The
MSWIN 4.1 Boot Record Revealed MBR
and Boot Records Index Page The Starman's
Realm Index Page
This
page is still under construction!
Like previous FAT32 Boot Records (see MSWIN4.1 Boot Record), most of its structure is the same as it was under Windows™ 98 or ME. Thus, you won't find much difference in the immediate appearance of Boot Records for a FAT32 partition under Windows™ 2000 or XP. The FSINFO sector, for example, is exactly the same; and even the code routines in the third sector appear to be the same. We would need to carry out some detailed research (many more experiments and time required) in order to provide conclusive comments about all possible differences.
Upon examining these sectors more closely, however, there are some major new differences: For example, these FAT32 Boot Records (and any FAT32 Boot Records that were accessed by a Windows™ 2000 or XP OS at the time one of those operating systems was installed) will contain one very noticeable difference: In a disk editor, you will no longer find the older MS-DOS related system file names here. They've all been replaced by the NTLDR file (the same file found in NTFS partitions)!
An EXAMPLE FAT32 Boot Record (first sector
only);
after being converted during a Windows™ 2000 install:
Absolute Sector 14105070 BPB | System Name 0 1 2 3 4 5 6 7 8 9 A B C D E |F | 0000: EB 58 90 4D 53 57 49 4E 34 2E 31 00 02 08 20 00 .X.MSWIN4.1... . 0010: 02 00 00 00 00 F8 00 00 3F 00 FF 00 EE 39 D7 00 ........?....9.. 0020: BD 86 BB 00 CD 2E 00 00 00 00 00 00 93 B2 0B 00 ................ 0030: 01 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0040: 80 00 29 56 2F BF 10 57 49 4E 39 38 5F 44 41 54 ..)V/..WIN98_DAT 0050: 41 00 46 41 54 33 32 20 20 20 33 C9 8E D1 BC F4 A.FAT32 3..... 0060: 7B 8E C1 8E D9 BD 00 7C 88 4E 02 8A 56 40 B4 08 {......|.N..V@.. 0070: CD 13 73 05 B9 FF FF 8A F1 66 0F B6 C6 40 66 0F ..s......f...@f. 0080: B6 D1 80 E2 3F F7 E2 86 CD C0 ED 06 41 66 0F B7 ....?.......Af.. 0090: C9 66 F7 E1 66 89 46 F8 83 7E 16 00 75 38 83 7E .f..f.F..~..u8.~ 00A0: 2A 00 77 32 66 8B 46 1C 66 83 C0 0C BB 00 80 B9 *.w2f.F.f....... 00B0: 01 00 E8 2B 00 E9 48 03 A0 FA 7D B4 7D 8B F0 AC ...+..H...}.}... 00C0: 84 C0 74 17 3C FF 74 09 B4 0E BB 07 00 CD 10 EB ..t.<.t......... 00D0: EE A0 FB 7D EB E5 A0 F9 7D EB E0 98 CD 16 CD 19 ...}....}....... 00E0: 66 60 66 3B 46 F8 0F 82 4A 00 66 6A 00 66 50 06 f`f;F...J.fj.fP. 00F0: 53 66 68 10 00 01 00 80 7E 02 00 0F 85 20 00 B4 Sfh.....~.... .. 0100: 41 BB AA 55 8A 56 40 CD 13 0F 82 1C 00 81 FB 55 A..U.V@........U 0110: AA 0F 85 14 00 F6 C1 01 0F 84 0D 00 FE 46 02 B4 .............F.. 0120: 42 8A 56 40 8B F4 CD 13 B0 F9 66 58 66 58 66 58 B.V@......fXfXfX 0130: 66 58 EB 2A 66 33 D2 66 0F B7 4E 18 66 F7 F1 FE fX.*f3.f..N.f... 0140: C2 8A CA 66 8B D0 66 C1 EA 10 F7 76 1A 86 D6 8A ...f..f....v.... 0150: 56 40 8A E8 C0 E4 06 0A CC B8 01 02 CD 13 66 61 V@............fa 0160: 0F 82 54 FF 81 C3 00 02 66 40 49 0F 85 71 FF C3 ..T.....f@I..q.. 0170: 4E 54 4C 44 52 20 20 20 20 20 20 00 00 00 00 00 NTLDR ..... 0180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01A0: 00 00 00 00 00 00 00 00 00 00 00 00 0D 0A 4E 54 ..............NT 01B0: 4C 44 52 20 69 73 20 6D 69 73 73 69 6E 67 FF 0D LDR is missing.. 01C0: 0A 44 69 73 6B 20 65 72 72 6F 72 FF 0D 0A 50 72 .Disk error...Pr 01D0: 65 73 73 20 61 6E 79 20 6B 65 79 20 74 6F 20 72 ess any key to r 01E0: 65 73 74 61 72 74 0D 0A 00 00 00 00 00 00 00 00 estart.......... 01F0: 00 00 00 00 00 00 00 00 00 AC BF CC 00 00 55 AA ..............U. 0 1 2 3 4 5 6 7 8 9 A B C D E F |
The last 144 bytes of the Boot Record's first sector contain the single system file name: NTLDR , many unused bytes, error messages and their data bytes (AC BF CC); indicating the offset of each error message in the sector (1ACh, 1BFh and 1CCh), and finally the Word-sized signature ID (or Magic number) of AA55h. By placing the three data bytes near the end of the sector, error messages for OS distributions in other languages requiring more characters, would begin further back in the sector.
