An Examination of the
Windows™ 7
VBR ( Volume Boot Record )
[ Embedded in untfs.dll,
winsetup.dll and
various other
System files; see Introduction ]
Web Presentation and Text are Copyright©2012 by Daniel B. Sedory
NOT to be reproduced in any form without Permission of the Author !
Caution: This is a NEW page; it may contain errors.
|
This page examines the Windows™ 7 OS's Volume Boot Record
(VBR); which we consider to be only the first sector of the system area at the beginning of a Win 7 OS volume. The BOOTMGR
Loader code immediately following the VBR, spans across the boundaries of eight more: Seven full 512-byte sectors, plus 40 bytes
at the beginning of the eighth sector. This structure is similar to the layout of the Windows XP VBR and its NTLDR Loader code. (Note: Every
byte of the BOOTMGR Loader code is the same as that found after a Windows Vista VBR.)
|
Other Microsoft OS Volume Boot Records:
An Examination of the Windows 95B/98/98SE/Me OS Boot Record (MSWIN4.1)
An Examination of the Windows 2000/XP OS Boot Record (NTFS)
An Examination of the Windows Vista OS Volume Boot Record (NTFS)
And Microsoft MBR pages:
An Examination of the Standard MBR created by MS-DOS FDISK
The MBR created by Windows 95B/98/98SE and ME's FDISK
The MBR created by Windows 2000/XP/2003 Installs or Disk Management Utility
The MBR created by Windows Vista OS Installs or Disk Management Utility
Confused? Send
me an email if you have a specific question about the MBR or any Boot Records...
Just as we urged readers of our Win 7 MBR page to make a copy of their MBR sector, you may wish to create copies of your Win 7
VBR. Though more difficult to work with; considering all the details stored in this sector, there may come a time when you
need/want to edit or replace this and other system sectors manually.
Some advice: Save all the data from the BIOS Parameter Block (BPB) area of the sector somewhere
apart from your main hard disk or write it down on paper(!); it does no good to have data you might need to access your OS
on the un-accessible HD itself! There are many ways you can do this... See our MBR Tools Page. Any good Disk Editor will allow you to manually enter data you've written down, or you can
use a number of utility programs to save the binary data to a file on say a thumb drive, and later on restore the VBR and other
sectors from the saved file(s). |
Introduction
This page examines the Windows™ 7 OS Volume Boot Record
code; the code which actually tests and begins to load a Windows™ 7 operating system from within the OS volume.
For our Windows™ 7 install, all the code bytes of
Win7's Volume Boot Record sector were also found inside the following files (listed by location, alphabetically; with offset
to first byte of the code). In each case, there will be a full 512 bytes that comprise the VBR sector, but locations for the
Volume Serial Number and other vital data in the BPB area are all zero-filled in these 'template' files; the correct
data being entered when the file is copied to disk by the installation program or operating system. The last two bytes will always
be a 55h followed by an AAh:
Note: The code for the whole Win7 Boot Record actually spans
across 9 sectors; including the one we're examining here, plus 40 bytes in the ninth one, for a total of 4,136 bytes.
Technically, the Boot Record area is a full 16 contiguous sectors; the remaining bytes being zero-filled. The VBR code loads all
of the first 16 sectors of the Volume into Memory; see the code lines below at 07C0:00BB and following.
1. C:\Windows\System32\autochk.exe [Offset: 80530h]; immediately followed by all 3,624 bytes of the BOOTMGR Loader code beginning at offset 80730h.
("Auto Check Utility"; File version: "6.1.7601.17514 (win7sp1_rtm.101119-1850)"; 777,728 bytes; Modification Date: "11/20/2010 8:24 PM").
There's a copy of it here: C:\Windows\winsxs\amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7601.17514_none_4019f2b8d860ad30\autochk.exe
2. C:\Windows\SysWOW64\autochk.exe [Offset: 66D58h]; immediately followed by all 3,624 bytes of the BOOTMGR Loader code beginning at offset 66F58h.
