Back to Windows
7 BOOTMGR Loader Code MBR and Boot Records Index The Starman's Realm Index Page
Since Windows 2000, there have always been a total of 16 sectors in every
Windows Volume Boot Record Area; though on average, only about half of that area has actually been used for code and data, the remaining bytes always
being zero-filled.
Here we show every byte of the Windows 7 Volume Boot Record Area. The Boot Sector (or VBR
sector) is always first, followed by the BOOTMGR Loader's ("Bootstrap") sectors. If we include both data and code, the BOOTMGR
Loader is comprised of 3,624 bytes (Seven full 512-byte sectors + 40 bytes of an 8th sector). And if we include all the bytes of the VBR
sector as well, the whole Volume Boot Record Area's data and code are comprised of: 4,136 bytes.
If you open a disk drive that has Windows 7 installed on it, its first partition (and the VBR Area) will highly likely begin at Absolute Sector
2048. For all other partitions, you can use the Relative Sector numbers which are also shown in the table below. The Offset in
Memory column shows where every byte of a PC booting into a Windows 7 OS loads these 16 sectors into Memory (and how its Data Area appears
before execution):
Absolute Sector 2048 (Cylinder 0, Head 32, Sector 33)
Relative Sector 0
Offset NTFS BPB "OEM ID"
in | |
Memory Off. 0 1 2 3 4 5 6 7 8 9 A B C| D E F |
7C00 000 EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00 .R.NTFS .....
7C10 010 00 00 00 00 00 F8 00 00 3F 00 FF 00[00 08 00 00] ........?.......
7C20 020 00 00 00 00 80 00 80 00 FF 1F 03 00 00 00 00 00 ................
7C30 030 55 21 00 00 00 00 00 00 02 00 00 00 00 00 00 00 U!..............
7C40 040 F6 00 00 00 01 00 00 00 45 66 44 08 9D 44 08 2E ........EfD..D..
7C50 050 00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB 68 C0 07 .....3.....|.h..
7C60 060 1F 1E 68 66 00 CB 88 16 0E 00 66 81 3E 03 00 4E ..hf......f.>..N
7C70 070 54 46 53 75 15 B4 41 BB AA 55 CD 13 72 0C 81 FB TFSu..A..U..r...
7C80 080 55 AA 75 06 F7 C1 01 00 75 03 E9 DD 00 1E 83 EC U.u.....u.......
7C90 090 18 68 1A 00 B4 48 8A 16 0E 00 8B F4 16 1F CD 13 .h...H..........
7CA0 0A0 9F 83 C4 18 9E 58 1F 72 E1 3B 06 0B 00 75 DB A3 .....X.r.;...u..
7CB0 0B0 0F 00 C1 2E 0F 00 04 1E 5A 33 DB B9 00 20 2B C8 ........Z3... +.
7CC0 0C0 66 FF 06 11 00 03 16 0F 00 8E C2 FF 06 16 00 E8 f...............
7CD0 0D0 4B 00 2B C8 77 EF B8 00 BB CD 1A 66 23 C0 75 2D K.+.w......f#.u-
7CE0 0E0 66 81 FB 54 43 50 41 75 24 81 F9 02 01 72 1E 16 f..TCPAu$....r..
7CF0 0F0 68 07 BB 16 68 70 0E 16 68 09 00 66 53 66 53 66 h...hp..h..fSfSf
7D00 100 55 16 16 16 68 B8 01 66 61 0E 07 CD 1A 33 C0 BF U...h..fa....3..
7D10 110 28 10 B9 D8 0F FC F3 AA E9 5F 01 90 90 66 60 1E (........_...f`.
7D20 120 06 66 A1 11 00 66 03 06 1C 00 1E 66 68 00 00 00 .f...f.....fh...
7D30 130 00 66 50 06 53 68 01 00 68 10 00 B4 42 8A 16 0E .fP.Sh..h...B...
7D40 140 00 16 1F 8B F4 CD 13 66 59 5B 5A 66 59 66 59 1F .......fY[ZfYfY.
7D50 150 0F 82 16 00 66 FF 06 11 00 03 16 0F 00 8E C2 FF ....f...........
7D60 160 0E 16 00 75 BC 07 1F 66 61 C3 A0 F8 01 E8 09 00 ...u...fa.......
7D70 170 A0 FB 01 E8 03 00 F4 EB FD B4 01 8B F0 AC 3C 00 ..............<.
7D80 180 74 09 B4 0E BB 07 00 CD 10 EB F2 C3 0D 0A 41 20 t.............A
7D90 190 64 69 73 6B 20 72 65 61 64 20 65 72 72 6F 72 20 disk read error
7DA0 1A0 6F 63 63 75 72 72 65 64 00 0D 0A 42 4F 4F 54 4D occurred...BOOTM
7DB0 1B0 47 52 20 69 73 20 6D 69 73 73 69 6E 67 00 0D 0A GR is missing...
7DC0 1C0 42 4F 4F 54 4D 47 52 20 69 73 20 63 6F 6D 70 72 BOOTMGR is compr
7DD0 1D0 65 73 73 65 64 00 0D 0A 50 72 65 73 73 20 43 74 essed...Press Ct
7DE0 1E0 72 6C 2B 41 6C 74 2B 44 65 6C 20 74 6F 20 72 65 rl+Alt+Del to re
7DF0 1F0 73 74 61 72 74 0D 0A 00 8C A9 BE D6 00 00 55 AA start.........U.
