The Starman's FREE TOOLS Page
MBR and Boot Records Index
The Starman's Realm Index Page|
This page examines the Win 95B MBR which was introduced in 1996 when Microsoft® released its FAT32 File System. FAT32 required a number of changes in their utility programs. The Standard MBR embedded in FDISK was replaced by the expanded code which you see here; it added routines to check for things that only applied to Win 95B at that time, but the same MBR code was later used in the Windows 98, 98SE and Windows ME FDISK programs. Basically, this MBR was created so that Microsoft's FAT32 Boot Sectors could be located in a partition that's beyond the reach of the Standard MBR (which is limited to cylinder 1024 or less, since it does not use the Extended INT 13 Function 42h which is found in this MBR). |
| IMPORTANT: One of the first
things that any PC user should do after setting up a new hard disk (or
creating a new partition with a utility such as Partition Magic)
is to make a copy of its MBR; especially if you have more than one
partition on the disk! Why? If you accidentally overwrite this
sector, or are infected by a Boot sector virus, you may never be
able to access some or even all of your disk again! Even the most
expensive HD utility might not correctly restore the Partition
Table of a multi-partitioned hard disk! Some advice: Save the Partition Table data on floppy disks or even on paper(!); it does no good to have the data you need to access your HD on the un-accessible HD itself! There are many ways you can do this... See the MBR Tools Page. Any good Disk Editor will allow you to manually enter data you've written down under an easy to use Partition Table View, or you can use Power Quest's excellent little utility program "MBRutil" (under any version of Windows!) and "MBRUTILD" (under DOS) to save the binary data to a file on a floppy diskette and later restore the MBR from the saved file. |
This page examines the bytes that are written
to Cylinder 0, Head 0, Sector 1 of your first Hard Disk by any of the
Win 95B, 98, 98SE or ME FDISK programs whenever you use them to:
1) Create a partition on a hard disk that has none, or
2) Overwrite any existing code in the first sector using the
so-called "undocumented" FDISK
/MBR command.
The following is a disk editor view of how
the MBR is stored on your hard disk's first sector; that's Absolute
(or Physical) Sector 0 or CHS 0,0,1. (See Examination
of the Code below to find out where this data ends up in Memory when it's
executed.)
Absolute Sector 0 (Cylinder 0, Head 0, Sector 1)
0 1 2 3 4 5 6 7 8 9 A B C D E F
0000 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C 3.....|.P.P....|
0010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BE BE 07 B1 04 ...PW...........
0020 38 2C 7C 09 75 15 83 C6 10 E2 F5 CD 18 8B 14 8B 8,|.u...........
0030 EE 83 C6 10 49 74 16 38 2C 74 F6 BE 10 07 4E AC ....It.8,t....N.
0040 3C 00 74 FA BB 07 00 B4 0E CD 10 EB F2 89 46 25 <.t...........F%
0050 96 8A 46 04 B4 06 3C 0E 74 11 B4 0B 3C 0C 74 05 ..F...<.t...<.t.
0060 3A C4 75 2B 40 C6 46 25 06 75 24 BB AA 55 50 B4 .u+@.F%.u$..UP.
0070 41 CD 13 58 72 16 81 FB 55 AA 75 10 F6 C1 01 74 A..Xr...U.u....t
0080 0B 8A E0 88 56 24 C7 06 A1 06 EB 1E 88 66 04 BF ....V$.......f..
0090 0A 00 B8 01 02 8B DC 33 C9 83 FF 05 7F 03 8B 4E .......3.......N
00A0 25 03 4E 02 CD 13 72 29 BE 46 07 81 3E FE 7D 55 %.N...r).F..>.}U
00B0 AA 74 5A 83 EF 05 7F DA 85 F6 75 83 BE 27 07 EB .tZ.......u..'..
00C0 8A 98 91 52 99 03 46 08 13 56 0A E8 12 00 5A EB ...R..F..V....Z.
00D0 D5 4F 74 E4 33 C0 CD 13 EB B8 00 00 00 00 00 00 .Ot.3...........
00E0 56 33 F6 56 56 52 50 06 53 51 BE 10 00 56 8B F4 V3.VVRP.SQ...V..
