Cixert Posted Wednesday at 10:29 PM Posted Wednesday at 10:29 PM (edited) For educational purposes, I've been trying to define the structure of an MBR disk with FAT partitions for some time now. I'm finding it increasingly difficult; each offset I note in the structure later reveals that it doesn't correspond to a pattern in different FAT32 and exFAT partitions. I'd like to initially focus on FAT32 partitions and then define the exFAT structure. Let's begin: Every source of information I find on the Internet is contradictory; I'm currently still examining official Microsoft information. The biggest doubt I have is regarding logical sector number 12; I can't find any information about it. The best clue I found was in this 2012 thread in which @DiracDeBroglie @jaclaz @Tripredacus discusses its contents. How to repair the BOOTSECTOR of a FAT32X active partition? https://msfn.org/board/topic/157262-how-to-repair-the-bootsector-of-a-fat32x-active-partition/ Which brings us to Starman's website, which claims that this sector 12 is only used when installing Windows XP. https://thestarman.pcministry.com/asm/mbr/ntFAT32brHexEd.htm https://thestarman.pcministry.com/asm/mbr/FAT32brcomp.htm I have to discuss this, as I don't install Windows XP; I copy the folders and files from an installation on another computer and paste them into my current installation using a generic chipset configuration. It's true that sometimes I do this with an image, but other times I simply unzip the files and folders to another hard drive, and the system works perfectly, and I do have sector 12 occupied. So, who creates sector 12, when, and for what purpose? Regarding VBR logical sectors 0, 1, and 2, these change depending on whether the partition is bootable or contains data. "A bootable partition can only have NTLR or contain an operating system". This is my current MBR disk structure: Disk 0 Primary Partition 1 -> FAT32 -> Boot Only, NTLDR, NTDETECT.COM, BOOT.INI Primary Partition 2 -> FAT32 -> Windows 2000 Primary Partition 3 -> FAT32 -> Windows XP Primary Partition 4 -> FAT32 -> Data Disk 1 Primary Partition 1 -> FAT32 -> Boot Only, BOOTMGR, and third-party loader. Primary Partition 2 -> NTFS -> Windows 7 Primary Partition 3 -> NTFS -> Windows 10 Primary Partition 4 -> FAT32 -> Data Disk 2, Disk 3... Three primary partitions and one extended partition with several logical partitions on disks with 512e logical sectors and 4096 logical sectors. In the following post I write what I have written down and more or less verified. Edited Wednesday at 11:58 PM by Cixert
Cixert Posted Wednesday at 11:48 PM Author Posted Wednesday at 11:48 PM (edited) Note: I don't know how to name the space between partitions; I'll name them relative physical sector 0. And I'll say that the partitions start at relative physical sector 63/64. I point out in blue what I have no knowledge about or the information available is not the same as what is seen with a binary editor like WinHex. MBR HARD DISK DIVISION WITH FAT32 PARTITIONS MBR Physical sector LBA 0 --> MBR (Master Boot Record) -Disk boot code (includes disk signature) -Partition table Entry 1 -Partition table Entry 2 -Partition table Entry 3 -Partition table Entry 4 -Boot signature 55AA Physical sector LBA 1 --> MBR copy on some hard disks, not on others. Physical sector LBA 2 --> Reserved boot sectors (empty space if using the original MBR) -Other boot loaders may occupy part of this space Note: On FAT12 disks, there is no MBR, only a primary partition. On hard drives, the VBR boot partition