0 1 2 3 4 5 6 7 8 9 A B C D E F
Absolute Sector 2049 (Cylinder 0, Head 32, Sector 34)
Relative Sector 1
Off. 0 1 2 3 4 5 6 7 8 9 A B C D E F
7E00 000 07 00 42 00 4F 00 4F 00 54 00 4D 00 47 00 52 00 ..B.O.O.T.M.G.R.
7E10 010 04 00 24 00 49 00 33 00 30 00 00 D4 00 00 00 24 ..$.I.3.0......$
7E20 020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
7E30 030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
7E40 040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
7E50 050 00 00 00 00 00 00 EB 22 90 90 05 00 4E 00 54 00 ......."....N.T.
7E60 060 4C 00 44 00 52 00 00 00 00 00 00 00 00 00 00 00 L.D.R...........
7E70 070 00 00 00 00 00 00 00 00 00 00 66 0F B7 06 0B 00 ..........f.....
7E80 080 66 0F B6 1E 0D 00 66 F7 E3 66 A3 52 02 66 8B 0E f.....f..f.R.f..
7E90 090 40 00 80 F9 00 0F 8F 0E 00 F6 D9 66 B8 01 00 00 @..........f....
7EA0 0A0 00 66 D3 E0 EB 08 90 66 A1 52 02 66 F7 E1 66 A3 .f.....f.R.f..f.
7EB0 0B0 66 02 66 0F B7 1E 0B 00 66 33 D2 66 F7 F3 66 A3 f.f.....f3.f..f.
7EC0 0C0 56 02 E8 95 04 66 8B 0E 4E 02 66 89 0E 26 02 66 V....f..N.f..&.f
7ED0 0D0 03 0E 66 02 66 89 0E 2A 02 66 03 0E 66 02 66 89 ..f.f..*.f..f.f.
7EE0 0E0 0E 2E 02 66 03 0E 66 02 66 89 0E 3E 02 66 03 0E ...f..f.f..>.f..
7EF0 0F0 66 02 66 89 0E 46 02 66 B8 90 00 00 00 66 8B 0E f.f..F.f.....f..
7F00 100 26 02 E8 83 09 66 0B C0 0F 84 5E FE 66 A3 32 02 &....f....^.f.2.
7F10 110 66 B8 A0 00 00 00 66 8B 0E 2A 02 E8 6A 09 66 A3 f.....f..*..j.f.
7F20 120 36 02 66 B8 B0 00 00 00 66 8B 0E 2E 02 E8 58 09 6.f.....f.....X.
7F30 130 66 A3 3A 02 66 A1 32 02 66 0B C0 0F 84 2B FE 67 f.:.f.2.f....+.g
7F40 140 80 78 08 00 0F 85 22 FE 67 66 8D 50 10 67 03 42 .x....".gf.P.g.B
7F50 150 04 67 66 0F B6 48 0C 66 89 0E 72 02 67 66 8B 48 .gf..H.f..r.gf.H
7F60 160 08 66 89 0E 6E 02 66 A1 6E 02 66 0F B7 0E 0B 00 .f..n.f.n.f.....
7F70 170 66 33 D2 66 F7 F1 66 A3 76 02 66 A1 46 02 66 03 f3.f..f.v.f.F.f.
7F80 180 06 6E 02 66 A3 4A 02 66 83 3E 36 02 00 0F 84 1D .n.f.J.f.>6.....
7F90 190 00 66 83 3E 3A 02 00 0F 84 CF FD 66 8B 1E 3A 02 .f.>:......f..:.
7FA0 1A0 1E 07 66 8B 3E 4A 02 66 A1 2E 02 E8 E0 01 66 0F ..f.>J.f......f.
7FB0 1B0 B7 0E 00 02 66 B8 02 02 00 00 E8 22 08 66 0B C0 ....f......".f..
7FC0 1C0 0F 85 16 00 66 0F B7 0E 5A 02 66 B8 5C 02 00 00 ....f...Z.f.\...
7FD0 1D0 E8 0C 08 66 0B C0 0F 84 42 0C 67 66 8B 00 1E 07 ...f....B.gf....
7FE0 1E0 66 8B 3E 3E 02 E8 3F 06 66 A1 3E 02 66 BB 20 00 f.>>..?.f.>.f. .
7FF0 1F0 00 00 66 B9 00 00 00 00 66 BA 00 00 00 00 E8 E4 ..f.....f.......
Absolute Sector 2050 (Cylinder 0, Head 32, Sector 35)
Relative Sector 2
Off. 0 1 2 3 4 5 6 7 8 9 A B C D E F
8000 000 00 66 85 C0 0F 85 23 00 66 A1 3E 02 66 BB 80 00 .f....#.f.>.f...
8010 010 00 00 66 B9 00 00 00 00 66 BA 00 00 00 00 E8 C4 ..f.....f.......
8020 020 00 66 0B C0 0F 85 44 00 E9 F1 0B 66 33 D2 66 B9 .f....D....f3.f.
8030 030 80 00 00 00 66 A1 3E 02 E8 CA 08 66 0B C0 0F 84 ....f.>....f....