All the Error Message lines begin with the Hex bytes 0Dh and 0Ah which are a Carriage Return and Line Feed. The first line of both messages (there are only two; either: "NTLDR is missing" or: "Disk error") end with an FFh byte (which the code checks for), then they continue with the last line ("Press any key to restart"; followed by another Carriage Return and Line Feed) which ends with a 00h byte, making it what's commonly known as a zero-terminated or 'sz' string (the string plus a zero byte).
Reminder: Don't forget that each FAT32 Boot Record has a Backup Copy (even under Windows 2000 or XP) just a few sectors beyond the original. These correspond to Relative (or Logical) Sectors 6 through 8 (for the Backup copy) of any FAT32 partition on your drive.
For more information on FAT32 Boot Records in general and some code routines, please read our page on the MSWIN4.1 Boot Record here.
Here's the disassembled code (; with comments)
after the whole sector has been loaded into memory at 0000:7C00 (by the Master
Boot code). We'll comment on a few of the differences between this sector
and the MSWIN4.1 Boot Record under Windows™ 98/ME.
(An asterisk '*' in front of any Assembly Instruction listed below
means that the instruction cannot be disassembled correctly by MS-DEBUG):
; The following code begins exactly as it did under Windows 98/ME:
7C00 EB58 JMP 7C5A ; Jump over BPB (BIOS Parameter
; Block) to beginning of code.
7C02 90 NOP ; Used later as a FLAG byte for
; Extended INT 13 Disk Func.'s
; (See instruction at: 7CADh).
; 7C03 thru 7C0A 'MSWIN4.1' System Name or OEM ID. (Some think
; this is part of the BPB; it's not!)
;
; 7C0B thru 7C59 BIOS Parameter Block (BPB) See text and tables here
; for more details on the BPB.
; The CLI instruction (under Win98/ME) is absent from this new VBR.
7C5A 33C9 XOR CX,CX ; Zero out both the Counter and
7C5C 8ED1 MOV SS,CX ; Stack Segment Registers.
7C5E BCF47B MOV SP,7BF4 ; Set Stack Pointer to 0000:7BF4
; because 7BF4-7BFF are used for
; data locations found below.
7C61 8EC1 MOV ES,CX ; Zero out the Extra and
7C63 8ED9 MOV DS,CX ; Data Segments.
7C65 BD007C MOV BP,7C00 ; Base Pointer set to 7C00, where
; our BPB data is now located.
7C68 884E02 MOV [BP+02],CL ; Zero-out byte at [7C02].
7C6B 8A5640 MOV DL,[BP+40] ; (DiskDriveID; 80h?) -> DL.
7C6E B408 MOV AH,08 ; Function: Get Drive Parameters
7C70 CD13 INT 13
7C72 7305 JNB 7C79
7C74 B9FFFF MOV CX,FFFF
7C77 8AF1 MOV DH,CL
7C79 660FB6C6 * MOVZX EAX,DH
7C7D 40 INC AX
7C7E 660FB6D1 * MOVZX EDX,CL
7C82 80E23F AND DL,3F
7C85 F7E2 MUL DX
7C87 86CD XCHG CL,CH
7C89 C0ED06 * SHR CH,06
7C8C 41 INC CX
7C8D 660FB7C9 * MOVZX ECX,CX
7C91 66F7E1 * MUL ECX
7C94 668946F8 * MOV [BP-08],EAX
7C98 837E1600 CMP WordPtr [BP+16],0000
7C9C 7538 JNZ 7CD6
7CA4 668B461C * MOV EAX,[BP+1C]
7CA8 6683C00C * ADD EAX,0000000C
7CAC BB0080 MOV BX,8000
7CAF B90100 MOV CX,0001
7CB2 E82B00 CALL 7CE0
7CB5 E94803 JMP 8000 ; Jump to code in 3rd sector.
