Master boot record
Encyclopedia
A master boot record is a type of boot sector
popularized by the IBM Personal Computer. It consists of a sequence of 512 byte
s located at the first sector
of a data storage device
such as a hard disk
. MBRs are usually placed on storage devices intended for use with IBM PC-compatible systems.
The MBR may be used for one or more of the following:
Because of the broad popularity of PC-compatible computers, the MBR format is widely used, to the extent of being supported by computer operating systems in addition to other pre-existing or cross-platform
standards for bootstrapping and partitioning.
IBM
PC-DOS
introduced the conventional IBM PC
(
The partitions themselves may also contain data to describe more complex partitioning schemes, such as extended boot records (EBRs), BSD disklabel
s, or Logical Disk Manager
metadata partitions.
The MBR is not located in a partition; it is located at a first sector of the device (physical offset 0), preceding the first partition. The boot sector present on a non-partitioned device or within an individual partition is called a volume boot record
. In cases where the computer is running a BIOS overlay
or boot manager, the partition table may be moved to some other physical location on the device; e.g., Ontrack Disk Manager
often placed a copy of the original MBR contents in the second sector, then hid itself from any subsequently booted OS or application, so the MBR copy was treated as if it were still residing in the first sector.
By convention, there are exactly four primary partition table entries in the MBR partition table scheme, although some defunct operating systems extended this to five (PTS-DOS) or even eight (AST or NEC DOS) entries.
An artifact of hard disk technology from the era of the IBM PC
, the partition table subdivides a storage medium using units of cylinders
, heads
, and sectors
(CHS
addressing). These values no longer correspond to their namesakes in modern disk drives, and other devices such as solid-state drive
s do not physically have cylinders or heads.
Sector indices have always begun with a 1, not a zero, and due to an early error in MS-DOS, the heads are generally limited to 255 instead of 256. Both the partition length and partition start address are sector values stored as 32-bit quantities. The sector size is fixed at 512 (29) bytes, which implies that either the maximum size of a partition or the maximum start address (both in bytes) cannot exceed 2 TB−512 bytes (2,199,023,255,040 bytes or 4,294,967,295 (232−1) sectors × 512 (29) bytes per sector). Alleviating this capacity limitation was one of the prime motivations for the development of the GUID partition table
(GPT).
When a CHS address is too large to fit into these fields, the tuple
(1023, 254, 63) is used (if the situation involves a "protective" MBR on a disk with a GPT, Intel's Extensible Firmware Interface
specification requires that the tuple (1023, 255, 63) be used). The 10-bit cylinder value is recorded within two bytes in order to facilitate making calls to the original/legacy INT 13h BIOS disk access routines, where 16 bits were divided into sector and cylinder parts, and not on byte boundaries.
Where a data storage device has been partitioned with the GUID partition table (GPT) scheme, the master boot record will still contain a partition table, but its only purpose is to indicate the existence of the GPT and to prevent utility programs which understand only the MBR partition table scheme from creating any partitions in what they would otherwise see as free space on the disk, thereby accidentally erasing the GPT.
contained within the ROM
BIOS
loads and executes the master boot record. The original IBM PC
used an Intel 8088
microprocessor. In order to remain compatible with the 8088, all x86 architecture systems start with the microprocessor in an operating mode referred to as real mode
. Thus, the beginning of the MBR is expected to contain real mode machine language
instructions. The BIOS reads the MBR from the storage device into physical memory, and then directs the microprocessor to the start of the boot code.
Due to the restricted size of the MBR's code section, it typically contains only a small program that copies additional code (such as a boot loader) from the storage device into memory. Control is then passed to this code, which is responsible for loading the actual operating system. This process is known as chain loading
.
Popular MBR code programs were created for booting PC DOS and MS-DOS
, and similar boot code remains in wide use. These boot sectors expect the
(VBR) of the active partition.
There are alternative boot code implementations, some of which are installed by boot managers, which operate in a variety of ways. Some MBR code loads additional code for a boot manager from the first track of the disk, which it assumes to be "free" space that is not allocated to any disk partition, and executes it. A MBR program may interact with the user to determine which partition on which drive should boot, and may transfer control to the MBR of a different drive. Other MBR code contains a list of disk locations (often corresponding to the contents of files
in a filesystem) of the remainder of the boot manager code to load and to execute. (The first relies on behavior that is not universal across all disk partitioning utilities, most notably those which read and write GPT
s. The last requires that the embedded list of disk locations be updated when changes are made that would relocate the remainder of the code.)
On machines that do not use x86 processors, or on x86 machines with non-BIOS firmware such as Open Firmware
or Extensible Firmware Interface
(EFI) firmware, this design is unsuitable, and the MBR is not used as part of the system bootstrap. EFI firmware is instead capable of directly understanding the GPT
partitioning scheme and the FAT
filesystem format, and loads and runs programs held as files in the EFI System partition
. The MBR will be involved only insofar as it might contain a partition table for compatibility purposes if the GPT partition table scheme has been used.
There is some MBR replacement code that emulates EFI firmware's bootstrap, which makes non-EFI machines capable of booting from disks using the GPT partitioning scheme. It detects a GPT, places the processor in the correct operating mode, and loads the EFI compatible code from disk to complete this task.
In addition to the bootstrap code and a partition table, master boot records may contain a Windows NT
disk signature. This is a 32-bit value that is intended to identify uniquely the disk medium (as opposed to the disk unit — the two not necessarily being the same for removable hard disks).