8040 040 DA 0B 1E 07 66 8B 3E 3E 02 E8 DB 05 66 A1 3E 02 ....f.>>....f.>.
8050 050 66 BB 80 00 00 00 66 B9 00 00 00 00 66 BA 00 00 f.....f.....f...
8060 060 00 00 E8 80 00 66 0B C0 0F 84 B0 0B 67 66 0F B7 .....f......gf..
8070 070 58 0C 66 81 E3 FF 00 00 00 0F 85 A5 0B 66 8B D8 X.f..........f..
8080 080 68 00 20 07 66 2B FF 66 A1 3E 02 E8 00 01 68 00 h. .f+.f.>....h.
8090 090 20 07 66 2B FF 66 A1 3E 02 E8 AC 0A 8A 16 0E 00 .f+.f.>........
80A0 0A0 B8 E8 03 8E C0 8D 36 0B 00 2B C0 68 00 20 50 CB ......6..+.h. P.
80B0 0B0 06 1E 66 60 66 8B DA 66 0F B6 0E 0D 00 66 F7 E1 ..f`f..f.....f..
80C0 0C0 66 A3 11 00 66 8B C3 66 F7 E1 A3 16 00 8B DF 83 f...f..f........
80D0 0D0 E3 0F 8C C0 66 C1 EF 04 03 C7 50 07 E8 3E FC 66 ....f.....P..>.f
80E0 0E0 61 90 1F 07 C3 67 03 40 14 67 66 83 38 FF 0F 84 a....g.@.gf.8...
80F0 0F0 4C 00 67 66 39 18 0F 85 33 00 66 0B C9 0F 85 0A L.gf9...3.f.....
8100 100 00 67 80 78 09 00 0F 85 23 00 C3 67 3A 48 09 0F .g.x....#..g:H..
8110 110 85 1A 00 66 8B F0 67 03 70 0A E8 97 06 66 51 1E ...f..g.p....fQ.
8120 120 07 66 8B FA F3 A7 66 59 0F 85 01 00 C3 67 66 83 .f....fY.....gf.
8130 130 78 04 00 0F 84 07 00 67 66 03 40 04 EB AB 66 2B x......gf.@...f+
8140 140 C0 C3 66 8B F3 E8 6C 06 67 66 03 00 67 F7 40 0C ..f...l.gf..g.@.
8150 150 02 00 0F 85 34 00 67 66 8D 50 10 67 3A 4A 40 0F ....4.gf.P.g:J@.
8160 160 85 18 00 67 66 8D 72 42 E8 49 06 66 51 1E 07 66 ...gf.rB.I.fQ..f
8170 170 8B FB F3 A7 66 59 0F 85 01 00 C3 67 83 78 08 00 ....fY.....g.x..
8180 180 0F 84 06 00 67 03 40 08 EB C2 66 33 C0 C3 67 80 ....g.@...f3..g.
8190 190 7B 08 00 0F 85 1C 00 06 1E 66 60 67 66 8D 53 10 {........f`gf.S.
81A0 1A0 67 66 8B 0A 66 8B F3 67 03 72 04 F3 A4 66 61 90 gf..f..g.r...fa.
81B0 1B0 1F 07 C3 66 50 67 66 8D 53 10 66 85 C0 0F 85 0A ...fPgf.S.f.....
81C0 1C0 00 67 66 8B 4A 08 66 41 EB 11 90 67 66 8B 42 18 .gf.J.fA...gf.B.
81D0 1D0 66 33 D2 66 F7 36 52 02 66 8B C8 66 2B C0 66 5E f3.f.6R.f..f+.f^
81E0 1E0 E8 01 00 C3 06 1E 66 60 67 80 7B 08 01 0F 84 03 ......f`g.{.....
81F0 1F0 00 E9 76 FB 66 83 F9 00 0F 85 06 00 66 61 90 1F ..v.f.......fa..
Absolute Sector 2051 (Cylinder 0, Head 32, Sector 36)
Relative Sector 3
Off. 0 1 2 3 4 5 6 7 8 9 A B C D E F
8200 000 07 C3 66 53 66 50 66 51 66 56 66 57 06 E8 91 04 ..fSfPfQfVfW....
8210 010 66 8B D1 07 66 5F 66 5E 66 59 66 85 C0 0F 84 34 f...f_f^fYf....4
8220 020 00 66 3B CA 0F 8D 03 00 66 8B D1 E8 82 FE 66 2B .f;.....f.....f+
8230 030 CA 66 8B DA 66 8B C2 66 0F B6 16 0D 00 66 F7 E2 .f..f..f.....f..
8240 040 66 0F B7 16 0B 00 66 F7 E2 66 03 F8 66 58 66 03 f.....f..f..fXf.
8250 050 C3 66 5B EB 9F 66 85 F6 0F 84 0E FB 66 51 66 57 .f[..f......fQfW
8260 060 06 67 66 0F B6 43 09 66 85 C0 0F 84 20 00 66 D1 .gf..C.f.... .f.
