Sponsored by:

Fully Managed Technology Services

 

The FAT32 Boot Record
under Windows™ 2000, XP and 7

Web Presentation and Text are Copyright © 2005, 2010, 2012 by Daniel B. Sedory
NOT to be reproduced in any form without Permission of the Author !


This page is still under construction!


At first glance, the Boot Record for a FAT32 partition under Windows™ 2000, XP or 7 doesn't appear to be any different than it was for the previous FAT32 Boot Record (see MSWIN4.1 Boot Record); much of its structure is in fact, exactly the same as it was under Windows™ 98 or ME.  For example, the FSINFO sector still remains as before, and the code in its third sector will remain byte for byte, exactly as before, when installing a Windows XP or 7 OS to another partition. [But note: For any FAT32 partitions created under an existing Windows XP or 7 boot OS, the third sector of the new FAT32 Boot Record will not have any code in it; as a matter of fact, it will be nothing but zero bytes, except for 55h and AAh in its last two bytes.]

However, upon examining its sectors more closely, we find some major differences: For example, during the installation of a Windows™ 2000 or XP OS, an existing FAT32 Boot Record will have all references to the MS-DOS related system file names replaced by NTLDR (the same file found in NTFS partitions), and copies of both ntldr and NTDETECT.COM will be installed in the partition, along with two new files: bootsect.dos (a binary copy of the first sector of the FAT32 partition's original Boot Record) and boot.ini (see our page, The Boot INI File, for all details concerning this file). Furthermore, there's a whole new sector of code that will be appended to the FAT32 Boot Record a few sectors after the old 'backup' copy! (See our quick side-by-side comparison of the FAT32 Boot Records, then examine all the details (in color) on our Disk Editor View of the NT FAT32 Boot Record page.)

Reminder: Don't forget that each bootable FAT32 Boot Record, after conversion by a Windows™ 2000 or XP install, has a Backup Copy of its original sectors stored just a few sectors beyond the new Boot sectors. These correspond to Relative (or Logical) Sectors 6 through 8 of any FAT32 OS partition.
Note: FAT32 partitions which are not bootable, for example, a FAT32 data partition created under Windows™ XP, or any that have been purposely altered, may not have the same structure presented here. It all depends upon what utilities created, or were allowed to modify, them.

For more information on FAT32 Boot Records in general or details concerning some of its code, please read our page on the MSWIN4.1 Boot Record here.

 

See this page for: A side-by-side comparison of the Boot Records of a FAT32 data partition created by the Windows XP and 7 Operating Systems!

 



An Examination of the Assembly Code


; The following code begins exactly as it did under Windows 98/ME:

7C00 EB58          JMP     7C5A         ; Jump over BPB (BIOS Parameter
                                        ;   Block) to beginning of code.
7C02 90            NOP                  ; Used later as a FLAG byte for
                                        ;   Extended INT 13 Disk Func.'s
                                        ;   (See instructions at: 7C68h,
                                        ;    7CF7h and 7D1Ch).

; 7C03 thru 7C0A   'MSWIN4.1'        System Name or OEM ID. (Some think
;                                    this is part of the BPB; it's not!)
;
; 7C0B thru 7C59   BIOS Parameter Block (BPB) See text and tables here
                                        ; for more details on the BPB.

; The CLI instruction (under Win98/ME) is absent from this new VBR.

7C5A 33C9          XOR     CX,CX        ; Zero out both the Counter and
7C5C 8ED1          MOV     SS,CX        ;    Stack Segment Registers.
7C5E BCF47B        MOV     SP,7BF4      ; Set Stack Pointer to 0000:7BF4
                                        ; because 7BF4-7BFF are used for
                                        ; data locations found below.
7C61 8EC1          MOV     ES,CX        ; Zero out the Extra and
7C63 8ED9          MOV     DS,CX        ;          Data Segments.
7C65 BD007C        MOV     BP,7C00      ; Base Pointer set to 7C00, where
                                        ;    our BPB data is now located.