00F0 50 52 B8 00 42 8A 56 24 CD 13 5A 58 8D 64 10 72 PR..B.V$..ZX.d.r
0100 0A 40 75 01 42 80 C7 02 E2 F7 F8 5E C3 EB 74 49 .@u.B......^..tI
0110 6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F 6E nvalid partition
0120 20 74 61 62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 table.Error loa
0130 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 ding operating s
0140 79 73 74 65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 ystem.Missing op
0150 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D 00 00 erating system..
0160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0180 00 00 00 8B FC 1E 57 8B F5 CB 00 00 00 00 00 00 ......W.........
0190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 01 ................
01C0 01 00 0B 7F BF FD 3F 00 00 00 C1 40 5E 00 00 00 ......?....@^...
01D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ..............U.
0 1 2 3 4 5 6 7 8 9 A B C D E F
|
The first 271 bytes of the 512-byte sector are executable code (000h through 10Eh) with the exception of six bytes (DAh through DFh) we used to call the mystery bytes; the first two should always be zero. See here for important and detailed information on these bytes!
The next 80 bytes (10Fh through 15Eh) contain the MBR's error messages. The last 66 bytes of the sector contain the 64-byte Partition Table (1BEh through 1FDh), of which the contents will vary depending upon the size and structure of a particular hard disk. The sector ends with the Word-sized signature ID (or Magic number) of AA55 hex. [Hex Words for Intel x86 CPUs are stored in memory with the Low-byte first and the High-byte last to make processing quicker!]
The remaining 95 bytes (from 15Fh to
1BDh) are mostly padding which FDISK fills with zeros (some of which
are used for longer error messages in other languages). However, the
MSWIN4.1 FDISK utility was programmed to write seven bytes between
183h and 189h inclusive! They are always: 8Bh,
FCh, 1Eh, 57h, 8Bh, F5h and CBh. The first time you see these bytes, you
might think they're an ID of some kind or possibly some data used by a program.
The truth is: they're actually instructions; part of the MBR program itself!
If you read the code below, you'll see there's a Jump at
070Dh to this
lonely string of bytes.
[This kind of coding by Microsoft sometimes
elicits comments such as: "That code
is so messed up you have to wonder if they didn't do it on purpose, just so no self-respecting
hacker would ever consider copying it!" Or perhaps they were being forced to ship
the product the same day they started coding! If anyone knows the real reason why these bytes
were separated from the rest of the code, please contact us. Was someone's attempt at
'branding' their own code?]
(Lastly, if you see four non-zero bytes at offsets
1B8h through 1BBh, this is often the result of having been in a computer
that was booted up with Windows NT/2000/XP. These bytes are collectively
referred to as the NT Drive Serial Number which you can read about
on our Win2kXP MBR page.)
Here's a disassembled copy of the code (; with comments) after being loaded into memory by the BIOS at 0000:7C00 ( All Memory locations listed below are in Segment 0000: ).
7C00 33C0 XOR AX,AX ; Zero out both the Accumulator and
7C02 8ED0 MOV SS,AX ; the Stack Segment register.
7C04 BC007C MOV SP,7C00 ; Set Stack Pointer to 0000:7C00
7C07 FB STI ; Enable Interrupts
7C08 50 PUSH AX ; (AX=0)
7C09 07 POP ES ; Zero-out Extra Segment
7C0A 50 PUSH AX ; (AX=0)
7C0B 1F POP DS ; Zero-out Data Segment
7C0C FC CLD ; Clear Direction Flag
7C0D BE1B7C MOV SI,7C1B ; Source Index: Copy from here...
7C10 BF1B06 MOV DI,061B ; Destination Index: Copy to here:
; Code will begin at: 0000:061B
7C13 50 PUSH AX ; Set up Segment(AX) and Offset(DI)
7C14 57 PUSH DI ; for jump to 0000:061B.
7C15 B9E501 MOV CX,01E5 ; Set up Counter (CX) to copy
; (1E5h) 485 bytes of code.
