Sponsoring website: Emergency Boot CD



The  MS-DOS  5.0
Floppy Disk Boot Record
 (on a 1200 KiB floppy diskette)

Web Presentation and Text are Copyright©2003-2011 by Daniel B. Sedory
NOT to be reproduced in any form without Permission of the Author !



Introduction

Since floppy disks never have an MBR, the first sector of any diskette (that's Absolute Sector 0 or CHS 0,0,1) normally contains the Boot Record for some OS. And since they are floppy disks, you'll most likely read about Tracks ( instead of Cylinders) and Sides ( instead of Heads) when dealing with them. These terms seem to make more sense to people, since you actually hold the removable media in your hands and can observe that the jacket (or hard plastic shell) contains a circular disc having two sides without ever having to think about the heads and mechanical parts inside a floppy drive.

Disk Editor View

This section is a disk editor view of how the Boot Record is stored on a 1200 KiB Floppy Diskette (often incorrectly called a 1.2mb floppy).

The bytes between the    two dark blue bands    (from offsets 00Bh through 03Dh) in this disk editor view of the sector are called the BPB (or BIOS Parameter Block); a detailed explanation of the BPB is found below. Most of the Boot Record is executable code; from offsets 03Eh through 19Dh. The code is followed by one long error message and the two system filenames: IO.SYS and MSDOS.SYS. Finally, the sector ends with the Word-sized signature ID (or Magic number) of AA55 hex (remember hex Words for Intel x86 CPUs are stored in memory with the Lowest-byte first and the Highest-byte last to make processing quicker).

                                               BPB  
Absolute Sector 0 (Track 0, Side 0, Sector 1)   |       OEM System Name
       0  1  2  3  4  5  6  7  8  9  A  B  C  D |E  F         |
0000  EB 3C 90 4D 53 44 4F 53 35 2E 30 00 02 01 01 00  .<.MSDOS5.0.....
0010  02 E0 00 60 09 F9 07 00 0F 00 02 00 00 00 00 00  ...`............
0020  00 00 00 00 00 00 29 FC 18 52 21 4E 4F 20 4E 41  ......)..R!NO NA
0030  4D 45 20 20 20 20 46 41 54 31 32 20 20 20 FA 33  ME    FAT12   .3
0040  C0 8E D0 BC 00 7C 16 07 BB 78 00 36 C5 37 1E 56  .....|...x.6.7.V
0050  16 53 BF 3E 7C B9 0B 00 FC F3 A4 06 1F C6 45 FE  .S.>|.........E.
0060  0F 8B 0E 18 7C 88 4D F9 89 47 02 C7 07 3E 7C FB  ....|.M..G...>|.
0070  CD 13 72 79 33 C0 39 06 13 7C 74 08 8B 0E 13 7C  ..ry3.9..|t....|
0080  89 0E 20 7C A0 10 7C F7 26 16 7C 03 06 1C 7C 13  .. |..|.&.|...|.
0090  16 1E 7C 03 06 0E 7C 83 D2 00 A3 50 7C 89 16 52  ..|...|....P|..R
00A0  7C A3 49 7C 89 16 4B 7C B8 20 00 F7 26 11 7C 8B  |.I|..K|. ..&.|.
00B0  1E 0B 7C 03 C3 48 F7 F3 01 06 49 7C 83 16 4B 7C  ..|..H....I|..K|
00C0  00 BB 00 05 8B 16 52 7C A1 50 7C E8 92 00 72 1D  ......R|.P|...r.
00D0  B0 01 E8 AC 00 72 16 8B FB B9 0B 00 BE E6 7D F3  .....r........}.
00E0  A6 75 0A 8D 7F 20 B9 0B 00 F3 A6 74 18 BE 9E 7D  .u... .....t...}
00F0  E8 5F 00 33 C0 CD 16 5E 1F 8F 04 8F 44 02 CD 19  ._.3...^....D...
0100  58 58 58 EB E8 8B 47 1A 48 48 8A 1E 0D 7C 32 FF  XXX...G.HH...|2.
0110  F7 E3 03 06 49 7C 13 16 4B 7C BB 00 07 B9 03 00  ....I|..K|......
0120  50 52 51 E8 3A 00 72 D8 B0 01 E8 54 00 59 5A 58  PRQ.:.r....T.YZX
0130  72 BB 05 01 00 83 D2 00 03 1E 0B 7C E2 E2 8A 2E  r..........|....
0140  15 7C 8A 16 24 7C 8B 1E 49 7C A1 4B 7C EA 00 00  .|..$|..I|.K|...
0150  70 00 AC 0A C0 74 29 B4 0E BB 07 00 CD 10 EB F2  p....t).........
0160  3B 16 18 7C 73 19 F7 36 18 7C FE C2 88 16 4F 7C  ;..|s..6.|....O|
0170  33 D2 F7 36 1A 7C 88 16 25 7C A3 4D 7C F8 C3 F9  3..6.|..%|.M|...
0180  C3 B4 02 8B 16 4D 7C B1 06 D2 E6 0A 36 4F 7C 8B  .....M|.....6O|.
0190  CA 86 E9 8A 16 24 7C 8A 36 25 7C CD 13 C3 0D 0A  .....$|.6%|.....
01A0  4E 6F 6E 2D 53 79 73 74 65 6D 20 64 69 73 6B 20  Non-System disk 
01B0  6F 72 20 64 69 73 6B 20 65 72 72 6F 72 0D 0A 52  or disk error..R
01C0  65 70 6C 61 63 65 20 61 6E 64 20 70 72 65 73 73  eplace and press
01D0  20 61 6E 79 20 6B 65 79 20 77 68 65 6E 20 72 65   any key when re
01E0  61 64 79 0D 0A 00 49 4F 20 20 20 20 20 20 53 59  ady...IO      SY
01F0  53 4D 53 44 4F 53 20 20 20 53 59 53 00 00 55 AA  SMSDOS   SYS..U.
        0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F