The disk signature was introduced by Windows NT version 3.5, but is now used by several operating systems, including the Linux
kernel version 2.6 and later. Linux uses the NT disk signature at boot time to determine the location of the boot volume.
Windows NT (and later Microsoft operating systems) uses the disk signature as an index to all the partitions on any disk ever connected to the computer under that OS; these signatures are kept in registry
keys, primarily for storing the persistent mappings between disk partitions and drive letters. It may also be used in boot.ini files (though most do not), to describe the location of bootable Windows NT (or later) partitions. One key (among many) where NT disk signatures appear in a Windows 2000/XP registry is:
HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\
If a disk's signature stored in the MBR was
A8 E1 B9 D2 00 7E 00 00 00 00 00 00
The first four bytes are said disk signature. (Note: In other keys, these bytes may appear in reverse order from that found in the MBR sector.) These are followed by eight more bytes, forming a 64-bit integer, in little endian
notation, which are used to locate the byte offset of this partition. In this case,
If this disk had another partition with the values
Starting with Windows Vista
, the disk signature is also stored in the Boot Configuration Data (BCD) store and the boot process depends on it . If the disk signature changes, cannot be found or has a conflict, Windows is unable to boot.
. IBM PC-compatible computers are little-endian
, which means numeric values spanning two or more bytes are stored by the processor in reverse order in memory. The format of the MBR on media reflects this convention. Thus, the MBR signature will appear in a disk editor
as the sequence
The bootstrap sequence in the BIOS will load the first valid MBR that it finds into the computer's physical memory at address
0x7C00. The last instruction executed in the BIOS code will be a "jump" to that address, to direct execution to the beginning of the MBR copy. The primary validation for most BIOSes is the 0xAA55 signature on the end, although a BIOS implementor may choose to include other checks, such verifying that the MBR contains a valid partition table without entries referring to sectors beyond the reported capacity of the disk.
While the MBR boot sector
code expects to be loaded at physical address 0x7C00, all the memory from physical address 0x501 (address 0x500 is the last one used by a Phoenix BIOS) to somewhere short of 0x9FFFF (below any EBDA) is typically available in real mode (a total of up to 640 KB minus the first 1281 bytes of memory); very old machines may have less than 640 KB (0xA0000 or 655,360 bytes) of memory, and newer machines may allocate significant amounts of memory for use by the BIOS. The INT 12h BIOS interrupt call
may help in determining how much memory can be allocated safely (it simply reads the base memory size in KiB from segment:offset location 0040h:0013h). In theory, only 64255 bytes are guaranteed (beginning at 0x501 and ending at 0x0FFFF); in practice it is safe to assume at least 391935 bytes (ending at 0x5FFFF) are available on modern hardware.
The last 72 bytes of the 512 byte MBR are reserved for the partition table and other information, so the MBR boot sector program must be small enough to fit within 440 bytes of memory. The MBR code may communicate with the user, examine the partition table, or perform some housekeeping tasks such as enabling the A20 line
, or changing the processor's operating mode from real mode to unreal mode
. Eventually, the MBR will need to perform its main task, and load the program that will perform the next stage of the boot process, usually by making use of INT 13h BIOS calls
.
As stated above, the conventional MBR bootstrap code loads and runs (boot loader or operating system dependent) volume boot record
code that is located at the beginning of the "active" partition. A conventional volume boot record is only one sector long, but it is safe for MBR code to load additional sectors to accommodate boot loaders longer than one sector. Like the MBR, a volume boot record often expects to be loaded at address 0x7C00. Since this is the same location where the MBR is loaded, one of the first tasks of an MBR is usually to relocate itself somewhere else in memory —most often at 0x600 (for MS-DOS MBR code).
The Status field in a non-extended partition table record is used to indicate an active partition. The status field in an extended partition table record may also be used by boot manager programs to determine which partitions are bootable, although values other than 0x00 and 0x80 are undefined and the bootstrap program may display an error message upon encountering unrecognized values. In practice, their parsing depends upon what the actual bootstrap code within the MBR has been coded to accept: some MBR bootstrap programs specifically look for the value 0x80 to indicate the bootable partition, others simply look for a non-zero value, and yet others look for any value with the highest bit
set.
s in the MBR sector directly using various disk editor
s, there are tools to write fixed sets of functioning code to the MBR. Since MS-DOS 5.0, the program fdisk
has included the switch
and Windows XP
, the Recovery Console
can be used to write new MBR code to a storage device using its
and Windows 7, the Recovery Environment can be used to write new MBR code using the
Some third-party utilities may also be used for directly editing the contents of partition tables (without requiring any knowledge of hexadecimal or disk/sector editors), such as MBRWizard
.
, ms-sys may be used to install a standard MBR. The GRUB and LILO
projects have tools for writing code to the MBR sector, namely
Various programs are able to create a "backup
" of both the primary partition table and the logical partitions in the extended partition.
Linux sfdisk (on a SystemRescueCD
) is able to save a backup of the primary and extended partition table. It creates a file that can be read in a text editor, or this file can be used by sfdisk to restore the primary/extended partition table. An example command to back up the partition table is
Boot sector
A boot sector or boot block is a region of a hard disk, floppy disk, optical disc, or other data storage device that contains machine code to be loaded into random-access memory by a computer system's built-in firmware...
popularized by the IBM Personal Computer. It consists of a sequence of 512 byte
Byte
The byte is a unit of digital information in computing and telecommunications that most commonly consists of eight bits. Historically, a byte was the number of bits used to encode a single character of text in a computer and for this reason it is the basic addressable element in many computer...
s located at the first sector
Disk sector
In computer disk storage, a sector is a subdivision of a track on a magnetic disk or optical disc. Each sector stores a fixed amount of user data. Traditional formatting of these storage media provides space for 512 bytes or 2048 bytes of user-accessible data per sector...
of a data storage device
Data storage device
thumb|200px|right|A reel-to-reel tape recorder .The magnetic tape is a data storage medium. The recorder is data storage equipment using a portable medium to store the data....
such as a hard disk
Hard disk
A hard disk drive is a non-volatile, random access digital magnetic data storage device. It features rotating rigid platters on a motor-driven spindle within a protective enclosure. Data is magnetically read from and written to the platter by read/write heads that float on a film of air above the...
