JustKernel

Today, I was debugging a file system filter driver and noted that Windows OS generating reads for disk offsets that that were greater than size of track zero (MBR) and less than start of first partition. I couldn’t figure out what lies in this unknown area.
Basically the disk that I report to OS has been created by my organization and I doubted that we may be reporting the wrong MBR information that’s why getting wrong read requests for the OS. Thus I read wiki articles to understand it and now I am explaining that. How the OS gets the disk and partition size information from MBR and how the CHS addressing work.

Sample data: MBR + 0x1BE : ie start of the Partitin Entry.

FFFFD081`F988F190 : 80 20 21 00 07 DD 1E 3F 00 08 00 00 00 A0 0F 00 00 DD 1F 3F 07 FE FF FF 00 A8 0F 00 00 50 10 03 00 00 ng.system.Missing.operating.system…c{………!….?………..?………P….

0x80: status of the physical drive

0x20 0x21 0x00 : Head : 0x20 , Cylinder 0x21: bit 0 – 5 of : 0010 0001 , bit 6 & 7 i.e 00 become become 8th and 9th bit of the sector. Sector: 0x00 and 8th and 9th bit which is also 00 –> 00 0000 0000

0x07 : Partition Type

0xDD 0x1E 0x3F Head 0xDD, Cylinder: 0x1E : 0 -5 th bit of : 0001 1110, bit 6 & 7 ie 00 becomes 8th and 9th bit of sector. Sector: 0x3F & 8th and 9th bit whi is 00 —> 00 0011 1111

0x 00 08 00 00 : Its intel so in little Endian: Starting address of partition: 0x 00 00 08 00 * size of sector: 1MB (LBA)

0x 00 A0 0F 00 : Total size of partition : again in little endian so 0x 00 0F A0 00 : 0x000FA000 * (size of sector)500 MB. (Total Sectors)

mail you query: anshul_makkar@justkernel.com

Tags: interpreting MBR + disk + partition size + CHS