Sponsoring website: Emergency Boot CD




An Examination of the MBR
( Master Boot Record ) Code
Embedded in FDISK.COM for
IBM® Personal Computer™ DOS 2.00

Web Presentation and Text are Copyright © 2003, 2013 by Daniel B. Sedory
NOT to be reproduced in any form without Permission of the Author !


This was the first version of what we
are calling the Standard MBR Code

This page examines the MBR code used in IBM's FDISK.COM utility for IBM® Personal Computer™ DOS 2.00 (1983) and all versions after that (including 2.10, 3.00, 3.10, 3.20 and 3.21) until the release of IBM® Personal Computer™ DOS 3.30 in which a few changes were made to the original MBR code that finally became what The Starman's Realm refers to as "The Standard MBR".



 Absolute Sector 0 (Cylinder 0, Head 0, Sector 1)

        0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
 0000  FA 33 C0 8E D0 BC 00 7C 8B F4 50 07 50 1F FB FC  .3.....|..P.P... 
 0010  BF 00 06 B9 00 01 F3 A5 EA 1D 06 00 00 BE BE 07  ................ 
 0020  B3 04 80 3C 80 74 0E 82 3C 00 75 1C 83 C6 10 FE  ...<.t..<.u..... 
 0030  CB 75 EF CD 18 8B 14 8B 4C 02 8B EE 83 C6 10 FE  .u......L.......
 0040  CB 74 1B 82 3C 00 74 F4 BE 8B 06 32 ED AC 8A C8  .t..<.t....2....
 0050  AC 56 BB 07 00 B4 0E CD 10 5E E2 F4 EB FE BF 05  .V......^.......
 0060  00 BB 00 7C B8 01 02 57 CD 13 5F 73 0C 33 C0 CD  ..|...W.._s.3...
 0070  13 4F 75 ED BE A3 06 EB D2 BE C2 06 81 3E FE 7D  .Ou..........>.}
 0080  55 AA 75 C7 8B F5 EA 00 7C 00 00 17 49 6E 76 61  U.u.....|...Inva
 0090  6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61  lid partition ta
 00A0  62 6C 65 1E 45 72 72 6F 72 20 6C 6F 61 64 69 6E  ble.Error loadin
 00B0  67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74  g operating syst
 00C0  65 6D 18 4D 69 73 73 69 6E 67 20 6F 70 65 72 61  em.Missing opera
 00D0  74 69 6E 67 20 73 79 73 74 65 6D 41 75 74 68 6F  ting systemAutho
 00E0  72 20 2D 20 44 61 76 69 64 20 4C 69 74 74 6F 6E  r - David Litton
 00F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 0100  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 0110  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 0120  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 0130  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 0140  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 0150  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 0160  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 0170  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 0180  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 0190  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 01A0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 01B0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 01  ................
 01C0  01 00 0B 7F BF FD 3F 00 00 00 C1 40 5E 00 00 00  ......?....@^...
 01D0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 01E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 01F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  ..............U. 
        0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F


An Examination of the Assembly Code

The code below that's hightlighted with a green background was retained without any changes in DOS versions 3.30 and beyond. The lines with a yellow background contain at least one byte that's different from the Standard MBR code.

7C00 FA            CLI                ; Disable maskable Interrupts
7C01 33C0          XOR    AX,AX       ; Zero out both the Accumulator
7C03 8ED0          MOV    SS,AX       ; and the Stack Segment register.
7C05 BC007C        MOV    SP,7C00     ; Set Stack Pointer to 0000:7C00
7C08 8BF4          MOV    SI,SP       ; Source Index: Copy from here...
7C0A 50            PUSH   AX
7C0B 07            POP    ES          ; Zero-out Extra Segment
7C0C 50            PUSH   AX
7C0D 1F            POP    DS          ; Zero-out  Data Segment
7C0E FB            STI                ; Enable Interrupts again
7C0F FC            CLD                ; Clear Direction Flag (df=0).
7C10 BF0006        MOV    DI,0600     ; Destination Index: New copy of
                                      ;  code will begin at 0000:0600
7C13 B90001        MOV    CX,0100     ; Copy 256 Words (512 bytes)
                                      ;    (100 hex = 256 decimal)
7C16 F3            REP                ; REPeat the following MOVSW
                                      ; instruction for 'CX' times.
7C17 A5            MOVSW              ;  Copy two bytes at a time.

7C18 EA1D060000    JMP    0000:061D   ; Jump to new copy of code...

; Since the preceding routine copies itself and all of the following
; code to 0000:0600 and then jumps to 0000:061D before continuing to
; run, the following addresses have been changed to reflect the
; code's actual location in memory at the time of execution.

