PC Allgemein      zurück       Links

Teile eines PC:

Tastatur

Empfehlenswerte Bücher

Betriebssysteme :  

Programmiersprachen

Master Boot Record

CMOS Bios

Links:

http://www.willemer.de/informatik/***

http://keplerweb.oeh.uni-linz.ac.at/Betzi/abwl/***

Master Boot Record

Erster physikalischer Sektor von Festplatten, der eine Tabelle mit der logischen Organisation (Partitionierung) der Festplatte sowie ein Programm zur Auswertung der Tabelle enthält. Er wird im Inhaltsverzeichnis nicht angezeigt.

Der MBR ist der Sektor mit folgender Lokalisation auf der Festplatte :

Damit überhaupt mehrere Betriebssysteme auf einer Festplatte Platz finden, muss sich diese in Bereiche aufteilen lassen. Und die exakte Position dieser Bereiche muss an einer allgemein bekannten Stelle der Festplatte gespeichert sein: in Spur 0, Seite 0, Sektor 1. Dort ist bei jeder Festplatte im PC der Master Boot Record, kurz MBR, gespeichert.

Er enthält zwei Dinge:

Die letzten zwei Byte im 512-Byte-großen MBR müssen immer den Wert AA55h enthalten, die den MBR als solchen identifizieren. Sonst könnten manche Programme den Sektor nicht als MBR akzeptieren.

Auf jeder bootfähigen Diskette ( zb der Notfalldiskette , oder der Win 98 Boot Diskette findet sich auch eine MBR.

Über den Master-Bootsektor der Festplatte wird die bootfähige Partition lokalisiert und von ihr die Datei IO.SYS geladen, welche wiederum das Laden von WINDOWS 95 initiiert.

Einträge im Master Boot Record

Adresse

Inhalt

Größe

+00h

Master Boot Routine

Win 98 schreibt nur 139 Byte Code

80 Byte sind für Fehlermeldungstext

227 Byte bleiben frei

446 Byte

+1BEh

1 Eintrag der Partitionstabelle

16 Byte

+1CEh

1 Eintrag der Partitionstabelle

16 Byte

+1DEh

1 Eintrag der Partitionstabelle

16 Byte

+1EEh

1 Eintrag der Partitionstabelle

16 Byte

+1FEh

Erkennungscode des MBR = AA55h

2 Byte

MBR unter Linux Mandrake

MBR anschauen

Zunächst wird auf DOS Ebene Debug gestartet

Dann wird der erste Sektor der Festplatte an den Speicherplatz 0000 geladen:

Dann kann man sich die geladenen Sektoren anschauen

Es erscheint zb :

-d 0000 008f

MBR sichern

MBR verändern

MBR wiederherstellen

Fals der Bootsektor nicht mehr läuft , muß man mit der Notfalldiskette booten.

Nach Erreichen der Dos Ebene wird der Befehl    fdisk /mbr   eingegeben.

Damit wird die Ursprungs mbr auf der Festplatte wiederhergestellt.

Dies Trick hat sich bewährt, um Bootsektor Viren wieder aus dem MBR herauszuschmeißen

Links:

http://masterbootrecord.de/docs/bootdisketten.php

http://ata-atapi.com/hiwmbr.htm

http://www.pcguide.com/index.htm

Englisch:

Master Boot Record

The Master Boot Record (MBR) is the information in the first sector of any hard disk or diskette that identifies how and where an operating system is located so that it can be boot (loaded) into the computer's main storage or random access memory. The Master Boot Record is also sometimes called the "partition sector" or the "master partition table" because it includes a table that locates each partition that the hard disk has been formatted into. In addition to this table, the MBR also includes a program that reads the boot sector record of the partition containing the operating system to be booted into RAM. In turn, that record contains a program that loads the rest of the operating system into RAM.

Disassembly of a Master Boot Record (MBR)

This article is a disassembly of a Master Boot Record (MBR). The MBR is the sector at cylinder 0, head 0, sector 1 of a hard disk. An MBR is created by the FDISK program. The FDISK program of all operating systems must create a functionally similar MBR. The MBR is first of what could be many partition sectors, each one containing a four entry partition table.

At the completion of your system's Power On Self Test (POST), INT 19 is called.

