Sponsoring website: Emergency Boot CD



An Examination of the
Windows™ 8/8.1 or 10
VBR ( Volume Boot Record )
or Boot Sector (and Beyond)

[ Embedded in bootsect.exe,
winsetup.dll and various other
System files
]


Web Presentation and Text are Copyright©2018 by Daniel B. Sedory
NOT to be reproduced in any form without Permission of the Author !

This page examines the Windows™ 8 / 8.1 / 10 OS's Volume Boot Record (VBR); which is considered to be only the first sector of the system area at the beginning of a Win 8 / 10 OS volume (thus, its alternate name: Boot Sector). The BOOTMGR Loader code, immediately following the VBR Sector, spans across the boundaries of nine more sectors: Eight full 512-byte sectors, plus 266 bytes at the beginning of the ninth sector. The structure is similar to that of the Windows 7 Boot Record area, but the Windows 8/10 BOOTMGR Loader contains more data (mostly error messages and two new filenames: BOOTTGT and BOOTNXT) and of course more code in its additional 738 bytes.

Note: The BOOTMGR Loader basically searches for the location of the "bootmgr" file, then loads it into Linear Memory location 0x20000 and jumps to that location.


Other Microsoft OS Volume Boot Records:
  An Examination of the Windows 95B/98/98SE/Me OS Boot Record (MSWIN4.1)
  An Examination of the Windows 2000/XP OS Boot Record (NTFS)
  An Examination of the Windows Vista OS Volume Boot Record (NTFS)
  An Examination of the Windows 7 OS Volume Boot Record (NTFS)
  A Comparison of Windows™ Vista, 7 and 8/10 VBR Code

And Microsoft MBR pages:
  An Examination of the Standard MBR created by MS-DOS FDISK
  The MBR created by Windows 95B/98/98SE and ME's FDISK
  The MBR created by Windows 2000/XP/2003 Installs or Disk Management Utility
  The MBR created by Windows Vista OS Installs or Disk Management Utility
  The MBR created by Windows 7 / 8 / 10 OS's Installs or Disk Management

Confused? Send us an email if you have a specific question about the MBR or any Boot Records...

 

Just as we urged readers of our Win 7/8 MBR page to make a copy of their MBR sector, you may wish to create copies of your Win 8/10 VBR. Though more difficult to work with; considering all the details stored in this sector, there may come a time when you need/want to edit or replace this and other system sectors manually.

Some advice: Save all the data from the BIOS Parameter Block (BPB) area of the sector somewhere apart from your main hard disk or write it down on paper(!); it does no good to have data you might need to access your OS on the un-accessible HD itself! There are many ways you can do this... See our MBR Tools Page. Any good Disk Editor will allow you to manually enter data you've written down, or you can use a number of utility programs to save the binary data to a file on say a thumb drive, and later on restore the VBR and other sectors from the saved file(s).


Introduction

 Relative Sector 0 (within the Volume)

                                          NTFS BPB          "OEM ID"
                                              |                 |
         0  1  2  3  4  5  6  7  8  9  A  B  C| D  E  F         |
 0000:  EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00  .R.NTFS    .....
 0010:  00 00 00 00 00 F8 00 00 3F 00 FF 00[00 08 00 00] ........?.......
 0020:  00 00 00 00 80 00 80 00 FF EF 0A 00 00 00 00 00  ................
 0030:  AA 74 00 00 00 00 00 00 02 00 00 00 00 00 00 00  .t..............
 0040:  F6 00 00 00 01 00 00 00 1F AA F8 12 C3 F8 12 D6  ö...............
 0050:  00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB 68 C0 07  .....3.....|.h..
 0060:  1F 1E 68 66 00 CB 88 16 0E 00 66 81 3E 03 00 4E  ..hf......f.>..N
 0070:  54 46 53 75 15 B4 41 BB AA 55 CD 13 72 0C 81 FB  TFSu..A..U..r...
 0080:  55 AA 75 06 F7 C1 01 00 75 03 E9 DD 00 1E 83 EC  U.u.....u.......
 0090:  18 68 1A 00 B4 48 8A 16 0E 00 8B F4 16 1F CD 13  .h...H..........
 00A0:  9F 83 C4 18 9E 58 1F 72 E1 3B 06 0B 00 75 DB A3  .....X.r.;...u..
 00B0:  0F 00 C1 2E 0F 00 04 1E 5A 33 DB B9 00 20 2B C8  ........Z3... +.
 00C0:  66 FF 06 11 00 03 16 0F 00 8E C2 FF 06 16 00 E8  f...............
 00D0:  4B 00 2B C8 77 EF B8 00 BB CD 1A 66 23 C0 75 2D  K.+.w......f#.u-
 00E0:  66 81 FB 54 43 50 41 75 24 81 F9 02 01 72 1E 16  f..TCPAu$....r..
 00F0:  68 07 BB 16 68 52 11 16 68 09 00 66 53 66 53 66  h...hR..h..fSfSf
 0100:  55 16 16 16 68 B8 01 66 61 0E 07 CD 1A 33 C0 BF  U...h..fa....3..
 0110:  0A 13 B9 F6 0C FC F3 AA E9 FE 01 90 90 66 60 1E  .............f`.
 0120:  06 66 A1 11 00 66 03 06 1C 00 1E 66 68 00 00 00  .f...f.....fh...
 0130:  00 66 50 06 53 68 01 00 68 10 00 B4 42 8A 16 0E  .fP.Sh..h...B...
 0140:  00 16 1F 8B F4 CD 13 66 59 5B 5A 66 59 66 59 1F  .......fY[ZfYfY.
 0150:  0F 82 16 00 66 FF 06 11 00 03 16 0F 00 8E C2 FF  ....f...........
 0160:  0E 16 00 75 BC 07 1F 66 61 C3 A1 F6 01 E8 09 00  ...u...fa.......
 0170:  A1 FA 01 E8 03 00 F4 EB FD*8B F0 AC 3C 00 74 09  ............<.t.
 0180:  B4 0E BB 07 00 CD 10 EB F2 C3 0D 0A 41 20 64 69  ............A di
 0190:  73 6B 20 72 65 61 64 20 65 72 72 6F 72 20 6F 63  sk read error oc
 01A0:  63 75 72 72 65 64 00 0D 0A 42 4F 4F 54 4D 47 52  curred...BOOTMGR
 01B0:  20 69 73 20 63 6F 6D 70 72 65 73 73 65 64 00 0D   is compressed..
 01C0:  0A 50 72 65 73 73 20 43 74 72 6C 2B 41 6C 74 2B  .Press Ctrl+Alt+
 01D0:  44 65 6C 20 74 6F 20 72 65 73 74 61 72 74 0D 0A  Del to restart..
 01E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 01F0:  00 00 00 00 00 00 8A 01 A7 01 BF 01 00 00 55 AA  ..............U.
         0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F

Figure 1.


An Examination of the Assembly Code


Location of Error Messages and
Message Offsets in Memory


First Published: 14 June 2015. (14.06.2015).
Updated: 14 JUN 2015 (14.06.2015); 7 NOV 2015 (07.11.2015).

Last Update: 3 May 2018. (03.05.2018). (And we're certainly not finished yet!)


You can write to us using this: online reply form.(It opens in a new window.)

The Starman's FREE TOOLS Page

MBR and Boot Records Index

The Starman's Realm Index Page