When the MBR code for DOS 3.30 was released, the 'F3' byte that you see above (at location 7C16) was changed to an 'F2' for some odd reason; remaining that way until it was finally changed back to an 'F3' for Microsoft's FAT32 MBR. Since use of the 'F2' machine code byte for carrying out this instruction is at best 'undocumented' [see here for all the details], we can't help but wonder if changing this byte was due to an error in whatever Assembler the programmer(s) were using, or in fact something they actually intended to do.

These next two sections of code are almost exactly the same as that used by the Standard MBR:

; This next bit of code tries to find an entry in the partition table
; that indicates at least one of them is ACTIVE (i.e., bootable). The
; first byte of a partition entry is used as the indicator: If it's
; an 80h, yes; if 00 then no it's not bootable. If none of the four
; possible partitions is active, then an error message is displayed.

061D BEBE07       MOV  SI,07BE           ; Location of first entry
                                         ; in the partition table.
0620 B304         MOV  BL,04             ; Maximum of 4 entries
0622 803C80       CMP  BYTE PTR [SI],80  ; Is this one bootable?
0625 740E         JZ   0635              ; Yes, jump to next test!
0627 823C00       CMP  BYTE PTR [SI],00  ;  No; is it a 00?  If not, it's
062A 751C         JNZ  0648              ;    an Invalid partition table.
062C 83C610       ADD  SI,+10            ; Checking the next entry...
                                         ; (10h = 16 bytes per entry)
062F FECB         DEC  BL                ; SUB 1 from Entry counter.
0631 75EF         JNZ  0622              ; Have all entries been tested?
0633 CD18         INT  18                ; Yes, and NONE of them were
                                         ;    bootable, so start...
                                         ; ROM-BASIC (only available on
                                         ; some IBM machines!) Many BIOS
                                         ; simply display "PRESS A
                                         ; KEY TO REBOOT" when an
                                         ; Interrupt 18h is executed.

; We found an Active partition, so all the other entries are checked
; for being non-bootable (first byte = 0x00), or there's an error!
; (Only one entry in the Partition Table can be marked as 'Active.')

The only difference above is in the use of an alternate machine code byte (the 82h at location 0627h changed to an 80h for DOS 3.30+) which was also repeated at 0643h (see below). Yet the first occurance of the "CMP BYTE PTR [SI],xx" instruction at 0622h was already using an 80h byte. The use of different machine code bytes for the same instructions are often the result of an Assembler program rather than a human decision; whereas making them all the same in DOS 3.30 probably was due to a programmer's intervention.

Apart from the alternate x86 machine code byte mentioned above, the only other difference is the jump length at 0641h being 1 byte longer due to an extra instruction further down in the code.

; Before doing so, we load the Head, Drive, Cylinder and Sector data
; into DX and CX for use by the DOS Interrupt 13 commands later.

0635 8B14          MOV   DX,[SI]          ; Drive  -> DL /   Head -> DH
                                          ; For the standard MBR code,
                                          ; DL will always be 80h; which
                                          ; means ONLY the first drive
                                          ; can be bootable! [ This part
                                          ; of the code is often changed 
                                          ; by MBR replacements! ]

0637 8B4C02        MOV   CX,[SI+02]       ; Sector -> CL / Cylinder -> CH

063A 8BEE          MOV   BP,SI            ; Save offset of active entry
063C 83C610        ADD   SI,+10           ; Do next entry
063F FECB          DEC   BL               ; Is this the last entry?
0641 741B          JZ    065E             ; -> Jump to Boot-routine!
0643 823C00        CMP   BYTE PTR [SI],00 ; Non-bootable entry?
0646 74F4          JZ    063C             ; Yes, check the next entry


This next section is used to display messages. This is where most of the differences occur! Looking at the error messages in the disk editor view above, you'll see three bolded hex bytes which tell the code below how many bytes to display on the screen. For the DOS 3.30 MBR, these were all replaced by 00 bytes which were moved to the end of each string. The code in DOS 3.30+ simply looks for the zero bytes to tell it when to stop displaying characters.

; If there's an error, then this next routine displays the message that
; SI points to.  After printing the pre-determined number of bytes, the
; program 'locks up' by going into an infinite loop (at 065B):

0648 BE8B06        MOV   SI,068B    ; -> 17h + "Invalid partition table"
064B 32ED          XOR   CH,CH       ; Zero-out CH register
064D AC            LODSB             ; Load byte at [SI] into AL ...
                                     ;   and increment the SI value.
064E 8AC8          MOV   CL,AL       ; Move "Number of characters to
                                     ; display" into CX register.