; After executing the instructions above, if you were able to run MS-DEBUG
; to debug this code, its CPU Registers display would appear as follows:
;
; AX=0000 BX=0000 CX=01E5 DX=0080 SP=7BFC BP=0000 SI=7C1B DI=061B
; DS=0000 ES=0000 SS=0000 CS=0000 IP=7C18 NV UP EI PL ZR NA PE NC
; 0000:7C18 F3A4 REP MOVSB BYTE PTR ES:[DI], BYTE PTR DS:[SI]
7C18 F3 REP ; REPeat the following MOVSB
; instruction for 'CX' times.
7C19 A4 MOVSB ; Copy one byte at a time.
7C1A CB RETF ; Uses RETF to do Jump to where we
; copied the code: 0000:061B.
; Since the preceding routine copies the remainder of the code to 0000:061B
; through 0000:07FF and continues its execution there, the following
; addresses have been changed to reflect the code's actual location in
; memory at the time of execution.
; This next section of code tries to find an ACTIVE (i.e., bootable) entry in
; the Partition Table. The first byte of an entry indicates if it's bootable
; (normally an 80h, but in this case, anything from 81h through FFh as well!)
; or not (a 00h); any other values (from 01h through 7Fh) in these locations
; means the Table is invalid! If none of the four entries in the Table is
; active, then the INT 18h instruction will be executed; for which most BIOS
; today (see note at 062B below) will display "PRESS A KEY TO REBOOT".
061B BEBE07 MOV SI,07BE ; Location of first entry
; in the partition table
; (see Sample Table here).
061E B104 MOV CL,04 ; Maximum of 4 entries.
0620 382C CMP [SI],CH ; We know (from Counter decrement
; above) that CH=0, so CoMPare 1st
; byte of entry [SI] to zero. Only
; if the high bit is set (80h thru
; FFh), will it be 'less than':
0622 7C09 JL 062D ; Found a possible boot entry, but
; let's check it out more at 062D,
; or... continue searching table.
0624 7515 JNZ 063B ; If not a zero byte (01h to 7Fh),
; then print out error message...
; -> "Invalid partition table"
0626 83C610 ADD SI,+10 ; Checking the next entry...
; (10h = 16 bytes per entry)
0629 E2F5 LOOP 0620 ; Go back & check next Entry...
; unless CL=0 (tried all four).
062B CD18 INT 18 ; Checked all 4; NONE of them
; were bootable, so start
; ROM-BASIC (only available on
; some IBM machines!) Many BIOS
; simply display "PRESS A KEY TO
; REBOOT" when Int 18h is run.
; An Active partition was found, but we must check all other entries
; for being non-bootable (first byte = 00h), or there's an error!
; (Obviously, only one entry at a time can be marked as 'Active'!)
; Before doing so, we load the Head and Drive data into DX for use by
; the DOS Interrupt 13 commands later....
062D 8B14 MOV DX,[SI] ; This causes the Drive # (Yes,
; the Active BootFlag bytes in
; Partition Tables are Drive Numbers) to be placed into -> DL and its
; Head # -> DH. For the Standard MBR, DL will always be 80h (see offset
; 0622 there with an 80h 'hardcoded' into the instruction) making only
; the first drive bootable! [So, that part of the Standard MBR code was
; often changed by MBR replacements! If you have an OS that can boot up
; from another drive, this new Win95B-ME MBR makes it easier to do so.]
062F 8BEE MOV BP,SI ; Save offset of this entry...
0631 83C610 ADD SI,+10 ; see if any more are left.
0634 49 DEC CX ; If CX=0, then we're done here,
0635 7416 JZ 064D ; so Jump to ID-type checking!
0637 382C CMP [SI],CH ; CoMPare entry's first byte [SI]
0639 74F6 JZ 0631 ; to Zero (CH=0). If it's not
; zero, we fall into the error
; routine immediately following...
; If there was an error, then this next routine displays the message that
; SI points to. After printing the ASCII-Z string (null terminated), the
; program 'hangs' by going into an infinite loop of executions between
; 063E and 0642 as soon as it hits the Zero-byte at the end of the error
; message.
; This is an interesting way to form an endless loop: Since the LODSB
; instruction increments SI whenever it's executed, the decrement of SI
; at 063E forces the CPU to load the same byte at 0726 (a 00h) into the
; AL register over and over again!