("Auto Check Utility"; File version: "6.1.7601.17514 (win7sp1_rtm.101119-1850)"; 668,160 bytes; Modification Date: "11/20/2010 8:23 PM").
There's a copy of it here: C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.1.7601.17514_none_e3fb573520033bfa\autochk.exe
3. C:\Windows\System32\autoconv.exe [Offset: 83F30h]; immediately followed by the BOOTMGR Loader code beginning at offset 84130h.
("Auto File System Conversion Utility"; File version: "6.1.7601.17514 (win7sp1_rtm.101119-1850)"; 793,088 bytes; Modification Date: "11/20/2012 8:24 PM").
There's a copy here: C:\Windows\winsxs\amd64_microsoft-windows-convert_31bf3856ad364e35_6.1.7601.17514_none_fafb502abef1be40\autoconv.exe
4. C:\Windows\SysWOW64\autoconv.exe [Offset: 69970h]; immediately followed by the BOOTMGR Loader code beginning at offset 69B70h.
("Auto File System Conversion Utility"; File version: "6.1.7601.17514 (win7sp1_rtm.101119-1850)"; 679,424 bytes; Modification Date: "11/20/2012 8:23 PM").
There's a copy here: C:\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.1.7601.17514_none_9edcb4a706944d0a\autoconv.exe
Missing details on the files listed below will appear in a future update; please contact us if you need this data.
5. C:\Windows\System32\autofmt.exe
6. C:\Windows\SysWOW64\autofmt.exe
7. C:\Windows\System32\RelPost.exe
8. C:\Windows\System32\untfs.dll
9. C:\Windows\SysWOW64\untfs.dll
10. C:\Windows\System32\oobe\winsetup.dll
Like all previous MS Boot Records, the first three bytes are often called the Jump
Instruction. But only the first two bytes (EB 52 in this case) are actually used to form the actual JMP
(Jump) code to the rest of the executable x86 (PC) Assembly code; the third byte (90h)
is just a NOP ('No Op' or do nothing) instruction. The next 8 bytes are the "OEM ID"
or System Name ("NTFS" and four blank spaces) for an NTFS volume; followed
by the BPB (BIOS Parameter Block).
Just like the _ BPB _ area for the Windows™ XP Volume Boot Record sector, this one also has all the fields
that an NTFS volume has in common with FAT16 and FAT32 Boot Records; such as Bytes per Sector, Sectors
per Cluster, etc. and even the old Media Descriptor byte (F8), but again, this one does not contain
"System ID" or "Volume Label" fields, nor any system file names. However, if you can locate
"bootmgr" on your system and dig into its code, you will find a number
of system file names, such as winload.exe and BCD in there.
All the elements of a Win7 VBR's _
BPB _ area are the same as those for earlier NTFS boot records (for details on
the NTFS BPB, see our NTFS Boot Record page). Just like Vista, a new Microsoft retail DVD
Windows 7 OS install will have 2,048 reserved sectors at the beginning of an MBR partitioned disk, so its 100 MiB
"System Reserved" partition VBR will have "00 08 00 00" (0x800 = 2048) at offsets 1Ch
through 1Fh in its BPB area. In the VBR below, copied from a Windows 7 OS's C: drive, we see the bytes "00 28 03
00" shown between the brackets at those offsets (which represent 206,848 sectors; 0x32800 = 206848). This is the total
of the 2048 sector offset at the beginning of the disk plus the 100 MiB size (104,857,600 bytes/512-byte sectors = 204800
sectors) of that first partition (2048 + 204800 = 206848).
The following is a disk editor view
of how the bytes of this VBR are stored on a hard disk in the first sector of a Windows 7 OS install's C: drive volume:
Relative Sector 0 (within the Volume)
NTFS BPB "OEM ID"
| |
0 1 2 3 4 5 6 7 8 9 A B C| D E F |
0000: EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00 .R.NTFS .....
0010: 00 00 00 00 00 F8 00 00 3F 00 FF 00[00 28 03 00] ........?.......
0020: 00 00 00 00 80 00 80 00 FF CF FC 02 00 00 00 00 ..........?.....
