Wikipedia: Making Life Easier.
$2,254,708
Our Goal: $6 million
Donate Now »
[Expand]
Support Wikipedia: a non-profit project
Donate Now »

Master boot record

From Wikipedia, the free encyclopedia

Jump to: navigation, search
Structure of a Master Boot Record
Address Description Size
in
bytes
Hex Oct Dec
0000 0000 0 Code Area 440
(max 446)
01B8 0670 440 Optional Disk signature 4
01BC 0674 444 Usually Nulls; 0x0000 2
01BE 0676 446 Table of primary partitions
(Four 16-byte entries, IBM Partition Table scheme)
64
01FE 0776 510 55h MBR signature;
0xAA55[1]
2
01FF 0777 511 AAh
MBR, total size: 446 + 64 + 2 = 512

A master boot record (MBR), or partition sector, is the 512-byte boot sector that is the first sector ("LBA Sector 0") of a partitioned data storage device such as a hard disk. (The boot sector of a non-partitioned device is a Volume Boot Record. These are usually different, although it is possible to create a record that acts as both; it is called a multi boot record.) The MBR may be used for one or more of the following:

  • Holding a disk's primary partition table.[2]
  • Bootstrapping operating systems, after the computer's BIOS passes execution to machine code instructions contained within the MBR.
  • Uniquely identifying individual disk media, with a 32-bit disk signature; even though it may never be used by the machine the disk is running on.[3][4][5][6]

Due to the broad popularity of IBM PC-compatible computers, this type of MBR is widely used, to the extent of being supported by and incorporated into other computer types including newer cross-platform standards for bootstrapping and partitioning.[citation needed]

Contents

[hide]

[edit] MBRs and disk partitioning

Layout of one 16-byte partition record
Offset Field
length
(bytes)
Description
0x00 1 status[7] (0x80 = bootable, 0x00 = non-bootable,
other = invalid[8])
0x01 3 sector address of first partition sector.[9]
The format is described in the next 3 bytes.
0x01 1 head[10]
0x02 1 sector is in bits 5–0[11]; bits 9–8 of cylinder are in bits 7–6
0x03 1 bits 7–0 of cylinder[12]
0x04 1 partition type[13]
0x05 3 sector address of the last sector in the partition.[14]
The format is described in the next 3 bytes.
0x05 1 head
0x06 1 sector is in bits 5–0; bits 9–8 of cylinder are in bits 7–6
0x07 1 bits 7–0 of cylinder
0x08 4 LBA of first sector in the partition
0x0C 4 sectors in partition

The MBR is not located in a partition, it is located at a Main Boot Record area in front of the first partition.

When a data storage device has been partitioned with the MBR Partition Table scheme (i.e., the conventional IBM PC partitioning scheme), the master boot record contains the primary partition entries in its partition table. The partition table entries for other, secondary partitions are stored in Extended Boot Records, BSD disklabels, and Logical Disk Manager metadata partitions that are described by those primary entries.[15]

By convention, there are exactly four primary partition table entries in the MBR Partition Table scheme, although some DOS operating systems did extend this to five (PTS-DOS)[16] or even eight (AST or NEC DOS)[17][18] entries.

Where a data storage device has been partitioned with the GUID Partition Table scheme, the Master Boot Record will still contain a partition table, but its only purpose is to indicate the existence of the GUID Table and to prevent utility programs that only understand the MBR Partition Table scheme from creating any partitions in what they would see as free space on the disk, thereby accidentally erasing the GUID table.

[edit] MBRs and system bootstrapping

On IA-32 IBM PC compatible machines using the MBR Partition Table scheme, the bootstrapping firmware contained within the ROM BIOS loads and executes the master boot record. Because the i386 family of processors boot up in real mode, the code in the MBR is real mode machine language instructions. This code normally passes control by chain loading the Volume Boot Record of the active (primary) partition, although some boot managers replace that conventional code with their own.

The conventional MBR code expects the MBR Partition Table scheme to have been used, and scans the list of (primary) partition entries in its embedded partition table to find the only one that is marked with the active flag. It then loads and runs the Volume Boot Record for that partition. (Thus the master boot record, like other boot sectors, is a target for boot-sector infecting computer viruses. See boot sector.)