. MBRs are usually placed on storage devices intended for use with IBM PC-compatible systems.
The MBR may be used for one or more of the following:
- Holding a partition tablePartition tableThe term partition table is most commonly associated with partition table but it may be used generically to refer to other "formats" that divide a disk drive into partitions, such as: GUID Partition Table, Apple partition map, or BSD disklabel.An alternative term to generically refer to partition...
, which describes the partitionsDisk partitioningDisk partitioning is the act of dividing a hard disk drive into multiple logical storage units referred to as partitions, to treat one physical disk drive as if it were multiple disks. Partitions are also termed "slices" for operating systems based on BSD, Solaris or GNU Hurd...
of a storage device. In this context the boot sector may also be called a partition sector. - Bootstrapping an operating systemOperating systemAn operating system is a set of programs that manage computer hardware resources and provide common services for application software. The operating system is the most important type of system software in a computer system...
. The BIOSBIOSIn IBM PC compatible computers, the basic input/output system , also known as the System BIOS or ROM BIOS , is a de facto standard defining a firmware interface....
built into a PC-compatible computer loads the MBR from the storage deviceData storage devicethumb|200px|right|A reel-to-reel tape recorder .The magnetic tape is a data storage medium. The recorder is data storage equipment using a portable medium to store the data....
and passes execution to machine codeMachine codeMachine code or machine language is a system of impartible instructions executed directly by a computer's central processing unit. Each instruction performs a very specific task, typically either an operation on a unit of data Machine code or machine language is a system of impartible instructions...
instructions at the beginning of the MBR. - Uniquely identifying individual disk media, with a 32-bit disk signature, even though it may never be used by the operating system.
Because of the broad popularity of PC-compatible computers, the MBR format is widely used, to the extent of being supported by computer operating systems in addition to other pre-existing or cross-platform
Cross-platform
In computing, cross-platform, or multi-platform, is an attribute conferred to computer software or computing methods and concepts that are implemented and inter-operate on multiple computer platforms...
standards for bootstrapping and partitioning.
| Address | Description | Size in byte Byte The byte is a unit of digital information in computing and telecommunications that most commonly consists of eight bits. Historically, a byte was the number of bits used to encode a single character of text in a computer and for this reason it is the basic addressable element in many computer... s |
|||
|---|---|---|---|---|---|
| Hex Hexadecimal In mathematics and computer science, hexadecimal is a positional numeral system with a radix, or base, of 16. It uses sixteen distinct symbols, most often the symbols 0–9 to represent values zero to nine, and A, B, C, D, E, F to represent values ten to fifteen... |
Oct Octal The octal numeral system, or oct for short, is the base-8 number system, and uses the digits 0 to 7. Numerals can be made from binary numerals by grouping consecutive binary digits into groups of three... |
Dec Decimal The decimal numeral system has ten as its base. It is the numerical base most widely used by modern civilizations.... |
|||
0000 |
0000 |
0 | code area | 440 (max. 446) |
|
01B8 |
0670 |
440 | disk signature (optional) | 4 | |
01BC |
0674 |
444 | Usually nulls; 0x0000 | 2 | |
01BE |
0676 |
446 | Table of primary partitions (Four 16-byte entries, IBM partition table scheme) |
64 | |
01FE |
0776 |
510 | 55h | MBR signature | 2 |
01FF |
0777 |
511 | AAh | ||
| MBR, total size: 446 + 64 + 2 = | 512 | ||||
Disk partitioning
| Offset | Field length (bytes) | Description | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 0x00 | 1 | status (0x80 = bootable (active), 0x00 = non-bootable, other = invalid ) | |||||||||||||||||
| 0x01 | 3 | CHS address Cylinder-head-sector Cylinder-head-sector, also known as CHS, was an early method for giving addresses to each physical block of data on a hard disk drive. In the case of floppy drives, for which the same exact diskette medium can be truly low-level formatted to different capacities, this is still true.Though CHS... of first absolute sector in partition. The format is described by 3 bytes, see the next 3 rows. |
|||||||||||||||||
| 0x01 | 1 | EWLINE
|
|||||||||||||||||
| 0x02 | 1 | EWLINE
|
|||||||||||||||||
| 0x03 | 1 | EWLINE
|
|||||||||||||||||
| 0x04 | 1 | Partition type Partition type This is not an exhaustive list, notably ambiguous or obscure partition types are not covered.... |
|||||||||||||||||
| 0x05 | 3 | CHS address Cylinder-head-sector Cylinder-head-sector, also known as CHS, was an early method for giving addresses to each physical block of data on a hard disk drive. In the case of floppy drives, for which the same exact diskette medium can be truly low-level formatted to different capacities, this is still true.Though CHS... of last absolute sector in partition. The format is described by 3 bytes, see the next 3 rows. |
|||||||||||||||||
| 0x05 | 1 | EWLINE
|
|||||||||||||||||
| 0x06 | 1 | EWLINE
|
|||||||||||||||||
| 0x07 | 1 | EWLINE
|
|||||||||||||||||
| 0x08 | 4 | LBA Logical block addressing Logical block addressing is a common scheme used for specifying the location of blocks of data stored on computer storage devices, generally secondary storage systems such as hard disks.... of first absolute sector in the partition |
|||||||||||||||||
| 0x0C | 4 | Number of sectors in partition, in little-endian format | |||||||||||||||||
| Notes: a Formally, status values other than 0x00 and 0x80 are undefined. b Starting Sector fields are limited to 1023+1 cylinders, 255+1 heads, and 63 sectors; Ending Sector fields have the same limitations. c The range for sector is 1 through 63; the range for cylinder is 0 through 1023; the range for head is 0 through 255 inclusive. d Used by OSes in certain circumstances; in such cases the CHS addresses are ignored. |
|||||||||||||||||||
IBM
IBM
International Business Machines Corporation or IBM is an American multinational technology and consulting corporation headquartered in Armonk, New York, United States. IBM manufactures and sells computer hardware and software, and it offers infrastructure, hosting and consulting services in areas...