is the active partition specified in the partition table. PRIMARY PARTITIONS Physical sector LBA 63/64 --> 1st primary partition on hard drives. (Starting LBA) Logical Sector 0 --> VBR (Volume Boot Record) - Jump Instruction - OEM Name - EBPB (Extended BIOS Parameter Block) - Partition Boot Code - Boot Signature 55AA Logical Sector 1 --> FSInfo (File System Information) - FSInfo - Boot Signature 55AA Logical Sector 2 --> - "I don't know" - Boot Signature 55AA Logical Sector 3 --> Reserved Empty Space Logical Sectors 6, 7, and 8 --> VBR Copy Logical Sector 6 --> - Sector 0 Copy (VBR) Logical Sector 7 --> - Sector 1 Copy (FSInfo) Logical Sector 8 --> - Sector 2 Copy Logical Sector 9 --> Reserved empty space Logical sector 12 --> Only on boot partitions - "I don't know" Logical Sector 13 --> Reserved Empty Space Logical Sector 32? 33? 34? 38? --> FAT Tables -FAT 1 -FAT 1 slack -FAT 2 (copy of FAT 1) -FAT 2 slack Cluster 2 --> File System Volume -Root Directory Cluster 3 --> Files and directorys Last Logical Sector --> Slack Volume Relative Physical Sector 0 --> Optional Partition Gap (Empty Space) EXTENDED PARTITION (only one with multiple logical partitions) Relative Physical Sector 63/64 --> 1st Logical Partition (Starting LBA) Logical Sector 0,1, 2? --> EBR (Extended Boot Record) or EPBR (Extended Partition Boot Record) - Jump Instruction - OEM Name - EBPB (Extended BIOS Parameter Block) - Partition Boot Code - Partition table Entry 1 -> Current Logical Partition - Partition table Entry 2 -> Next Logical Partition (if any) (entries 3 and 4 empty) - Boot Signature 55AA (required) Logical Sectors 6, 7, and 8 --> EBR Copy Logical Sector 6 --> Empty in my partitions Logical Sector 7 --> Sector 1 Copy (FSInfo) Logical Sector 8 --> Sector 2 Copy Logical Sector 32 --> FAT Tables -FAT 1 -FAT 1 slack -FAT 2 (copy of FAT 1) -FAT 2 slack Cluster 2 --> File System Volume -Root Directory Cluster 3 --> Files and directorys Last Logical Sector --> Slack Volume Edited Wednesday at 11:56 PM by Cixert
Cixert Posted Thursday at 12:32 AM Author Posted Thursday at 12:32 AM (edited) Ok, so to the point 1- Does the content of the sectors depend on the program used to create the hard disk and the partitions? 2- Why do some MBRs have a copy of sector 0 in sector 1? 3- Why do some FAT tables start at logical sector 32, others at 33, 34, or 37? 4- Some partitioning programs don't create spaces between partitions. Doesn't this prevent proper alignment? 5- The truth is, I can't interpret the binary code; I only recognize the boot signature 55AA in bytes 510 and 511. Is there a table to guide me? Some programs list the VBR OEM name as MSDOS5.0, while others say MSWIN4.1. Although the names are the same, the content varies greatly on different hard disks. 6- When I create an MBR disk with the same program, all the FAT32 partitions appear to have the same content. But in the partitions I've previously created on other disks, I see completely different binary codes. It seems like the boot partitions only have -Jump instruction? To where? -OEM Name -EBPB? In which sector? -FSInfo? What does FSInfo contain? Sector 1 contains almost nothing. -What does sector 2 contain? -What does sector 12 contain that is only present in boot partitions? -Why is backup sector 6 empty in logical partitions? -What do sectors 0, 1, and 2 contain in logical partitions? I will give the example of two different sectors No. 12: Disk 0: Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 000001800 66 0F B6 46 10 66 8B 4E 24 66 F7 E1 66 03 46 1C f ¶F