0030: 00 00 0C 00 00 00 00 00 02 00 00 00 00 00 00 00 ................
0040: F6 00 00 00 01 00 00 00 6B E5 F9 78 1A FA 78 EA ........k..x..x.
0050: 00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB 68 C0 07 .....3.....|.h..
0060: 1F 1E 68 66 00 CB 88 16 0E 00 66 81 3E 03 00[4E ..hf......f.>..N
0070: 54 46 53]75 15 B4 41 BB AA 55 CD 13 72 0C 81 FB TFSu..A..U..r...
0080: 55 AA 75 06 F7 C1 01 00 75 03 E9 DD 00 1E 83 EC U.u.....u.......
0090: 18 68 1A 00 B4 48 8A 16 0E 00 8B F4 16 1F CD 13 .h...H..........
00A0: 9F 83 C4 18 9E 58 1F 72 E1 3B 06 0B 00 75 DB A3 .....X.r.;...u..
00B0: 0F 00 C1 2E 0F 00 04 1E 5A 33 DB B9 00 20 2B C8 ........Z3... +.
00C0: 66 FF 06 11 00 03 16 0F 00 8E C2 FF 06 16 00 E8 f...............
00D0: 4B 00 2B C8 77 EF B8 00 BB CD 1A 66 23 C0 75 2D K.+.w......f#.u-
00E0: 66 81 FB 54 43 50 41 75 24 81 F9 02 01 72 1E 16 f..TCPAu$....r..
00F0: 68 07 BB 16 68 70 0E 16 68 09 00 66 53 66 53 66 h...hp..h..fSfSf
0100: 55 16 16 16 68 B8 01 66 61 0E 07 CD 1A 33 C0 BF U...h..fa....3..
0110: 28 10 B9 D8 0F FC F3 AA E9 5F 01 90 90 66 60 1E (........_...f`.
0120: 06 66 A1 11 00 66 03 06 1C 00 1E 66 68 00 00 00 .f...f.....fh...
0130: 00 66 50 06 53 68 01 00 68 10 00 B4 42 8A 16 0E .fP.Sh..h...B...
0140: 00 16 1F 8B F4 CD 13 66 59 5B 5A 66 59 66 59 1F .......fY[ZfYfY.
0150: 0F 82 16 00 66 FF 06 11 00 03 16 0F 00 8E C2 FF ....f...........
0160: 0E 16 00 75 BC 07 1F 66 61 C3 A0 F8 01 E8 09 00 ...u...fa.......
0170: A0 FB 01 E8 03 00 F4 EB FD B4 01 8B F0 AC 3C 00 ..............<.
0180: 74 09 B4 0E BB 07 00 CD 10 EB F2 C3 0D 0A 41 20 t.............A
0190: 64 69 73 6B 20 72 65 61 64 20 65 72 72 6F 72 20 disk read error
01A0: 6F 63 63 75 72 72 65 64 00 0D 0A 42 4F 4F 54 4D occurred...BOOTM
01B0: 47 52 20 69 73 20 6D 69 73 73 69 6E 67 00 0D 0A GR is missing...
01C0: 42 4F 4F 54 4D 47 52 20 69 73 20 63 6F 6D 70 72 BOOTMGR is compr
01D0: 65 73 73 65 64 00 0D 0A 50 72 65 73 73 20 43 74 essed...Press Ct
01E0: 72 6C 2B 41 6C 74 2B 44 65 6C 20 74 6F 20 72 65 rl+Alt+Del to re
01F0: 73 74 61 72 74 0D 0A 00 8C A9 BE D6 00 00 55 AA start.........U.
0 1 2 3 4 5 6 7 8 9 A B C D E F
|
Figure 1.
The last 116 bytes of this Boot Record contain Error Messages, Message Offset bytes and the Word-sized signature ID (or Magic number)
of AA55h. Remember that hex Words (numerical data requiring more than a single byte) for Intel
x86 CPUs are always stored in memory with the Lowest-byte first and the Highest-byte last to make CPU processing quicker.
