[TAG] Re: [Answered] How to Locate the second stage boot loader.

[Benjamin A. Okopnik]

On Fri, Feb 18, 2005 at 12:31:29PM -0500, David.Smith at celera.com wrote:
> 
> >> If I look at the MBR can I determine where the second stage boot loader is
> >> located?
> >
> >Possibly, if you really feel like decoding the physical disk address,
> >and correlating that to your partition table and mounts. But it's
> >probably found in /boot/grub/.
> 
> I think this is the answer.  I'd have to decode the physical disk address.  I
> was kind of hoping that someone had done that or that you'd tell me the pointer
> /address was something like the last 6 bytes of the 446 byte code in the MBR.

Again, I haven't played that much with the MBRs created by the various
Linux boot managers, but I still recall some of the stuff from the DOS
MBR (I used to teach data recovery, and this was pretty important
stuff.) The MBR would copy itself into memory, parse the partition table
(which was part of that 512-byte block at 0,0,0 where the MBR lived) to
find the active partition, get the DBR from there, copy _it_ into memory
just below the MBR code, and exec it.

Google, as always, comes up with the exact procedure:

http://bootmaster.filerecovery.biz/appnote4.html

Note that the way GRUB, LILO, etc. do it is necessarily different;
however, there's much learning to be had from reading the relevant
assembler code.


* Ben Okopnik * Editor-in-Chief, Linux Gazette * http://linuxgazette.net *