The FAT32 Boot Record
under Windows 2000 and XP

Web Presentation and Text are Copyright 2005 by Daniel B. Sedory
NOT to be reproduced in any form without Permission of the Author !


This page is still under construction!

 

Like previous FAT32 Boot Records (see MSWIN4.1 Boot Record), most of its structure is the same as it was under Windows 98 or ME.  Thus, you won't find much difference in the immediate appearance of Boot Records for a FAT32 partition under Windows 2000 or XP.  The FSINFO sector, for example, is exactly the same; and even the code routines in the third sector appear to be the same.  We would need to carry out some detailed research (many more experiments and time required) in order to provide conclusive comments about all possible differences.

Upon examining these sectors more closely, however, there are some major new differences: For example, these FAT32 Boot Records (and any FAT32 Boot Records that were accessed by a Windows 2000 or XP OS at the time one of those operating systems was installed) will contain one very noticeable difference: In a disk editor, you will no longer find the older MS-DOS related system file names here. They've all been replaced by the NTLDR file (the same file found in NTFS partitions)!

An EXAMPLE FAT32 Boot Record (first sector only);
after
being converted during a Windows 2000 install:

Absolute Sector 14105070                            BPB  
                                                     |     System Name
         0  1  2  3  4  5  6  7  8  9  A  B  C  D  E |F         |
 0000:  EB 58 90 4D 53 57 49 4E 34 2E 31 00 02 08 20 00  .X.MSWIN4.1... .
 0010:  02 00 00 00 00 F8 00 00 3F 00 FF 00 EE 39 D7 00  ........?....9..
 0020:  BD 86 BB 00 CD 2E 00 00 00 00 00 00 93 B2 0B 00  ................
 0030:  01 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 0040:  80 00 29 56 2F BF 10 57 49 4E 39 38 5F 44 41 54  ..)V/..WIN98_DAT
 0050:  41 00 46 41 54 33 32 20 20 20 33 C9 8E D1 BC F4  A.FAT32   3.....
 0060:  7B 8E C1 8E D9 BD 00 7C 88 4E 02 8A 56 40 B4 08  {......|.N..V@..
 0070:  CD 13 73 05 B9 FF FF 8A F1 66 0F B6 C6 40 66 0F  ..s......f...@f.
 0080:  B6 D1 80 E2 3F F7 E2 86 CD C0 ED 06 41 66 0F B7  ....?.......Af..
 0090:  C9 66 F7 E1 66 89 46 F8 83 7E 16 00 75 38 83 7E  .f..f.F..~..u8.~
 00A0:  2A 00 77 32 66 8B 46 1C 66 83 C0 0C BB 00 80 B9  *.w2f.F.f.......
 00B0:  01 00 E8 2B 00 E9 48 03 A0 FA 7D B4 7D 8B F0 AC  ...+..H...}.}...
 00C0:  84 C0 74 17 3C FF 74 09 B4 0E BB 07 00 CD 10 EB  ..t.<.t.........
 00D0:  EE A0 FB 7D EB E5 A0 F9 7D EB E0 98 CD 16 CD 19  ...}....}.......
 00E0:  66 60 66 3B 46 F8 0F 82 4A 00 66 6A 00 66 50 06  f`f;F...J.fj.fP.
 00F0:  53 66 68 10 00 01 00 80 7E 02 00 0F 85 20 00 B4  Sfh.....~.... ..
 0100:  41 BB AA 55 8A 56 40 CD 13 0F 82 1C 00 81 FB 55  A..U.V@........U
 0110:  AA 0F 85 14 00 F6 C1 01 0F 84 0D 00 FE 46 02 B4  .............F..
 0120:  42 8A 56 40 8B F4 CD 13 B0 F9 66 58 66 58 66 58  B.V@......fXfXfX
 0130:  66 58 EB 2A 66 33 D2 66 0F B7 4E 18 66 F7 F1 FE  fX.*f3.f..N.f...
 0140:  C2 8A CA 66 8B D0 66 C1 EA 10 F7 76 1A 86 D6 8A  ...f..f....v....
 0150:  56 40 8A E8 C0 E4 06 0A CC B8 01 02 CD 13 66 61  V@............fa
 0160:  0F 82 54 FF 81 C3 00 02 66 40 49 0F 85 71 FF C3  ..T.....f@I..q..
 0170:  4E 54 4C 44 52 20 20 20 20 20 20 00 00 00 00 00  NTLDR      .....
 0180:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 0190:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 01A0:  00 00 00 00 00 00 00 00 00 00 00 00 0D 0A 4E 54  ..............NT
 01B0:  4C 44 52 20 69 73 20 6D 69 73 73 69 6E 67 FF 0D  LDR is missing..
 01C0:  0A 44 69 73 6B 20 65 72 72 6F 72 FF 0D 0A 50 72  .Disk error...Pr
 01D0:  65 73 73 20 61 6E 79 20 6B 65 79 20 74 6F 20 72  ess any key to r
 01E0:  65 73 74 61 72 74 0D 0A 00 00 00 00 00 00 00 00  estart..........
 01F0:  00 00 00 00 00 00 00 00 00 AC BF CC 00 00 55 AA  ..............U.
 