PC-DOS
PC-DOS
IBM PC DOS is a DOS system for the IBM Personal Computer and compatibles, manufactured and sold by IBM from the 1980s to the 2000s....
introduced the conventional IBM PC
IBM PC
The IBM Personal Computer, commonly known as the IBM PC, is the original version and progenitor of the IBM PC compatible hardware platform. It is IBM model number 5150, and was introduced on August 12, 1981...
(
fdiskFdiskOn personal computer operating systems, fdisk is a commonly used name for a command-line utility that provides disk partitioning functions...
) partitioning scheme, which took advantage of the space reserved for the master boot record. When a storage device has been partitioned with this scheme, its MBR contains a partition table describing the locations, sizes, and other attributes of linear regions referred to as partitions.The partitions themselves may also contain data to describe more complex partitioning schemes, such as extended boot records (EBRs), BSD disklabel
BSD disklabel
In BSD-derived computer operating systems and in related operating systems such as SunOS, a disklabel is a record stored on a data storage device such as a hard disk that contains information about the location of the partitions on the disk. Disklabels were introduced in the 4.3BSD-Tahoe release...
s, or Logical Disk Manager
Logical Disk Manager
The Logical Disk Manager is an implementation of a logical volume manager for Microsoft Windows NT, developed by Microsoft and Veritas Software. It was introduced with the Windows 2000 operating system, and is supported in Windows XP, Windows Server 2003, Windows Vista and Windows 7...
metadata partitions.
The MBR is not located in a partition; it is located at a first sector of the device (physical offset 0), preceding the first partition. The boot sector present on a non-partitioned device or within an individual partition is called a volume boot record
Volume Boot Record
A volume boot record is a type of boot sector introduced by the IBM Personal Computer...
. In cases where the computer is running a BIOS overlay
Interrupt vector
An interrupt vector is the memory address of an interrupt handler, or an index into an array called an interrupt vector table that contains the memory addresses of interrupt handlers...
or boot manager, the partition table may be moved to some other physical location on the device; e.g., Ontrack Disk Manager
Disk Manager
Disk Manager was a popular 1980s and 1990s software and documentation package for MS-DOS and PC DOS computers, useful for self-installing PC hard disks...
often placed a copy of the original MBR contents in the second sector, then hid itself from any subsequently booted OS or application, so the MBR copy was treated as if it were still residing in the first sector.
By convention, there are exactly four primary partition table entries in the MBR partition table scheme, although some defunct operating systems extended this to five (PTS-DOS) or even eight (AST or NEC DOS) entries.
An artifact of hard disk technology from the era of the IBM PC
IBM PC
The IBM Personal Computer, commonly known as the IBM PC, is the original version and progenitor of the IBM PC compatible hardware platform. It is IBM model number 5150, and was introduced on August 12, 1981...
, the partition table subdivides a storage medium using units of cylinders
Cylinder (disk drive)
A disk drive cylinder is a division of data in a disk drive, as used in the CHS addressing mode of a Fixed Block Architecture disk or the cylinder–head–record addressing mode of a CKD disk. The concept is concentric, hollow, cylindrical slices through the physical disks , collecting the respective...
, heads
Disk read-and-write head
Disk read/write heads are the small parts of a disk drive, that move above the disk platter and transform platter's magnetic field into electrical current or vice versa – transform electrical current into magnetic field...
, and sectors
Disk sector
In computer disk storage, a sector is a subdivision of a track on a magnetic disk or optical disc. Each sector stores a fixed amount of user data. Traditional formatting of these storage media provides space for 512 bytes or 2048 bytes of user-accessible data per sector...
(CHS
Cylinder-head-sector
Cylinder-head-sector, also known as CHS, was an early method for giving addresses to each physical block of data on a hard disk drive. In the case of floppy drives, for which the same exact diskette medium can be truly low-level formatted to different capacities, this is still true.Though CHS...
addressing). These values no longer correspond to their namesakes in modern disk drives, and other devices such as solid-state drive
Solid-state drive
A solid-state drive , sometimes called a solid-state disk or electronic disk, is a data storage device that uses solid-state memory to store persistent data with the intention of providing access in the same manner of a traditional block i/o hard disk drive...
s do not physically have cylinders or heads.