The small program in the MBR will attempt to locate an active (bootable) partition in its partition table. If such a partition is found, the boot sector of that partition is read into memory at location 0000:7C00 and the MBR program jumps to memory location 0000:7C00. Each operating system has its own boot sector format. The small program in the boot sector must locate the first part of the operating system's kernel loader program (or perhaps the kernel itself or perhaps a "boot manager program") and read that into memory.

INT 19 is also called when the CTRL-ALT-DEL keys are used. On most systems, CTRL-ALT-DEL causes an short version of the POST to be executed before INT 19 is called.

Where stuff is

Summary of what this thing does

If an active partition is found, that partition's boot record is read into 0000:7c00 and the MBR code jumps to 0000:7c00 with SI pointing to the partition table entry that describes the partition being booted. The boot record program uses this data to determine the drive being booted from and the location of the partition on the disk.

If no active partition table enty is found, ROM BASIC is entered via INT 18. All other errors cause a system hang, see label HANG.

Notes (VERY IMPORTANT)

1.The first byte of an active partition table entry is 80.

This byte is loaded into the DL register before INT 13 is called to read the boot sector. When INT 13 is called, DL is the BIOS device number. Because of this, the boot sector read by this MBR program can only be read from BIOS device number 80 (the first hard disk). This is one of the reasons why it is usually not possible to boot from any other hard disk.

2.The MBR program uses the CHS based INT 13H AH=02H call to read the boot sector of the active partition. The location of the active partition's boot sector is in the partition table entry in CHS format. If the drive is >528MB, this CHS must be a translated CHS (or L-CHS, see my BIOS TYPES document). No addresses in LBA form are used (another reason why LBA does not solve the >528MB problem).

Entire MBR record in hex and ASCII

OFFSET 0 1 2 3 4 5 6 7 8 9 A B C D E F *0123456789ABCDEF*

000000 fa33c08e d0bc007c 8bf45007 501ffbfc *.3.....|..P.P...*

000010 bf0006b9 0001f2a5 ea1d0600 00bebe07 *................*

000020 b304803c 80740e80 3c00751c 83c610fe *.....t....u.....*

000030 cb75efcd 188b148b 4c028bee 83c610fe *.u......L.......*

000040 cb741a80 3c0074f4 be8b06ac 3c00740b *.t....t.......t.*

000050 56bb0700 b40ecd10 5eebf0eb febf0500 *V.......^.......*

000060 bb007cb8 010257cd 135f730c 33c0cd13 *..|...W.._s.3...*

000070 4f75edbe a306ebd3 bec206bf fe7d813d *Ou...........}.=*

000080 55aa75c7 8bf5ea00 7c000049 6e76616c *U.u.....|..Inval*

000090 69642070 61727469 74696f6e 20746162 *id partition tab*

0000a0 6c650045 72726f72 206c6f61 64696e67 *le.Error loading*

0000b0 206f7065 72617469 6e672073 79737465 * operating syste*

0000c0 6d004d69 7373696e 67206f70 65726174 *m.Missing operat*

0000d0 696e6720 73797374 656d0000 00000000 *ing system......*

0000e0 00000000 00000000 00000000 00000000 *................*

0000f0 TO 0001af SAME AS ABOVE

0001b0 00000000 00000000 00000000 00008001 *................*

0001c0 0100060d fef83e00 00000678 0d000000 *...........x....*

0001d0 00000000 00000000 00000000 00000000 *................*

0001e0 00000000 00000000 00000000 00000000 *................*

0001f0 00000000 00000000 00000000 000055aa *..............U.*

Disassembly of the MBR

This sector is initially loaded into memory at 0000:7c00 but it immediately relocates itself to 0000:0600.

BEGIN: NOW AT 0000:7C00, RELOCATE

0000:7C00 FA CLI disable int's

0000:7C01 33C0 XOR AX,AX set stack seg to 0000

0000:7C03 8ED0 MOV SS,AX

0000:7C05 BC007C MOV SP,7C00 set stack ptr to 7c00

0000:7C08 8BF4 MOV SI,SP SI now 7c00

0000:7C0A 50 PUSH AX

0000:7C0B 07 POP ES ES now 0000:7c00

0000:7C0C 50 PUSH AX

0000:7C0D 1F POP DS DS now 0000:7c00

0000:7C0E FB STI allow int's

0000:7C0F FC CLD clear direction

0000:7C10 BF0006 MOV DI,0600 DI now 0600

0000:7C13 B90001 MOV CX,0100 move 256 words (512 bytes)