The MBR replacement code in some boot managers can perform a variety of tasks, and what those tasks are varies from boot manager to boot manager. In some, for example, it loads the remainder of the boot manager code from the first track of the disk, which it assumes to be "free" space that is not allocated to any disk partition, and executes it. In others, it uses a table of embedded disk locations to locate the remainder of the boot manager code to load and to execute. (Both approaches have problems. The first relies on behavior that is not universal across all disk partitioning utilities. The second requires that the embedded list of disk locations be updated when changes are made that would relocate the remainder of the code.)

On machines that do not use IA-32 processors, and on machines that use Extensible Firmware Interface (EFI) firmware, this design is unsuitable, and the MBR is not used as part of the system bootstrap. On the latter, the firmware is instead capable of directly understanding the GPT partitioning scheme and the FAT filesystem format, and loads and runs programs held as files in the EFI System Partition. The MBR will only be involved insofar as it might contain the partition table if the MBR Partition Table scheme has been used.

There are some MBR replacement code, that emulates EFI firmware's bootstrap, which makes non-EFI machines capable of booting from GPT partitioning scheme. (A typical example is a Multi Boot Record, which can be used as MBR and as a Volume Boot Record in the bootstrap process, hence the name. It detects GPT table and loads the EFI compatible code from disk to complete this task.)

[edit] MBRs and disk identity

Information contained in the Partition Table of an external hard drive as it appears in the utility program, QTparted, running under Linux.

In addition to the bootstrap code and a partition table, master boot records may contain a Windows NT disk signature. This is a 32-bit value that is intended to uniquely identify the disk medium (as opposed to the disk unit — the two not necessarily being the same for removable hard disks).

The disk signature was introduced by Windows NT version 3.5, but is now used by several operating systems, including the Linux kernel version 2.6 and later. Linux uses the NT disk signature at boot time to determine the location of the boot volume.[19]

Windows NT (and later Microsoft operating systems) uses the disk signature as an index to all the partitions on any disk ever connected to the computer under that OS; these signatures are kept in Registry keys, primarily for storing the persistent mappings between disk partitions and drive letters. It may also be used in boot.ini files (though most do not), to describe the location of bootable Windows NT (or later) partitions.[20] One key (among many) where NT disk signatures appear in a Windows 2000/XP Registry is:

HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices

If a disk's signature stored in the MBR was A8 E1 B9 D2 (in that order) and its first partition corresponded with logical drive C: under Windows, then the REG_BINARY data under the key value, \DosDevices\C:, would be:

A8 E1 B9 D2 00 7E 00 00 00 00 00 00

The first four bytes are said disk signature. (Note: In other keys, these bytes may appear in reverse order from that found in the MBR sector.) These are followed by eight more bytes, forming a 64-bit Integer, in little endian notation, which are used to locate the byte offset of this partition. In this case, 00 7E corresponds to the hexadecimal value 0x7E00 (32,256dec). Dividing this byte offset by 512 (the size of a hard disk's physical sector in bytes) results in 63, which is the physical sector number (or LBA) containing the first block of the partition ([21]).

If this disk had another partition with the values 00 F8 93 71 02 following the disk signature (under, e.g., the key value \DosDevices\D:), it would begin at byte offset 0x27193f800 (10,495,457,280dec), which is also the first byte of physical sector 20,498,940.

[edit] Programming Considerations

Assume that the system being programmed uses the BIOS MBR scheme, as stated above, and the system BIOS locates a valid MBR on a partitioned drive in its boot sequence. As stated above, conventional MBR code loads and runs the operating-system-dependent Volume Boot Record (or bootloader) code that is located at the beginning of the disk's "active" partition. The MBR can simply assume that the one active partition on the current drive is supposed to boot, or alternately, it can be programmed as a Dual boot MBR. A dual boot MBR must interact with the user to determine which partition on which drive should boot, and may transfer control to the MBR of a different drive.

The BIOS will load the first valid MBR that it finds into hexadecimal physical address 0x7c00, and jump to that address. Part of the end of the 512 byte sector is pre-allocated for the partition table and other information (see above), so the MBR program must be tiny enough to fit within 440 bytes of memory. The MBR program may communicate with the user, examine the partition table, or perform some housekeeping tasks such as enabling the A20 line, or changing to Unreal mode from Real mode. Eventually, the MBR will need to perform its main task, and load the program that will perform the next stage of the boot process, usually by making use of the INT 13 BIOS call.