Sector indices have always begun with a 1, not a zero, and due to an early error in MS-DOS, the heads are generally limited to 255 instead of 256. Both the partition length and partition start address are sector values stored as 32-bit quantities. The sector size is fixed at 512 (29) bytes, which implies that either the maximum size of a partition or the maximum start address (both in bytes) cannot exceed 2 TB−512 bytes (2,199,023,255,040 bytes or 4,294,967,295 (232−1) sectors × 512 (29) bytes per sector). Alleviating this capacity limitation was one of the prime motivations for the development of the GUID partition table
GUID Partition Table
In computer hardware, GUID Partition Table is a standard for the layout of the partition table on a physical hard disk. Although it forms a part of the Extensible Firmware Interface standard , it is also used on some BIOS systems because of the limitations of MBR partition tables, which restrict...
(GPT).
When a CHS address is too large to fit into these fields, the tuple
Tuple
In mathematics and computer science, a tuple is an ordered list of elements. In set theory, an n-tuple is a sequence of n elements, where n is a positive integer. There is also one 0-tuple, an empty sequence. An n-tuple is defined inductively using the construction of an ordered pair...
(1023, 254, 63) is used (if the situation involves a "protective" MBR on a disk with a GPT, Intel's Extensible Firmware Interface
Extensible Firmware Interface
The Unified Extensible Firmware Interface is a specification that defines a software interface between an operating system and platform firmware...
specification requires that the tuple (1023, 255, 63) be used). The 10-bit cylinder value is recorded within two bytes in order to facilitate making calls to the original/legacy INT 13h BIOS disk access routines, where 16 bits were divided into sector and cylinder parts, and not on byte boundaries.
Where a data storage device has been partitioned with the GUID partition table (GPT) scheme, the master boot record will still contain a partition table, but its only purpose is to indicate the existence of the GPT and to prevent utility programs which understand only the MBR partition table scheme from creating any partitions in what they would otherwise see as free space on the disk, thereby accidentally erasing the GPT.
System bootstrapping
On IBM PC-compatible computers, the bootstrapping firmwareFirmware
In electronic systems and computing, firmware is a term often used to denote the fixed, usually rather small, programs and/or data structures that internally control various electronic devices...
contained within the ROM
Read-only memory
Read-only memory is a class of storage medium used in computers and other electronic devices. Data stored in ROM cannot be modified, or can be modified only slowly or with difficulty, so it is mainly used to distribute firmware .In its strictest sense, ROM refers only...
BIOS
BIOS
In IBM PC compatible computers, the basic input/output system , also known as the System BIOS or ROM BIOS , is a de facto standard defining a firmware interface....
loads and executes the master boot record. The original IBM PC
IBM PC
The IBM Personal Computer, commonly known as the IBM PC, is the original version and progenitor of the IBM PC compatible hardware platform. It is IBM model number 5150, and was introduced on August 12, 1981...
used an Intel 8088
Intel 8088
The Intel 8088 microprocessor was a variant of the Intel 8086 and was introduced on July 1, 1979. It had an 8-bit external data bus instead of the 16-bit bus of the 8086. The 16-bit registers and the one megabyte address range were unchanged, however...
microprocessor. In order to remain compatible with the 8088, all x86 architecture systems start with the microprocessor in an operating mode referred to as real mode
Real mode
Real mode, also called real address mode, is an operating mode of 80286 and later x86-compatible CPUs. Real mode is characterized by a 20 bit segmented memory address space and unlimited direct software access to all memory, I/O addresses and peripheral hardware...
. Thus, the beginning of the MBR is expected to contain real mode machine language
Machine code
Machine code or machine language is a system of impartible instructions executed directly by a computer's central processing unit. Each instruction performs a very specific task, typically either an operation on a unit of data Machine code or machine language is a system of impartible instructions...
instructions. The BIOS reads the MBR from the storage device into physical memory, and then directs the microprocessor to the start of the boot code.
Due to the restricted size of the MBR's code section, it typically contains only a small program that copies additional code (such as a boot loader) from the storage device into memory. Control is then passed to this code, which is responsible for loading the actual operating system. This process is known as chain loading
Chain loading
Chain loading is a method used by computer programs to replace the currently executing program with a new program, using a common data area to pass information from the current program to the new program. It occurs in several areas of computing.Chain loading is similar to the use of overlays...
.
Popular MBR code programs were created for booting PC DOS and MS-DOS
MS-DOS
MS-DOS is an operating system for x86-based personal computers. It was the most commonly used member of the DOS family of operating systems, and was the main operating system for IBM PC compatible personal computers during the 1980s to the mid 1990s, until it was gradually superseded by operating...
, and similar boot code remains in wide use. These boot sectors expect the
fdisk partition table scheme to be in use, and scans the list of partitions in the MBR's embedded partition table to find the only one that is marked with the active flag. It then loads and runs the volume boot recordVolume Boot Record
A volume boot record is a type of boot sector introduced by the IBM Personal Computer...
(VBR) of the active partition.
There are alternative boot code implementations, some of which are installed by boot managers, which operate in a variety of ways. Some MBR code loads additional code for a boot manager from the first track of the disk, which it assumes to be "free" space that is not allocated to any disk partition, and executes it. A MBR program may interact with the user to determine which partition on which drive should boot, and may transfer control to the MBR of a different drive. Other MBR code contains a list of disk locations (often corresponding to the contents of files
Computer file
A computer file is a block of arbitrary information, or resource for storing information, which is available to a computer program and is usually based on some kind of durable storage. A file is durable in the sense that it remains available for programs to use after the current program has finished...
in a filesystem) of the remainder of the boot manager code to load and to execute. (The first relies on behavior that is not universal across all disk partitioning utilities, most notably those which read and write GPT
GUID Partition Table
In computer hardware, GUID Partition Table is a standard for the layout of the partition table on a physical hard disk. Although it forms a part of the Extensible Firmware Interface standard , it is also used on some BIOS systems because of the limitations of MBR partition tables, which restrict...
s. The last requires that the embedded list of disk locations be updated when changes are made that would relocate the remainder of the code.)
