The
MSWIN 4.1 Boot Record Revealed MBR
and Boot Records Index Page The Starman's Realm Index Page
This
page is still under construction!
At first glance, the Boot Record for a FAT32 partition under Windows™ 2000, XP or 7 doesn't appear to be any different than it was for the previous FAT32 Boot Record (see MSWIN4.1 Boot Record); much of its structure is in fact, exactly the same as it was under Windows™ 98 or ME. For example, the FSINFO sector still remains as before, and the code in its third sector will remain byte for byte, exactly as before, when installing a Windows XP or 7 OS to another partition. [But note: For any FAT32 partitions created under an existing Windows XP or 7 boot OS, the third sector of the new FAT32 Boot Record will not have any code in it; as a matter of fact, it will be nothing but zero bytes, except for 55h and AAh in its last two bytes.]
However, upon examining its sectors more closely, we find some major differences: For example, during the installation of a Windows™ 2000 or XP OS, an existing FAT32 Boot Record will have all references to the MS-DOS related system file names replaced by NTLDR (the same file found in NTFS partitions), and copies of both ntldr and NTDETECT.COM will be installed in the partition, along with two new files: bootsect.dos (a binary copy of the first sector of the FAT32 partition's original Boot Record) and boot.ini (see our page, The Boot INI File, for all details concerning this file). Furthermore, there's a whole new sector of code that will be appended to the FAT32 Boot Record a few sectors after the old 'backup' copy! (See our quick side-by-side comparison of the FAT32 Boot Records, then examine all the details (in color) on our Disk Editor View of the NT FAT32 Boot Record page.)
Reminder: Don't forget that each bootable FAT32
Boot Record, after conversion by a Windows™ 2000 or XP install, has a Backup Copy of its original sectors stored
just a few sectors beyond the new Boot sectors. These correspond to Relative (or Logical) Sectors 6 through 8
of any FAT32 OS partition.
Note: FAT32 partitions which are not bootable, for example, a FAT32 data partition created
under Windows™ XP, or any that have been purposely altered, may not have the same structure presented here. It all depends upon
what utilities created, or were allowed to modify, them.
For more information on FAT32 Boot Records in general or details concerning some of its code, please read our page on the MSWIN4.1 Boot Record here.
See this page for: A side-by-side comparison of the Boot Records of a FAT32 data partition created by the Windows XP and 7 Operating Systems!
Here's the disassembled code (; with comments)
after the whole sector has been loaded into memory at 0000:7C00 (by the Master
Boot code). We'll comment on a few of the differences between this sector
and the MSWIN4.1 Boot Record under Windows™ 98/ME.
(An asterisk '*' in front of any Assembly Instruction listed below
means that the instruction cannot be disassembled correctly by MS-DEBUG):
; The following code begins exactly as it did under Windows 98/ME:
7C00 EB58 JMP 7C5A ; Jump over BPB (BIOS Parameter
; Block) to beginning of code.
7C02 90 NOP ; Used later as a FLAG byte for
; Extended INT 13 Disk Func.'s
; (See instructions at: 7C68h,
; 7CF7h and 7D1Ch).
; 7C03 thru 7C0A 'MSWIN4.1' System Name or OEM ID. (Some think
; this is part of the BPB; it's not!)
;
; 7C0B thru 7C59 BIOS Parameter Block (BPB) See text and tables here
; for more details on the BPB.
; The CLI instruction (under Win98/ME) is absent from this new VBR.
7C5A 33C9 XOR CX,CX ; Zero out both the Counter and
7C5C 8ED1 MOV SS,CX ; Stack Segment Registers.
7C5E BCF47B MOV SP,7BF4 ; Set Stack Pointer to 0000:7BF4
; because 7BF4-7BFF are used for
; data locations found below.
7C61 8EC1 MOV ES,CX ; Zero out the Extra and
7C63 8ED9 MOV DS,CX ; Data Segments.
7C65 BD007C MOV BP,7C00 ; Base Pointer set to 7C00, where
; our BPB data is now located.
7C68 884E02 MOV [BP+02],CL ; Zero-out byte at [7C02].
7C6B 8A5640 MOV DL,[BP+40] ; (DiskDriveID; 80h?) -> DL.
7C6E B408 MOV AH,08 ; Function: Get Drive Parameters
7C70 CD13 INT 13
7C72 7305 JNB 7C79
7C74 B9FFFF MOV CX,FFFF
7C77 8AF1 MOV DH,CL
7C79 660FB6C6 * MOVZX EAX,DH
7C7D 40 INC AX
7C7E 660FB6D1 * MOVZX EDX,CL
7C82 80E23F AND DL,3F
7C85 F7E2 MUL DX
7C87 86CD XCHG CL,CH
7C89 C0ED06 * SHR CH,06
7C8C 41 INC CX
7C8D 660FB7C9 * MOVZX ECX,CX
7C91 66F7E1 * MUL ECX
7C94 668946F8 * MOV [BP-08],EAX
7C98 837E1600 CMP WORD PTR [BP+16],0000
7C9C 7538 JNZ 7CD6
7C9E 837E2A00 CMP WORD PTR [BP+2A],0000
7CA2 7732 JA 7CD6
7CA4 668B461C * MOV EAX,[BP+1C]
7CA8 6683C00C * ADD EAX,0000000C
7CAC BB0080 MOV BX,8000
7CAF B90100 MOV CX,0001
7CB2 E82B00 CALL 7CE0
7CB5 E94803 JMP 8000 ; Jump to new code loaded from
; 13th sector of Boot Record.
