Read the MBR with DEBUG
Materials: Working complete PCBlank DisketteStudent Diskette, "New Boot A Ver 2.0+"Student CD-ROM, "Room 6359"Objectives: The student will become familiar with:use the BIOS INT 13h Interface to read the HDD's MBRthe MBR layout,a partition table layout.Competency: The student will learn how to use the BIOS INT 13h interface for the purposes of data recovery including the definitions of the passed parameters to the call and how to read and write a physical sector using DEBUG to execute the INT 13h call. |
-
Boot to the student CD-ROM and GHOST in DOS. Accept the size offered (2GB) and restart the machine when prompted. As it reboots remove the CD-ROM. The system will boot to true MS-DOS 6.22. At the C:\> prompt start DEBUG and proceed with the following exercise.
The DEBUG LOAD command only reads COOKED sectors as opposed to RAW sectors. In our language a RAW sector is read AS IS by BIOS off of the disk. A COOKED sector is located and retrieved or written using the drive's file system. In the event that the drive's file system has been compromised then it is impossible to access COOKED sectors. They must be accessed RAW, directly by their geometric coordinate.
The HDD's Master Boot Record resides outside of the partitions it defines and as such it cannot be located within any particularly drive letter and does not have a file system logical offset. It is by definition then a pure RAW sector and cannot be accessed ever by the DEBUG LOAD command. It will now be accessed using the BIOS INT 13h call.
The MBR is ALWAYS located at Cyl=0, Head=0, Sector=1 of the physical disk. In this exercise, the MBR of the first physical HDD will accessed, which is BIOS drive # 80h. Therefore the required parameters are:
AH = 02, AL = 01 so AX = 0201 BX = 0100 CH = 00, CL = 01 so CX = 0001 DH = 00, DL = 80 so DX = 0080
The assembly language instructions are then:
mov ax, 0201 then drop the leading zeros: mov ax, 201 mov bx, 0100 => mov bx, 100 mov cx, 0001 => mov cx, 1 mov dx, 0080 => mov dx, 80
Now start DEBUG's assembly language processor at offset 300h and input the program:
-a 300 242C:0300 mov ax, 201 242C:0303 mov bx, 100 242C:0306 mov cx, 1 242C:0309 mov dx, 80 242C:030C int 13 242C:030E int 3 242C:030F (press [Enter] here to exit the assembler) -_
Execute the program with the "g=300" command and watch for the "No Carry" flag indicator:
-g=300 AX=0001 BX=0100 CX=0001 DX=0080 SP=FFEE BP=0000 SI=0000 DI=0000 DS=242C ES=242C SS=242C CS=242C IP=030E NV UP EI PL ZR NA PE NC 242C:030E CC INT 3 -_
The INT 13h call read the MBR into RAM. Display the top half of it on screen:
-d 100 1ff 242C:0100 FA 33 C0 8E D0 BC 00 7C-8B F4 50 07 50 1F FB FC .3.....|..P.P... 242C:0110 BF 00 06 B9 00 01 F2 A5-EA 1D 06 00 00 BE BE 07 ................ 242C:0120 B3 04 80 3C 80 74 0E 80-3C 00 75 1C 83 C6 10 FE ...<.t..<.u..... 242C:0130 CB 75 EF CD 18 8B 14 8B-4C 02 8B EE 83 C6 10 FE .u......L....... 242C:0140 CB 74 1A 80 3C 00 74 F4-BE 8B 06 AC 3C 00 74 0B .t..<.t.....<.t. 242C:0150 56 BB 07 00 B4 0E CD 10-5E EB F0 EB FE BF 05 00 V.......^....... 242C:0160 BB 00 7C B8 01 02 57 CD-13 5F 73 0C 33 C0 CD 13 ..|...W.._s.3... 242C:0170 4F 75 ED BE A3 06 EB D3-BE C2 06 BF FE 7D 81 3D Ou...........}.= 242C:0180 55 AA 75 C7 8B F5 EA 00-7C 00 00 49 6E 76 61 6C U.u.....|..Inval 242C:0190 69 64 20 70 61 72 74 69-74 69 6F 6E 20 74 61 62 id partition tab 242C:01A0 6C 65 00 45 72 72 6F 72-20 6C 6F 61 64 69 6E 67 le.Error loading 242C:01B0 20 6F 70 65 72 61 74 69-6E 67 20 73 79 73 74 65 operating syste 242C:01C0 6D 00 4D 69 73 73 69 6E-67 20 6F 70 65 72 61 74 m.Missing operat 242C:01D0 69 6E 67 20 73 79 73 74-65 6D 00 00 81 31 57 12 ing system...1W. 242C:01E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:01F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ -_The error messages that it can display are visible. The 1st stage OS boot strap loader program code is above them. Now display the bottom half of the sector:
-d 200 2ff 242C:0200 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0210 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0220 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0230 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0240 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0250 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0260 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0270 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0280 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0290 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 ................ 242C:02C0 01 00 06 FE 7F 04 3F 00-00 00 86 FA 3F 00 00 00 ......?.....?... 242C:02D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA ..............U. -_The bottom of the sector is very sparse BUT the values that are here are CRITICAL, the primary DOS partition is defined here, and the sector ends in the boot signature of 55 AA. Without that, the BIOS boot strap loader will ignore the sector as invalid and the system will not boot up at all from the HDD. The layout of the MBR is:
Offset Size Field 00h 420 bytes 1st stage OS boot strap loader 1BEh 16 bytes 1st partition table 1CEh 16 bytes 2nd partition table 1DEh 16 bytes 3rd partition table 1EEh 16 bytes 4th partition table 1FEh 2 bytes boot signature (55 AA) With the bottom half of the MBR still on screen locate the byte at offset 1BEh of the sector. NOTE: these offsets are ZERO based, but the sector was loaded into DEBUG's RAM workspace which starts at offset 100h. So the byte is actually located at offset 2BEh of the DEBUG RAM workspace. First locate the row that starts with offset 2B0h. Then the first byte is 2B0h, then the byte after the dash is eight so its address is 2B8h, continue counting 2B9, 2BA, 2BB, 2BC, 2BD then 2BE. This is the first byte of the first partition table:
-d 200 2ff 242C:0200 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0210 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0220 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0230 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0240 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0250 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0260 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0270 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0280 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0290 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 ................ 242C:02C0 01 00 06 FE 7F 04 3F 00-00 00 86 FA 3F 00 00 00 ......?.....?... 242C:02D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA ..............U. -_
The partition table itself is sixteen bytes long, so it occupies the highlighted bytes:
-d 200 2ff 242C:0200 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0210 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0220 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0230 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0240 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0250 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0260 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0270 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0280 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0290 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 ................ 242C:02C0 01 00 06 FE 7F 04 3F 00-00 00 86 FA 3F 00 00 00 ......?.....?... 242C:02D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA ..............U. -_
The 2nd partition table starts at offset 1CEh of the sector. Add 100h and it can be found at offset 2CEh of the DEBUG output. Find the row that starts with 2C0h, the byte after the dash is 2C8, then 2C9, 2CA, 2CB, 2CC, 2CD, and then 2CE, the byte we seek:
-d 200 2ff 242C:0200 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0210 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0220 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0230 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0240 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0250 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0260 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0270 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0280 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0290 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 ................ 242C:02C0 01 00 06 FE 7F 04 3F 00-00 00 86 FA 3F 00 00 00 ......?.....?... 242C:02D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA ..............U. -_
The 2nd partition table is also 16 bytes in size occupying the highlighted bytes:
-d 200 2ff 242C:0200 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0210 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0220 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0230 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0240 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0250 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0260 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0270 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0280 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0290 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 ................ 242C:02C0 01 00 06 FE 7F 04 3F 00-00 00 86 FA 3F 00 00 00 ......?.....?... 242C:02D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA ..............U. -_
Locate the start and then the full 16 bytes occupied by the 3rd and 4th partition tables of this MBR. NOTE: the 2nd 3rd and 4th partitions on this drive are empty (all zeros).