Each Error Message begins with the Hex bytes 0Dh and 0Ah; a Carriage Return and Line Feed, and ends with a 00h byte which makes these what's commonly known in various programming languages as
zero-terminated or 'sz' strings (a character string followed by a single zero byte). The error messages are exactly the same
as those under Windows XP, except 'NTLDR' has been replaced by "BOOTMGR".
Note that the string of letters ("TCPA")
at offsets E3h through E6h are not coincidental; they stand for "Trusted Computing Platform Alliance"
and are actually part of the code which tests for the existence of a TPM chip. If the hardware supports TPM (Trusted
Platform Module) version 1.2, then it can be used to provide extra functionality for Win7's BitLocker™ Drive Encryption.
Neither are the bytes at offsets 6Fh through 72h a coincidence. The characters ("NTFS")
are used in the code to check for an "OEM ID" of that name, and display "A disk read error occurred" if that
string is not found (at offset 0003).
The eight physical sectors directly following a Windows™ 7 NTFS Boot
Sector, contain code which can interface with the older NTLDR file (in order to boot up Windows™ NT,
2000, XP, 2003 OS partitions) plus code to interact with the new BOOTMGR (boot manager)
program introduced with the Vista OS. This code is still necessary when booting up a Windows™ OS (even though the
bootmgr or NTLDR files may have been copied to the OS partition you start booting up from; as would be the
case if, for example, you installed Windows™ 7 on a disk already containing a bootable Win 98 OS in the
first partition followed by a Win7 install partition). When the code in such an altered volume boot record is executed, it will
look for, and require the existence of, the Windows™ XP or 7 OS partition's system code in order to boot-up the
original Windows™ 98 OS (cf. FAT32 Boot Record under Windows NT OSs).
The four bytes at offsets 1F8h through 1FBh
("8C A9 BE D6") are used by the Microsoft Windows™ 7
VBR for a very specific purpose; for English versions of Windows 7, you'll always see these same
Hex values ("8C A9 BE D6") in your VBR. They're used by the code to display Error Messages
on your screen. But for those using Windows™ 7 in a different language, their VBRs may have different values
in the second, third and fourth bytes depending upon how many characters are in each of the messages. In the
disassembled code, we'll point out where these values show up. In any case, since the code portion above the messages
will always be the same, the first offset (018Ch)
will never change no matter what languages (or string lengths) are used.
Now that you know what the bytes at offsets 1F8h
through 1FBh are used for, you could change these error messages to display whatever you wish (as long as they all fit
into the space between offsets 18Ch and 1F7h) by counting the character lengths and using a disk editor to
change the appropriate bytes in the VBR sector.
After the code in your hard disk's MBR sector transfers control to
this Volume Boot Record code, it will test critical aspects of the Win7 operating system, then load and run the BOOTMGR
"bootstrap" code which will eventually run the actual "bootmgr.exe" program that finally attempts to
load an operating system!
An Examination of the Assembly Code
You can learn a great deal about the instructions used here by obtaining
the x86 Opcode Windows Help file and Ralf Brown's Interrupt List from our Intro to Assembly page.
Here's a Listing of the disassembled code (; with comments) after
first being loaded into Memory at 0000:7C00 by the Windows 7 MBR code. Until noted, the instructions below are
referenced to a CS (Code Segment) of 0000. If you see an asterisk (*) next to an instruction, it means MS-DEBUG can
not disassemble its code; you'd only see "DB nn" displayed.
7C00 EB52 JMP 7C54 ; Jump over BPB (BIOS Parameter
; Block) to code at 0x7C54.
7C02 90 NOP ; Used later ?
; 7C03 thru 7C0A 'NTFS ' 8-byte System Name or OEM ID. (Some think
; this is part of the BPB; it's not!)
; 7C0B thru 7C53 BIOS Parameter Block (BPB) Compare with XP VBR here.
; 0 1 2 3 4 5 6 7 8 9 A B C D E F
7C03 4E 54 46 53 20 20 20 20 00 02 08 00 00 NTFS .....