On machines that do not use x86 processors, or on x86 machines with non-BIOS firmware such as Open Firmware
Open Firmware
Open Firmware, or OpenBoot in Sun Microsystems parlance, is a standard defining the interfaces of a computer firmware system, formerly endorsed by the Institute of Electrical and Electronics Engineers . It originated at Sun, and has been used by Sun, Apple, IBM, and most other non-x86 PCI chipset...
or Extensible Firmware Interface
Extensible Firmware Interface
The Unified Extensible Firmware Interface is a specification that defines a software interface between an operating system and platform firmware...
(EFI) firmware, this design is unsuitable, and the MBR is not used as part of the system bootstrap. EFI firmware is instead capable of directly understanding the GPT
GUID Partition Table
In computer hardware, GUID Partition Table is a standard for the layout of the partition table on a physical hard disk. Although it forms a part of the Extensible Firmware Interface standard , it is also used on some BIOS systems because of the limitations of MBR partition tables, which restrict...
partitioning scheme and the FAT
File Allocation Table
File Allocation Table is a computer file system architecture now widely used on many computer systems and most memory cards, such as those used with digital cameras. FAT file systems are commonly found on floppy disks, flash memory cards, digital cameras, and many other portable devices because of...
filesystem format, and loads and runs programs held as files in the EFI System partition
EFI System Partition
The EFI System partition is a partition on a data storage device that is used by machines that adhere to the Extensible Firmware Interface. It contains the boot loader programs for all operating systems installed on the device, device driver files for other devices, and system utility programs...
. The MBR will be involved only insofar as it might contain a partition table for compatibility purposes if the GPT partition table scheme has been used.
There is some MBR replacement code that emulates EFI firmware's bootstrap, which makes non-EFI machines capable of booting from disks using the GPT partitioning scheme. It detects a GPT, places the processor in the correct operating mode, and loads the EFI compatible code from disk to complete this task.
Disk identity
Windows NT
Windows NT is a family of operating systems produced by Microsoft, the first version of which was released in July 1993. It was a powerful high-level-language-based, processor-independent, multiprocessing, multiuser operating system with features comparable to Unix. It was intended to complement...
disk signature. This is a 32-bit value that is intended to identify uniquely the disk medium (as opposed to the disk unit — the two not necessarily being the same for removable hard disks).
The disk signature was introduced by Windows NT version 3.5, but is now used by several operating systems, including the Linux
Linux
Linux is a Unix-like computer operating system assembled under the model of free and open source software development and distribution. The defining component of any Linux system is the Linux kernel, an operating system kernel first released October 5, 1991 by Linus Torvalds...
kernel version 2.6 and later. Linux uses the NT disk signature at boot time to determine the location of the boot volume.
Windows NT (and later Microsoft operating systems) uses the disk signature as an index to all the partitions on any disk ever connected to the computer under that OS; these signatures are kept in registry
Windows registry
The Windows Registry is a hierarchical database that stores configuration settings and options on Microsoft Windows operating systems. It contains settings for low-level operating system components as well as the applications running on the platform: the kernel, device drivers, services, SAM, user...
keys, primarily for storing the persistent mappings between disk partitions and drive letters. It may also be used in boot.ini files (though most do not), to describe the location of bootable Windows NT (or later) partitions. One key (among many) where NT disk signatures appear in a Windows 2000/XP registry is:
HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\
If a disk's signature stored in the MBR was
A8 E1 B9 D2 (in that order) and its first partition corresponded with logical drive C: under Windows, then the REG_BINARY data under the key value DosDevices\C: would be:A8 E1 B9 D2 00 7E 00 00 00 00 00 00
The first four bytes are said disk signature. (Note: In other keys, these bytes may appear in reverse order from that found in the MBR sector.) These are followed by eight more bytes, forming a 64-bit integer, in little endian
Endianness
In computing, the term endian or endianness refers to the ordering of individually addressable sub-components within the representation of a larger data item as stored in external memory . Each sub-component in the representation has a unique degree of significance, like the place value of digits...
notation, which are used to locate the byte offset of this partition. In this case,
00 7E corresponds to the hexadecimal value 0x7E00 (32,256dec). Dividing this byte offset by 512 (the size of a hard disk's physical sector in bytes) results in 63, which is the physical sector number (or LBA) containing the first sector of the partition (unlike the sector count used in the sectors value of CHS tuples, which counts from one, the absolute or LBA sector value starts counting from zero).If this disk had another partition with the values
00 F8 93 71 02 following the disk signature (under, e.g., the key value \DosDevices\D:), it would begin at byte offset 0x27193f800 (10,495,457,280dec), which is also the first byte of physical sector 20,498,940.Starting with Windows Vista
Windows Vista
Windows Vista is an operating system released in several variations developed by Microsoft for use on personal computers, including home and business desktops, laptops, tablet PCs, and media center PCs...
, the disk signature is also stored in the Boot Configuration Data (BCD) store and the boot process depends on it . If the disk signature changes, cannot be found or has a conflict, Windows is unable to boot.
Programming considerations
The MBR originated in a predecessor of the IBM PCIBM PC
The IBM Personal Computer, commonly known as the IBM PC, is the original version and progenitor of the IBM PC compatible hardware platform. It is IBM model number 5150, and was introduced on August 12, 1981...
