Home Artwork Page Comp Art Page Books Calenders Food and Brew Page Links Page Metal Working Page Pictures Page Projects Page CAFL Control Algorithm DOS Bootsector DFP Project Linux Page Music Page Recursive Logistic Eqn RF Electronics Projects Software Projects Temperature Data Logging Wind Chime Weather Page

Viewing Boot Sectors,FAT,ROOT this was done using a W98 formatted 1.44M floppy Patching Disks Patching the boot sector Proving the boot chain Boot Records, FAT & Root Directories ------------------------------------ Boot Record-- Located at Sector 0 on Floppy and Sector 1 on Hard Disk. Sector 0 on Hard Disk is the MBR (Master Boot Record), this tells it where the boot code is and what partitions are active (partition record, FDISK has an option to look at the partition record and display results) . If you have a dual boot box this controls what OS will boot. It gets its vector from the MBR. Loc. Description 0 E9 XX XX or EB XX 90 Vector to Boot Code. ( * See note below) 3 8 byte OEM Name&Version (ignored) 11(0Bh) 2 bytes Number of bytes per sector (512 on 1.44M floppy)---- Start of BIOS Block ----- 13(0Dh) 1 byte Sectors per cluster, always a power of 2. 14(0Fh) 2 byte Reserved sectors- skipped over when looking for FAT tables. 16(10h) 1 byte Number of FAT's (2) 17(11h) 2 bytes Number of 32 byte wide root entries. (224 on 1.44M floppy) 19(13h) 2 bytes # sectors on drive if < 32M. If > 32M this is 00 00, see hugh sectors (2880 on 1.44M floppy. 21(15h) 1 byte Media descriptor F0 floppy 1.44M, F8 Hard Drive. 22(16h) 2 byte Sectors per FAT entry. (9 on 1.44M floppy) 24(18h) 2 byte Sectors per track. ( 18 on 1.44M floppy ) 26(1Ah) 2 byte Number of r/w heads. (2 on 1.44M floppy ) 28(1Ch) 4 bytes Number of hidden sectors. (0 on 1.44M floppy) 32(20h) 4 bytes Hugh Sectors Number of sectors if drive > 32M.------ End of BIOS Block ----- 36(24h) 1 byte Drive Number 80h or 00h. 37(25h) 1 byte Reserved/Unused 38(26h) 1 byte extended boot signature record value = 29h 39(27h) 4 bytes Volume S/N or ID 43(2Bh) 11 ASCII Chars Vol Label 54(36h) 8 ASCII Chars Label (FAT12 on 1.44M floppy ) 62(3Eh) Start of boot strap program. 377 - 467 (179-1D3h) Error Messages 470 - 491 (1D6-1EBh)Names of 2 or more hidden SYS files to be loaded next. Typical load chain call,each calling the next... Boot Sector Code->IO.SYS->MSDOS.SYS(kernel)->CONFIG.SYS->COMMAND.COM->AUTOEXEC.BAT ( See section - Proving the boot chain) 510(1FEh) Boot Sector Signature 55AA * Vector to Boot Code. The vector can be read using the u command in debug... -l 100 0 0 1 <--- Load the boot sector to location 100. -u 100 <--- Unassemble at 100. 1392:0100 EB3C JMP 013E <-- Location where boot code starts. 1392:0102 90 NOP <-- A NOP that fills the empty 3rd byte. 1392:0103 2B5D41 SUB BX,[DI+41] 1392:0106 5D POP BP 1392:0107 7449 JZ 0152 1392:0109 48 DEC AX 1392:010A 43 INC BX 1392:010B 0002 ADD [BP+SI],AL 1392:010D 0101 ADD [BX+DI],AX 1392:010F 0002 ADD [BP+SI],AL 1392:0111 E000 LOOPNZ 0113 1392:0113 40 INC AX 1392:0114 0BF0 OR SI,AX 1392:0116 0900 OR [BX+SI],AX 1392:0118 1200 ADC AL,[BX+SI] 1392:011A 0200 ADD AL,[BX+SI] 1392:011C 0000 ADD [BX+SI],AL 1392:011E 0000 ADD [BX+SI],AL -q Next in debug doing a u 13E would allow viewing the boot code itself. The NOP in byte 3 is just a placeholder if the JMP went beyond 256 bytes, byte 3 would be used. 512(200h) 1st FAT (database of clusters, 1 way linked list) starts right here. --------------------------------------------------------------------- 1 entry for every cluster on drive. ------------------------------------------------------------------------------------- FAT16 ex. of entries 0000 Cluster empty avail for use. 0002 - FFEF Cluster in use, goto cluster value to find info on next cluster for file. FFF0 - FFF6 Reserved cluster FFF7 Bad cluster FFF8 - FFFF Last cluster of this file. ------------------------------------------------------------------------------------- 512(200h) Media descriptor F0 FF for floppy F8 FF for HD. 514(202h) FF FF spacer. 