8270 070 E0 66 2B E0 66 8B FC 66 54 66 56 67 66 0F B7 73 .f+.f..fTfVgf..s
8280 080 0A 66 03 F3 66 8B C8 F3 A4 66 5E EB 03 90 66 50 .f..f....f^...fP
8290 090 66 50 67 66 8B 03 66 50 67 66 8B 43 18 66 50 67 fPgf..fPgf.C.fPg
82A0 0A0 66 8B 56 20 66 85 D2 0F 84 0B 00 66 8B FE 1E 07 f.V f......f....
82B0 0B0 66 8B C2 E8 71 03 66 8B C6 66 5A 66 59 66 42 66 f...q.f..fZfYfBf
82C0 0C0 51 66 56 E8 3F 06 66 85 C0 0F 84 9D FA 66 5E 66 QfV.?.f......f^f
82D0 0D0 59 66 8B FE 1E 07 E8 4E 03 66 8B C6 66 8B D9 66 Yf.....N.f..f..f
82E0 0E0 59 66 5A 66 51 66 56 66 D1 E9 E8 F8 FD 66 85 C0 YfZfQfVf.....f..
82F0 0F0 0F 84 76 FA 66 5E 66 59 66 03 E1 07 66 5F 66 59 ..v.f^fYf...f_fY
8300 100 66 8B D0 66 58 66 5B 66 8B DA E9 F5 FE 06 1E 66 f..fXf[f.......f
8310 110 60 26 67 66 0F B7 5F 04 26 67 66 0F B7 4F 06 66 `&gf.._.&gf..O.f
8320 120 0B C9 0F 84 44 FA 66 03 DF 66 83 C3 02 66 81 C7 ....D.f..f...f..
8330 130 FE 01 00 00 66 49 66 0B C9 0F 84 17 00 26 67 8B ....fIf......&g.
8340 140 03 26 67 89 07 66 83 C3 02 66 81 C7 00 02 00 00 .&g..f...f......
8350 150 66 49 EB E2 66 61 90 1F 07 C3 06 1E 66 60 66 B8 fI..fa......f`f.
8360 160 01 00 00 00 66 A3 22 02 66 A1 1E 02 66 03 06 66 ....f.".f...f..f
8370 170 02 66 A3 6A 02 66 03 06 66 02 66 A3 4E 02 66 A1 .f.j.f..f.f.N.f.
8380 180 30 00 66 0F B6 1E 0D 00 66 F7 E3 66 8B 1E 4E 02 0.f.....f..f..N.
8390 190 66 89 07 66 A3 11 00 83 C3 04 66 A1 56 02 66 89 f..f......f.V.f.
83A0 1A0 07 A3 16 00 83 C3 04 66 89 1E 4E 02 66 8B 1E 1E .......f..N.f...
83B0 1B0 02 1E 07 E8 67 F9 66 8B FB E8 51 FF 66 A1 1E 02 ....g.f...Q.f...
83C0 1C0 66 BB 20 00 00 00 66 B9 00 00 00 00 66 BA 00 00 f. ...f.....f...
83D0 1D0 00 00 E8 10 FD 66 0B C0 0F 84 19 01 66 8B D8 1E .....f......f...
83E0 1E0 07 66 8B 3E 1A 02 66 33 C0 E8 A2 FD 66 8B 1E 1A .f.>..f3....f...
83F0 1F0 02 66 81 3F 80 00 00 00 0F 84 EB 00 03 5F 04 EB .f.?........._..
Absolute Sector 2052 (Cylinder 0, Head 32, Sector 37)
Relative Sector 4
Off. 0 1 2 3 4 5 6 7 8 9 A B C D E F
8400 000 F0 66 53 66 8B 47 10 66 F7 26 56 02 66 50 66 33 .fSf.G.f.&V.fPf3
8410 010 D2 66 0F B6 1E 0D 00 66 F7 F3 66 52 E8 DC 00 66 .f.....f..fR...f
8420 020 0B C0 0F 84 44 F9 66 8B 0E 56 02 66 0F B6 1E 0D ....D.f..V.f....
8430 030 00 66 F7 E3 66 5A 66 03 C2 66 8B 1E 4E 02 66 89 .f..fZf..f..N.f.
8440 040 07 83 C3 04 66 0F B6 06 0D 00 66 2B C2 66 3B C1 ....f.....f+.f;.
8450 050 0F 86 03 00 66 8B C1 66 89 07 66 2B C8 66 5A 0F ....f..f..f+.fZ.
8460 060 84 75 00 66 03 C2 66 50 66 33 D2 66 0F B6 1E 0D .u.f..fPf3.f....
8470 070 00 66 F7 F3 66 51 E8 82 00 66 59 66 0B C0 0F 84 .f..fQ...fYf....
8480 080 E8 F8 66 0F B6 1E 0D 00 66 F7 E3 66 8B 1E 4E 02 ..f.....f..f..N.
8490 090 66 8B 17 83 C3 04 66 03 17 66 3B D0 0F 85 15 00 f.....f..f;.....
84A0 0A0 66 0F B6 06 0D 00 66 3B C1 0F 86 03 00 66 8B C1 f.....f;.....f..
84B0 0B0 66 01 07 EB A5 83 C3 04 66 89 1E 4E 02 66 89 07 f.......f..N.f..
84C0 0C0 83 C3 04 66 0F B6 06 0D 00 66 3B C1 0F 86 03 00 ...f.....f;.....
84D0 0D0 66 8B C1 66 89 07 EB 82 83 C3 04 66 FF 06 22 02 f..f.......f..".