The BIOS Parameter Block

Next we have the _ BIOS Parameter Block _ (or BPB); some of which dates back to the release of version 2.0 of (IBM/MS) DOS. Beginning at offset 0Bh, the BPB data on this diskette is interpreted as follows:

        0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
  00:                                   00 02 01 01 00
  10:  02 E0 00 60 09 F9 07 00 0F 00 02 00 00 00 00 00
  20:  00 00 00 00 00 00 29 FC 18 52 21 4E 4F 20 4E 41   ......)..R!NO NA
  30:  4D 45 20 20 20 20 46 41 54 31 32 20 20 20         ME    FAT12   

 Hex   As seen
OFFSET on Disk HEX value       Meaning / Description
------ ------- ---------  -----------------------------------------------
 0B-0C  00 02     0200h =  512 Bytes per Sector,
   0D      01       01h =    1 Sector(s) per Cluster,
 0E-0F  01 00     0001h =    1 Reserved sector (starting at Sector 0),
   10      02       02h =    2 FATs on the diskette,
 11-12  E0 00     00E0h =  224 possible Root Directory entries,
 13-14  60 09     0960h = 2400 Total Sectors on the diskette,
                              ( 2400 x 512 = 1,228,800 bytes total ),

   15      F9        =>   Media Descriptor Byte:  F9  means that this is
                          either a Double-Sided diskette with 15 Sectors
                          per Track, or a Double-Sided (720KB) diskette
                          with only 9 Sectors per Track! ( Obviously you
                          need more info than just this one byte to know
                          for sure what type and capacity it is.  Mabye
                          this fact signaled the end of its usefulness.*)

 16-17  07 00     0007h =    7 Sectors per FAT,
 18-19  0F 00     000Fh =   15 Sectors per Track,
 1A-1B  02 00     0002h =    2 Sides (or Heads).
 1C-25               =>   See the text below (should be all zeros).

   26      29        =>   Extended BPB Signature Byte (if present, then
                          the following strings will also have meaning):  
 27-2A    xx xx xx xx   = Volume Serial Number.
 2B-35    (11 bytes)    = Volume Label.
 36-3B                  = File System ID (see discussion below).
 ______________
 * FF=DS,8 SPT; FE=SS,8 SPT; FD=DS, 9 SPT (the 360kb diskette);
   FC=SS,9 SPT; F9 = DS,9 SPT (a 720kb) or DS,15 SPT. As noted above,
   since F9 could mean either of these, it wasn't very useful.

Checking the data, we see that our diskette has a capacity of 1200 Kbytes with two sides and 15 Sectors per Track; that should mean you're looking at a standard 5.25 inch 'DSHD' Double-Sided High Density diskette. (For a 3.5 inch 1440 kb diskette, you'll find the Word 0B40h at offsets 13-14h for a total of 2,880 sectors, and offsets 16-17h and 18-19h would contain the Words 0009h and 0012h for 9 Sectors per FAT and 18 Sectors per Track, respectively.)