516(204h) Start of 3 byte (FAT12) or 4 byte (FAT16) cluster list. Floppy 1.44M has 2880 512 byte sectors/9 per FAT entry. Each FAT entry represents a cluster. Each entry on floppy is a row of 3 bytes. In theory the floppy has 320 (140h)clusters and should only write out 960 bytes of data in the FAT table. FAT12 allows up to FEF (4079) for a cluster number. With 4608 bytes - 8 for the header gives 4600 bytes with 3 bytes per entry 1533 entry slots. 1476 End of live FAT #1 data for a 1.44M floppy. Slack space. 5120 2nd FAT 6080 End of live FAT #2 data for a 1.44M floppy. Slack space. 9728 Start of root dir. 224 entries on 1.44M floppy * 32 bytes = 7168 bytes long. Dir entry | 8 | 3 |1| 10 | 2| 2| 2| 4 | filename ext a reserved t d file t i a ^ size t m t | r e e | i | b | Starting FAT entry 16895- End of root 16896- First file starts here. Back to Top Viewing Boot Sectors,FAT,ROOT this was done using a W98 formatted 1.44M floppy. ------------------------------------------------------------------------------- Use debug at CMD line. In Debug Boot Sector l 100 0 0 1 FAT l 100 0 1 2 FAT 2 l 100 0 A 2 ROOT DIR l 100 0 13 14 ROOT DIR + start of files l 100 0 13 20 First file starts at 1D00, use d 1d00 in debug. After using l type d to view what is loaded. The 100 means load at memory location 100. The 0 after the 100 means drive 0, which is floppy A: The next number means starting sector on the drive. The last number means how many sectors to load. Example: Using l 100 0 0 27 in debug will load enough sectors to be able to reach into the 1st file on the disk. This example uses a disk with only 1 file called test.txt which contains the string TEST. After doing l 100 0 0 27 d 100 shows the boot sector d 300 shows the first FAT d 1500 the 2nd FAT d 2700 The root dir showing the file test.txt d 4300 The 1st file test.txt -l 100 0 0 27 <--- Load 27 sectors in memory taking up the space 0100-4EFF -d 300 <--- Dump at 300 to see FAT #1 1392:0300 F0 FF FF FF 0F 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:0310 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:0320 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:0330 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:0340 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:0350 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:0360 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:0370 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ -d 1500 <--- Dump at 1500 to see FAT #2 1392:1500 F0 FF FF FF 0F 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:1510 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:1520 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:1530 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:1540 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:1550 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:1560 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:1570 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ -d 2700 <--- Dump at 2700 to See the Root Dir 1392:2700 54 45 53 54 20 20 20 20-54 58 54 20 18 9B 6C 5C TEST TXT ..l\ 1392:2710 8D 31 8D 31 00 00 73 5C-8D 31 02 00 06 00 00 00 .1.1..s\.1...... 1392:2720 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:2730 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:2740 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:2750 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:2760 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:2770 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ -d 4300 <--- Dump at 4300 to see the contents of the first file 1392:4300 54 45 53 54 0D 0A 00 00-00 00 00 00 00 00 00 00 TEST............ 1392:4310 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:4320 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:4330 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:4340 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:4350 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:4360 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:4370 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ -q <--- quit debug Trick to find data and strings. In the above example you could either page through all of the memory from 0100 using the d command multiple times or to find the file TEST and it's contents you could use the s command like this... -l 100 0 0 27 <-- Load memory -s 0000 4F00 54 45 53 54 <--- Search memory 0000 to 4F00 for the string 'TEST' 54h 45h 53h 54h 1392:012C <-- debug generates the list. At this spot the disk label has TEST in it 1392:2700 <-- TEST appears in the root dir. 1392:4300 <-- Finally TEST appears in the file itself. -q Deciphering FAT12's -l 100 0 0 27 -d 300 137D:0300 F0 FF FF 00 F0 FF 05 60-00 07 80 00 09 A0 00 0B .......