f‹N$f÷áf F 000001810 66 0F B7 56 0E 66 03 C2 66 89 46 FC 66 C7 46 F4 f ·V f Âf‰FüfÇFô 000001820 FF FF FF FF 66 8B 46 2C 66 83 F8 02 0F 82 A6 FC ÿÿÿÿf‹F,fƒø ‚¦ü 000001830 66 3D F8 FF FF 0F 0F 83 9C FC 66 50 66 83 E8 02 f=øÿÿ ƒœüfPfƒè 000001840 66 0F B6 5E 0D 8B F3 66 F7 E3 66 03 46 FC BB 00 f ¶^ ‹óf÷ãf Fü» 000001850 82 8B FB B9 01 00 E8 87 FC 38 2D 74 1E B1 0B 56 ‚‹û¹ è‡ü8-t ± V 000001860 BE 70 7D F3 A6 5E 74 1B 03 F9 83 C7 15 3B FB 72 ¾p}ó¦^t ùƒÇ ;ûr 000001870 E8 4E 75 DA 66 58 E8 65 00 72 BF 83 C4 04 E9 55 èNuÚfXèe r¿ƒÄ éU 000001880 FC 00 20 83 C4 04 8B 75 09 8B 7D 0F 8B C6 66 C1 ü ƒÄ ‹u ‹} ‹ÆfÁ 000001890 E0 10 8B C7 66 83 F8 02 0F 82 3A FC 66 3D F8 FF à ‹Çfƒø ‚:üf=øÿ 0000018A0 FF 0F 0F 83 30 FC 66 50 66 83 E8 02 66 0F B6 4E ÿ ƒ0üfPfƒè f ¶N 0000018B0 0D 66 F7 E1 66 03 46 FC BB 00 00 06 8E 06 81 80 f÷áf Fü» Ž € 0000018C0 E8 1D FC 07 66 58 C1 EB 04 01 1E 81 80 E8 0E 00 è ü fXÁë €è 0000018D0 0F 83 02 00 72 D0 8A 56 40 EA 00 00 00 20 66 C1 ƒ rЊV@ê fÁ 0000018E0 E0 02 E8 11 00 26 66 8B 01 66 25 FF FF FF 0F 66 à è &f‹ f%ÿÿÿ f 0000018F0 3D F8 FF FF 0F C3 BF 00 7E 66 0F B7 4E 0B 66 33 =øÿÿ ÿ ~f ·N f3 000001900 D2 66 F7 F1 66 3B 46 F4 74 3A 66 89 46 F4 66 03 Òf÷ñf;Fôt:f‰Fôf 000001910 46 1C 66 0F B7 4E 0E 66 03 C1 66 0F B7 5E 28 83 F f ·N f Áf ·^(ƒ 000001920 E3 0F 74 16 3A 5E 10 0F 83 AB FB 52 66 8B C8 66 ã t :^ ƒ«ûRf‹Èf 000001930 8B 46 24 66 F7 E3 66 03 C1 5A 52 8B DF B9 01 00 ‹F$f÷ãf ÁZR‹ß¹ 000001940 E8 9D FB 5A 8B DA C3 00 00 00 00 00 00 00 00 00 èûZ‹Úà 000001950 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000001960 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000001970 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000001980 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000001990 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000019A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000019B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000019C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000019D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000019E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000019F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA Uª Disk 4: Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 000001800 0D 0A 41 6E 20 6F 70 65 72 61 74 69 6E 67 20 73 An operating s 000001810 79 73 74 65 6D 20 77 61 73 6E 27 74 20 66 6F 75 ystem wasn't fou 000001820 6E 64 2E 20 54 72 79 20 64 69 73 63 6F 6E 6E 65 nd. Try disconne 000001830 63 74 69 6E 67 20 61 6E 79 20 64 72 69 76 65 73 cting any drives 000001840 20 74 68 61 74 20 64 6F 6E 27 74 0D 0A 63 6F 6E that don't con 000001850 74 61 69 6E 20 61 6E 20 6F 70 65 72 61 74 69 6E tain an operatin 000001860 67 20 73 79 73 74 65 6D 2E FF 00 00 00 00 00 00 g system.ÿ 000001870 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 66 f 000001880 0F B6 46 10 66 8B 4E 24 66 F7 E1 66 03 46 1C 66 ¶F f‹N$f÷áf F f 000001890 0F B7 56 0E 66 03 C2 66 89 46 FC 66 C7 46 F4 FF ·V f Âf‰FüfÇFôÿ 0000018A0 FF FF FF 66 8B 46 2C 66 83 F8 02 0F 82 47 FC 66 ÿÿÿf‹F,fƒø ‚Güf 0000018B0 3D F8 FF FF 0F 0F 83 3D FC 66 50 66 83 E8 02 66 =øÿÿ ƒ=üfPfƒè f 0000018C0 0F B6 5E 0D 8B F3 66 F7 E3 66 03 46 FC BB 00 82 ¶^ ‹óf÷ãf Fü» ‚ 0000018D0 8B FB B9 01 00 E8 28 FC 38 2D 74 1E B1 0B 56 BE ‹û¹ è(ü8-t ± V¾ 0000018E0 6D 7D F3 A6 5E 74 1B 03 F9 83 C7 15 3B FB 72 E8 m}ó¦^t ùƒÇ ;ûrè 0000018F0 4E 75 DA 66 58 E8 65 00 72 BF 83 C4 04 E9 F6 FB NuÚfXèe r¿ƒÄ éöû 000001900 00 20 83 C4 04 8B 75 09 8B 7D 0F 8B C6 66 C1 E0 ƒÄ ‹u ‹} ‹ÆfÁà 000001910 10 8B C7 66 83 F8 02 0F 82 DB FB 66 3D F8 FF FF ‹Çfƒø ‚Ûûf=øÿÿ 000001920 0F 0F 83 D1 