0650 AC            LODSB             ; Load character byte at [SI] into
                                     ;   AL.  (inc. SI -> don't care).
0651 56            PUSH  SI          ;  Store string pointer on stack.
0652 BB0700        MOV   BX,0007     ; Use Function 0E (Write Text) of
0655 B40E          MOV   AH,0E       ;  DOS Interrupt 10 to send the
0657 CD10          INT   10          ;  character in AL to the screen.
0659 5E            POP   SI
065A E2F4          LOOP  0650        ; Loop through display routine for
                                     ; for as many times as the number
                                     ; in the CX register (forget SI).
065C EBFE          JMP   065C        ; Infinite Loop.  You must
                                     ;    power-down or Reboot!

Here's another section that's almost identical to that used by the Standard MBR. Only the byte at 0678h had to be changed to correct for a difference in offsets.

; Now we can load the first sector of the Active Partition (on most drives
; this would be Absolute Sector 63 for the first or only partition of your
; Hard Drive. Absolute Sectors 2 thru 62 are normally empty, unless you've
; installed a large MBR replacement, disk translation software for a very
; large HD or some kind of multi-OS or security/encryption boot code).
;
; The first two words of the partition entry are the drive/head
; and the sector/cylinder numbers of the first partition sector.
; This data is in the format required by the INT 13 calls below.

065E BF0500        MOV   DI,0005       ; Retry 5 times (if necessary)...
0661 BB007C        MOV   BX,7C00       ; Load OS Boot Sector to 0000:7C00
0664 B80102        MOV   AX,0201       ; Function 02h; read 1 sector.
0667 57            PUSH  DI
0668 CD13          INT   13
066A 5F            POP   DI
066B 730C          JNB   0679          ; Carry Flag set ?
066D 33C0          XOR   AX,AX         ; Yes, so we had an error! Must
066F CD13          INT   13            ; ...reset drive (Function 00h)
0671 4F            DEC   DI            ; Decrement counter and
0672 75ED          JNZ   0661          ;   try again...

0674 BEA306        MOV   SI,06A3       ; Or, declare: "Error loading
0677 EBD2          JMP   064B          ;            operating system"

; The section of code above is often changed by MBR replacements that
; will tell you if it ever takes more than ONCE to try loading the OS
; Boot code!  Surely you'd want to know this wouldn't you?!
; This old code was obviously made in the days when hard drives, memory
; chips and the boot process itself may have been quite unreliable.

In this last section of code, the longest instruction (at 067Ch) was split into two pieces for DOS 3.30+ by replacing the WORD for the memory location 7DFEh with [DI] to accomplish exactly the same thing (compare Standard MBR code here).

; Once a boot sector for the Active Partition has been loaded into memory,
; it must be checked to see if it is valid. This is accomplished by simply
; checking the last word of the sector; it must be the hex number 0xAA55.

0679 BEC206        MOV   SI,06C2     ; -> 18h + "Missing operating system"

                                        ; Point to last Word in the sector
                                        ; ... it should be: AA55 Hex.
067C 813EFE7D55AA  CMP  WORD PTR [7DFE],AA55
                                        ; Is it? ('Signature' check)

0682 75C7          JNZ   064B           ; If not, display Error Message
                                        ;    and 'lock-up' system.

0684 8BF5          MOV   SI,BP          ;   SI=BP ->  Both are equal to...
                                        ; offset of Active Partition entry
                                        ; which is used by OS Boot code.
0686 EA007C0000    JMP   0000:7C00      ;   Jump to OS Boot Sector code
                                        ;   and continue booting-up!


Location of Error Messages in Memory


068B                                   17 49 6E 76 61              .Inva
0690  6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61   lid partition ta
06A0  62 6C 65 1E 45 72 72 6F 72 20 6C 6F 61 64 69 6E   ble.Error loadin
06B0  67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74   g operating syst
06C0  65 6D 18 4D 69 73 73 69 6E 67 20 6F 70 65 72 61   em.Missing opera
06D0  74 69 6E 67 20 73 79 73 74 65 6D                  ting system 

 


Footnotes

1[Return to Text] The 16 bolded blue bytes in the code section (the first one being F3; in the Disk Editor View above) are the bytes which were changed when this MBR took its final form in the release of DOS 3.30; turning it into what we're calling the Standard MBR.

2[Return to Text] In the Error Messages section, the three bolded red bytes were changed into zero-bytes for DOS 3.30 (actually, the first one was also moved to the end of the whole section and all the other bytes moved back by 1 in offset).

3[Return to Text] References to "David Litton" seem to be non-existent (apart from this web site). We would appreciate any further information about the role he played in creating the MBR code which ended up becoming embedded in so many hard drives across the world. His name also appears as the author of three DOS utilities as noted in our Forensic Examination of the IBM DOS 1.00 Diskette; where we mentioned that he died around 1982/1983.


Created: July 30, 2003 (30.07.2003).
Last Update: March 2, 2013 (02.03.2013).


You can write to me using this: online reply form. (It opens in a new window.)

The Starman's FREE TOOLS Page

MBR and Boot Records Index

The Starman's Realm Index Page