7C68 884E02        MOV     [BP+02],CL   ; Zero-out byte at [7C02].
7C6B 8A5640        MOV     DL,[BP+40]   ; (DiskDriveID; 80h?) -> DL.
7C6E B408          MOV     AH,08        ; Function: Get Drive Parameters
7C70 CD13          INT     13

7C72 7305          JNB     7C79
7C74 B9FFFF        MOV     CX,FFFF
7C77 8AF1          MOV     DH,CL
7C79 660FB6C6    * MOVZX   EAX,DH
7C7D 40            INC     AX
7C7E 660FB6D1    * MOVZX   EDX,CL
7C82 80E23F        AND     DL,3F
7C85 F7E2          MUL     DX
7C87 86CD          XCHG    CL,CH
7C89 C0ED06      * SHR     CH,06
7C8C 41            INC     CX
7C8D 660FB7C9    * MOVZX   ECX,CX
7C91 66F7E1      * MUL     ECX
7C94 668946F8    * MOV     [BP-08],EAX
7C98 837E1600      CMP     WORD PTR [BP+16],0000
7C9C 7538          JNZ     7CD6
7C9E 837E2A00      CMP     WORD PTR [BP+2A],0000
7CA2 7732          JA      7CD6
7CA4 668B461C    * MOV     EAX,[BP+1C]
7CA8 6683C00C    * ADD     EAX,0000000C
7CAC BB0080        MOV     BX,8000
7CAF B90100        MOV     CX,0001
7CB2 E82B00        CALL    7CE0

7CB5 E94803        JMP     8000         ; Jump to new code loaded from
                                        ; 13th sector of Boot Record.

; ====================================================================
;    Display Error Message   S U B R O U T I N E :
; ====================================================================
7CB8 A0FA7D        MOV     AL,[7DFA]    ; [7DFA]->AL, so AX=7DBF
                                        ; Causes SI -> 0D,0A,
                                        ; "NTLDR is missing"
7CBB B47D          MOV     AH,7D        ; Always AH = 7D here.
7CBD 8BF0          MOV     SI,AX        ; SI -> Error Message.
7CBF AC            LODSB                ; Each byte -> AL, one at
                                        ;                 a time.  
7CC0 84C0          TEST    AL,AL        ; Test for 00h byte.
7CC2 7417          JZ      7CDB         ; If zero, we're done.
7CC4 3CFF          CMP     AL,FF        ; Check for FFh bytes.
7CC6 7409          JZ      7CD1         ; Yes, so do last line.
7CC8 B40E          MOV     AH,0E        ; Output One Character.
7CCA BB0700        MOV     BX,0007
7CCD CD10          INT     10           ; Video Display Interrupt
7CCF EBEE          JMP     7CBF         ; Repeat until all of the
                                        ;    string is displayed.
7CD1 A0FB7D        MOV     AL,[7DFB]    ; [7DFB]->AL, so AX=7DCC
                                        ; Causes SI -> 0D,0A,
                                        ; "Press any key to restart"
7CD4 EBE5          JMP     7CBB         ; Strt displaying last line.

7CD6 A0F97D        MOV     AL,[7DF9]    ; [7DF9]->AL, so AX=7DAC
                                        ; Causes SI -> 0D,0A,
                                        ; "NTLDR is missing"
7CD9 EBE0          JMP     7CBB         ; Begin displaying message.

7CDB 98            CBW                  ; Convert Byte to Word
7CDC CD16          INT     16           ; Wait until getting a key-
                                        ; stroke from Keyboard.
7CDE CD19          INT     19           ; If a key was pressed, then
                                        ;  Start over again with
                                        ;  System BOOTSTRAP LOADER.

