DOS Master boot Record sector: A detailed explanation of MBR technology

DOS is a type of operating system on a personal computer. From 1981 until the 1995 of 15 years, DOS in the IBM PC compatible Machine Market occupies a pivotal position. Also, if you have a partial dos based http://www.aliyun.com/zixun/aggregation/11208.html ">microsoft Windows version, such as Windows 95, 98 and me are counted, then the business life can be at least 2000 years. DOS is a disk-oriented operating system software, in short, DOS is a bridge between people and machines, is located in the machine hardware inside a set of human-computer interaction system, simple understanding is that, with DOS, we do not have to go into the hardware structure of the machine, and do not have to memorize those boring machine commands.

When using a DOS partition system, the first sector of the disk-that is, the NO. 0 number sector-is called the Master boot Record sector, also known as the MBR (Master boot record, master boot recorder--mbr). When the computer starts and completes the self-test, it first looks for the MBR sector of the disk and reads the boot record in it, and then gives the system control to it. This shows that if the MBR is damaged, all subsequent work will not continue.

1. MBR data structure

The MBR consists of 446-byte boot code, 64-byte primary partition table, and 2-byte signature value ' 55AA '. We first use Winhex to look at the contents of the MBR sector, as shown in Figure 2.11 (because the disk has not been partitioned, all the partitioned tables are empty).

Figure 2.11 Master Boot Record sector

As you can see, the MBR sector consists of three main parts:

(1) Boot code. After the MBR takes control of the system, the boot code is responsible for checking other code information (such as checking for "55AA" valid tags) and further booting the system.

(2) partition table. The partition table is responsible for describing the partitions within the disk.

(3) "55AA" valid sign. The 55AA flag is used as a valid flag to notify the system that the MBR sector is valid, and if the flag is missing or damaged, the disk will appear as uninitialized.

The data structure of the MBR sector is shown in table 2.1.

Table 2.1 MBR Sector data structure

byte offset (hexadecimal)

Number of bytes

Description

00~1bd

446

Boot code

1be~1cd

16

Partition Table Entry 1

1ce~1dd

16

Partition Table Entry 2

1de~1ed

16

Partition Table Entry 3

1ee~1fd

16

Partition Table Entry 4

1fe~1ff

2

Signature Value (55AA)

The specific meanings are explained as follows:

1 0x00~0x1bd:446 bytes, the boot code area, contains a section of instructions to inform the computer how to access the partition table and locate the operating system location.

The U Master boot code is a very important piece of code because it is the first code that is loaded into memory and executed on disk. Also because of this, many guided viruses embed themselves in the master boot code to achieve the first run. The standard Microsoft boot code completes the self-test after the computer starts and gives control to it. Reads the partition table and determines which primary partition is the boot partition based on the bootable flag of the partitioned table entry, finds the partition, and then views and reads the boot code located in the first sector of the partition and then starts the operating system. This part of the code will vary depending on the operating system.

You can implement multiple system booting with boot code. Many users need to install more than one operating system on the same computer, which requires multiple system booting to be able to select the operating system to enter when the computer starts. Multi-system booting can be implemented in two ways.

Ø One method is that most users will make the Windows operating system one of the systems to be installed, and windows can set up a section of code in the boot partition to allow the user to select the operating system to enter. That is, the master bootstrapper in the MBR first loads the Windows boot code and then renders the Windows boot code to the user with an operating system selection interface.

Ø Another way is to change the boot code in the MBR, and the modified boot code will be presented directly to the user with a list of choices from which partition the user chooses to boot. This method typically takes up part of the first partition without using sector-stored program code.

2) 0x1be~0x1fd:64 byte, 4 partition table entries, each table entry occupies 16 bytes. Each table entry describes a DOS partition, which can describe up to 4 primary partitions.

U partitioned table entries do not have sequential requirements, that is, the first partition table entry corresponds to the first partition of the physical location, and the second table entry corresponds to the second partition.

The U-Partition table also does not require that the first partitioned table entry be used first, followed by the following table entries. When the operating system retrieves the primary partition table, it completely retrieves the four partitioned table entries, and then locates the partitions according to the physical location described by each partition table item, rather than locating the prioritized relationships of the partitions in the order of the partitioned table entries.

Figure 2.12 depicts a disk divided into three primary partitions, and the first three partitioned table entries are used to describe a partition, and the last partition table entry is not used.

Figure 2.12 Disks divided into three primary partitions

3 0x1fe~0x1ff:2 Byte, valid end Flag "55AA". Without this signature value, the operating system would assume that the disk was not initialized and would not properly load partitions and interpret data on the disk. However, as long as partitions and file systems are normal, some data recovery software can correctly detect partitioned tables and correctly interpret all normal data without this signature value.

This is an MBR table, the following parameters are critical

In a Linux environment, backing up the MBR is a fairly simple thing to do, and it takes just one command.

DD IF=/DEV/SDA of=~/mbr_ ' date +%f ' bs=512 count=1 #需要root权限

In this way, the SDA MBR is written to a file in the user directory mbr_2010-03-17, which LS can see, the file size is 512B.

Recovery is also simple when the MBR is damaged:

In Linux sruce mode, dd if=~/mbr_* OF=/DEV/SDA bs=512 count=1 #同样需要root权限

Note: The hard drive master boot record is independent of the operating system, but it is closely related to the operating system-often generated by the tools provided by the operating system (with the exception that you use other partitioning tools, but what operating system does it run on?) ;(）。