Sponsored by:

Fully Managed Technology Services

 

An Examination of the
Windows™ Vista
MBR ( Master Boot Record )

[Also embedded in vdsutil.dll,
winsetup.dll and various other
System files
; see Introduction
]


Web Presentation and Text are Copyright©2009 by Daniel B. Sedory
NOT to be reproduced in any form without Permission of the Author !

This page examines the Windows Vista MBR code. Whenever you install Windows Vista to a hard disk, even one with an existing MBR, its first sector may be overwritten with the Vista MBR code. (Note: If necessary, it will also change the Volume Boot Record of an existing Active Windows boot OS; usually found in the first partition of a PC's first hard disk.) This code is also installed on blank hard drives when using Windows Vista's Disk Management utility.

NOTE: On our Vista Install DVD (which included all the original editions: Starter, Home Basic, Home Premium, Business, Enterprise and Ultimate), all 512 bytes of this MBR (including the zero-bytes in the partition table) were found once in UPGDRIVER.DLL and twice in WINSETUP.DLL; see below for more files containing this code.

Like all other MBRs presented in this series, this MBR code could still be used to boot any OS on an x86 PC if it meets the conditions listed here*.


Other Microsoft MBR pages:
  An Examination of the Standard MBR created by MS-DOS FDISK
  The MBR created by Windows 95B/98/98SE and ME's FDISK
  The MBR created by Windows 2000/XP/2003 Installs or Disk Management Utility
  The MBR created by Windows 7 Installs or Disk Management Utility

And Microsoft OS Volume Boot Records:
  An Examination of the MS-Windows 95B/98/98SE/Me OS Boot Record (MSWIN4.1)
  An Examination of the MS-Windows 2000/XP OS Boot Record (NTFS)
  An Examination of the MS-Windows Vista OS Volume Boot Record
  A Comparison of Windows™ Vista, 7 and 8 VBR Code

Confused? Send me an email if you have a specific question about the MBR or any Boot Records...

 

IMPORTANT: One of the first things that any PC user should do after setting up a new hard disk (or creating a new partition with a utility such as Partition Magic) is to make a copy of its MBR; especially if you have more than one partition on the disk! Why? If you accidentally overwrite this sector, or are infected by a Boot sector virus, you may never be able to access some or even all of your disk again!   Even the most expensive HD utility might not correctly restore the Partition Table of a multi-partitioned hard disk!
Some advice: Save the Partition Table data on floppy disks or write it down on paper(!); it does no good to have the data you need to access your HD on the un-accessible HD itself! There are many ways you can do this... See our MBR Tools Page. Any good Disk Editor will allow you to manually enter data you've written down under an easy to use Partition Table View, or you can use a utility program, such as "MbrFix" (for Win NT/2K, XP, 2003, PE, Vista & 7; even 64-bit versions!) to save the binary data to a file on say a thumb drive, and later on restore the MBR from that saved file.

____________
*

NOTE: Even though we're examining code created by a Microsoft Operating System, this MBR can also be used to start the boot process for any operating system's Boot Record on an x86-CPU based (PC) computer as long as that OS is: 1) on the Primary Master hard drive, 2) set to be the only Active partition and 3) it has a boot loader in the first sector of that partition. Most Linux OS distributions can install LILO or GRUB as a Boot Record rather than in the MBR and following sectors, so even the oldest MBR by Microsoft could still be used to boot Linux; as long as its boot code was at or under the 1024 cylinder limit that is.

Furthermore, the processor must be an 80386 or later in order to use the Win7 MBR code, since it includes the "Operand-Size Prefix" (66h which can only be executed by an 80386 or later CPU. See Code, location 0659). When certain 16-bit assembly instructions, such as PUSHA (PUSH All registers onto the Stack), are prefixed by the byte 0x66, it forces that instruction to act as if it were running in 32-bit mode. So PUSHA effectively becomes a PUSHAD instruction, pushing all the 32-bit registers onto the Stack.

Windows Vista can also boot multiple OSs using its new console (Command Prompt) program BCDEDIT (Boot Configuration Data Editor; "Sets properties in boot database to control boot loading") and BOOTMGR files, so for systems with multiple OSs, this would be a far more practical approach than changing the Active partition in the MBR each time you want to boot up a different OS. If you intend to install a Linux OS, it would probably be best to do so after installing Vista, then use the GRUB boot manager as the first boot code to load the others from. By the way, BCDEDIT, as with all programs under Vista that can change its system files, cannot be used unless you first open the Command Prompt window in Administrator mode (you must right-click on the icon or program name and choose to open it as Administrator). Running BCDEDIT without any switches will display a few facts about BOOTMGR and another new program called the Windows Boot Loader (\Windows\system32\winload.exe); which is the Vista OS Loader.

There have been many MBRs or IPLs (Initial Program Loaders) created for booting an OS and even for booting multiple OSs. See Multi-OS Booting on our "Tools and References" Page for some alternative code and Boot Managers.

 

 


Introduction


Figure 2.   Showing the bytes "62 7A 99"which are part of the Vista MBR's code.