Typical boot sector code also expects to be loaded at physical address 0x7c00, even though all the memory from physical address 0x501 (address 0x500 is the last one used by the BIOS)[citation needed] to somewhere short of 0x9ffff is typically available in Real mode (a total of up to 640 KB minus the first 1281 bytes of memory)[22] Since 0x7c00 is the location where the MBR is already running, one of the first tasks of an MBR is usually to relocate itself somewhere else in memory -- most often at 0x600 (for Microsoft code). A conventional Volume Boot Record is only one sector long; but it does no harm and is trivial to allow the MBR to load significantly more than just one sector. Some bootloaders are longer than one sector, so loading more than one sector can speed up the boot process.

[edit] Differences in MBR Code

Different operating systems, disk partitioning utilities and repair tools may supply different MBR code performing the same task.

The following table shows how the MBR code of GRUB 0.92 would appear in a hex editor:[23]

Absolute sector 0 (cylinder 0, head 0, sector 1)
     0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
0000 EB 48 90 D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C .H....|.P.P....|
0010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BE BE 07 B1 04 ...PW...........
0020 38 2C 7C 09 75 15 83 C6 10 E2 F5 CD 18 8B 14 8B 8,|.u...........
0030 EE 83 C6 10 49 74 16 38 2C 74 F6 BE 10 07 03 02 ....It.8,t......
0040 80 00 00 80 DF 0A 93 01 00 08 FA EA 50 7C 00 00 ............P|..
0050 31 C0 8E D8 8E D0 BC 00 20 FB A0 40 7C 3C FF 74 1....... ..@|<.t
0060 02 88 C2 52 BE 76 7D E8 34 01 F6 C2 80 74 54 B4 ...R.v}.4....tT.
0070 41 BB AA 55 CD 13 5A 52 72 49 81 FB 55 AA 75 43 A..U..ZRrI..U.uC
0080 A0 41 7C 84 C0 75 05 83 E1 01 74 37 66 8B 4C 10 .A|..u....t7f.L.
0090 BE 05 7C C6 44 FF 01 66 8B 1E 44 7C C7 04 10 00 ..|.D..f..D|....
00A0 C7 44 02 01 00 66 89 5C 08 C7 44 06 00 70 66 31 .D...f.\..D..pf1
00B0 C0 89 44 04 66 89 44 0C B4 42 CD 13 72 05 BB 00 ..D.f.D..B..r...
00C0 70 EB 7D B4 08 CD 13 73 0A F6 C2 80 0F 84 F3 00 p.}....s........
00D0 E9 8D 00 BE 05 7C C6 44 FF 00 66 31 C0 88 F0 40 .....|.D..f1...@
00E0 66 89 44 04 31 D2 88 CA C1 E2 02 88 E8 88 F4 40 f.D.1..........@
00F0 89 44 08 31 C0 88 D0 C0 E8 02 66 89 04 66 A1 44 .D.1......f..f.D
0100 7C 66 31 D2 66 F7 34 88 54 0A 66 31 D2 66 F7 74 |f1.f.4.T.f1.f.t
0110 04 88 54 0B 89 44 0C 3B 44 08 7D 3C 8A 54 0D C0 ..T..D.;D.}<.T..
0120 E2 06 8A 4C 0A FE C1 08 D1 8A 6C 0C 5A 8A 74 0B ...L......l.Z.t.
0130 BB 00 70 8E C3 31 DB B8 01 02 CD 13 72 2A 8C C3 ..p..1......r*..
0140 8E 06 48 7C 60 1E B9 00 01 8E DB 31 F6 31 FF FC ..H|`......1.1..
0150 F3 A5 1F 61 FF 26 42 7C BE 7C 7D E8 40 00 EB 0E ...a.&B|.|}.@...
0160 BE 81 7D E8 38 00 EB 06 BE 8B 7D E8 30 00 BE 90 ..}.8.....}.0...
0170 7D E8 2A 00 EB FE 47 52 55 42 20 00 47 65 6F 6D }.*...GRUB .Geom
0180 00 48 61 72 64 20 44 69 73 6B 00 52 65 61 64 00 .Hard Disk.Read.
0190 20 45 72 72 6F 72 00 BB 01 00 B4 0E CD 10 AC 3C Error.........<
01A0 00 75 F4 C3 00 00 00 00 00 00 00 00 00 00 00 00 .u..............
01B0 00 00 00 00 00 00 00 00 A8 E1 A8 E1 00 00 80 01 ................
01C0 01 00 07 FE FF 6D 3F 00 00 00 AF 39 D7 00 00 00 .....m?....9....
01D0 C1 6E 0C FE FF FF EE 39 D7 00 BD 86 BB 00 00 FE .n.....9........
01E0 FF FF 83 FE FF FF AB C0 92 01 CD 2F 03 00 00 FE .........../....
01F0 FF FF 0F FE FF FF 78 F0 95 01 83 AF CC 00 55 AA ......x.......U.