063B BE1007 MOV SI,0710 ; To make SI point to: (070F;
; or "Invalid partition table")
; after the decrement of SI.
|063E 4E DEC SI ; Used only to 'hang' machine!
|063F AC LODSB ; Load byte at SI into AL
| ; and increment SI register.
|0640 3C00 CMP AL,00 ; Is it the string terminator?
|0642 74FA JZ 063E ; If so, 'lock-up' machine!
0644 BB0700 MOV BX,0007 ; Use normal White on Black text
0647 B40E MOV AH,0E ; and Function 0Eh of INT 10 to
0649 CD10 INT 10 ; display the character in AL
; on the video screen.
064B EBF2 JMP 063F ; Get next string character...
; At this point, the BP Register contains the offset to the Active entry
; (see 062F) and AX should still be zero. The first instruction in the code
; below appears rather strange, since this overwrites data in the 3rd entry!
; These are Memory locations; not bytes on the hard disk, and the only data
; which still matters is in the Boot entry. But why use an offset of +25 Hex
; (i.e., 37 bytes) when each entry is only 16 bytes long? If we boot from
; the first entry (making BP=07BE), this first instruction will affect the
; two bytes at offsets 07E3h and 07E4h. See below for why this was done:
064D 894625 MOV [BP+25],AX ; Zero-out the two bytes at offsets
; BP plus 37 (25 hex) and 38.
0650 96 XCHG SI,AX ; The contents of SI should be 07FE
; at this point (from checking the
; last entry in the Table), so this
; makes AX -> 07FE and SI -> zero.
; But after the next 2 instructions
; the 07FE is gone! So this is just
; a quick way to zero-out SI!
0651 8A4604 MOV AL,[BP+04] ; This is the Partition Type ID
; for the bootable entry!
0654 B406 MOV AH,06 ; 06h = FAT16 (>32MB) Partition.
0656 3C0E CMP AL,0E ; 0Eh = FAT16 LBA-mapped Partition.
0658 7411 JZ 066B ; If Partition Type is 0E hex,
; Jump to 066B with AX=060E.
065A B40B MOV AH,0B ; 0Bh = FAT32 Partition.
065C 3C0C CMP AL,0C ; 0Ch = FAT32 LBA-mapped Partition;
; uses Extended INT 13 code to
; begin past cylinder 1024.
065E 7405 JZ 0665 ; If Partition Type is 0C hex,
; Jump to 0665 with AX=0B0C.
0660 3AC4 CMP AL,AH ; AH should still be 0Bh.
0662 752B JNZ 068F ; For ID Types other than 06,0B,
; 0C or 0E, skip tests for BIOS
; Extensions, jump to 068F with
; AX=0Bxx where xx = ID Type.
0664 40 INC AX ; Partition Type is 0B hex, but we
; make it a 0C hex in AL (this
; changes the Zero Flag to a
; Non-zero which forces a jump
; to 068F at 0669 below!)
0665 C6462506 MOV BYTE PTR [BP+25],06 ; Make the byte at BP
; plus 37 a 06 and..
0669 7524 JNZ 068F ; Jump to 068F with AX=0B0C only
; if we have an ID Type = 0Bh.
;
; Otherwise (e.g., type=0Ch)...
066B BBAA55 MOV BX,55AA ;|
066E 50 PUSH AX ;| Check for INT 13
066F B441 MOV AH,41 ;| Extended Functions
0671 CD13 INT 13 ;| Any of the 3 tests below may
;| indicate the check failed.
0673 58 POP AX
0674 7216 JB 068C ;/ If Carry Flag (CF=1) is set,
;\ Extensions are not present!
0676 81FB55AA CMP BX,AA55 ;/ BX must equal AA55h or:
067A 7510 JNZ 068C ;\ Extensions are not present!
067C F6C101 TEST CL,01 ;/ If removable drive controller
;| functions are present, then
067F 740B JZ 068C ;\ Extensions will not be used!
0681 8AE0 MOV AH,AL ; Copy Partition Type -> AH
0683 885624 MOV [BP+24],DL ; Copy Drive Number to [BP+36]
; For a bootable First Entry,
; this would be 07E2h.