7C10 00 00 00 00 00 F8 00 00 3F 00 FF 00 00 08 00 00 ........?.......
7C20 00 00 00 00 80 00 80 00 FF EF 3F 01 00 00 00 00 ..........?.....
7C30 04 00 00 00 00 00 00 00 FF FE 13 00 00 00 00 00 ................
7C40 F6 00 00 00 01 00 00 00 6B E5 F9 78 1A FA 78 EA ........k..x..x.
7C50 00 00 00 00 ....
7C54 FA CLI ; Disable maskable Interrupts.
7C55 33C0 XOR AX,AX ; Zero out both the Accumulator
7C57 8ED0 MOV SS,AX ; and Stack Segment Registers.
7C59 BC007C MOV SP,7C00 ; Set Stack Pointer to 0000:7C00
7C5C FB STI ; Enable Interrupts again.
; NOTE: This section merely changes the Segment reference to locations in
; memory. It switches the Segment from 0000 to 07C0 when RETF is executed
; at 0000:7C65. The next instruction, at 07C0:0066, is the same location
; as linear address 0x7C66 (or, 0000:7C66).
7C5D 68C007 * PUSH 07C0 ; New segment ref. to be used for
7C60 1F POP DS ; both Data (DS = Data Segment)
7C61 1E PUSH DS ; . . .
7C62 686600 * PUSH 0066 ; and Code segements . . .
7C65 CB RETF ; after this RETF instruction.
So, all Code (CS) and Data (DS) Segments in the instructions
which follow are in reference to Segment 07C0. This means the next instruction is, technically:
07C0:0066 (only the "Offsets" are shown below).
0066 88160E00 MOV [000E],DL ; DL = Drive # (often 80h).
; (See Win7 MBR code here.)
006A 66813E0300+ * CMP DWORD PTR [0003],5346544E ;/ -> "NTFS"
4E544653
;| Check to see if this is an NTFS Boot Record, and if not display...
0073 7515 JNZ 008A ;\ ... Disk read error -> 016A.
; NOTE: A Windows 7 OS must be run on a computer with INT 13 Extensions!
0075 B441 MOV AH,41 ;/ Function 41h (with BX=55AAh):
0077 BBAA55 MOV BX,55AA ;| Checks for INT 13 Extentions
007A CD13 INT 13 ;| in BIOS. If CF flag cleared
;| and [BX] changes to AA55h, they are installed; Major version is in
;| AH: 01h=1.x; 20h=2.0/EDD-1.0; 21h=2.1/EDD-1.1; 30h=EDD-3.0.
;| CX = API subset support bitmap. If bit 0 is set (CX is 'odd' number),
;| extended disk access functions (AH=42h-44h,47h,48h) are supported.
;\ So, only if no extended support is available, will it fail.
007C 720C JB 008A ; If CF flag not cleared, then
; declare 'Disk error' -> 016A.
007E 81FB55AA CMP BX,AA55 ; Was [BX] changed to AA55h ?
0082 7506 JNZ 008A ; If not, 'Disk error' -> 016A.
0084 F7C10100 TEST CX,0001 ; If bit 0 of CX isn't zero ...
0088 7503 JNZ 008D ; ... we Jump to 07C0:008D.
008A E9D200 JMP 016A ; If zero, -> 'error routine'.
The following code is missing many comments, but all the instructions are here for you to study.
008D 1E PUSH DS ;
008E 83EC18 SUB SP,+18 ;
0091 681A00 * PUSH 001A ;
0094 B448 MOV AH,48 ;
0096 8A160E00 MOV DL,[000E] ;
009A 8BF4 MOV SI,SP ;
009C 16 PUSH SS ;
009D 1F POP DS ;
009E CD13 INT 13 ;
00A0 9F LAHF ; Load Status flags into AH
00A1 83C418 ADD SP,+18
00A4 9E SAHF ; Save AH into flags register
00A5 58 POP AX ;
00A6 1F POP DS ;
00A7 72E1 JB 008A ;
00A9 3B060B00 CMP AX,[000B] ; [0B] -> 200h = 512
00AD 75DB JNZ 008A ;
00AF A30F00 MOV [000F],AX ;
00B2 C12E0F0004 * SHR WORD PTR [000F],04 ;
00B7 1E PUSH DS
00B8 5A POP DX
00B9 33DB XOR BX,BX
00BB B90020 MOV CX,2000 ; 2000h = 8192 = 16 sectors.