The bytes from offsets 1Ch through 1Fh are a Double-Word containing the Number of Hidden Sectors. Floppy disks should have only zeros here, since there are no sectors before the Boot Sector on a normal floppy diskette. The next four bytes (offsets 20h through 23h), another Double-Word, are used in DOS versions 3 and above for disk partitions having more than 65,535 sectors! That's far beyond the size of any diskette, so this field should be all zeros as well. (The bytes at offsets 13-14 hex are where you'll find the Total Number of Sectors for a floppy diskette.) The byte at offset 25h is “Reserved” and always set to zero. [Some documents state that offset 24h is for a drive number under DOS 4.0 or above, so a zero-byte would mean the first floppy drive. The only way it can be used for floppy diskettes in a 2nd drive is if the whole BPB is first copied into memory and altered there, since you can't change the byte on a write-protected floppy disk!]

Beginning with DOS version 4.0, if the byte at offset 26h is a 29, then the next four bytes (offsets 27h through 2Ah) will contain a Serial Number based on the date and time that the diskette was formatted; these bytes (along with the OEM ID and the Volume Label) can, of course, be changed by a disk editor. If the 29 Extended BPB Signature Byte is present, then the bytes at offsets 2Bh through 35h may contain an 11-byte Volume Label and the bytes at offsets 36h through 3Dh should contain the File System ID of: "FAT12   "; with three trailing space bytes (20h).

If you require more information on the BPB, then see the TABLE on this page: The MSWIN4.1 Hard Disk Boot Record.

 


Examination of the Code

This Listing is still missing
many necessary comments!

The first sector of the floppy disk is copied into Memory at location 0000:7C00 by a 'bootstrap' routine in the computer's BIOS chip.



7C00 EB3C          JMP     7C3E          ; Jump over the BPB.
7C02 90            NOP                   ; Do nothing. Address not used.

=========================================================================
               OEM string and BIOS Parameter Block Data
       0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
7C00           4D 53 44 4F 53 35 2E 30 00 02 01 01 00     MSDOS5.0.....
7C10  02 E0 00 60 09 F9 07 00 0F 00 02 00 00 00 00 00  ...`............
7C20  00 00 00 00 00 00 29 FC 18 52 21 4E 4F 20 4E 41  ......)..R!NO NA
7C30  4D 45 20 20 20 20 46 41 54 31 32 20 20 20        ME    FAT12   
       0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
=========================================================================

;      After setting up various registers, this code copies data from the
; Diskette Drive Parameters table which a far pointer (Segment:Offset) in
; the Interrupt Vector Table (IVT) at 0:0078 and following points to; for
; later use.  This data overwrites the first 11 bytes (7C3E thru 7C48) of
; its own code following the BPB area:

7C3E FA            CLI               ; Disable maskable Interrupts
7C3F 33C0          XOR	AX,AX        ; Zero-out the Accumulator and set
7C41 8ED0          MOV	SS,AX        ;  Stack Segment register to ZERO.
7C43 BC007C        MOV	SP,7C00	     ; Stack Pointer top now 0000:7C00
7C46 16            PUSH	SS           ;|
7C47 07            POP	ES           ;|Makes sure Extra Segment = ZERO.
7C48 BB7800        MOV	BX,0078      ; 0078h ---> BX
7C4B 36C537        LDS	SI,SS:[BX]   ; SS is still zero...
                                     ; Load Far Pointer from [SS:0078]
                                     ; into DS:SI  (usually 0000:0522).
7C4E 1E            PUSH	DS
7C4F 56            PUSH	SI
7C50 16            PUSH	SS
7C51 53            PUSH	BX

; The following four instructions will overwrite 11 code bytes starting at 7C3Eh:
7C52 BF3E7C        MOV	DI,7C3E      ; Will overwrite some code bytes!
7C55 B90B00        MOV	CX,000B      ; Copy CX (0Bh = 11) bytes from ...
7C58 FC            CLD               ; Clear Direction Flag (df=0).
7C59 F3A4          REP	MOVSB        ; ... DS:SI to ES:DI (0000:7C3E) and
                                     ; following; DI increases to 7C49.
7C5B 06            PUSH    ES
7C5C 1F            POP     DS        ; Data Segment set to ZERO.
7C5D C645FE0F      MOV     BYTE PTR [DI-02],0F  ; 0Fh ---> [7C47].
7C61 8B0E187C      MOV     CX,[7C18]            ; Copy SPT ([7C18]) into CX
7C65 884DF9        MOV     [DI-07],CL           ; Sectors/Track --> [7C42].