`........ 137D:0310 C0 00 0D E0 00 0F 00 01-11 20 01 13 40 01 15 60 ......... ..@..` 137D:0320 01 17 80 01 19 A0 01 1B-C0 01 1D E0 01 1F 00 02 ................ 137D:0330 21 20 02 23 40 02 25 60-02 27 80 02 29 F0 FF 00 ! .#@.%`.'..)... 137D:0340 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 137D:0350 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 137D:0360 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 137D:0370 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ -q The FAT above reflects the same disk as above, with another file 19232 bytes long added this takes up 38 sectors. Ignoring the F0 FF FF 00 (media descriptor & spacer). The F0 FF reads as FFF in 12bit. This means end of file, the first file is 7 bytes long and ends in the same sector it starts in. Next you can see 05 60.. etc. It counts up to 29 and looks strange because it is 12bit representation. After the 29 comes F0 FF which means FFF end of file. This sector counts towards the size of the file. This works out to the file occupying sectors 5 up to and including 42, effectively 38. In debug it is possible to look at just a specific number of bytes when doing a d command. This makes it easier to see what you are looking for sometimes. Using d 136 l 8, Shows 8 bytes of data at location 136. -l 100 0 0 1 -d 136 l 8 1395:0130 46 41-54 31 32 20 20 20 FAT12 -q Back to Top Patching Disks -------------- It is possible to patch the boot sector, root directory, subdirectories, the FAT's are redundant themselves and are hard to interpret so patching there may be a lost cause. CAUTION: In this direct hardware writes to disk are performed. If you screw up you may wind up with a disk that you cannot recover, as in debug won't even be able to look at it! It is best to experiment with a floppy that you don't care about first. Example: Undeleting files & dirs in root. This directory used to hold a file named test2.txt it was recently deleted. Volume in drive A is TEST Volume Serial Number is 234B-1DFE Directory of A:\ 12/10/2004 09:25 AM 6 test.txt 1 File(s) 6 bytes 0 Dir(s) 1,457,152 bytes free First using debug perform a l 100 0 13 14. Use the d command over and over to scroll through the root until finding the partial file name. The first letter will be missing. -l 100 0 13 14 <--- Load -d 137D:0100 54 45 53 54 20 20 20 20-20 20 20 28 00 00 00 00 TEST (.... 137D:0110 00 00 00 00 00 00 51 B5-87 31 00 00 00 00 00 00 ......Q..1...... 137D:0120 54 45 53 54 20 20 20 20-54 58 54 20 18 3E 3C 4B TEST TXT .>.. 137D:0130 8A 31 8A 31 00 00 31 4B-8A 31 02 00 06 00 00 00 .1.1..1K.1...... 137D:0140 E5 45 53 54 32 20 20 20-54 58 54 20 18 AF 3C 4B .EST2 TXT .... 137D:0150 8A 31 8A 31 00 00 39 4B-8A 31 03 00 07 00 00 00 .1.1..9K.1...... 137D:0160 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 137D:0170 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ -d 137D:0180 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 137D:0190 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 137D:01A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 137D:01B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 137D:01C0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 137D:01D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 137D:01E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 137D:01F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ -q <-- quit debug The first instance of TEST is the label for the disk. The 2nd instance is a file TEST.TXT The 3rd instance is a file that was TEST2.TXT but has been deleted. Recover TEST2.TXT with the following debug commands -l 100 0 13 14 <--- Load the ROOT -e 140 54 <--- Edit location 140 with 54h...the letter T -d 100 <--- Display the results 137D:0100 54 45 53 54 20 20 20 20-20 20 20 28 00 00 00 00 TEST (.... 