FB 66 50 66 83 E8 02 66 0F B6 4E 0D ƒÑûfPfƒè f ¶N 000001930 66 F7 E1 66 03 46 FC BB 00 00 06 8E 06 00 81 E8 f÷áf Fü» Ž è 000001940 BE FB 07 66 58 C1 EB 04 01 1E 00 81 E8 0E 00 0F ¾û fXÁë è 000001950 83 02 00 72 D0 8A 56 40 EA 00 00 00 20 66 C1 E0 ƒ rЊV@ê fÁà 000001960 02 E8 11 00 26 66 8B 01 66 25 FF FF FF 0F 66 3D è &f‹ f%ÿÿÿ f= 000001970 F8 FF FF 0F C3 BF 00 7E 66 0F B7 4E 0B 66 33 D2 øÿÿ ÿ ~f ·N f3Ò 000001980 66 F7 F1 66 3B 46 F4 74 3A 66 89 46 F4 66 03 46 f÷ñf;Fôt:f‰Fôf F 000001990 1C 66 0F B7 4E 0E 66 03 C1 66 0F B7 5E 28 83 E3 f ·N f Áf ·^(ƒã 0000019A0 0F 74 16 3A 5E 10 0F 83 4C FB 52 66 8B C8 66 8B t :^ ƒLûRf‹Èf‹ 0000019B0 46 24 66 F7 E3 66 03 C1 5A 52 8B DF B9 01 00 E8 F$f÷ãf ÁZR‹ß¹ è 0000019C0 3E FB 5A 8B DA C3 00 00 00 00 00 00 00 00 00 00 >ûZ‹Úà 0000019D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000019E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000019F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA Uª Edited Thursday at 12:35 AM by Cixert
Tripredacus Posted Thursday at 02:01 PM Posted Thursday at 02:01 PM To get this out of the way, the MBR is a standard but all of the different tools do something a little different. Things are not really as documented as we'd like or perhaps they are but are stuck in the dead internet somewhere. As for specific tools and how they manipulate disks, some may be more generic or some may be based on an intended or observed use. For example a tool that was tested on a *nix vs a Windows 98 vs a Windows XP disk may write the bits a little differently. And unfortunately, a lot of what we know to be true is not found through any sort of documentation but through actual testing. My input on the linked thread was not so much in regards to the disk but rather the BCD aspect of things. At first I would consider to ask an LLM some of these questions but so far none I have experience with are any good at figuring out disk related questions of this sort because it is mostly theory and public LLMs are trained on support articles. I had considered running my own LLM and only train it on hard disk related info, but I don't have the time for such an endeavor.
Cixert Posted 15 hours ago Author Posted 15 hours ago 23 hours ago, Tripredacus said: To get this out of the way, the MBR is a standard but all of the different tools do something a little different. Things are not really as documented as we'd like or perhaps they are but are stuck in the dead internet somewhere. As for specific tools and how they manipulate disks, some may be more generic or some may be based on an intended or observed use. For example a tool that was tested on a *nix vs a Windows 98 vs a Windows XP disk may write the bits a little differently. And unfortunately, a lot of what we know to be true is not found through any sort of documentation but through actual testing. My input on the linked thread was not so much in regards to the disk but rather the BCD aspect of things. At first I would consider to ask an LLM some of these questions but so far none I have experience with are any good at figuring out disk related questions of this sort because it is mostly theory and public LLMs are trained on support articles. I had considered running my own LLM and only train it on hard disk related info, but I don't have the time for such an endeavor. Which do you consider to be the best LLM for technical questions? Do you know of any programs that translate the binary/hexadecimal code of boot sectors? Thank you. I read that Sector Inspector and Active Disk Editor might do this.