84E0 0E0 66 89 1E 4E 02 66 5B 03 5F 04 66 81 3F 80 00 00 f..N.f[._.f.?...
84F0 0F0 00 0F 84 0C FF 66 61 90 1F 07 C3 66 8B D0 66 8B .....fa....f..f.
8500 100 0E 22 02 66 8B 36 6A 02 66 03 36 66 02 66 52 66 .".f.6j.f.6f.fRf
8510 110 51 66 52 66 8B 1E 6A 02 66 8B 3E 56 02 66 8B 04 QfRf..j.f.>V.f..
8520 120 66 A3 11 00 83 C6 04 66 8B 04 A3 16 00 83 C6 04 f......f........
8530 130 1E 07 E8 E8 F7 66 2B F8 0F 84 08 00 F7 26 0B 00 .....f+......&..
8540 140 03 D8 EB D9 66 8B 3E 6A 02 1E 07 E8 BF FD 66 A1 ....f.>j......f.
8550 150 6A 02 66 BB 80 00 00 00 66 B9 00 00 00 00 66 8B j.f.....f.....f.
8560 160 D1 E8 81 FB 66 0B C0 0F 84 FF F7 66 8B D8 66 58 ....f......f..fX
8570 170 66 56 E8 2C 01 66 5E 66 0B C0 0F 84 05 00 66 5B fV.,.f^f......f[
8580 180 66 5B C3 66 59 66 5A E2 84 66 33 C0 C3 06 1E 66 f[.fYfZ..f3....f
8590 190 60 66 50 66 51 66 33 D2 66 0F B6 1E 0D 00 66 F7 `fPfQf3.f.....f.
85A0 1A0 F3 66 52 66 57 E8 53 FF 66 5F 66 0B C0 0F 84 B9 .fRfW.S.f_f.....
85B0 1B0 F7 66 0F B6 1E 0D 00 66 F7 E3 66 5A 66 03 C2 66 .f.....f..fZf..f
85C0 1C0 A3 11 00 66 59 66 0F B6 1E 0D 00 66 3B CB 0F 8E ...fYf.....f;...
85D0 1D0 13 00 89 1E 16 00 66 2B CB 66 58 66 03 C3 66 50 ......f+.fXf..fP
85E0 1E0 66 51 EB 14 90 66 58 66 03 C1 66 50 89 0E 16 00 fQ...fXf..fP....
85F0 1F0 66 B9 00 00 00 00 66 51 06 66 57 8B DF 83 E3 0F f.....fQ.fW.....
Absolute Sector 2053 (Cylinder 0, Head 32, Sector 38)
Relative Sector 5
Off. 0 1 2 3 4 5 6 7 8 9 A B C D E F
8600 000 8C C0 66 C1 EF 04 03 C7 50 07 E8 10 F7 66 5F 07 ..f.....P....f_.
8610 010 66 03 3E 52 02 66 59 66 58 66 83 F9 00 0F 8F 70 f.>R.fYfXf.....p
8620 020 FF 66 61 90 1F 07 C3 06 1E 66 60 66 F7 26 56 02 .fa......f`f.&V.
8630 030 66 8B 0E 56 02 E8 55 FF E8 D2 FC 66 61 90 1F 07 f..V..U....fa...
8640 040 C3 06 1E 66 60 66 F7 26 72 02 66 8B 1E 36 02 66 ...f`f.&r.f..6.f
8650 050 8B 0E 72 02 66 8B 36 2A 02 1E 07 66 8B 3E 46 02 ..r.f.6*...f.>F.
8660 060 E8 81 FB E8 A7 FC 66 61 90 1F 07 C3 66 50 66 53 ......fa....fPfS
8670 070 66 51 66 8B 1E 4A 02 66 8B C8 66 C1 E8 03 66 83 fQf..J.f..f...f.
8680 080 E1 07 66 03 D8 66 B8 01 00 00 00 66 D3 E0 67 84 ..f..f.....f..g.
8690 090 03 0F 84 04 00 F8 EB 02 90 F9 66 59 66 5B 66 58 ..........fYf[fX
86A0 0A0 C3 67 80 7B 08 01 0F 84 04 00 66 2B C0 C3 67 66 .g.{......f+..gf
86B0 0B0 8D 73 10 67 66 8B 56 08 66 3B C2 0F 87 0B 00 67 .s.gf.V.f;.....g
86C0 0C0 66 8B 16 66 3B C2 0F 83 04 00 66 2B C0 C3 67 03 f..f;.....f+..g.
86D0 0D0 5E 10 66 2B F6 67 80 3B 00 0F 84 3E 00 E8 81 00 ^.f+.g.;...>....
86E0 0E0 66 03 F1 E8 39 00 66 03 CA 66 3B C1 0F 8C 21 00 f...9.f..f;...!.
86F0 0F0 66 8B D1 66 50 67 66 0F B6 0B 66 8B C1 66 83 E0 f..fPgf...f..f..
8700 100 0F 66 C1 E9 04 66 03 D9 66 03 D8 66 43 66 58 EB .f...f..f..fCfX.