0000:7C16 F2 REPNZ move MBR from 0000:7c00

0000:7C17 A5 MOVSW to 0000:0600

0000:7C18 EA1D060000 JMP 0000:061D jmp to NEW_LOCATION

NEW_LOCATION: NOW AT 0000:0600

0000:061D BEBE07 MOV SI,07BE point to first table entry

0000:0620 B304 MOV BL,04 there are 4 table entries

SEARCH_LOOP1: SEARCH FOR AN ACTIVE ENTRY

0000:0622 803C80 CMP BYTE PTR [SI],80 is this the active entry?

0000:0625 740E JZ FOUND_ACTIVE yes

0000:0627 803C00 CMP BYTE PTR [SI],00 is this an inactive entry?

0000:062A 751C JNZ NOT_ACTIVE no

0000:062C 83C610 ADD SI,+10 incr table ptr by 16

0000:062F FECB DEC BL decr count

0000:0631 75EF JNZ SEARCH_LOOP1 jmp if not end of table

0000:0633 CD18 INT 18 GO TO ROM BASIC

FOUND_ACTIVE: FOUND THE ACTIVE ENTRY

0000:0635 8B14 MOV DX,[SI] set DH/DL for INT 13 call

0000:0637 8B4C02 MOV CX,[SI+02] set CH/CL for INT 13 call

0000:063A 8BEE MOV BP,SI save table ptr

SEARCH_LOOP2: MAKE SURE ONLY ONE ACTIVE ENTRY

0000:063C 83C610 ADD SI,+10 incr table ptr by 16

0000:063F FECB DEC BL decr count

0000:0641 741A JZ READ_BOOT jmp if end of table

0000:0643 803C00 CMP BYTE PTR [SI],00 is this an inactive entry?

0000:0646 74F4 JZ SEARCH_LOOP2 yes

NOT_ACTIVE: MORE THAN ONE ACTIVE ENTRY FOUND

0000:0648 BE8B06 MOV SI,068B display "Invld prttn tbl"

DISPLAY_MSG: DISPLAY MESSAGE LOOP

0000:064B AC LODSB get char of message

0000:064C 3C00 CMP AL,00 end of message

0000:064E 740B JZ HANG yes

0000:0650 56 PUSH SI save SI

0000:0651 BB0700 MOV BX,0007 screen attributes

0000:0654 B40E MOV AH,0E output 1 char of message

0000:0656 CD10 INT 10 to the display

0000:0658 5E POP SI restore SI

0000:0659 EBF0 JMP DISPLAY_MSG do it again

HANG: HANG THE SYSTEM LOOP

0000:065B EBFE JMP HANG sit and stay!

READ_BOOT: READ ACTIVE PARITION BOOT RECORD

0000:065D BF0500 MOV DI,0005 INT 13 retry count

INT13RTRY: INT 13 RETRY LOOP

0000:0660 BB007C MOV BX,7C00

0000:0663 B80102 MOV AX,0201 read 1 sector

0000:0666 57 PUSH DI save DI

0000:0667 CD13 INT 13 read sector into 0000:7c00

0000:0669 5F POP DI restore DI

0000:066A 730C JNB INT13OK jmp if no INT 13

0000:066C 33C0 XOR AX,AX call INT 13 and

0000:066E CD13 INT 13 do disk reset

0000:0670 4F DEC DI decr DI

0000:0671 75ED JNZ INT13RTRY if not zero, try again

0000:0673 BEA306 MOV SI,06A3 display "Errr ldng systm"

0000:0676 EBD3 JMP DISPLAY_MSG jmp to display loop

INT13OK: INT 13 ERROR

0000:0678 BEC206 MOV SI,06C2 "missing op sys"

0000:067B BFFE7D MOV DI,7DFE point to signature

0000:067E 813D55AA CMP WORD PTR [DI],AA55 is signature correct?

0000:0682 75C7 JNZ DISPLAY_MSG no

0000:0684 8BF5 MOV SI,BP set SI

0000:0686 EA007C0000 JMP 0000:7C00 JUMP TO THE BOOT SECTOR

WITH SI POINTING TO

PART TABLE ENTRY

Messages here.