. IBM PC-compatible computers are little-endian
Endianness
In computing, the term endian or endianness refers to the ordering of individually addressable sub-components within the representation of a larger data item as stored in external memory . Each sub-component in the representation has a unique degree of significance, like the place value of digits...
, which means numeric values spanning two or more bytes are stored by the processor in reverse order in memory. The format of the MBR on media reflects this convention. Thus, the MBR signature will appear in a disk editor
Disk editor
A disk editor is a computer program that allows its user to read, edit, and write raw data on disk drives ; as such, they are sometimes called sector editors, since the read/write routines built into the electronics of most disk drives require to read/write data in...
as the sequence
55 AA. Interpreting this "magic number" as little endian number 0xAA55 would be different from 0xAA550000 as used for FAT32 signatures, arguably it is simpler to consider these signatures as strings in Network order.The bootstrap sequence in the BIOS will load the first valid MBR that it finds into the computer's physical memory at address
Memory address
A digital computer's memory, more specifically main memory, consists of many memory locations, each having a memory address, a number, analogous to a street address, at which computer programs store and retrieve, machine code or data. Most application programs do not directly read and write to...
0x7C00. The last instruction executed in the BIOS code will be a "jump" to that address, to direct execution to the beginning of the MBR copy. The primary validation for most BIOSes is the 0xAA55 signature on the end, although a BIOS implementor may choose to include other checks, such verifying that the MBR contains a valid partition table without entries referring to sectors beyond the reported capacity of the disk.
While the MBR boot sector
Boot sector
A boot sector or boot block is a region of a hard disk, floppy disk, optical disc, or other data storage device that contains machine code to be loaded into random-access memory by a computer system's built-in firmware...
code expects to be loaded at physical address 0x7C00, all the memory from physical address 0x501 (address 0x500 is the last one used by a Phoenix BIOS) to somewhere short of 0x9FFFF (below any EBDA) is typically available in real mode (a total of up to 640 KB minus the first 1281 bytes of memory); very old machines may have less than 640 KB (0xA0000 or 655,360 bytes) of memory, and newer machines may allocate significant amounts of memory for use by the BIOS. The INT 12h BIOS interrupt call
BIOS interrupt call
BIOS interrupt calls are a facility that DOS programs and some other software, such as boot loaders, use to invoke the facilities of the Basic Input/Output System...
may help in determining how much memory can be allocated safely (it simply reads the base memory size in KiB from segment:offset location 0040h:0013h). In theory, only 64255 bytes are guaranteed (beginning at 0x501 and ending at 0x0FFFF); in practice it is safe to assume at least 391935 bytes (ending at 0x5FFFF) are available on modern hardware.
The last 72 bytes of the 512 byte MBR are reserved for the partition table and other information, so the MBR boot sector program must be small enough to fit within 440 bytes of memory. The MBR code may communicate with the user, examine the partition table, or perform some housekeeping tasks such as enabling the A20 line
A20 line
The A20 or addressing line 20 is one of the plethora of electrical lines that make up the system bus of an x86-based computer system. The A20 line in particular is used to transmit the 21st bit on the address bus....
, or changing the processor's operating mode from real mode to unreal mode
Unreal mode
In x86 computing, unreal mode, also big real mode, huge real mode, or flat real mode, is a variant of real mode , in which one or more data segment registers have been loaded with 32-bit addresses and limits. Contrary to its name, it is not a separate addressing mode that the x86-32 and x86-64...
. Eventually, the MBR will need to perform its main task, and load the program that will perform the next stage of the boot process, usually by making use of INT 13h BIOS calls
BIOS interrupt call
BIOS interrupt calls are a facility that DOS programs and some other software, such as boot loaders, use to invoke the facilities of the Basic Input/Output System...
.
As stated above, the conventional MBR bootstrap code loads and runs (boot loader or operating system dependent) volume boot record
Volume Boot Record
A volume boot record is a type of boot sector introduced by the IBM Personal Computer...
code that is located at the beginning of the "active" partition. A conventional volume boot record is only one sector long, but it is safe for MBR code to load additional sectors to accommodate boot loaders longer than one sector. Like the MBR, a volume boot record often expects to be loaded at address 0x7C00. Since this is the same location where the MBR is loaded, one of the first tasks of an MBR is usually to relocate itself somewhere else in memory —most often at 0x600 (for MS-DOS MBR code).
The Status field in a non-extended partition table record is used to indicate an active partition. The status field in an extended partition table record may also be used by boot manager programs to determine which partitions are bootable, although values other than 0x00 and 0x80 are undefined and the bootstrap program may display an error message upon encountering unrecognized values. In practice, their parsing depends upon what the actual bootstrap code within the MBR has been coded to accept: some MBR bootstrap programs specifically look for the value 0x80 to indicate the bootable partition, others simply look for a non-zero value, and yet others look for any value with the highest bit
Bit
A bit is the basic unit of information in computing and telecommunications; it is the amount of information stored by a digital device or other physical system that exists in one of two possible distinct states...
set.