8710 110 C4 66 2B C8 66 2B C2 66 03 C6 C3 66 2B C0 C3 66 .f+.f+.f...f+..f
8720 120 2B C9 67 8A 0B 80 E1 0F 66 83 F9 00 0F 85 04 00 +.g.....f.......
8730 130 66 2B C9 C3 66 53 66 52 66 03 D9 67 66 0F BE 13 f+..fSfRf..gf...
8740 140 66 49 66 4B 66 83 F9 00 0F 84 0D 00 66 C1 E2 08 fIfKf.......f...
8750 150 67 8A 13 66 4B 66 49 EB EB 66 8B CA 66 5A 66 5B g..fKfI..f..fZf[
8760 160 C3 66 53 66 52 66 2B D2 67 8A 13 66 83 E2 0F 66 .fSfRf+.g..f...f
8770 170 2B C9 67 8A 0B C0 E9 04 66 83 F9 00 0F 85 08 00 +.g.....f.......
8780 180 66 2B C9 66 5A 66 5B C3 66 03 DA 66 03 D9 67 66 f+.fZf[.f..f..gf
8790 190 0F BE 13 66 49 66 4B 66 83 F9 00 0F 84 0D 00 66 ...fIfKf.......f
87A0 1A0 C1 E2 08 67 8A 13 66 4B 66 49 EB EB 66 8B CA 66 ...g..fKfI..f..f
87B0 1B0 5A 66 5B C3 66 0B C9 0F 85 01 00 C3 66 51 66 56 Zf[.f.......fQfV
87C0 1C0 67 83 3E 61 0F 8C 0C 00 67 83 3E 7A 0F 8F 04 00 g.>a....g.>z....
87D0 1D0 67 83 2E 20 66 83 C6 02 E2 E6 66 5E 66 59 C3 66 g.. f.....f^fY.f
87E0 1E0 50 66 51 66 8B D0 66 A1 32 02 67 66 8D 58 10 67 PfQf..f.2.gf.X.g
87F0 1F0 03 43 04 67 66 8D 40 10 66 8B DA E8 44 F9 66 0B .C.gf.@.f...D.f.
Absolute Sector 2054 (Cylinder 0, Head 32, Sector 39)
Relative Sector 6
Off. 0 1 2 3 4 5 6 7 8 9 A B C D E F
8800 000 C0 0F 84 05 00 66 59 66 59 C3 66 A1 36 02 66 0B .....fYfY.f.6.f.
8810 010 C0 0F 85 08 00 66 59 66 59 66 33 C0 C3 66 8B 16 .....fYfYf3..f..
8820 020 36 02 67 66 8D 52 10 67 66 8B 42 18 66 33 D2 66 6.gf.R.gf.B.f3.f
8830 030 F7 36 6E 02 66 33 F6 66 50 66 56 66 58 66 5E 66 .6n.f3.fPfVfXf^f
8840 040 3B C6 0F 84 3A 00 66 56 66 40 66 50 66 48 E8 1B ;...:.fVf@fPfH..
8850 050 FE 72 E8 E8 EB FD 66 5A 66 5E 66 59 66 5B 66 53 .r....fZf^fYf[fS
8860 060 66 51 66 56 66 52 66 A1 46 02 67 66 8D 40 18 E8 fQfVfRf.F.gf.@..
8870 070 D0 F8 66 0B C0 74 C4 66 59 66 59 66 59 66 59 C3 ..f..t.fYfYfYfY.
8880 080 66 59 66 59 66 33 C0 C3 66 51 66 50 66 B8 05 00 fYfYf3..fQfPf...
8890 090 00 00 1E 07 66 8B F9 E8 8D FD 66 8B C1 66 BB 20 ....f.....f..f.
88A0 0A0 00 00 00 66 B9 00 00 00 00 66 BA 00 00 00 00 E8 ...f.....f......
88B0 0B0 33 F8 66 5B 66 59 66 85 C0 0F 85 15 00 66 8B C1 3.f[fYf......f..
88C0 0C0 66 0F B7 0E 10 02 66 BA 12 02 00 00 E8 16 F8 EB f.....f.........
88D0 0D0 33 90 66 33 D2 66 8B C1 66 8B CB 66 50 66 53 E8 3.f3.f..f..fPfS.
88E0 0E0 23 00 66 5B 66 5F 66 0B C0 0F 84 17 00 1E 07 E8 #.f[f_f.........
88F0 0F0 35 FD 66 8B C7 66 0F B7 0E 10 02 66 BA 12 02 00 5.f..f.....f....
8900 100 00 E8 E1 F7 C3 66 52 66 51 66 BB 20 00 00 00 66 .....fRfQf. ...f
8910 110 B9 00 00 00 00 66 BA 00 00 00 00 E8 C7 F7 66 0B .....f........f.
8920 120 C0 0F 84 63 00 66 8B D8 1E 07 66 8B 3E 1A 02 66 ...c.f....f.>..f
8930 130 33 C0 E8 59 F8 1E 07 66 8B 1E 1A 02 66 59 66 5A 3..Y...f....fYfZ
8940 140 26 66 39 0F 0F 85 0C 00 26 66 39 57 08 0F 84 31 &f9.....&f9W...1
8950 150 00 EB 13 90 26 66 83 3F FF 0F 84 2F 00 26 83 7F ....&f.?.../.&..