137D:0110 00 00 00 00 00 00 51 B5-87 31 00 00 00 00 00 00 ......Q..1...... 137D:0120 54 45 53 54 20 20 20 20-54 58 54 20 18 3E 3C 4B TEST TXT .>.. 137D:0130 8A 31 8A 31 00 00 31 4B-8A 31 02 00 06 00 00 00 .1.1..1K.1...... 137D:0140 54 45 53 54 32 20 20 20-54 58 54 20 18 AF 3C 4B TEST2 TXT .... 137D:0150 8A 31 8A 31 00 00 39 4B-8A 31 03 00 07 00 00 00 .1.1..9K.1...... 137D:0160 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 137D:0170 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ -w 100 0 13 1 <--- Write to disk the area that was modified. -q <-- quit debug Important, don't write too much to disk using w 100 0 13 14 above could have wrote across part of the FAT, then there would be a mismatch in the FAT with the DIR. Windows/DOS would then complain about a problem with the disk. Results of the change using DIR A:\ Volume in drive A is TEST Volume Serial Number is 234B-1DFE Directory of A:\ 12/10/2004 09:25 AM 6 test.txt 12/10/2004 09:25 AM 7 test2.txt 2 File(s) 13 bytes 0 Dir(s) 1,457,152 bytes free Test2 shows a valid length and it's time date stamp is correct as well. It is possible to find files in the subdirectories off of the root. This involves searching the disk by loading blocks of sectors and using the s command in debug. Ex: Use l 100 0 13 20 <-- load 20 sectors s 45 53 54 <-- Search for the string EST to find the deleted file or dir formerly named test. If it not found load the next group of sectors. l 100 0 23 20... so on and so forth. Can be a tedious procedure. Back to Top Patching the boot sector. ------------------------- CAUTION: Mistakes made here may render the disk unreadable. The boot sector can be patched manual by using the e command in debug to manually fix broken parts of it. This is tedious and requires a copy of a known good boot sector to look at while modifying it. This is done by view a valid boot sector and editing the broken one. In debug do a l 100 0 0 1 on the good disk, followed by a d twice to view the entire boot sector. Put the bad disk in, using a 2nd command prompt window, do the about l 100 0 0 1 and d twice on the bad disk. Compare the 2 line by line. Use the e command in debug to modify the broken boot sector. If you see mismatches. The e command enters hex data at an address location. Ex. e 100 54, enters 54 hex at 100. Or e 100 54 45 53 54 enters a string of hex values. After patch the boot sector write it back to the disk using w 100 0 0 1, writing 1 sector at sector 0 to floppy A: Alternatively. Get a 2nd disk, identical to the first format it, using the same OS. In debug do a l 100 0 0 1 on this disk. Do a d 100 to look at the boot sector, make sure it looks OK. Put in the bad disk, staying in debug. Do a w 100 0 0 1 on it. This copies the boot sector from the first disk onto the 2nd. Now see if you can read the disk, if so grab all of your files off of it and store them. Don't trust this disk it may be failing and probably will become unreadable soon. Remember the low sectors get a lot of action when using a floppy. Escpecially if it is a boot floppy. This is most likely where it will fail first. It could also be the place where a Flash drive will fail first, lots of write cycles on the Root and FAT's over time will wear it out here first. It is possible to patch drives other than a floppy. NT/XP won't let you access anything it thinks is a Hard Drive, including USB Drives. It is possible to do patches on WIN9X hard drives, risky, be very careful. It is possible to save the boot sector from a disk to a file using a trick. Start with a freshly formatted disk. Using the command line go to the disk and do the following... type con > bs.bin Type in TEST Then use Ctrl-Z to save and exit. Next use debug , do l 100 0 0 27. A d 4300 should reveal the contents of the file, verify this. If not search for the TEST string. Use the move command m to copy the boot sector to this location. m 100 300 4300 This will copy the boot sector 512 bytes to the file, which has been allocated 512 bytes as well, no problems. Next do a d 2700 to show the root dir. -d 2700 1392:2700 54 45 53 54 20 20 20 20-20 20 20 08 00 00 00 00 TEST ..... 