; ====================================================================
; Display Error Message S U B R O U T I N E :
; ====================================================================
7CB8 A0FA7D MOV AL,[7DFA] ; [7DFA]->AL, so AX=7DBF
; Causes SI -> 0D,0A,
; "NTLDR is missing"
7CBB B47D MOV AH,7D ; Always AH = 7D here.
7CBD 8BF0 MOV SI,AX ; SI -> Error Message.
7CBF AC LODSB ; Each byte -> AL, one at
; a time.
7CC0 84C0 TEST AL,AL ; Test for 00h byte.
7CC2 7417 JZ 7CDB ; If zero, we're done.
7CC4 3CFF CMP AL,FF ; Check for FFh bytes.
7CC6 7409 JZ 7CD1 ; Yes, so do last line.
7CC8 B40E MOV AH,0E ; Output One Character.
7CCA BB0700 MOV BX,0007
7CCD CD10 INT 10 ; Video Display Interrupt
7CCF EBEE JMP 7CBF ; Repeat until all of the
; string is displayed.
7CD1 A0FB7D MOV AL,[7DFB] ; [7DFB]->AL, so AX=7DCC
; Causes SI -> 0D,0A,
; "Press any key to restart"
7CD4 EBE5 JMP 7CBB ; Strt displaying last line.
7CD6 A0F97D MOV AL,[7DF9] ; [7DF9]->AL, so AX=7DAC
; Causes SI -> 0D,0A,
; "NTLDR is missing"
7CD9 EBE0 JMP 7CBB ; Begin displaying message.
7CDB 98 CBW ; Convert Byte to Word
7CDC CD16 INT 16 ; Wait until getting a key-
; stroke from Keyboard.
7CDE CD19 INT 19 ; If a key was pressed, then
; Start over again with
; System BOOTSTRAP LOADER.
;==================================================================
; S U B R O U T I N E
;==================================================================
7CE0 6660 * PUSHAD
7CE2 663B46F8 * CMP EAX,[BP-08]
7CE6 0F824A00 * JB 7D34
7CEA 666A00 * PUSH 00000000
7CED 6650 * PUSH EAX
7CEF 06 PUSH ES
7CF0 53 PUSH BX
7CF1 666810000100 * PUSH 00010010
7CF7 807E0200 CMP BYTE PTR [BP+02],00
7CFB 0F852000 * JNZ 7D1F
7CFF B441 MOV AH,41 ; INT 13, Func. 41h
7D01 BBAA55 MOV BX,55AA ;
7D04 8A5640 MOV DL,[BP+40]
7D07 CD13 INT 13
7D09 0F821C00 * JB 7D29
7D0D 81FB55AA CMP BX,AA55 ;
7D11 0F851400 * JNZ 7D29
7D15 F6C101 TEST CL,01
7D18 0F840D00 * JZ 7D29
7D1C FE4602 INC BYTE PTR [BP+02]
7D1F B442 MOV AH,42 ; INT 13, Func. 42h
7D21 8A5640 MOV DL,[BP+40]
7D24 8BF4 MOV SI,SP
7D26 CD13 INT 13
7D28 B0F9 MOV AL,F9
7D2A 6658 * POP EAX
7D2C 6658 * POP EAX
7D2E 6658 * POP EAX
7D30 6658 * POP EAX
7D32 EB2A JMP 7D5E
7D34 6633D2 * XOR EDX,EDX
7D37 660FB74E18 * MOVZX ECX,WORD PTR [BP+18]
7D3C 66F7F1 * DIV ECX
7D3F FEC2 INC DL
7D41 8ACA MOV CL,DL
7D43 668BD0 * MOV EDX,EAX
7D46 66C1EA10 * SHR EDX,10
7D4A F7761A DIV WORD PTR [BP+1A]
7D4D 86D6 XCHG DL,DH
7D4F 8A5640 MOV DL,[BP+40]
7D52 8AE8 MOV CH,AL
7D54 C0E406 * SHL AH,06
7D57 0ACC OR CL,AH
7D59 B80102 MOV AX,0201
7D5C CD13 INT 13
7D5E 6661 * POPAD
7D60 0F8254FF * JB 7CB8 ; If <, then NTLDR not found.
7D64 81C30002 ADD BX,0200
7D68 6640 * INC EAX
7D6A 49 DEC CX
7D6B 0F8571FF * JNZ 7CE0
7D6F C3 RET
Location
of Data and
Error Messages in Memory
|
From Logical Sector 0: 0 1 2 3 4 5 6 7 8 9 A B C D E F |
First Created: June 8, 2007. [2007.06.08]
Updated: September 15, 2010. [2010.09.15]
Last Update: July 19, 2012. [2012.07.19]
You can write to us using this:
contact form (opens in
a new window).
The
MSWIN 4.1 Boot Record Revealed
MBR
and Boot Records Index Page The Starman's Realm Index Page