; The next two instructions set the Diskette Parameters Table SEG:OFF vector
; at [0:0078] from the original vector of 0000:0522 to our 0000:7C3E address,
; so any DPT look-ups will access the data created here instead:

7C68 894702        MOV     [BX+02],AX           ; 0000 --> [0:007A]
7C6B C7073E7C      MOV     WORD PTR [BX],7C3E   ; 7C3E --> [0:0078]

7C6F FB            STI               ; Enable maskable Interrupts
                                     ; after the next instruction.
;---------------------------------------------------------------------------
; INT 13 - DISK - RESET DISK SYSTEM
;	AH = 00h
;	DL = drive (if bit 7 is set both hard disks and floppy disks reset)
; Return: AH = status (see #00234)
;	CF clear if successful (returned AH=00h)
;	CF set on error
;---------------------------------------------------------------------------
7C70 CD13          INT     13
7C72 7279          JC	   7CED          ; If CF set, there's a disk error,
                                         ; so jump to Error Msg. routine!

7C74 33C0          XOR     AX,AX
7C76 3906137C      CMP     [7C13],AX
7C7A 7408          JZ      7C84
7C7C 8B0E137C      MOV     CX,[7C13]        ; [7C13] = Total Sectors 
                                            ; 960h = 2400 sectors.
7C80 890E207C      MOV     [7C20],CX
7C84 A0107C        MOV     AL,[7C10]        ; FAT12 F.S. has two FATs
7C87 F726167C      MUL     WORD PTR [7C16]  ; of 7 sectors each, plus...
7C8B 03061C7C      ADD     AX,[7C1C]
7C8F 13161E7C      ADC     DX,[7C1E]
7C93 03060E7C      ADD     AX,[7C0E]        ; 1 Rsrvd sector (VBR itself)
7C97 83D200        ADC     DX,+00
7C9A A3507C        MOV     [7C50],AX
7C9D 8916527C      MOV     [7C52],DX
7CA1 A3497C        MOV     [7C49],AX
7CA4 89164B7C      MOV     [7C4B],DX

7CA8 B82000        MOV     AX,0020          ; 20h = 32 bytes per Dir entry
7CAB F726117C      MUL     WORD PTR [7C11]  ; [7C11] is number of possible
                                            ; Root Directory entries (224).
;    So, AX now contains (32 x 224 = 7,168) more used system area in bytes.

7CAF 8B1E0B7C      MOV     BX,[7C0B]        ; [7C0B] is 512 bytes per sector.
7CB3 03C3          ADD     AX,BX            ; Add 1 more sector in bytes.
7CB5 48            DEC     AX               ; Subtract 1 byte.
7CB6 F7F3          DIV     BX               ; Divide by 512 to get sectors.
7CB8 0106497C      ADD     [7C49],AX
7CBC 83164B7C00    ADC     WORD PTR [7C4B],+00
7CC1 BB0005        MOV     BX,0500          ; 500h = 1,280
7CC4 8B16527C      MOV     DX,[7C52]
7CC8 A1507C        MOV     AX,[7C50]
7CCB E89200        CALL    7D60

7CCE 721D          JB      7CED
7CD0 B001          MOV     AL,01
7CD2 E8AC00        CALL    7D81             ; -> Read Sectors

7CD5 7216          JB      7CED
7CD7 8BFB          MOV     DI,BX
7CD9 B90B00        MOV     CX,000B          ; 11 characters per file name.
7CDC BEE67D        MOV     SI,7DE6          ; Points to IO.SYS 
7CDF F3            REPZ
7CE0 A6            CMPSB                    ; Compare  "IO.SYS"  name  to
                          ; first file name in Root Directory of diskette.
7CE1 750A          JNZ     7CED             ; If not identical, there's a
                                   ; disk error or it's not a System disk!

; Now we check if "MSDOS.SYS" is the second file in the Root Directory:
7CE3 8D7F20        LEA     DI,[BX+20]       ; Points to MSDOS.SYS 
7CE6 B90B00        MOV     CX,000B
7CE9 F3            REPZ
7CEA A6            CMPSB
7CEB 7418          JZ      7D05

7CED BE9E7D        MOV     SI,7D9E          ; Points to Error Message 
7CF0 E85F00        CALL    7D52             ; Display Character String
7CF3 33C0          XOR     AX,AX
7CF5 CD16          INT     16               ; Get Keystroke from Keyboard

7CF7 5E            POP     SI
7CF8 1F            POP     DS
7CF9 8F04          POP     [SI]
7CFB 8F4402        POP     [SI+02]
7CFE CD19          INT     19               ; If a key was pressed, then
                                            ;   Start over again with
                                            ;   System BOOTSTRAP LOADER.