In contrast, the MBR code created by a Windows 2000 or XP install (seen in this next table):

Absolute Sector 0 (Cylinder 0, Head 0, Sector 1)
     0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
0000 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C 3.....|.P.P....|
0010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04 ...PW...........
0020 38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5 8n.|.u..........
0030 83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B ...It.8,t.......
0040 F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88 ..<.t...........
0050 4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B N..F.s*.F..~..t.
0060 80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83 .~..t....u..F...
0070 46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB F...V...!.s.....
0080 BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0 ..>.}U.t..~..t..
00A0 00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC .....r#..$?.....
00B0 43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56 C..........B..9V
00C0 0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C .w#r.9F.s......|
00D0 8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A .N..V...sQOtN2..
00E0 56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD V......V.`..U.A.
00F0 13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60 .r6..U.u0...t+a`
0100 6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A j.j..v..v.j.h.|j
0110 01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B .j..B....aas.Ot.
0120 32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61 2..V.....a..Inva
0130 6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61 lid partition ta
0140 62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E ble.Error loadin
0150 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 g operating syst
0160 65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61 em.Missing opera
0170 74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00 ting system.....
0180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01B0 00 00 00 00 00 2C 44 63 B5 EB 31 E0 00 00 80 01 .....,Dc..1.....
01C0 01 00 07 FE BF 82 3F 00 00 00 84 9E 9D 00 00 00 ......?.........
01D0 81 83 05 FE FF FF C3 9E 9D 00 FE F2 0A 04 00 00 ................
01E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ..............U.

[edit] Editing/replacing MBR contents

Though it is possible to directly manipulate the bytes in the MBR sector using various Disk Editors, there are tools to write fixed sets of functioning code to the MBR . Since MS-DOS 5.0, the DOS-mode program FDISK has included the (undocumented, but widely used) switch /mbr, which will rewrite the MBR code. Under Windows 2000 or later, the Recovery Console can be used to write new MBR code to a hard disk using its fixmbr command.

Some third-party utilities may also be used for directly editing the contents of partition tables (without requiring any knowledge of hexadecimal or disk/sector editors).[24]

In Linux, the GRUB and LILO projects have tools for writing code to the MBR sector. Namely grub-install and lilo -mbr. The grub interactive console also has commands to write to the MBR.

