Resolution of--dos partition with Android full image on Chip direct reading mode

Recently got an Android full-text image is still using the chip direct reading mode, this time is a red rice phone image, and the previous image, the partition type of DOS partition, here to explain, is a supplement to the previous record.

First of all, correct one of my misconceptions: that DOS partitions are only related to Windows OS and not to the Linux OS. The correct cognition should be: DOS partition is no OS, he and GPT partition similar, are used to manage the operating system partition of each file system, and these files can be the Fat series of Windows, NTFS, also can be the EXTX series of Linux.

DOS Partition and GPT partition analogy: 1) The EFI in the GPT partition is equivalent to the x86 BIOS;

2) GPT partition table is equivalent to the MBR of DOS partition;

Here is a detailed description of the DOS Partition format:

　1. MBR

I got this image, the first is an MBR sector, the MBR sector consists of three parts: 1) boot code

2) partition table information

3) Signature Value (AA)

To parse this image, partition table information is our clue, DOS partition table each item consists of 16 bytes, each MBR partition table has four items, that is, MBR partition table occupies 64 bytes. MBR partition table each structure is:

All the numbers in the table are in hexadecimal.

Offset (0x)	Number of bytes	Describe
00	1	Bootable flag, 80 is bootable, 00 is not bootable
01-03	3	The partition starts with the CHS address, which doesn't seem to be used now.
04	1	Partition type, 05 is extended partition, 83 is Linux partition, 82 is Linux swap,0b, 0C is Win95 fat32,86, 87 is NTFS
05-07	3	Partition End CHS Address
08-0b	4	Partition starting logical sector code, the logical meaning is relative to the DOS partition of the starting sector area code, that is, a relative address, when calculated by adding MBR sector start address to replace the absolute address
0c-0f	4	Partition size Sector number

Of the four items in the partitioned table, typically three primary partitions and one extended partition, the primary partition item record does not have to be preceded by the extended partition, meaning that the following two sequences are possible:

Primary partition 1		Extended partition
Primary Partition 2		Primary partition 1
Primary Partition 3		Primary Partition 2
Extended partition		Primary Partition 3

Of course, the partition table is not necessarily four items have content, can also be a primary partition, the rest are extended partitions, overall is more flexible.

　2, EBR

The E in EBR is the meaning of the extended extension, which is used to manage the extended partition, which is similar to the MBR, and also uses a partitioned table to record the partition type, logical starting sector area code, and number of partition sectors for each primary partition in the extended partition. One thing to note is that although the logical starting sector area code in EBR is relative to the address of this EBR sector, the starting sector area code for each extended partition is relative to the primary extended partition, which means that the calculation of each extended partition address should be taken care of when a follow-up EBR partition table shifts the relative address to an absolute address. Each of the other partitions is evaluated as long as the starting address of the partitioned table is considered. The following image is truncated from Marin, "data reproduction-best practices for file system principles and data Recovery", page 51:

　　

Show the case of 6 file system partitions, when computing the absolute address of two-level system file partition 1, use 2 address to do base address, two-level extended partition 1 of absolute addresses with 1 base, two-level file system partition 2 is the base of 3, two-level extended partition 2 base or 1.

It is also important to note that the organization of 6 file system partitions is: three primary partitions and three logical partitions that are two-level file system partitions all are logical partitions, and their EBR partition table contains up to two items, one logical partition and one extended partition.

　3, Superblock

We found the type of each file system partition according to the instructions of the MBR and EBR, but how do we know what the name of this filesystem partition is? (For example, we focus on the more data partition) in the GPT partition, we directly get the partition name and address of each file system partition through the GPT partition table, but in the DOS partition, we need to use the Super block to get the name of each partition of the Android image. The 16 bytes of the Super block offset 0x78-0x87 record the partition name of the partition, so we can locate the starting address of the destination partition based on the file system partition start address and the partition name combination in the corresponding Super block from the MBR and EBR partition tables.

The subsequent parsing works just like parsing the Ext4 file system process, no longer duplicates.

Reference:

Marin "Data reproduction-best practices for file system principles and Data Recovery" chapter II and fifth

Resolution of--dos partition with Android full image on Chip direct reading mode