0000:0680 ........ ........ ......49 6e76616c * Inval*

0000:0690 69642070 61727469 74696f6e 20746162 *id partition tab*

0000:06a0 6c650045 72726f72 206c6f61 64696e67 *le.Error loading*

0000:06b0 206f7065 72617469 6e672073 79737465 * operating syste*

0000:06c0 6d004d69 7373696e 67206f70 65726174 *m.Missing operat*

0000:06d0 696e6720 73797374 656d00.. ........ *ing system. *

Data not used.

0000:06d0 ........ ........ ......00 00000000 * .....*

0000:06e0 00000000 00000000 00000000 00000000 *................*

0000:06f0 00000000 00000000 00000000 00000000 *................*

0000:0700 00000000 00000000 00000000 00000000 *................*

0000:0710 00000000 00000000 00000000 00000000 *................*

0000:0720 00000000 00000000 00000000 00000000 *................*

0000:0730 00000000 00000000 00000000 00000000 *................*

0000:0740 00000000 00000000 00000000 00000000 *................*

0000:0750 00000000 00000000 00000000 00000000 *................*

0000:0760 00000000 00000000 00000000 00000000 *................*

0000:0770 00000000 00000000 00000000 00000000 *................*

0000:0780 00000000 00000000 00000000 00000000 *................*

0000:0790 00000000 00000000 00000000 00000000 *................*

0000:07a0 00000000 00000000 00000000 00000000 *................*

0000:07b0 00000000 00000000 00000000 0000.... *............ *

The partition table starts at 0000:07be. Each partition table entry is 16 bytes. This table defines a single primary partition which is also an active (bootable) partition.

0000:07b0 ........ ........ ........ ....8001 * ....*

0000:07c0 0100060d fef83e00 00000678 0d000000 *...........x....*

0000:07d0 00000000 00000000 00000000 00000000 *................*

0000:07e0 00000000 00000000 00000000 00000000 *................*

0000:07f0 00000000 00000000 00000000 0000.... *............ *

The last two bytes contain a 55AAH signature.

0000:07f0 ........ ........ ........ ....55aa *..............U.*

Master Boot Record (MBR)

When you turn on your PC, the processor has to begin processing. However, your system memory is empty, and the processor

doesn't have anything to execute, or really even know where it is. To ensure that the PC can always boot regardless of which

BIOS is in the machine, chip makers and BIOS manufacturers arrange so that the processor, once turned on, always starts

executing at the same place, FFFF0h. This is discussed in much more detail here.

In a similar manner, every hard disk must have a consistent "starting point" where key information is stored about the disk, such as

how many partitions it has, what sort of partitions they are, etc. There also needs to be somewhere that the BIOS can load the

initial boot program that starts the process of loading the operating system. The place where this information is stored is called the

master boot record (MBR). It is also sometimes called the master boot sector or even just the boot sector. (Though the master

boot sector should not be confused with volume boot sectors, which are different.)

The master boot record is always located at cylinder 0, head 0, and sector 1, the first sector on the disk (see here for more on

these disk geometry terms). This is the consistent "starting point" that the disk always uses. When the BIOS boots the machine, it

will look here for instructions and information on how to boot the disk and load the operating system. The master boot record

contains the following structures:

Master Partition Table: This small table contains the descriptions of the partitions that are contained on the hard disk.

There is only room in the master partition table for the information describing four partitions. Therefore, a hard disk can

have only four true partitions, also called primary partitions. Any additional partitions are logical partitions that are linked

to one of the primary partitions. Partitions are discussed here. One of the partitions is marked as active, indicating that it is

the one that the computer should use for booting up.

Master Boot Code: The master boot record contains the small initial boot program that the BIOS loads and executes to

start the boot process. This program eventually transfers control to the boot program stored on whichever partition is used

for booting the PC.

Due to the great importance of the information stored in the master boot record, if it ever becomes damaged or corrupted in some

way, serious data loss can be--in fact, often will be--the result. Since the master boot code is the first program executed when you

turn on your PC, this is a favorite place for virus writers to target.

System Boot Sequence

The system BIOS is what starts the computer running when you turn it on. The following are

the steps that a typical boot sequence involves. Of course this will vary by the manufacturer of

your hardware, BIOS, etc., and especially by what peripherals you have in the PC. Here is

what generally happens when you turn on your system power:

1.The internal power supply turns on and initializes. The power supply takes some time

until it can generate reliable power for the rest of the computer, and having it turn on

prematurely could potentially lead to damage. Therefore, the chipset will generate a

reset signal to the processor (the same as if you held the reset button down for a while

on your case) until it receives the Power Good signal from the power supply.