 

 Absolute Sector 0 (Cylinder 0, Head 0, Sector 1)

        0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
 0000  33 C0 8E D0 BC 00 7C 8E C0 8E D8 BE 00 7C BF 00  3.....|......|..
 0010  06 B9 00 02 FC F3 A4 50 68 1C 06 CB FB B9 04 00  .......Ph.......
 0020  BD BE 07 80 7E 00 00 7C 0B 0F 85 10 01 83 C5 10  ....~..|........
 0030  E2 F1 CD 18 88 56 00 55 C6 46 11 05 C6 46 10 00  .....V.U.F...F..
 0040  B4 41 BB AA 55 CD 13 5D 72 0F 81 FB 55 AA 75 09  .A..U..]r...U.u.
 0050  F7 C1 01 00 74 03 FE 46 10 66 60 80 7E 10 00 74  ....t..F.f`.~..t
 0060  26 66 68 00 00 00 00 66 FF 76 08 68 00 00 68 00  &fh....f.v.h..h.
 0070  7C 68 01 00 68 10 00 B4 42 8A 56 00 8B F4 CD 13  |h..h...B.V.....
 0080  9F 83 C4 10 9E EB 14 B8 01 02 BB 00 7C 8A 56 00  ............|.V.
 0090  8A 76 01 8A 4E 02 8A 6E 03 CD 13 66 61 73 1E FE  .v..N..n...fas..
 00A0  4E 11 0F 85 0C 00 80 7E 00 80 0F 84 8A 00 B2 80  N......~........
 00B0  EB 82 55 32 E4 8A 56 00 CD 13 5D EB 9C 81 3E FE  ..U2..V...]...>.
 00C0  7D 55 AA 75 6E FF 76 00[E8 8A 00 0F 85 15 00 B0  }U.un.v.........
 00D0  D1 E6 64 E8 7F 00 B0 DF E6 60 E8 78 00 B0 FF E6  ..d......`.x....
 00E0  64 E8 71 00 B8 00 BB CD 1A 66 23 C0 75 3B 66 81  d.q......f#.u;f.
 00F0  FB 54 43 50 41 75 32 81 F9 02 01 72 2C 66 68 07  .TCPAu2....r,fh.
 0100  BB 00 00 66 68 00 02 00 00 66 68 08 00 00 00 66  ...fh....fh....f
 0110  53 66 53 66 55 66 68 00 00 00 00 66 68 00 7C 00  SfSfUfh....fh.|.
 0120  00 66 61 68 00 00 07 CD 1A]5A 32 F6 EA 00 7C 00  .fah.....Z2...|.
 0130  00 CD 18 A0 B7 07 EB 08 A0 B6 07 EB 03 A0 B5 07  ................
 0140  32 E4 05 00 07 8B F0 AC 3C 00 74 FC BB 07 00 B4  2.......<.t.....
 0150  0E CD 10 EB F2[2B C9 E4 64 EB 00 24 02 E0 F8 24  .....+..d..$...$
 0160  02 C3]49 6E 76 61 6C 69 64 20 70 61 72 74 69 74  ..Invalid partit
 0170  69 6F 6E 20 74 61 62 6C 65 00 45 72 72 6F 72 20  ion table.Error  
 0180  6C 6F 61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E  loading operatin
 0190  67 20 73 79 73 74 65 6D 00 4D 69 73 73 69 6E 67  g system.Missing
 01A0  20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 65   operating syste
 01B0  6D 00 00 00 00 62 7A 99 D4 34 A0 2E 00 00 80 20  m....bz..4..... 
 01C0  21 00 07 FE FF FF 00 08 00 00 00 88 82 01 00 00  !...............
 01D0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 01E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 01F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  ..............U.
        0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
Figure 3.


An Examination of the Assembly Code


Location of Error Messages and
Message Offsets in Memory

             2  3  4  5  6  7  8  9  A  B  C  D  E  F
0762        49 6E 76 61 6C 69 64 20 70 61 72 74 69 74    Invalid partit
0770  69 6F 6E 20 74 61 62 6C 65 00 45 72 72 6F 72 20  ion Table.Error 
0780  6C 6F 61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E  loading operatin
0790  67 20 73 79 73 74 65 6D 00 4D 69 73 73 69 6E 67  g system.Missing
07A0  20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 65   operating syste
07B0  6D 00 00 00 00 62 7A 99                          m....bz.
       0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F

Location of Sample Disk Signature
and Partition Table in Memory

                               8  9  A  B  C  D  E  F
07B8                          D4 34 A0 2E 00 00 80 20          .4.."". 
07C0  21 00 07 FE FF FF 00 08 00 00 00 88 82 01 00 00  !...............
07D0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
07E0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
07F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA  ..............U.
       0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F

This is how it would be seen in a disk editor that can interpret Partition Table data:

  Partition    Active  Starting Loc   Ending Loc    Relative   Number of
    Type        Boot   Cyl Head Sec  Cyl  Head Sec   sectors     sectors
-------------  ------  ------------  -------------  --------   ---------
     NTFS       Yes      0  32  33   1023  254  63      2048    25331712

[Note: Cylinders and heads start counting at ZERO; sectors at 1. So, a CHS of
 0,32,33 gives us 32 'full' heads of 32 x 63 = 2016 sectors; the 33rd head being
 only 33 sectors, for a total of: 2016 + 33 = 2049, or Absolute Sector 2048, as
 the sector where Vista partitions begin on a disk; 2048 sectors preceding.]

 

First Published: August 3, 2009. (03.08.09)
Updated: August 5, 2009 (05.08.09); August 11, 2009 (11.08.09); August 16, 2009 (16.08.09); October 3, 2010 (03.10.10); March 11, 2011 (11.03.11); May 12, 2013 (12.05.13); May 1, 2015 (01.05.2015).
Last Update: March 16, 2018. (16.03.2018)


You can write to me using this: online reply form. (It opens in a new window.)

The Starman's FREE TOOLS Page

MBR and Boot Records Index

The Starman's Realm Index Page