; ====================================================================
; Display Error Message S U B R O U T I N E :
; ====================================================================
7CB8 A0FA7D MOV AL,[7DFA] ; [7DFA]->AL, so AX=7DBF
; Causes SI -> 0D,0A,
; "NTLDR is missing"
7CBB B47D MOV AH,7D ; Always AH = 7D here.
7CBD 8BF0 MOV SI,AX ; SI -> Error Message.
7CBF AC LODSB ; Each byte -> AL, one at
; a time.
7CC0 84C0 TEST AL,AL ; Test for 00h byte.
7CC2 7417 JZ 7CDB ; If zero, we're done.
7CC4 3CFF CMP AL,FF ; Check for FFh bytes.
7CC6 7409 JZ 7CD1 ; Yes, so do last line.
7CC8 B40E MOV AH,0E ; Output One Character.
7CCA BB0700 MOV BX,0007
7CCD CD10 INT 10 ; Video Display Interrupt
7CCF EBEE JMP 7CBF ; Repeat until all of the
; string is displayed.
7CD1 A0FB7D MOV AL,[7DFB] ; [7DFB]->AL, so AX=7DCC
; Causes SI -> 0D,0A,
; "Press any key to restart"
7CD4 EBE5 JMP 7CBB ; Strt displaying last line.
7CD6 A0F97D MOV AL,[7DF9] ; [7DF9]->AL, so AX=7DAC
; Causes SI -> 0D,0A,
; "NTLDR is missing"
7CD9 EBE0 JMP 7CBB ; Begin displaying message.
7CDB 98 CBW ; Convert Byte to Word
7CDC CD16 INT 16 ; Wait until getting a key-
; stroke from Keyboard.
7CDE CD19 INT 19 ; If a key was pressed, then
; Start over again with
; System BOOTSTRAP LOADER.
;==================================================================
; S U B R O U T I N E
;==================================================================
7CE0 6660 * PUSHAD
7CE2 663B46F8 * CMP EAX,[BP-08]
7CE6 0F824A00 * JB 7D34
7CEA 666A00 * PUSH 00000000
7CED 6650 * PUSH EAX
7CEF 06 PUSH ES
7CF0 53 PUSH BX
7CF1 666810000100 * PUSH 00010010
7CF7 807E0200 CMP BYTE PTR [BP+02],00
7CFB 0F852000 * JNZ 7D1F
7CFF B441 MOV AH,41 ; INT 13, Func. 41h
7D01 BBAA55 MOV BX,55AA ;
7D04 8A5640 MOV DL,[BP+40]
7D07 CD13 INT 13
7D09 0F821C00 * JB 7D29
7D0D 81FB55AA CMP BX,AA55 ;
7D11 0F851400 * JNZ 7D29
7D15 F6C101 TEST CL,01
7D18 0F840D00 * JZ 7D29
7D1C FE4602 INC BYTE PTR [BP+02]
7D1F B442 MOV AH,42 ; INT 13, Func. 42h
7D21 8A5640 MOV DL,[BP+40]
7D24 8BF4 MOV SI,SP
7D26 CD13 INT 13
7D28 B0F9 MOV AL,F9
7D2A 6658 * POP EAX
7D2C 6658 * POP EAX
7D2E 6658 * POP EAX
7D30 6658 * POP EAX
7D32 EB2A JMP 7D5E
7D34 6633D2 * XOR EDX,EDX
7D37 660FB74E18 * MOVZX ECX,Word [BP+18]
7D3C 66F7F1 * DIV ECX
7D3F FEC2 INC DL
7D41 8ACA MOV CL,DL
7D43 668BD0 * MOV EDX,EAX
7D46 66C1EA10 * SHR EDX,10
7D4A F7761A DIV WORD PTR [BP+1A]
7D4D 86D6 XCHG DL,DH
7D4F 8A5640 MOV DL,[BP+40]
7D52 8AE8 MOV CH,AL
7D54 C0E406 * SHL AH,06
7D57 0ACC OR CL,AH
7D59 B80102 MOV AX,0201
7D5C CD13 INT 13
7D5E 6661 * POPAD
7D60 0F8254FF * JB 7CB8 ; If <, then NTLDR not found.
7D64 81C30002 ADD BX,0200
7D68 6640 * INC EAX
7D6A 49 DEC CX
7D6B 0F8571FF * JNZ 7CE0
7D6F C3 RET
Location
of Data and
Error Messages in Memory
|
From Logical Sector 0: 0 1 2 3 4 5 6 7 8 9 A B C D E F |
Last Update: June 8, 2007. [2007.06.08]
You can write to us using this:
contact form (opens in
a new window).
The
MSWIN 4.1 Boot Record Revealed
MBR
and Boot Records Index Page
The Starman's
Realm Index Page