2.When the reset button is released, the processor will be ready to start executing. When

the processor first starts up, it is suffering from amnesia; there is nothing at all in the

memory to execute. Of course processor makers know this will happen, so they

pre-program the processor to always look at the same place in the system BIOS ROM

for the start of the BIOS boot program. This is normally location FFFF0h, right at the

end of the system memory. They put it there so that the size of the ROM can be

changed without creating compatibility problems. Since there are only 16 bytes left from

there to the end of conventional memory, this location just contains a "jump" instruction

telling the processor where to go to find the real BIOS startup program.

3.The BIOS performs the power-on self test (POST). If there are any fatal errors, the

boot process stops. POST beep codes can be found in this area of the Troubleshooting

Expert.

4.The BIOS looks for the video card. In particular, it looks for the video card's built in

BIOS program and runs it. This BIOS is normally found at location C000h in memory.

The system BIOS executes the video card BIOS, which initializes the video card. Most

modern cards will display information on the screen about the video card. (This is why

on a modern PC you usually see something on the screen about the video card before

you see the messages from the system BIOS itself).

5.The BIOS then looks for other devices' ROMs to see if any of them have BIOSes.

Normally, the IDE/ATA hard disk BIOS will be found at C8000h and executed. If any

other device BIOSes are found, they are executed as well.

6.The BIOS displays its startup screen.

7.The BIOS does more tests on the system, including the memory count-up test which you

see on the screen. The BIOS will generally display a text error message on the screen if

it encounters an error at this point; these error messages and their explanations can be

found in this part of the Troubleshooting Expert.

8.The BIOS performs a "system inventory" of sorts, doing more tests to determine what

sort of hardware is in the system. Modern BIOSes have many automatic settings and

will determine memory timing (for example) based on what kind of memory it finds.

Many BIOSes can also dynamically set hard drive parameters and access modes, and

will determine these at roughly this time. Some will display a message on the screen for

each drive they detect and configure this way. The BIOS will also now search for and

label logical devices (COM and LPT ports).

9.If the BIOS supports the Plug and Play standard, it will detect and configure Plug and

Play devices at this time and display a message on the screen for each one it finds. See

here for more details on how PnP detects devices and assigns resources.

10.The BIOS will display a summary screen about your system's configuration. Checking

this page of data can be helpful in diagnosing setup problems, although it can be hard to

see because sometimes it flashes on the screen very quickly before scrolling off the top.

11.The BIOS begins the search for a drive to boot from. Most modern BIOSes contain a

setting that controls if the system should first try to boot from the floppy disk (A:) or first

try the hard disk (C:). Some BIOSes will even let you boot from your CD-ROM drive or

other devices, depending on the boot sequence BIOS setting.

12.Having identified its target boot drive, the BIOS looks for boot information to start the

operating system boot process. If it is searching a hard disk, it looks for a master boot

record at cylinder 0, head 0, sector 1 (the first sector on the disk); if it is searching a

floppy disk, it looks at the same address on the floppy disk for a volume boot sector.

13.If it finds what it is looking for, the BIOS starts the process of booting the operating

system, using the information in the boot sector. At this point, the code in the boot sector

takes over from the BIOS. The DOS boot process is described in detail here. If the first

device that the system tries (floppy, hard disk, etc.) is not found, the BIOS will then try

the next device in the boot sequence, and continue until it finds a bootable device.

14.If no boot device at all can be found, the system will normally display an error message

and then freeze up the system. What the error message is depends entirely on the

BIOS, and can be anything from the rather clear "No boot device available" to the very

cryptic "NO ROM BASIC - SYSTEM HALTED". This will also happen if you have a

bootable hard disk partition but forget to set it active.

This process is called a "cold boot" (since the machine was off, or cold, when it started). A

"warm boot" is the same thing except it occurs when the machine is rebooted using

{Ctrl}+{Alt}+{Delete} or similar. In this case the POST is skipped and the boot process

continues roughly at step 8 above.

CMOS

Bios

Teile eines PC

Empfehlenswerte Bücher

Betriebssysteme

Programmiersprachen