[edit] References

  1. ^ On all IBM PC, PC compatible or any other little-endian computers, hexadecimal numbers of two or more bytes are always stored on media or in memory in reverse order (for more efficient CPU processing). Thus, the hex number 0xAA55 (or AA55h) will appear in a disk editor as the sequence: 55 AA.
  2. ^ In cases where the disk has a BIOS overlay or Boot manager installed, the partition table may be moved to some other physical location on the drive; e.g., a BIOS overlay often places a copy of the original MBR contents in the second sector ("Sector 1") then hides itself from any subsequently booted OS or application, so the MBR copy in Sector 1 is treated as if it were still residing in the first sector.
  3. ^ Peter C Norton and Scott Clark (2002). Peter Norton's New Inside the PC. Sams Publishing, 360–361. ISBN 0672322897. 
  4. ^ Michael W. Graves (2004). A+ Guide To PC Hardware Maintenance and Repair. Thomson Delmar, 276. ISBN 1401852300. 
  5. ^ Jean Andrews (2003). Upgrade and Repair with Jean Andrews. Thomson Course Technology, 646. ISBN 1592001122. 
  6. ^ William Boswell (2003). Inside Windows Server 2003. Addison-Wesley Professional, 13. ISBN 0735711585. 
  7. ^ The status fields in an non-extended partition table record are used by the embedded bootstrap code within the MBR to determine which partition is bootable (it is referred to as the active partition, and there can only be one active/bootable partition within the MBR). The status fields in an extended partition table record may also be used by boot manager programs to determine which partitions are bootable.
  8. ^ Formally, partition status values other than 0x00 and 0x80 are undefined and the bootstrap program may display an error message if this occurs. In practice, their meaning depends upon what the actual bootstrap code within the MBR has been written to accept. Some MBR bootstrap programs specifically look for the value 0x80 to indicate the bootable ("active") partition, others simply look for a non-zero value, and yet others look for any value with the top bit set.
  9. ^ Starting Sector fields are limited to 1024 cylinders, 255 heads, and 63 sectors. Sector counts have always begun with a 1, not a zero, and due to an early error in MS-DOS, the heads are generally limited to 255 instead of 256. When a CHS address is too large to fit into these fields, the tuple (1023, 254, 63) is used.
  10. ^ The range for head is 0 through 254 inclusive
  11. ^ The range for sector is 1 through 63
  12. ^ The 10-bit cylinder value is split into two bytes. The value can be reassembled using this formula: cylinder = (byte[2] & 0xc0) * 4 + byte[3]; range for cylinder is 0 through 1023
  13. ^ Andries Brouwer. "List of partition identifiers for PCs". Partition types.
  14. ^ Ending Sector fields have the same limitations as the Starting Sector fields.
  15. ^ Roderick W. Smith (2000). The Multi-Boot Configuration Handbook. Que Publishing, 260–261. ISBN 0789722836. 
  16. ^ Andries Brouwer. "Properties of partition tables". Partition types. PTS-DOS uses "a special 5th partition entry in front of the other four entries in the MBR and corresponding AAP-aware MBR bootstrap code." (Brouwer).
  17. ^ Brouwer, ibid. Some OEM systems, such as AST DOS (type 14h) and NEC DOS (type 24h) had 8 instead of 4 partition entries in their MBR sectors.
  18. ^ Daniel B. Sedory. "Notes on the Differences in one OEM version of the DOS 3.30 MBR". Master Boot Records. Shows an 8-entry partition table and where its boot code differs from MS-DOS 3.30.
  19. ^ Matt Domsch. "Re: RFC 2.6.0 EDD enhancements". Linux Kernel Mailing List.
  20. ^ Microsoft. "Windows May Use Signature() Syntax in the Boot.ini File". KnowledgeBase.
  21. ^ Unlike the sector count used in the Sectors value of CHS tuples, which counts from one, the Absolute or LBA Sectors value starts counting from zero.
  22. ^ Very old machines may have less than 640 KB (A0000h or 655,360 bytes) of memory, and newer machines may allocate significant amounts of memory for BIOS uses. The INT 12 BIOS call may help in determining how much memory can safely be allocated (it simply reads the Base Memory size in KB from Segment:Offset location 0040h:0013h). In theory, only 64255 bytes is guaranteed (beginning at 0x501 and ending at 0x0ffff); in practice it is safe to assume at least 382.74 KB (ending at 0x5ffff) are available on modern hardware.
  23. ^ "The GRUB MBR".
  24. ^ For example, Power Quest's Partition Table Editor (PTEDIT32.EXE), which runs under Windows operating systems, is still available here: Symantec's FTP site.

[edit] Further reading

[edit] See also

[edit] External links

  • Standard MBR code dissasembly
  • MBRWizard! The MBR Management Utility - freeware for Linux and Windows
  • HxD - A freeware Windows disk editor which can be used to explore and back up critical sectors, such as the MBR.
  • rohPod - A simple block oriented disk editor, which can repair MBRs and works even over the network. Works on Linux, Mac OS X and Windows
  • MBRtool, a DOS program designed to backup, restore and manipulate hard disk MBR.
  • Booting 100+ Operating systems - An example of GRUB usage to boot every type of Operating Systems. Contains a lot of info about booting.
Personal tools