8960 160 04 00 0F 84 26 00 26 66 0F B7 47 04 03 D8 8B C3 ....&.&f..G.....
8970 170 25 00 80 74 CB 8C C0 05 00 08 8E C0 81 E3 FF 7F %..t............
8980 180 EB BE 26 66 8B 47 10 C3 66 59 66 5A 66 33 C0 C3 ..&f.G..fYfZf3..
8990 190 66 50 66 51 66 8B C7 66 C1 E8 04 06 59 03 C8 51 fPfQf..f....Y..Q
89A0 1A0 07 66 83 E7 0F 66 59 66 58 C3 60 06 BE BD 0D BF .f...fYfX.`.....
89B0 1B0 00 20 1E 07 B9 0D 00 90 F3 A5 07 61 C3 01 23 45 . .........a..#E
89C0 1C0 67 89 AB CD EF FE DC BA 98 76 54 32 10 F0 E1 D2 g........vT2....
89D0 1D0 C3 00 00 00 00 20 20 60 8B 36 18 20 26 8A 05 88 ..... `.6. &...
89E0 1E0 04 47 46 66 FF 06 14 20 81 FE 60 20 75 06 E8 5B .GFf... ..` u..[
89F0 1F0 00 BE 20 20 E2 E6 89 36 18 20 61 C3 66 60 8B 36 .. ...6. a.f`.6
Absolute Sector 2055 (Cylinder 0, Head 32, Sector 40)
Relative Sector 7
Off. 0 1 2 3 4 5 6 7 8 9 A B C D E F
8A00 000 18 20 B0 80 88 04 46 32 C0 81 FE 60 20 75 06 E8 . ....F2...` u..
8A10 010 3A 00 BE 20 20 81 FE 58 20 75 E9 66 33 C0 66 A3 :.. ..X u.f3.f.
8A20 020 58 20 66 A1 14 20 66 C1 E0 03 66 0F C8 66 A3 5C X f.. f...f..f.\
8A30 030 20 E8 18 00 BB 00 20 66 8B 07 66 0F C8 66 89 07 ..... f..f..f..
8A40 040 83 C3 04 81 FB 34 20 75 EE 66 61 C3 66 60 BB 20 .....4 u.fa.f`.
8A50 050 20 66 8B 07 66 0F C8 66 89 07 83 C3 04 81 FB 60 f..f..f.......`
8A60 060 20 75 EE BB 00 20 66 8B 0F 66 8B 57 04 66 8B 77 u... f..f.W.f.w
8A70 070 08 66 8B 7F 0C 66 8B 6F 10 BB 20 20 C7 06 1A 20 .f...f.o.. ...
8A80 080 30 0F C6 06 1C 20 14 90 53 8B 1E 1A 20 FF 17 66 0.... ..S... ..f
8A90 090 03 47 02 5B 66 03 E8 66 03 2F 66 8B C1 66 C1 C0 .G.[f..f./f..f..
8AA0 0A0 05 66 03 C5 66 8B EF 66 8B FE 66 8B F2 66 C1 C6 .f..f..f..f..f..
8AB0 0B0 1E 66 8B D1 66 8B C8 66 8B 07 66 33 47 08 66 33 .f..f..f..f3G.f3
8AC0 0C0 47 20 66 33 47 34 66 D1 C0 66 89 47 40 83 C3 04 G f3G4f..f.G@...
8AD0 0D0 FE 0E 1C 20 75 B2 83 06 1A 20 06 81 3E 1A 20 48 ... u.... ..>. H
8AE0 0E0 0F 75 9F BB 00 20 66 01 0F 66 01 57 04 66 01 77 .u... f..f.W.f.w
8AF0 0F0 08 66 01 7F 0C 66 01 6F 10 66 61 C3 66 8B C6 66 .f...f.o.fa.f..f
8B00 100 33 C7 66 23 C2 66 33 C7 C3 66 8B C2 66 33 C6 66 3.f#.f3..f..f3.f
8B10 110 33 C7 C3 66 53 66 8B C2 66 23 C6 66 8B DA 66 23 3..fSf..f#.f..f#
8B20 120 DF 66 0B C3 66 8B DE 66 23 DF 66 0B C3 66 5B C3 .f..f..f#.f..f[.
8B30 130 FC 0E 99 79 82 5A 09 0F A1 EB D9 6E 13 0F DC BC ...y.Z.....n....
8B40 140 1B 8F 09 0F D6 C1 62 CA 06 1E 66 60 66 33 DB B8 ......b...f`f3..
8B50 150 00 BB CD 1A 66 23 C0 0F 85 BB 00 66 81 FB 54 43 ....f#.....f..TC
8B60 160 50 41 0F 85 B0 00 81 F9 02 01 0F 82 A8 00 66 61 PA............fa
8B70 170 90 1F 07 06 1E 66 60 67 80 7B 08 00 0F 85 0C 00 .....f`g.{......
8B80 180 67 66 8D 53 10 67 66 8B 0A EB 25 90 67 66 8D 53 gf.S.gf...%.gf.S
8B90 190 10 67 66 8B 4A 28 66 81 F9 00 00 08 00 0F 83 0C .gf.J(f.........
8BA0 1A0 00 67 66 8B 42 2C 66 23 C0 0F 84 03 00 66 33 C9 .gf.B,f#.....f3.