0686 C706A106EB1E MOV WORD PTR [06A1],1EEB ; This is an unusual use of
; code in a commercial OS!
; This instruction actually modifies
; the code at offset 06A1 from what
; you see below to a: JMP 06C1 which
; aborts the Standard INT13 call.
068C 886604 MOV [BP+04],AH
068F BF0A00 MOV DI,000A
0692 B80102 MOV AX,0201 ; Function 02 of INT 13
; overwriting the 0B0C in AX!
0695 8BDC MOV BX,SP ; BX = 7C00h (where we copy VBR to).
0697 33C9 XOR CX,CX
0699 83FF05 CMP DI,+05
069C 7F03 JG 06A1
069E 8B4E25 MOV CX,[BP+25]
06A1 034E02 ADD CX,[BP+02] ; Normally, [BP+02] = Sector value.
;
; ButCan also be: JMP 06C1 (if the
; test for Extended INT 13 above
; is positive!)
06A4 CD13 INT 13 ; Copy first sector of Volume Boot
; Record from Cylinder (low 8 bits
; in CH and 2 high bits in CL; 10 bits = 3FFh for max. of 1024 cylinders),
; Head (in DH), Sector (low 6 bits in CL; for max. of 3Fh = 63) and Drive
; Number (in DL). The CHS scheme cannot access a partition beyond the
; 1024th cylinder or LBA 16,450,559 (that's [1024 x 255 x 63] - 1, or:
; C,H,S = 1023, 254, 63).
I hope to eventually finish commenting
on the following code... You can still
email me with specific questions.
06A6 7229 JB 06D1
06A8 BE4607 MOV SI,0746 ; -> "Missing operating system"
06AB 813EFE7D55AA CMP WORD PTR [7DFE],AA55 ; Checking the last two
; bytes of newly loaded sector
; for "Magic Number" (AA55h).
06B1 745A JZ 070D ; See Note at 070Dh for this
; seemingly odd usage.
06B3 83EF05 SUB DI,+05
06B6 7FDA JG 0692
06B8 85F6 TEST SI,SI
06BA 7583 JNZ 063F
06BC BE2707 MOV SI,0727 ; --> "Error loading operating
; system"
06BF EB8A JMP 064B ; The code at 064B was conveniently
; used in order to jump all the way
; back to 063F without having to
; use a three-byte NEAR jump! See
; Using SHORT Jumps for more info.
06C1 98 CBW ; Convert Byte to Word.
06C2 91 XCHG CX,AX
06C3 52 PUSH DX
06C4 99 CWD ; Convert Word to DoubleWord.
06C5 034608 ADD AX,[BP+08]
06C8 13560A ADC DX,[BP+0A]
06CB E81200 CALL 06E0
06CE 5A POP DX
06CF EBD5 JMP 06A6
06D1 4F DEC DI
06D2 74E4 JZ 06B8
06D4 33C0 XOR AX,AX ;| INT 13 Function 0
06D6 CD13 INT 13 ;| "RESET DISK SYSTEM"
06D8 EBB8 JMP 0692
===========================================================================
06DA 0000 ; Location in Memory of what we're
06DC 00000000 ; calling the "Mystery Bytes"
===========================================================================
; SUBROUTINE:
06E0 56 PUSH SI
06E1 33F6 XOR SI,SI
06E3 56 PUSH SI
06E4 56 PUSH SI
06E5 52 PUSH DX
06E6 50 PUSH AX
06E7 06 PUSH ES
06E8 53 PUSH BX
06E9 51 PUSH CX
06EA BE1000 MOV SI,0010
06ED 56 PUSH SI
06EE 8BF4 MOV SI,SP
06F0 50 PUSH AX
06F1 52 PUSH DX
06F2 B80042 MOV AX,4200 ;| ( An INT 13 Extension )
06F5 8A5624 MOV DL,[BP+24] ;|
06F8 CD13 INT 13 ;| Extended READ Function
06FA 5A POP DX
06FB 58 POP AX
06FC 8D6410 LEA SP,[SI+10]
06FF 720A JB 070B
0701 40 INC AX
0702 7501 JNZ 0705
0704 42 INC DX
0705 80C702 ADD BH,02
0708 E2F7 LOOP 0701
070A F8 CLC
070B 5E POP SI
070C C3 RET
=========================================================================
070D EB74 JMP 0783 ; At first glance, this may appear
; to be a wasteful use of bytes,
; but it's necessary because the point of the code here is to get program
; execution to jump from 06B1 to 0783 using only fast 2-byte jumps which
; are limited to +127 bytes forward. See Using SHORT Jumps for more info.