00BE 2BC8 SUB CX,AX
00C0 66FF061100 * INC DWORD PTR [0011]
00C5 03160F00 ADD DX,[000F]
00C9 8EC2 MOV ES,DX
00CB FF061600 INC WORD PTR [0016]
00CF E84B00 CALL 011D
00D2 2BC8 SUB CX,AX
00D4 77EF JA 00C5
; =================================================================
; This code (from 00D6 through 010B) is related to discovering if
; TPM version 1.2 interface support is operational on the system.
;
; Comments below checked with the document, "TCG PC Client Specific
; Implementation Specification For Conventional BIOS" (Version 1.20
; FINAL/Revision 1.00/July 13, 2005/For TPM Family 1.2; Level 2), §
; 12.5, pages 85 ff. 
TCG and "TCG BIOS DOS Test Tool" (MSDN).
00D6 B800BB MOV AX,BB00 ; With AH = BBh and AL = 00h
00D9 CD1A INT 1A ; Int 1A -> TCG_StatusCheck
00DB 6623C0 * AND EAX,EAX ;/ If EAX does not equal zero,
00DE 752D JNZ 010D ;\ then no BIOS support for TCG.
00E0 6681FB+ * CMP EBX,41504354 ; EBX must also return ..
54435041 ; the numerical equivalent
; of the ASCII character string "TCPA" ("54 43 50 41") as a further
; check. (Note: Since hex numbers are stored in reverse order on PC
; media or in Memory, a TPM BIOS would put 41504354h in EBX.)
00E7 7524 JNZ 010D ; If not, exit TCG code.
00E9 81F90201 CMP CX,0102 ; Version 1.2 or higher ?
00ED 721E JB 010D ; If not, exit TCG code.
; If TPM 1.2 found, perform a: "TCG_CompactHashLogExtendEvent".
; 06FD 666807BB0000 * PUSH 0000BB07 ; Setup for INT 1Ah AH = BB,
; AL = 07h command (p.94 f).
00EF 16 PUSH SS
00F0 6807BB * PUSH BB07
00F3 16 PUSH SS
00F4 68700E * PUSH 0E70
00F7 16 PUSH SS
00F8 680900 * PUSH 0009
00FB 6653 * PUSH EBX
00FD 6653 * PUSH EBX
00FF 6655 * PUSH EBP
0101 16 PUSH SS
0102 16 PUSH SS
0103 16 PUSH SS
0104 68B801 PUSH 01B8
0107 6661 POPAD
0109 0E PUSH CS
010A 07 POP ES
010B CD1A INT 1A (BIOS Clock)
; On return, "(EAX) = Return Code as defined in Section 12.3" and
; "(EDX) = Event number of the event that was logged".
; =================================================================
Note: The following 11 bytes of code (from offsets
10D through 117) are new to the Windows 7 VBR (they are not found in Vista's VBR):
010D 33C0 XOR AX,AX
010F BF2810 MOV DI,1028
0112 B9D80F MOV CX,0FD8
0115 FC CLD
0116 F3AA REP STOSB
0118 E96A01 JMP 027A ; Beginning of BOOTMGR
; "bootstrap" code in Boot
; Record's second sector.
011B 90 NOP
011C 90 NOP
; =============================================================
; SUBROUTINE - INT 13 Function 42h Extended DISK READ
; =============================================================
011D 6660 * PUSHAD ; 'Push All Double'-all 32-bit
; GP Regs pushed onto stack!