1392:2710 00 00 00 00 00 00 C3 6E-8E 31 00 00 00 00 00 00 .......n.1...... 1392:2720 42 53 20 20 20 20 20 20-42 49 4E 20 18 2C 96 73 BS BIN .,.s 1392:2730 8E 31 8E 31 00 00 A1 73-8E 31 02 00 00 02 00 00 .1.1...s.1...... 1392:2740 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:2750 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:2760 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 1392:2770 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ NOTE: If your file name is on a different line of memory proceed according to where it is in memory. In the above example modify bytes 273C to 00 , 273D to 02 using the commands... e 273C 00 02 This will change the length of the file to 512 bytes as far as DOS cares. Now the final step, w 100 0 0 27. Which writes everything to disk. IMPORTANT: wait until the disk stops before hitting q to quit, or else you will have a ruined File System on the disk! Verify the file is correct, by checking the dir. Volume in drive A is TEST Volume Serial Number is E844-51E8 Directory of A:\ 12/12/2004 10:29 PM 512 bs.bin 1 File(s) 512 bytes 0 Dir(s) 1,457,152 bytes free Doing a debug a:\bs.bin then a d 100 will reveal the saved boot sector. This boot sector can be then used if needed to patch a disk. It should be saved to the harddrive first! If needed the you can do a debug bs.bin in the dir you have stored it. Then you can do a w 100 0 0 1 with the floppy in the drive you want to write the BS to. On an NT/XP box it is possible to boot via a DOS floppy and read and write to devices such as a USB drive, making patches possible. The correct drivers are needed. The Hard drives if NTFS are most likely out of reach to be touched, would recommend against it, even if a program such as ntfsdos is available that allows touching the NTFS drive. Additionally there are ways to remove partition tables from hard drives using debug. This is done to remove non DOS partition as FDISK will not recognize them, info is available online for this. Back to Top Proving the boot chain ---------------------- To prove to yourself the files in the boot sector load the way they do. Look at a floppy boot sector with debug. Use l 100 0 0 1, then use d and page down to the bottom of the boot sector you should see a region like this, note the 55 AA that marks the end of the boot sector. Note the first file IO.SYS. Above this region you will see ASCII error messages the kind that you get when the disk has no system files on it. Try to boot off of this disk and you will see those messages. 1392:02D0 20 20 20 20 0D 0A 00 00-49 4F 20 20 20 20 20 20 ....IO 1392:02E0 53 59 53 4D 53 44 4F 53-20 20 20 53 59 53 7F 01 SYSMSDOS SYS.. 1392:02F0 00 41 BB 00 07 60 66 6A-00 E9 3B FF 00 00 55 AA .A...`fj..;...U. At the command line goto the floppy drive. Do type con > IO.SYS at the command line. Type alt-244, hit enter, hit Ctrl-z saving the file. You have just written a program, you can view it by using debug io.sys followed by u. -u <--- Unassemble 1392:0100 F4 HLT <-- 244 decimal F4 hex, the halt instuction. 1392:0101 0D0A46 OR AX,460A <-- Carriage Rtn & Line feed 0D 0A, get ignored. 1392:0104 7265 JB 016B 1392:0106 65 DB 65 1392:0107 44 INC SP 1392:0108 4F DEC DI 1392:0109 53 PUSH BX 1392:010A 2000 AND [BX+SI],AL 1392:010C 0201 ADD AL,[BX+DI] 1392:010E 0100 ADD [BX+SI],AX 1392:0110 02E0 ADD AH,AL 1392:0112 00400B ADD [BX+SI+0B],AL 1392:0115 F0 LOCK 1392:0116 0900 OR [BX+SI],AX 1392:0118 1200 ADC AL,[BX+SI] 1392:011A 0200 ADD AL,[BX+SI] 1392:011C 3400 XOR AL,00 1392:011E 81130000 ADC WORD PTR [BP+DI],0000 -q Boot off of the disk and the computer simply halts, no message or nothing. Pull the disk and use Ctrl-Alt-Del to restart. Jump Routine type con > test.exe Alt 235 JMP Alt 254 Memory loc -1 Alt 144 NOP <-- Pad with NOP's Alt 144 NOP Alt 144 NOP Ctrl-Z Back to Top Boot Records, FAT & Root Directories Viewing Boot Sectors,FAT,ROOT this was done using a W98 formatted 1.44M floppy Patching Disks Patching the boot sector Proving the boot chain   Original Build Date:07-18-2005 Last updated 12-23-2005