Locate the byte located at offset 1FEh of the sector (2FEh within the DEBUG RAM workspace.) This is the first byte of the boot signature field which is two bytes long and MUST contain the values 55h and AAh:
-d 200 2ff 242C:0200 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0210 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0220 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0230 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0240 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0250 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0260 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0270 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0280 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0290 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 ................ 242C:02C0 01 00 06 FE 7F 04 3F 00-00 00 86 FA 3F 00 00 00 ......?.....?... 242C:02D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA ..............U. -_
The layout of a partition table is an industrywide BIOS standard as follows:
Offset Size Field 00h 1 byte Active flag: 80h = active, 00h = not active 01h 1 byte start sector's head# 02h 1 byte Start sector's sector# 03h 1 byte start sector's cylinder# 04h 1 byte Partition ID (See below) 05h 1 byte end sector's head# 06h 1 byte end sector's sector# 07h 1 byte end sector's cylinder# 08h 4 bytes start sector's LBA offset from this MBR 0Ch 4 bytes partition size in number of sectors Some basic partition ID's are:
PID Means 00h No partition 01h Microsoft FAT12 04h Microsoft FAT16 (no clusters, max. partition = 32MB) 05h Microsoft Extended DOS Partition 06h Microsoft FAT16B (cluster support, max. partition = 2GB) 07h Originally IBM OS/2 HPFS, now Microsoft NTFS 0Bh Microsoft FAT32 no INT 13h Extensions support (CHS) 0Ch Microsoft FAT32 with INT 13h Extensions support (LBA) 0Eh Microsoft FAT16 with INT 13h Extensions support (LBA) 0Fh Microsoft Extended DOS Partition with INT 13h Extensions support (LBA) There are MANY more definitions for PID's than these. You should look them up online and collect as many as you can for future reference. All types that we will be working with this semester will be within this list. Locate the first partition table again:
-d 200 2ff 242C:0200 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0210 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0220 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0230 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0240 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0250 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0260 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0270 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0280 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:0290 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 ................ 242C:02C0 01 00 06 FE 7F 04 3F 00-00 00 86 FA 3F 00 00 00 ......?.....?... 242C:02D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 242C:02F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA ..............U. -_
The first byte of it is the byte that in the partition table layout table refers to as the byte at offset 00h. It is the field at offset 00h OF THIS PARTITION TABLE. Create on a sheet of paper an empty partition table layout table like this:
Offset Size Value 00h 1 byte 01h 1 byte 02h 1 byte 03h 1 byte 04h 1 byte 05h 1 byte 06h 1 byte 07h 1 byte 08h 4 bytes 0Ch 4 bytes Now fill in the boxes with the values found in each field of the partition table:
Offset Size Value 00h 1 byte 80 01h 1 byte 01 02h 1 byte 01 03h 1 byte 00 04h 1 byte 06 05h 1 byte FE 06h 1 byte 7F 07h 1 byte 04 08h 4 bytes 3F 00 00 00 0Ch 4 bytes 86 FA 3F 00 Now an analysis of this partition table can begin. According to the definitions of the fields above the value of the byte at offset 00h of 80h indicates that the partition is set active and therefore the system will boot from the partition. The byte at offset 01h holds the start sector's head#, at 02h holds the sector# and at offset 03h holds the cylinder#. Together they hold the start sector's geometric coordinate or CHS address of: Cyl=0, Head=1, Sector=1. The byte at offset 04h holds the partition ID. These are accepted somewhat industrywide. The value of 06h means Microsoft FAT 16B, the one that supports clusters and partitions up to 2GB in size.
The value at offset 05h is the end sector's head#, at offset 06 is its sector# and at 07 is its cylinder#. The geometric coordinate of the ending sector of the partition is then: Cyl=04, Head=FE, Sector=7F. However, the high 2 bits of the 10 bit cylinder number are stored as the high 2 bits of the sector number. This leads to madness, but that's the way they did it 24 years ago. It is the BIOS standard and far be it from us to change it now, though screams of agony are acceptable.
First, convert the sector number to binary: 7Fh =b=> 0111 1111b. Take the top two bits off leaving xx11 1111b and convert back to hexadecimal =h=> 3Fh or 63. Now convert the removed 2 bits back to hex also: 01b =h=> 1h and place this to the far left of the cylinder number. 1h merged with 04h = 104h. This is the actual cylinder number. So the geometric coordinate is actually: Cyl=104h, head=FEh, Sector=3Fh.
The value that starts at offset 08h is a four byte value: 3F 00 00 00. Because the CPU is a little endian machine these must be byte reversed to reveal the actual 32-bit number: 3F 00 00 00 =x=> 00 00 00 3Fh. NOTE: BYTE reversed NOT hex digit reversed. This number is 63 and is the LBA address of the starting sector if the partition table is found in the hard drive's MBR. It is the DISTANCE to the starting sector if the partition table is found in any other location (which do exist and will be dealt with in the future.)
The value that starts at offset 0Ch is a four byte value: 86 FA 3F 00. Because the CPU is a little endian machine these must be byte reversed to reveal the actual 32-bit number: 86 FA 3F 00 =x=> 00 3F FA 86h. NOTE: BYTE reversed NOT hex digit reversed. This number is 4,192,902 and indicates that the partition is this many sectors in size.
In future lessons, deeper analysis will be performed in which many of these values can be manually verified for accuracy.
Preparation
Procedures
Copyright©2000-2006 Brian Robinson ALL RIGHTS RESERVED