; Apparently, moving the Error Messages you see below wasn't an option.
=========================================================================
070F 49 I 0710 6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F 6E nvalid partition 0720 20 74 61 62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 table.Error loa 0730 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 ding operating s 0740 79 73 74 65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 ystem.Missing op 0750 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D 00 00 erating system.. 0760 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0770 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0780 00 00 00 ...
(Note: The unused bytes above allow for longer error messages in other languages.)
0783 8BFC MOV DI,SP ; Set up Offset (DI) with 7C00.
0785 1E PUSH DS ; (DS = 0000 when executed.)
0786 57 PUSH DI ; (DI = 7C00.)
0787 8BF5 MOV SI,BP
0789 CB RETF ; Use RETF to do a Jump to the OS
; Boot Sector code at 0000:7C00;
; continuing the boot-up process!
A B C D E F
078A 00 00 00 00 00 00 ......
0790 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
07A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
07B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..............
0 1 2 3 4 5 6 7 8 9 A B C D
(The bytes in offset 7B8h through
7BBh, may contain an NT Drive Serial Number if the
computer was ever booted up under Windows NT/2000/XP.)
A Sample Partition Table
This shows a sample partition table as it would appear in memory during the boot-up process. See Reference Page for links to complete listings of Partition Identifiers. This Sample Table contains entries in all four records; each record is 16 bytes long. I've underlined the bytes in the first (7BEh through 7CDh) and last (7EEh through 7FDh) of the four entries:
0 1 2 3 4 5 6 7 8 9 A B C D E F 07BE 80 01 .. 07C0 01 00 06 3F 3F C4 3F 00-00 00 81 1E 0C 00 00 00 ...??.?......... 07D0 01 C5 05 3F 7F 47 C0 1E-0C 00 40 0F 08 00 00 00 ...?.G....@..... 07E0 41 48 82 3F 7F 53 00 2E-14 00 00 BD 00 00 00 00 AH.?.S.......... 07F0 41 54 83 3F BF 0F 00 EB-14 00 00 91 0B 00 55 AA AT.?..........U. |
And this is how it would be seen in a disk editor that can interpret Partition Table data:
Partition Active Starting Loc Ending Loc Relative Number of
Type Boot Cyl Head Sec Cyl Head Sec sectors sectors
------------- ------ ------------ ------------ ------- -------
DOS FAT-16 Yes 0 1 1 196 63 63 63 794241
Extended No 197 0 1 327 63 63 794304 528192
LINUX Swap No 328 0 1 339 63 63 1322496 48384
LINUX Ext2FS No 340 0 1 527 63 63 1370880 758016
|
|
Note: |
During boot-up, these locations are later replaced by communications parameters for COM2 thru COM4 and other data. Here's a listing of my own computer's memory after boot-up for these same memory locations:
07BE 7A 02 z. 07C0 AC 02 43 4F 4D 32 20 20 20 20 DC 00 70 00 00 80 ..COM2 ..p..€ 07D0 7A 02 B2 02 43 4F 4D 33 20 20 20 20 00 00 0D 0E z...COM3 .... 07E0 00 80 7A 02 B8 02 43 4F 4D 34 20 20 20 20 E8 D2 .€z...COM4 .. 07F0 01 D7 07 38 CD 01 3B 0E 00 00 7C 04 18 00 59 04 ......;...|...Y.
Major Update: 26 AUG 2004 [26.8.2004].
Updated: 15 SEP 2010 [15.9.2010].
Last Update: 31 OCT 2010 [31.10.2010].
You can write to me using this:
online reply form.
(It opens in a new window.)
The Starman's FREE TOOLS Page
MBR and Boot Records Index
The Starman's Realm Index Page