Understanding and Working with the MBR

by

Standard MBR functionality can be restored by adding proper boot code back into the MBR. This document will mostly discuss how to restore the boot sector finding code to the MBR. This document also gives several options for which boot code you may want to put in the MBR.

WHATISMBR
RESTORE
FDISK_MBR
LILO_U
ATA_ATAPI
BOOTCONTROL

What is the MBR and How does it Work

When a system boots, system control is passed from the BIOS to the MBR (Master Boot Record) on whichever device the BIOS tries to boot from. The MBR determines what the system does next. A standard MBR on a hard drive would locate the active partition and try passing control to that partition’s boot sector.

This boot code in the MBR (the code which locates the active partition and passes control to that partition’s boot sector) can get replaced, removed, or otherwise become damaged. Installing LILO to the MBR is one example of how this standard boot code in the MBR can get replaced.

Note: An MBR has 3 parts:

  1. (000000 - 0001bd) The boot code which is 446 bytes long
  2. (0001be - 0001fd) The partition table which is 64 bytes long
  3. (0001fe - 0001ff) The boot code signature of 55aa which is 2 bytes long and goes at the very end

WHATISMBR
RESTORE
FDISK_MBR
LILO_U
ATA_ATAPI
BOOTCONTROL

Methods for Restoring the MBR

WHATISMBR
RESTORE
FDISK_MBR
LILO_U
ATA_ATAPI
BOOTCONTROL

Restoring the MBR: Using MS-Dos Command “fdisk /mbr”

The most common way is to boot to a DOS/Win95/Win98 boot floppy and run the command:

fdisk /mbr

WHATISMBR
RESTORE
FDISK_MBR
LILO_U
ATA_ATAPI
BOOTCONTROL

Restoring the MBR: Using LILO Uninstall

You may also use the lilo uninstall command:

lilo -u

But to use this command you have to have the backup copy of the old boot sector which LILO had saved in a file. If you have since formatted or removed your Linux partitions, then you will not have this file anymore.

WHATISMBR
RESTORE
FDISK_MBR
LILO_U
ATA_ATAPI
BOOTCONTROL

Restoring the MBR: Using an MBR from ATA-Atapi.com

You may put a boot sector of your own there:

MBR boot code:

Note: The following is the boot code of the MBR.


OFFSET 0 1 2 3  4 5 6 7  8 9 A B  C D E F  *0123456789ABCDEF*
000000 fa33c08e d0bc007c 8bf45007 501ffbfc *.3.....|..P.P...*
000010 bf0006b9 0001f2a5 ea1d0600 00bebe07 *................*
000020 b304803c 80740e80 3c00751c 83c610fe *.....t....u.....*
000030 cb75efcd 188b148b 4c028bee 83c610fe *.u......L.......*
000040 cb741a80 3c0074f4 be8b06ac 3c00740b *.t....t.......t.*
000050 56bb0700 b40ecd10 5eebf0eb febf0500 *V.......^.......*
000060 bb007cb8 010257cd 135f730c 33c0cd13 *..|...W.._s.3...*
000070 4f75edbe a306ebd3 bec206bf fe7d813d *Ou...........}.=*
000080 55aa75c7 8bf5ea00 7c000049 6e76616c *U.u.....|..Inval*
000090 69642070 61727469 74696f6e 20746162 *id partition tab*
0000a0 6c650045 72726f72 206c6f61 64696e67 *le.Error loading*
0000b0 206f7065 72617469 6e672073 79737465 * operating syste*
0000c0 6d004d69 7373696e 67206f70 65726174 *m.Missing operat*
0000d0 696e6720 73797374 656d0000 00000000 *ing system......*
0000e0 00000000 00000000 00000000 00000000 *................*
0000f0 00000000 00000000 00000000 00000000 *................*
000100 00000000 00000000 00000000 00000000 *................*
000110 00000000 00000000 00000000 00000000 *................*
000120 00000000 00000000 00000000 00000000 *................*
000130 00000000 00000000 00000000 00000000 *................*
000140 00000000 00000000 00000000 00000000 *................*
000150 00000000 00000000 00000000 00000000 *................*
000160 00000000 00000000 00000000 00000000 *................*
000170 00000000 00000000 00000000 00000000 *................*
000180 00000000 00000000 00000000 00000000 *................*
000190 00000000 00000000 00000000 00000000 *................*
0001a0 00000000 00000000 00000000 00000000 *................*
0001b0 00000000 00000000 00000000 0000     *............    *