011F 1E PUSH DS ;
0120 06 PUSH ES ;
0121 66A11100 MOV EAX,[0011] ;
0125 6603061C00 ADD EAX,[001C] ;
012A 1E PUSH DS ;
012B 666800000000 * PUSH 00000000 ;
0131 6650 * PUSH EAX ;
0133 06 PUSH ES ;
0134 53 PUSH BX ;
0135 680100 * PUSH 0001 ;
0138 681000 * PUSH 0010 ;
013B B442 MOV AH,42 ; Function 42h (INT13)
013D 8A160E00 MOV DL,[000E] ;
0141 16 PUSH SS ;
0142 1F POP DS ;
0143 8BF4 MOV SI,SP ;
0145 CD13 INT 13
0147 6659 * POP ECX
0149 5B POP BX
014A 5A POP DX
014B 6659 * POP ECX
014D 6659 * POP ECX
014F 1F POP DS
0150 0F821600 * JB 016A
0154 66FF061100 * INC DWORD PTR [0011]
0159 03160F00 ADD DX,[000F]
015D 8EC2 MOV ES,DX
015F FF0E1600 DEC WORD PTR [0016]
0163 75BC JNZ 0121
0165 07 POP ES
0166 1F POP DS
0167 6661 * POPAD
0169 C3 RET
; Note: When the last character of any Error Message has been displayed on
; the screen, the HLT instruction at offset 0176 should prevent any further
; code execution. But if it didn't, the JMP instruction at 0177 would still
; lock the computer's execution into an endless loop! You must reboot your
; machine. INT 10, Function 0Eh (Teletype Output) is used to display each
; character of the error messages.
016A A0F801 MOV AL,[01F8] ; [1F8] = 8C + 100 -> 18C h
016D E80900 CALL 0179 ; Displays: "A disk read error occurred"
0170 A0FB01 MOV AL,[01FB] ; [1FB] = D6 + 100 -> 1D6 h
0173 E80300 CALL 0179 ; Displays: "Press Ctrl+Alt+Del to
; restart"
0176 F4 HLT ; HLT: Not found in Vista VBR code!
0177 EBFE JMP 0176
0179 B401 MOV AH,01 ; Adds 100h to offsets from above.
017B 8BF0 MOV SI,AX ; Offset of message -> Source Index Reg.
017D AC LODSB ; Load one character into AL from [SI].
017E 3C00 CMP AL,00 ;/ Have we reached end of message
0180 7409 JZ 018B ;\ marker?(00) If so, then RETurn.
0182 B40E MOV AH,0E ;/ Otherwise use Teletype Output to ...
0184 BB0700 MOV BX,0007 ;| (Display page 0, normal white
;| on black characters.)
0187 CD10 INT 10 ;| ... display one character at a time,
0189 EBF2 JMP 017D ;\ and go back for another character...
018B C3 RET
Location of Error
Messages and
Message Offsets in Memory
0 1 2 3 4 5 6 7 8 9 A B C D E F
018C 0D 0A 41 20 ..A
0190 64 69 73 6B 20 72 65 61 64 20 65 72 72 6F 72 20 disk read error
01A0 6F 63 63 75 72 72 65 64 00 0D 0A 42 4F 4F 54 4D occurred...BOOTM
01B0 47 52 20 69 73 20 6D 69 73 73 69 6E 67 00 0D 0A GR is missing...
01C0 42 4F 4F 54 4D 47 52 20 69 73 20 63 6F 6D 70 72 BOOTMGR is compr
01D0 65 73 73 65 64 00 0D 0A 50 72 65 73 73 20 43 74 essed...Press Ct
01E0 72 6C 2B 41 6C 74 2B 44 65 6C 20 74 6F 20 72 65 rl+Alt+Del to re
01F0 73 74 61 72 74 0D 0A 00 8C A9 BE D6 00 00 55 AA start.........U.
0 1 2 3 4 5 6 7 8 9 A B C D E F
First Published: March 30, 2012. (30.03.2012).
Updated: March 28, 2012 (28.03.12), April 15, 2012 (15.04.2012).
Last Update: April 19, 2012. (19.04.2012)
You can write to me using this:
online reply form.
(It opens in a new window.)
The Starman's FREE TOOLS Page
MBR and
Boot Records Index
The Starman's Realm Index Page