How to read the MBR contents

How to do things, solutions, recipes, tutorials
Post Reply
Message
Author
Mark L

How to read the MBR contents

#1 Post by Mark L »

What's the simplest way to read the contents of the master boot record (MBR)? Should I be able to view the contents using a read-only command from a console (newbie here)? If so, how do I do that?

Mark L

User avatar
rarsa
Posts: 3053
Joined: Sun 29 May 2005, 20:30
Location: Kitchener, Ontario, Canada
Contact:

#2 Post by rarsa »

I don't know about the simplest. And I don't know that as a newbie you will make any sense of the boot record. In any case, I think this will work:

Code: Select all

 dd if=/dev/hda of=mbrcontent bs=1 count=512
It will write the contents of the first HDD's mbr to the "mbrcontent" file (you can use whatever name for that file).

You will be able to look at the file in any binary viewer or editor.

Sage
Posts: 5536
Joined: Tue 04 Oct 2005, 08:34
Location: GB

#3 Post by Sage »

You can inspect MBR from a Disk Editor like Norton running out of DOS. You can even change it, if you know how - most folk don't!

User avatar
Flash
Official Dog Handler
Posts: 13071
Joined: Wed 04 May 2005, 16:04
Location: Arizona USA

#4 Post by Flash »

rarsa wrote:...I don't know that as a newbie you will make any sense of the boot record.
Well, it won't hurt to look at the MBR, and maybe you will learn something :) The minimum you will learn is that you can use "dd" to inspect the contents of any place on the hard drive.
rarsa wrote:...In any case, I think this will work:

Code: Select all

 dd if=/dev/hda of=mbrcontent bs=1 count=512
It will write the contents of the first HDD's mbr to the "mbrcontent" file (you can use whatever name for that file).

You will be able to look at the file in any binary viewer or editor.
rarsa, does that script create the "mbrcontent" file? If so, where does it put the file? The directory you are in when you execute the script?

kethd
Posts: 451
Joined: Thu 20 Oct 2005, 12:54
Location: Boston MA USA

Sector 0 of hard drive

#5 Post by kethd »

I've been learning how to deal with the first sector. (I've learned ways to find out what is really there.) If you are dealing with the MBR, I've gathered what I've learned so far here:
http://puppylinux.org/wikka/Sector0
(Please add what you learn, so we can all learn!)

-------
Sector0

Sector 0 is the first sector of the Hard Disk Drive.
Absolute (or Physical) Sector 0 is at CHS 0,0,1.

It contains the Partition Table, which is four 16-byte entries, starting at location 01BE.
The Partition Table can be viewed (and changed) with Pdisk, fdisk, and cfdisk.

The last two bytes, at location 01FE, should always be 55 AA.
This is called the Signature ID or Magic Number.

The first 446 bytes of the MBR is the IPL (Initial Program Loader) or boot code. This searches the partition table for an active partition and then loads the first sector of that partition in to memory, and starts executing its code. If the IPL is damaged or missing, the MBR cannot boot an otherwise undamaged disk, even if the partition table is intact. (But booting from a floppy or other device should allow access to the drive and its partitions -- if the partition table is OK.)

Use the Linux utility hexdump to view the contents of Sector 0.

Learn all about the details of this code at
http://thestarman.dan123.com/asm/mbr/MBR_in_detail.htm
Daniel B. Sedory dis-assembles and analyzes each version of boot code!

Unfortunately, Puppy 1.0.6. and previous versions are missing hexdump. (It is rumored to be returning in Puppy 1.0.7.) But dd and awk are present, and can be used to find out what IPL is actually present.

This code can be used from the console command line:
# dd if=/dev/hda bs=512 count=1 | awk 'BEGIN {RS="GRUB"} {printf "%X\n", length($0)}'
1+0 records in
1+0 records out
179
83

dd reads the first 512 byte sector from the hard drive.
awk searches for the string "GRUB", and prints out the location (in hexadecimal).
This example shows a normal GRUB installation, at hex location 0179. Other versions of GRUB might locate at 0176. (The 83 is the number of bytes remaining, from the end of the found string to the end of the sector.)

If there is no GRUB, the program would print just one number, 200 (that equals 512 bytes, in hex). Replace "GRUB" with "LILO" -- that would be located at 0006.

To find out if Windows is installed, replace "GRUB" with "Invalid", the beginning of an error message that is included in all DOS/Windows IPLs, at these locations:
008B - MS-DOS3.30/Win95A
010F - Win95B/98/98SE/ME
012C - Win2000/XP

User avatar
rarsa
Posts: 3053
Joined: Sun 29 May 2005, 20:30
Location: Kitchener, Ontario, Canada
Contact:

#6 Post by rarsa »

rarsa, does that script create the "mbrcontent" file? If so, where does it put the file? The directory you are in when you execute the script?
Correct!
I've gathered what I've learned so far here:
http://puppylinux.org/wikka/Sector0
(Please add what you learn, so we can all learn!)
I've learned that you should not mess too with the MBR if you don't have a current backup of your dear data.

I've also learned that it's not that difficult to understand the contents as the layout is quite standard:
Here are two good references:
http://home.teleport.com/~brainy/fat32.htm
http://www.geocities.com/thestarman3/as ... Tables.htm
http://www.win.tue.nl/~aeb/partitions/p ... pes-2.html

kethd
Posts: 451
Joined: Thu 20 Oct 2005, 12:54
Location: Boston MA USA

#7 Post by kethd »

Programs for viewing the MBR and Partition Table:
http://puppylinux.org/wikka/hexdumpBASIC

User avatar
greengeek
Posts: 5789
Joined: Tue 20 Jul 2010, 09:34
Location: Republic of Novo Zelande

#8 Post by greengeek »

sorry, only posting so that I can get this topic into my current watchlist. (I think I may have a problem with correct creation of mbr or maybe partition table)

Post Reply