How does software boot from hard drive ?
What are the requirements to boot any operating system from a hard drive ?
What means MBR, FAT, cluster, sector ... ?
MBR, the cornerstone
The Master Boot Record is a memory zone located at:- Logical address 0 (if the hard drive uses LBA)
- Cylinder 0, Head 0, Sector 1 (if the hard drive uses CHS addressing. Used by old hard drives)
This memory area has a size of 512 bytes.
mbr.gif
Basically, if anything happens to this memory zone, the hard drive is brain dead.
Usually, the machine will execute the bootstrap which is the 1st level bootloader that scans the partition table, finds the active partition and jumps to it where the 2nd level bootloader shall be located at address 0. Others, like embedded systems where the CPU has its own 1st level bootloader, will read directly the partition table and achieve the same task.
partitionentry.jpg
All partition have a beginning address, ending address, a size given in sectors.
By reading this table, a machine locates the active partition, and jumps to its starting address where another boot record is located. Basically, a boot record is present at the first sector of each partition.
Wait, a sector ? What is this ?
When speaking about hard drives, the same vocabulary is always used:- sector: amount of bytes (almost always 512 byte for compatibily purpose)
- cluster: amount of sectors. This number depends on the disk format settings and can be read from boot record.
The cluster is the unit used by file systems.
FAT
File Allocation table is one of the disk formats used by computers (old Windows mashines, boot disks for some linux machines, ...).There are 3 types of FAT that are commonly used : FAT12, FAT16 and FAT32.
Here is an overview of the layout of a FAT disk:
fatlayout.jpg
One of the biggest difference between FAT32 and older FAT layouts is that the root directory section is now part of the data area.
OK about FAT layout, but where is the MBR ?
In the reserved area, the first sector of a FAT disk is ... the MBR !Here are the settings that are registered in the boot code for a FAT12 disk:
Bytes | Description |
---|---|
0-2 | Jump to bootstrap Legacy bytes almost always equals to 0xeb 0x3C 0x90 where 0xEB is the jump instruction for x86 machine (sometimes 0xEA is used instead) |
3-10 | OEM Name / Version (string) |
11-12 | Number of bytes per sector (512,1024,2048,4096) |
13 | Number of sectors per cluster (1,2,4,8,16,32,64,128) |
14-15 | Number of reserved sectors (FAT32 -> 32, others -> 1) |
16 | Number of FAT copies |
17-18 | Number of root directory entries (0 for FAT32, 512 recommended for FAT16) |
19-20 | Total number of sectors in the filesystem (N/A for FAT32) |
21 | Media descriptor type (0xF0: Floppy disk, 0xF8: Hard disk) |
22-23 | Number of sectors per FAT (0 for FAT32) |
24-25 | Number of sectors per track |
26-27 | Number of heads (2 for a double sided floppy disk) |
28-29 | Number of hidden sectors |
30-509 | Bootstrap |
510-511 | Signature, always equal to 55h AAh (signature of the MBR) |
Bytes | Description |
---|---|
11-27 | Identical |
28-31 | Number of hidden sectors |
32-35 | Total number of sectors in the filesystem (replaces byte 19-20 of FAT12) |
36 | Logical drive number |
37 | Reserved |
38 | Extended signature |
39-42 | Serial Number of partition |
43-53 | Volume label or no name (string) |
54-61 | File system type ("FAT32 ", "FAT16 ", "FAT ") |
62-509 | Bootstrap |
510-511 | Signature 55h AAh |
Bytes | Description |
---|---|
11-35 | Identical |
36-39 | Sectors per FAT |
40-41 | Mirror flags (Bits 0-3: number of active FAT, Bits 4-6: reserved, Bit7; 1=single active FAT, 0=all FATs are updated at runtime) |
42-43 | Filesystem version |
44-47 | First cluster of root directory (usually 2). This is the important improvement of FAT32. Now the root directory area is not at a fixed place with a fixed size and grow. |
48-49 | Filesystem information sector (FSINFO) in reserved area (usually 1) |
50-51 | Backup boot sector location (can be 0) |
52-63 | Reserved |
64 | Logical drive number |
65 | Reserved |
66 | Extended signature |
67-70 | Serial number of partition |
71-81 | Volume label |
82-89 | Filesystem type ("FAT32 ") |
The FAT area
A FAT is table with one entry per cluster. Each entry has a size of:- 12 bits for FAT12
- 16 bits for FAT16
- 32 bits for FAT32
The first 2 entries of a FAT table are unused. The first one contains 0xFFFFFFF8 with 0xF8 the media descriptor while the other one contains the end of file marker (0xFFFFFFFF).
The FAT area is split in two :
FAT #1 | FAT #2 |
---|
FSINFO
File system information sector is located at logical sector 1 (in reserved area).The purpose of this sector is not clear.
Offset | Description | Size |
---|---|---|
00h | First Signature (52h 52h 61h41h) | 1 Double Word |
04h | Unknown, Currently (Mightjust be Null) | 480 Bytes |
1E4h | Signature of FSInfo Sector(72h 72h 41h 61h) | 1 Double Word |
1E8h | Number of Free Clusters (Setto -1 if Unknown) | 1 Double Word |
1ECh | Cluster Number of Clusterthat was Most Recently Allocated. | 1 Double Word |
1F0h | Reserved | 12 Bytes |
1FCh | Unknown or Null | 2 Bytes |
1FEh | Boot Record Signature (55hAAh) | 2 Bytes |
Root directory
This area contains an entry for each file located at the root of the filesystem. Every entry has the following properties:Offset | Description | Size |
---|---|---|
00h | Filename | 8 bytes |
08h | Filename extension | 3 bytes |
0Bh | File attributes | 1 byte |
0Ch | Reserved | 10 bytes |
16h | Time created or last updated | 2 bytes |
18h | Date created or last updated | 2 bytes |
1Ah | Starting cluster for this file | 2 bytes |
1Ch | File size in bytes | 4 bytes |
0 comments:
Post a Comment
Note: Only a member of this blog may post a comment.