Notice the extra zero’s (191 from 0000f0 to 0001af and 14 from 0001b0 to 0001bd); this is unused space in the boot sector using the code above. This leaves room for developing more advanced boot sectors that can boot in various ways.

MBR Partition Table:

Note: The following is the partition table. You must not overwrite your partition table on your MBR because that will remove all of your existing partitions.

Note: The following partition table is provided as an EXAMPLE ONLY. DO Not use this partition table because it WILL ERASE your EXISTING PARTITIONS if you use it.


0001b0                                8001 *              ..*
0001c0 0100060d fef83e00 00000678 0d000000 *...........x....*
0001d0 00000000 00000000 00000000 00000000 *................*
0001e0 00000000 00000000 00000000 00000000 *................*
0001f0 00000000 00000000 00000000 0000     *..............  *

Boot Sector 55aa Signature:

The following is the boot sector signature. That signifies that the code found in this 512 byte boot sector should be valid.


0001f0                                55aa *              U.*

Notice that the very last entry is 55aa, that is a good thing, but is probably already set up in your existing boot sector.

The above boot sector comes from: http://ata-atapi.com/hiwmbr.htm#T5. If you want to know more about boot sectors then go there.

To convert this hex dump text version of the boot sector to a usable binary version do the following steps:

  1. Save the boot sector (without the partition table) as a text file (let’s use the filename mbr.hex so we can keep things straight).

    2. Note: DO NOT save the following header as part of the boot sector:

    
OFFSET 0 1 2 3  4 5 6 7  8 9 A B  C D E F  *0123456789ABCDEF*
  2. Convert from hex to binary the file using xxd (in Linux)
    3. xxd -r mbr.hex mbr.bin

    Your mbr.bin should be 446 bytes in size or less. If you grabbed the boot sector listed on this page, then your mbr.bin should be exactly 446 bytes in size.

  3. You may also want to convert the file back to hex (let’s use the filename mbr.hex-new) so you can verify that the conversion went OK.
    4. xxd -g 4 mbr.bin mbr.hex-new
diff mbr.hex mbr.hex-new
  4. Backup the old boot sector.

    5. dd if=/dev/sda of=mbr.backup bs=512 count=1

    Note: The above command assumes you are using a SCSI drive. Replace the /dev/xxx portion of the command as appropriate to your system.

  5. Put the new boot sector in place

    6. dd if=mbr.bin of=/dev/sda bs=1

    Note: The above command assumes you are using a SCSI drive. Replace the /dev/xxx portion of the command as appropriate to your system.

    Note: You probably don’t need the bs=1, but I put it just to make sure. As I do more testing I’ll remove the bs=1 if it is not needed.

  6. That’s it, you should be able to reboot and the newly modified MBR should now properly look for an active partition to boot to.

WHATISMBR
RESTORE
FDISK_MBR
LILO_U
ATA_ATAPI
BOOTCONTROL

MBRs from Boot Control

Another method is to get one from:

http://www.xs4all.nl/~gklein/bc.html

Here is a short description of Boot Control from their homepage (they describe their product themselves much better and precise than I could even begin to):

“1.1 What is Boot Control?
Boot Control is a set of alternative Master Boot Records, together with an installation program. The installation program replaces the current MBR with one of Boot Control’s, which displays a small menu at boot time. The menu shows up to four (named) partitions, and lets you choose which one you want to boot. Some of the MBRs also allow you to boot other drives.”

I read up on “Boot Control” and it looks to be really nice.

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.