;==================================================================
;                  S U B R O U T I N E
;==================================================================
7CE0 6660        * PUSHAD
7CE2 663B46F8    * CMP     EAX,[BP-08]
7CE6 0F824A00    * JB      7D34
7CEA 666A00      * PUSH    00000000
7CED 6650        * PUSH    EAX
7CEF 06            PUSH    ES
7CF0 53            PUSH    BX
7CF1 666810000100 * PUSH   00010010
7CF7 807E0200      CMP     BYTE PTR [BP+02],00
7CFB 0F852000    * JNZ     7D1F
7CFF B441          MOV     AH,41          ; INT 13, Func. 41h
7D01 BBAA55        MOV     BX,55AA        ; 
7D04 8A5640        MOV     DL,[BP+40]
7D07 CD13          INT     13

7D09 0F821C00    * JB      7D29
7D0D 81FB55AA      CMP     BX,AA55        ;
7D11 0F851400    * JNZ     7D29
7D15 F6C101        TEST    CL,01
7D18 0F840D00    * JZ     7D29
7D1C FE4602        INC     BYTE PTR [BP+02]
7D1F B442          MOV     AH,42          ; INT 13, Func. 42h
7D21 8A5640        MOV     DL,[BP+40]
7D24 8BF4          MOV     SI,SP
7D26 CD13          INT     13

7D28 B0F9          MOV     AL,F9
7D2A 6658        * POP     EAX
7D2C 6658        * POP     EAX
7D2E 6658        * POP     EAX
7D30 6658        * POP     EAX
7D32 EB2A          JMP     7D5E
7D34 6633D2      * XOR     EDX,EDX
7D37 660FB74E18  * MOVZX   ECX,WORD PTR [BP+18]
7D3C 66F7F1      * DIV     ECX
7D3F FEC2          INC     DL
7D41 8ACA          MOV     CL,DL
7D43 668BD0      * MOV     EDX,EAX
7D46 66C1EA10    * SHR     EDX,10
7D4A F7761A        DIV     WORD PTR [BP+1A]
7D4D 86D6          XCHG    DL,DH
7D4F 8A5640        MOV     DL,[BP+40]
7D52 8AE8          MOV     CH,AL
7D54 C0E406      * SHL     AH,06
7D57 0ACC          OR      CL,AH
7D59 B80102        MOV     AX,0201
7D5C CD13          INT     13

7D5E 6661        * POPAD
7D60 0F8254FF    * JB      7CB8         ; If <, then NTLDR not found.
7D64 81C30002      ADD     BX,0200
7D68 6640        * INC     EAX
7D6A 49            DEC     CX
7D6B 0F8571FF    * JNZ     7CE0
7D6F C3            RET



 

Location of Data and
Error Messages in Memory

From Logical Sector 0:

       0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
7D70 4E 54 4C 44 52 20 20 20 20 20 20 00 00 00 00 00 NTLDR ..... 7D80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 7D90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 7DA0 00 00 00 00 00 00 00 00 00 00 00 00 0D 0A 4E 54 ..............NT 7DB0 4C 44 52 20 69 73 20 6D 69 73 73 69 6E 67 FF 0D LDR is missing.. 7DC0 0A 44 69 73 6B 20 65 72 72 6F 72 FF 0D 0A 50 72 .Disk error...Pr 7DD0 65 73 73 20 61 6E 79 20 6B 65 79 20 74 6F 20 72 ess any key to r 7DE0 65 73 74 61 72 74 0D 0A 00 00 00 00 00 00 00 00 estart.......... 7DF0 00 00 00 00 00 00 00 00 00 AC BF CC 00 00 55 AA ..............U. 0 1 2 3 4 5 6 7 8 9 A B C D E F

First Created: June 8, 2007.  [2007.06.08]
Updated: September 15, 2010.  [2010.09.15]

Last Update: July 19, 2012.  [2012.07.19]


You can write to us using this: contact form (opens in a new window).

The MSWIN 4.1 Boot Record Revealed

MBR and Boot Records Index Page

The Starman's Realm Index Page