Editing/replacing MBR contents
Though it is possible to manipulate the byteByte
The byte is a unit of digital information in computing and telecommunications that most commonly consists of eight bits. Historically, a byte was the number of bits used to encode a single character of text in a computer and for this reason it is the basic addressable element in many computer...
s in the MBR sector directly using various disk editor
Disk editor
A disk editor is a computer program that allows its user to read, edit, and write raw data on disk drives ; as such, they are sometimes called sector editors, since the read/write routines built into the electronics of most disk drives require to read/write data in...
s, there are tools to write fixed sets of functioning code to the MBR. Since MS-DOS 5.0, the program fdisk
Fdisk
On personal computer operating systems, fdisk is a commonly used name for a command-line utility that provides disk partitioning functions...
has included the switch
/mbr, which will rewrite the MBR code. Under Windows 2000Windows 2000
Windows 2000 is a line of operating systems produced by Microsoft for use on personal computers, business desktops, laptops, and servers. Windows 2000 was released to manufacturing on 15 December 1999 and launched to retail on 17 February 2000. It is the successor to Windows NT 4.0, and is the...
and Windows XP
Windows XP
Windows XP is an operating system produced by Microsoft for use on personal computers, including home and business desktops, laptops and media centers. First released to computer manufacturers on August 24, 2001, it is the second most popular version of Windows, based on installed user base...
, the Recovery Console
Recovery Console
The Recovery Console is a feature of the Windows 2000, Windows XP and Windows Server 2003 operating systems. It provides the means for administrators to perform a limited range of tasks using a command line interface. Its primary function is to enable administrators to recover from situations...
can be used to write new MBR code to a storage device using its
fixmbr command. Under Windows VistaWindows Vista
Windows Vista is an operating system released in several variations developed by Microsoft for use on personal computers, including home and business desktops, laptops, tablet PCs, and media center PCs...
and Windows 7, the Recovery Environment can be used to write new MBR code using the
bootrec /FixMbr command.Some third-party utilities may also be used for directly editing the contents of partition tables (without requiring any knowledge of hexadecimal or disk/sector editors), such as MBRWizard
MBRwizard
MBRWizard is a Master Boot Record management application for x86 and x86-64 based computers. As the use of disk imaging applications for backup and operating system deployment began to increase, as well as many users beginning to experiment with dual-booting Linux on existing Windows machines,...
.
dd is also a commonly used POSIX command to read or write to any location on a storage device, MBR included. In LinuxLinux
Linux is a Unix-like computer operating system assembled under the model of free and open source software development and distribution. The defining component of any Linux system is the Linux kernel, an operating system kernel first released October 5, 1991 by Linus Torvalds...
, ms-sys may be used to install a standard MBR. The GRUB and LILO
Lilo
Lilo may refer to:People* Lilo , a French actress and singer, the leading lady in the Broadway production of Can-Can* Lilo, nickname of Carmine Galante, American mobster* lilo, nickname of Rob Levin, founder of the freenode IRC network...
projects have tools for writing code to the MBR sector, namely
grub-install and lilo -mbr. The GRUB Legacy interactive console can write to the MBR, using the setup and embed commands, but GRUB2 currently requires grub-install to be run from within an operating system.Various programs are able to create a "backup
Backup
In information technology, a backup or the process of backing up is making copies of data which may be used to restore the original after a data loss event. The verb form is back up in two words, whereas the noun is backup....
" of both the primary partition table and the logical partitions in the extended partition.
Linux sfdisk (on a SystemRescueCD
SystemRescueCD
SystemRescueCd is an operating system for the x86 computer platform, though the primary purpose of SystemRescueCD is to repair unbootable or otherwise damaged computer systems after a system crash. SystemRescueCD is not intended to be used as a permanent operating system. It runs from a Live CD or...
) is able to save a backup of the primary and extended partition table. It creates a file that can be read in a text editor, or this file can be used by sfdisk to restore the primary/extended partition table. An example command to back up the partition table is
sfdisk -d /dev/hda > hda.out and to restore is sfdisk /dev/hda < hda.out . It is possible to copy the partition table from one disk to another this way, useful for setting up mirroring, but it should be noted that sfdisk executes the command without prompting/warnings using sfdisk /dev/sda | sfdisk /dev/sdb . See also
- BIOS Boot partition
- BIOS interrupt callBIOS interrupt callBIOS interrupt calls are a facility that DOS programs and some other software, such as boot loaders, use to invoke the facilities of the Basic Input/Output System...
- Boot loader
- Disk cloningDisk cloningDisk cloning is the process of copying the contents of one computer hard disk to another disk or to an "image" file. Often, the contents of the first disk are written to an image file as an intermediate step, and the second disk is loaded with the contents of the image...
- EFI System partitionEFI System PartitionThe EFI System partition is a partition on a data storage device that is used by machines that adhere to the Extensible Firmware Interface. It contains the boot loader programs for all operating systems installed on the device, device driver files for other devices, and system utility programs...
- Extended boot record
- GNU PartedGNU PartedGNU Parted is a free partition editor, used for creating, destroying, resizing, checking, and copying partitions, and the file systems on them. This is useful for creating space for new operating systems, reorganising hard disk usage, copying data between hard disks, and disk imaging...
- GUID Partition TableGUID Partition TableIn computer hardware, GUID Partition Table is a standard for the layout of the partition table on a physical hard disk. Although it forms a part of the Extensible Firmware Interface standard , it is also used on some BIOS systems because of the limitations of MBR partition tables, which restrict...
(GPT), a more modern partitioning scheme, replacing the purpose of the MBR - Recovery disc
- Rigid Disk Block, the partitioning standard for AmigaAmigaThe Amiga is a family of personal computers that was sold by Commodore in the 1980s and 1990s. The first model was launched in 1985 as a high-end home computer and became popular for its graphical, audio and multi-tasking abilities...
and compatible computers. - Volume boot recordVolume Boot RecordA volume boot record is a type of boot sector introduced by the IBM Personal Computer...