Tripredacus Posted 14 hours ago Posted 14 hours ago My experience is limited only having used Bard and Grok. Neither are good for technical questions about hard disks. That being said, both of those are good at general things like being able to read hex dumps or assembly. So just as an example, here are some info from Bard to your questions above but as I warned, you cannot take the answers as gospel. And there is a lot of fluff which I'll leave out. If it provides relevant links, I will post those. I prefaced the conversation about being relating to 2000/XP era. 2. Why do some MBRs have a copy of sector 0 in sector 1? Quote "Some MBR implementations did indeed store a backup copy of sector 0 in sector 1 as a rudimentary form of redundancy." So it doesn't actually answer the question really. All of these public LLMs are designed to add a bunch of explanatory content to answers as well. Sometimes the question needs to be re-worded as well. 3. Why do some FAT tables start at logical sector 32, others at 33, 34, or 37? Quote "The starting sector of the first File Allocation Table (FAT) in a FAT12 or FAT16 volume wasn't strictly fixed at logical sector 32. The actual starting point could vary due to several factors determined during the formatting process: - Number of Reserved Sectors: The sectors immediately following the Volume Boot Record (VBR) are reserved. - Size of the Boot Code: While the core boot code in the VBR is usually small, some implementations might have included slightly larger or custom boot loaders that required more than one sector. - Alignment Considerations (Less Common in Early FAT): In some cases, there might have been rudimentary attempts at aligning file system structures to certain boundaries - Formatting Utility Variations: Different disk formatting utilities, whether built into the operating system or third-party tools, might have had slightly different default settings or allowed users to specify the number of reserved sectors" Seems to be general information, no specifics. 4. Some partitioning programs don't create spaces between partitions. Doesn't this prevent proper alignment? Quote "when we talk about partitioning programs from the Windows 2000/XP era, the concept and importance of strict sector alignment between partitions weren't as critical as they are today. - CHS Addressing: Older systems often relied heavily on Cylinder-Head-Sector (CHS) addressing for disk geometry. Partition boundaries were frequently aligned to cylinder boundaries, which were relatively large units compared to individual sectors. - Smaller Sector Sizes: Standard sector size was 512 bytes. However, even back then, some partitioning tools did aim for some form of alignment, often to cylinder boundaries, even if they didn't explicitly create empty sectors between partitions." In this response it is doing a comparison to AFd/SSD/4Kn, so I left out the extra text it generated about the above items that was referencing modern implementations. Links provided: https://knowledge.broadcom.com/external/article/152308/alphabetical-list-of-ghost-command-line.html https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm look familiar? 5. My friend is having trouble interpreting the binary code in an MBR. He can only recognize the boot signature 55AA in bytes 510 and 511. Is there any reference material that can help him understand the boot code? Understanding the MBR Structure: Quote - The 512-byte Layout - Boot Code Area (Bytes 0-445) - Partition Table (Bytes 446-509 - Boot Signature (Bytes 510-511) Key Concepts for Interpreting Boot Code: - x86 Real Mode: The BIOS loads the MBR into memory at a specific address (usually 0x7C00) and executes it in 16-bit real mode. This means understanding the basics of x86 real mode addressing, registers (like AX, BX, CX, DX, SI, DI, CS, DS, ES, SS, IP) - BIOS Interrupts: The boot code often relies on BIOS interrupts (like INT 10h for video output and INT 13h for disk access) to perform basic functions Reference Materials: - Search "x86 bootloader" or "MBR analysis" in Github Repositories Tips: - Use a Disassembler. Tools like ndisasm (for Linux) can convert the raw binary MBR to assembly language instructions A good idea about searching in Github, of course, jaclaz could just come in here and answer all of these questions. 