8BB0 1B0 0E 1F E8 F5 FD 66 23 C9 0F 84 32 00 66 BA 00 80 .....f#...2.f...
8BC0 1C0 00 00 66 3B CA 0F 86 1F 00 66 2B CA 06 66 51 66 ..f;.....f+..fQf
8BD0 1D0 57 66 52 66 8B CA E8 B7 FD E8 FB FD 66 5A 66 5F WfRf........fZf_
8BE0 1E0 66 59 07 66 03 FA EB DA E8 A5 FD E8 E9 FD E8 0B fY.f............
8BF0 1F0 FE 0E 07 66 BB 54 43 50 41 66 BF 00 20 00 00 66 ...f.TCPAf.. ..f
Absolute Sector 2056 (Cylinder 0, Head 32, Sector 41)
Relative Sector 8
Off. 0 1 2 3 4 5 6 7 8 9 A B C D E F
8C00 000 B9 14 00 00 00 66 B8 07 BB 00 00 66 BA 0A 00 00 .....f.....f....
8C10 010 00 66 33 F6 CD 1A 66 61 90 1F 07 C3 A0 F9 01 E9 .f3...fa........
8C20 020 4B F1 A0 FA 01 E9 45 F1 00 00 00 00 00 00 00 00 K.....E.........
8C30 030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8C40 040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8C50 050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8C60 060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8C70 070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8C80 080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8C90 090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8CA0 0A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8CB0 0B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8CC0 0C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8CD0 0D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8CE0 0E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8CF0 0F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8D00 100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8D10 110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8D20 120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8D30 130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8D40 140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8D50 150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8D60 160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8D70 170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8D80 180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8D90 190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8DA0 1A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8DB0 1B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8DC0 1C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8DD0 1D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8DE0 1E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
8DF0 1F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0 1 2 3 4 5 6 7 8 9 A B C D E F |
All of the remaining 7 sectors (for a total of 16) are zero-filled (contain only
zero bytes). For the first partition of a Windows 7 OS disk drive, these would normally be Absolute Sectors 2057 through 2063, or
Relative Sectors 9 through 15 for any other partitions. So there are 4,056 zero bytes at the end of these 16 sectors [(7 x 512) +
(512 - 40) = 3584 + 472], or about half the total number of bytes in the Boot Record Area: 4,136 bytes of data and code plus 4,056 zero bytes =
8,192 bytes total.
Once again, the zero-padded bytes fill Linear Memory locations 0x8C28 through 0x9BFF during initial
boot-up.
It is not at all uncommon under a Windows 7 OS install, to find the following bytes at the beginning of the last sector of the C: Volume's Boot Record Area: "6B 87 08 38 76 C1 48 4E B7 AE 04 04 6E 6C C7 52" (with the ASCII characters: "nonic" also occurring twice at the offsets shown below). [Note: It would, however, be very unusual for any of this to occur in the VBR Area of a System Reserved partition.] The bytes "80 6E 6F 6E 69 63" (.nonic) also appear in ntoskrnl.exe (an NT Kernel & System file) and ntkrnlpa.exe (another NT Kernel & System file) and all their stored copies, the many other hidden files having the extension: "regtrans-ms" (Registry Transaction Log Files) in their file names and others.
Relative Sector 15
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
1E00 6B 87 08 38 76 C1 48 4E B7 AE 04 04 6E 6C C7 52 k‡.8vÁHN·®..nlÇR
1E10 01 00 00 00 01 00 00 00 00 1E 00 00 00 00 00 00 ................
1E20 00 1E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
1E30 00 40 32 00 00 00 00 00 D7 1B 48 1B 00 00 00 00 .@2.....×.H.....
1E40 37 EF 07 1B 2A 3D E5 11 A9 58 80 6E 6F 6E 69 63 7ï..*=å.©X€nonic
1E50 37 EF 07 1B 2A 3D E5 11 A9 58 80 6E 6F 6E 69 63 7ï..*=å.©X€nonic
0 1 2 3 4 5 6 7 8 9 A B C D E F |
The bytes at the beginning of this file correspond to the GUID label of:
{3808876b-c176-4e48-b7ae-04046e6cc752} in the machine's Windows Registry; where all the bytes within each dash-separated section,
except for the last one ("04046e6cc752"), are stored in little-endian format (reverse order) on the drive.
The Windows OS files associated with VSS can be found here on a Windows 7 machine (but earlier versions of these files may also exist under Windows XP, and
elsewhere):
Directory of C:\Windows\system32 07/13/2009 06:39 PM 167,424 vssadmin.exe 11/20/2010 06:27 AM 1,753,088 vssapi.dll 07/13/2009 06:41 PM 76,800 vsstrace.dll 11/20/2010 06:25 AM 1,600,512 VSSVC.exe 11/20/2010 06:27 AM 61,952 vss_ps.dll
First Published: 14 July 2015. (14.07.2015).
Updated: 30 JUL 2015 (30.07.2015); 20 AUG 2015 (20.08.2015); 30 AUG 2015 (30.08.2015).
Last Update: 03 SEP 2015 (03.09.2015)
You can write to me using this: online reply form.
(It opens in a new window.) Back to Windows
7 BOOTMGR Loader Code MBR and Boot Records Index The Starman's Realm Index Page