sector and the hard disk may be changed after Linux is installed.
The DPT table is also damaged. That's a bad thing.

Linuxrat: = )...

MBr-> main/Master Boot Record. Some books are written as master.
I think it can be divided into three parts: MBR + DPT + magicnumber (446 + 64 + 2 = 512)
This is why BS = 512, BS = 1 K, and count = 1 must be specified during MBR backup.
Then, we often see BS = 446 COUNT = 1 in howto. This 446 is the restoration of the instruction part,
Instead of DPT recovery. The first command in MBR is Cli... it is interesting to study.