5.1. Why do some programs show the VBR OEM name as MSDOS5.0 while others show MSWIN4.1? The OEM name identifies the formatting tool's origin. MSDOS5.0 from MS DOS 5.0 and MSWIN4.1 from Windows 95 (OSR2) based tools. the LLM seems to indicate that MSWIN4.1 name means the file system supports VFAT/long filenames. I can't ask it about question 6 because I don't know what "the same program" refers to. Sector 12 (at least from my reading on the Starman site you linked earlier) has the NTLDR in it. 6.1: Why is backup sector 6 empty in logical partitions? It doesn't actually know the answer to this. LLMs typically won't have a response of "I don't know" and they end up speculating (or hallucinating) and I think the answers it gives to this question is one of those two results. It does provide one link that might be useful: https://sysplay.github.io/books/LinuxDrivers/book/Content/Part14.html 6.2 What do sectors 0, 1, and 2 contain in logical partitions? Quote Sector 0: Volume Boot Record (VBR) It contains: - Jump Code: A small sequence of instructions that tells the system where to find the main boot code. - OEM Identifier: An 8-byte string indicating the operating system or utility that formatted the volume (e.g., "MSDOS5.0" or "MSWIN4.1"). - BIOS Parameter Block (BPB): A data structure containing essential information about the file system layout on this specific volume. This includes details like: - Bytes per sector - Sectors per cluster - Number of reserved sectors - Number of FATs - Sectors per FAT - Total sectors in the volume - Sectors per track, number of heads - Hidden sectors (number of sectors before the start of this partition relative to the beginning of the physical drive) - Total logical sectors (for FAT32) - Physical drive number - Extended boot signature - Volume serial number - Volume label - File system type - Boot Code: The main boot program that will attempt to load the operating system or other bootable software from this partition. - Boot Signature (55 AA): Located at the very end of the sector (bytes 510-511), indicating a valid boot sector. Sector 1 and Sector 2 (and potentially more): Extensions of the VBR or Reserved Sectors - Immediately following the VBR in sector 0 are the reserved sectors. The number of reserved sectors is specified in the BPB within the VBR (typically at offset 0x0E for FAT16 and 0x0C for FAT12). - FAT12 and FAT16: Typically, the number of reserved sectors is small, often just 1. In these cases, sector 1 and sector 2 would be the very beginning of the File Allocation Table (FAT). The first copy of the FAT usually starts immediately after the reserved sectors. - FAT32: FAT32 often uses a larger number of reserved sectors (e.g., 32). In this scenario, sectors 1 and 2 (and many more) would still be part of the reserved area. This reserved area might contain: - Extended Boot Record Information: FAT32 often stores a backup copy of critical parts of the VBR in one of the subsequent reserved sectors for redundancy. The location of this backup is indicated within the primary VBR. - Other File System Specific Data: Depending on the implementation or any later extensions to the FAT32 file system, other metadata or information could potentially be stored in these reserved sectors. However, for basic FAT32, it's primarily the backup VBR. The further along questions during this instance seemed to get more helpful as time went on. If you have a google account you can talk to this LLM here: https://gemini.google.com/ While people seem split on using an AI/LLM for anything for various reasons, a few things are clear. First, they are just a tool and second this is (currently) where the future of the internet or computing is going. So I personally feel that people should get experience in dealing with these things, to understand how to read their responses, understand how to word things for interaction, etc. I have posted some of my own observations in this thread about that. And worst case scenario, maybe the future will be like that meme where the robot overlord spares the human from being killed because they used to talk online years ago.