7D00 58            POP     AX
7D01 58            POP     AX
7D02 58            POP     AX
7D03 EBE8          JMP     7CED


7D05 8B471A        MOV     AX,[BX+1A]
7D08 48            DEC     AX
7D09 48            DEC     AX
7D0A 8A1E0D7C      MOV     BL,[7C0D]
7D0E 32FF          XOR     BH,BH
7D10 F7E3          MUL     BX
7D12 0306497C      ADD     AX,[7C49]
7D16 13164B7C      ADC     DX,[7C4B]
7D1A BB0007        MOV     BX,0700
7D1D B90300        MOV     CX,0003
7D20 50            PUSH    AX
7D21 52            PUSH    DX
7D22 51            PUSH    CX
7D23 E83A00        CALL    7D60
7D26 72D8          JB      7D00
7D28 B001          MOV     AL,01
7D2A E85400        CALL    7D81                ; -> Read Sectors
7D2D 59            POP     CX
7D2E 5A            POP     DX
7D2F 58            POP     AX
7D30 72BB          JB      7CED
7D32 050100        ADD     AX,0001
7D35 83D200        ADC     DX,+00
7D38 031E0B7C      ADD     BX,[7C0B]
7D3C E2E2          LOOP    7D20

7D3E 8A2E157C      MOV     CH,[7C15]
7D42 8A16247C      MOV     DL,[7C24]
7D46 8B1E497C      MOV     BX,[7C49]
7D4A A14B7C        MOV     AX,[7C4B]
7D4D EA00007000    JMP     FAR PTR 0070:0000   ; Same as jumping to
                                               ;  0000:0700 (start DOS).


SUBROUTINES

; Display Zero-terminated Character String
7D52 AC            LODSB
7D53 0AC0          OR      AL,AL
7D55 7429          JZ      7D80           ; -> RETurn from Subroutine.
7D57 B40E          MOV     AH,0E          ; Video Function 0Eh
7D59 BB0700        MOV     BX,0007        ;  Page 0, Mode 7...
7D5C CD10          INT     10             ;  of INT 10. 'Tele-
                                          ;  type Output' AL =
                                          ; character to write.

7D5E EBF2          JMP     7D52           ; Loop until done.

;====================================================================

7D60 3B16187C      CMP     DX,[7C18]
7D64 7319          JNB     7D7F
7D66 F736187C      DIV     WORD PTR [7C18]
7D6A FEC2          INC     DL
7D6C 88164F7C      MOV     [7C4F],DL
7D70 33D2          XOR     DX,DX
7D72 F7361A7C      DIV     WORD PTR [7C1A]
7D76 8816257C      MOV     [7C25],DL
7D7A A34D7C        MOV     [7C4D],AX
7D7D F8            CLC                      ; Clear Carry Flag (CF=0)
7D7E C3            RET
7D7F F9            STC                      ;   Set Carry Flag (CF=1)
7D80 C3            RET

; READ SECTORS INTO MEMORY
7D81 B402          MOV     AH,02            ; Function 02 of INT 13
7D83 8B164D7C      MOV     DX,[7C4D]
7D87 B106          MOV     CL,06
7D89 D2E6          SHL     DH,CL
7D8B 0A364F7C      OR      DH,[7C4F]
7D8F 8BCA          MOV     CX,DX
7D91 86E9          XCHG    CH,CL
7D93 8A16247C      MOV     DL,[7C24]
7D97 8A36257C      MOV     DH,[7C25]
7D9B CD13          INT     13

7D9D C3            RET

Location of Error Messages and File Names in Memory

7D9E                                            0D 0A                ..
7DA0  4E 6F 6E 2D 53 79 73 74 65 6D 20 64 69 73 6B 20  Non-System disk 
7DB0  6F 72 20 64 69 73 6B 20 65 72 72 6F 72 0D 0A 52  or disk error..R
7DC0  65 70 6C 61 63 65 20 61 6E 64 20 70 72 65 73 73  eplace and press
7DD0  20 61 6E 79 20 6B 65 79 20 77 68 65 6E 20 72 65   any key when re
7DE0  61 64 79 0D 0A 00 49 4F 20 20 20 20 20 20 53 59  ady...IO      SY
7DF0  53 4D 53 44 4F 53 20 20 20 53 59 53 00 00 55 AA  SMSDOS   SYS..U.

       0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F

 

Updates: 18 December 2007 (18/12/2007).
Last Update: 24 September 2011 (24/09/2011).

You can write to me using this: online reply form. (It opens in a new window.)

MBR and Boot Records Index

The Starman's Realm Index Page