Cixert Posted 9 hours ago Author Posted 9 hours ago 3 hours ago, Tripredacus said: My experience is limited only having used Bard and Grok. Neither are good for technical questions about hard disks. That being said, both of those are good at general things like being able to read hex dumps or assembly. So just as an example, here are some info from Bard to your questions above but as I warned, you cannot take the answers as gospel. And there is a lot of fluff which I'll leave out. If it provides relevant links, I will post those. I prefaced the conversation about being relating to 2000/XP era. 2. Why do some MBRs have a copy of sector 0 in sector 1? So it doesn't actually answer the question really. All of these public LLMs are designed to add a bunch of explanatory content to answers as well. Sometimes the question needs to be re-worded as well. 3. Why do some FAT tables start at logical sector 32, others at 33, 34, or 37? Seems to be general information, no specifics. 4. Some partitioning programs don't create spaces between partitions. Doesn't this prevent proper alignment? In this response it is doing a comparison to AFd/SSD/4Kn, so I left out the extra text it generated about the above items that was referencing modern implementations. Links provided: https://knowledge.broadcom.com/external/article/152308/alphabetical-list-of-ghost-command-line.html https://thestarman.pcministry.com/asm/mbr/NTFSBR.htm look familiar? 5. My friend is having trouble interpreting the binary code in an MBR. He can only recognize the boot signature 55AA in bytes 510 and 511. Is there any reference material that can help him understand the boot code? Understanding the MBR Structure: A good idea about searching in Github, of course, jaclaz could just come in here and answer all of these questions. 5.1. Why do some programs show the VBR OEM name as MSDOS5.0 while others show MSWIN4.1? The OEM name identifies the formatting tool's origin. MSDOS5.0 from MS DOS 5.0 and MSWIN4.1 from Windows 95 (OSR2) based tools. the LLM seems to indicate that MSWIN4.1 name means the file system supports VFAT/long filenames. I can't ask it about question 6 because I don't know what "the same program" refers to. Sector 12 (at least from my reading on the Starman site you linked earlier) has the NTLDR in it. 6.1: Why is backup sector 6 empty in logical partitions? It doesn't actually know the answer to this. LLMs typically won't have a response of "I don't know" and they end up speculating (or hallucinating) and I think the answers it gives to this question is one of those two results. It does provide one link that might be useful: https://sysplay.github.io/books/LinuxDrivers/book/Content/Part14.html 6.2 What do sectors 0, 1, and 2 contain in logical partitions? The further along questions during this instance seemed to get more helpful as time went on. If you have a google account you can talk to this LLM here: https://gemini.google.com/ While people seem split on using an AI/LLM for anything for various reasons, a few things are clear. First, they are just a tool and second this is (currently) where the future of the internet or computing is going. So I personally feel that people should get experience in dealing with these things, to understand how to read their responses, understand how to word things for interaction, etc. I have posted some of my own observations in this thread about that. And worst case scenario, maybe the future will be like that meme where the robot overlord spares the human from being killed because they used to talk online years ago. My experience with openAI GPT-4 is that it invents most things. Just as it predicts the most logical word in natural language, it also predicts the most logical technical data, which leads us to mix philosophy with mathematics. If humanity relies on this without cross-checking the information, it will clearly lead to an evolutionary regression, in my opinion. I've managed to extract a lot of information from it, but after a lot of fighting, telling GPT-4 that it's false, that it's not like that, etc. Perhaps years ago I wouldn't have been able to obtain the information it has provided, and now I find myself needing to use it... because I have 3 computers, each with 4 operating systems, 10 browsers on each operating system, and 1,500 open tabs on each one, waiting to be read. Of course, I can't open a thousand more tabs to search for more information, so I struggle with chatGPT until it loops or I reach the point where chatGPT first tells me one thing, then another, and then tells me the first thing again. Since I realized everything was false regarding the sectors, here we are in this forum, reading starman's website, which is certainly more useful. The worst part is when I pass it machine code, it tells me to read it, but in reality, it's searching the internet for the result of reading a code different from mine. On starman's website, I read that both MBR and VBR are dynamic and modifiable by the operating system, so that question is resolved; I just need to know when they are modified. From what I read, in Windows there is a file with the MBR code called "dmadmin exe." I used the Active Disk Editor program, and it gave me the meaning of all the bytes in sector 0 MBR and sector 0 VBR. But it doesn't give any information about sectors 1 and beyond. I've seen a screenshot of another program on this forum that gives information about the bytes in sectors, but I don't know its name and I'd like someone to tell me. Wait a minute, I can't find the link now. I'll reboot with another operating system where I have this tab open. I'm currently on 7 because Active Disk Editor resets the disks when I open it in XP, even though the website says it's XP compatible. I'll reboot with XP and post back.
Cixert Posted 9 hours ago Author Posted 9 hours ago (edited) This program in this post, Which is? https://msfn.org/board/topic/177176-mbr-gpt-drive-dissection/page/2/#findComment-1146865 Edited 9 hours ago by Cixert
deomsh Posted 8 hours ago Posted 8 hours ago (edited) Probably a script from Jaclaz: view_bs_008.zip look at https://msfn.org/board/topic/152097-on-superfloppies-and-their-images/page/11/#findComment-1001712 Edited 8 hours ago by deomsh
Recommended Posts
Please sign in to comment
You will be able to leave a comment after signing in
Sign In Now