         0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F

The last 144 bytes of the Boot Record's first sector contain the single system file name: NTLDR      , many unused bytes, error messages and their data bytes (AC BF CC); indicating the offset of each error message in the sector (1ACh, 1BFh and 1CCh), and finally the Word-sized signature ID (or Magic number) of AA55h. By placing the three data bytes near the end of the sector, error messages for OS distributions in other languages requiring more characters, would begin further back in the sector.

All the Error Message lines begin with the Hex bytes 0Dh and 0Ah which are a Carriage Return and Line Feed. The first line of both messages (there are only two; either: "NTLDR is missing" or: "Disk error") end with an FFh byte (which the code checks for), then they continue with the last line ("Press any key to restart"; followed by another Carriage Return and Line Feed) which ends with a 00h byte, making it what's commonly known as a zero-terminated or 'sz' string (the string plus a zero byte).

 

Reminder: Don't forget that each FAT32 Boot Record has a Backup Copy (even under Windows 2000 or XP) just a few sectors beyond the original. These correspond to Relative (or Logical) Sectors 6 through 8 (for the Backup copy) of any FAT32 partition on your drive.

 

For more information on FAT32 Boot Records in general and some code routines, please read our page on the MSWIN4.1 Boot Record here.

 


 

An Examination of the Assembly Code

Here's the disassembled code (; with comments) after the whole sector has been loaded into memory at 0000:7C00 (by the Master Boot code). We'll comment on a few of the differences between this sector and the MSWIN4.1 Boot Record under Windows 98/ME.
(An asterisk '*' in front of any Assembly Instruction listed below means that the instruction cannot be disassembled correctly by MS-DEBUG):

 
; The following code begins exactly as it did under Windows 98/ME:
 
7C00 EB58          JMP     7C5A         ; Jump over BPB (BIOS Parameter
                                        ;   Block) to beginning of code.
7C02 90            NOP                  ; Used later as a FLAG byte for
                                        ;   Extended INT 13 Disk Func.'s
                                        ;   (See instruction at: 7CADh).
 
; 7C03 thru 7C0A   'MSWIN4.1'        System Name or OEM ID. (Some think
;                                    this is part of the BPB; it's not!)
;
; 7C0B thru 7C59   BIOS Parameter Block (BPB) See text and tables here
                                        ; for more details on the BPB.
 
; The CLI instruction (under Win98/ME) is absent from this new VBR.
 
7C5A 33C9          XOR     CX,CX        ; Zero out both the Counter and
7C5C 8ED1          MOV     SS,CX        ;    Stack Segment Registers.
7C5E BCF47B        MOV     SP,7BF4      ; Set Stack Pointer to 0000:7BF4
                                        ; because 7BF4-7BFF are used for
                                        ; data locations found below.
7C61 8EC1          MOV     ES,CX        ; Zero out the Extra and
7C63 8ED9          MOV     DS,CX        ;          Data Segments.
7C65 BD007C        MOV     BP,7C00      ; Base Pointer set to 7C00, where
                                        ;    our BPB data is now located.
                                                                            
7C68 884E02        MOV     [BP+02],CL   ; Zero-out byte at [7C02].
7C6B 8A5640        MOV     DL,[BP+40]   ; (DiskDriveID; 80h?) -> DL.
7C6E B408          MOV     AH,08        ; Function: Get Drive Parameters
7C70 CD13          INT     13
 
7C72 7305          JNB     7C79
7C74 B9FFFF        MOV     CX,FFFF
7C77 8AF1          MOV     DH,CL
7C79 660FB6C6    * MOVZX   EAX,DH
7C7D 40            INC     AX
7C7E 660FB6D1    * MOVZX   EDX,CL
7C82 80E23F        AND     DL,3F
7C85 F7E2          MUL     DX
7C87 86CD          XCHG    CL,CH
7C89 C0ED06      * SHR     CH,06
7C8C 41            INC     CX
7C8D 660FB7C9    * MOVZX   ECX,CX
7C91 66F7E1      * MUL     ECX
7C94 668946F8    * MOV     [BP-08],EAX
7C98 837E1600      CMP     WordPtr [BP+16],0000
7C9C 7538          JNZ     7CD6
7CA4 668B461C    * MOV     EAX,[BP+1C]
7CA8 6683C00C    * ADD     EAX,0000000C
7CAC BB0080        MOV     BX,8000
7CAF B90100        MOV     CX,0001
7CB2 E82B00        CALL    7CE0
7CB5 E94803        JMP     8000         ; Jump to code in 3rd sector.
 
 
; ====================================================================
;    Display Error Message   S U B R O U T I N E :
; ====================================================================
7CB8 A0FA7D        MOV     AL,[7DFA]    ; [7DFA]->AL, so AX=7DBF
                                        ; Causes SI -> 0D,0A,
                                        ; "NTLDR is missing"
7CBB B47D          MOV     AH,7D        ; Always AH = 7D here.
7CBD 8BF0          MOV     SI,AX        ; SI -> Error Message.
7CBF AC            LODSB                ; Each byte -> AL, one at
                                        ;                 a time.  
7CC0 84C0          TEST    AL,AL        ; Test for 00h byte.
7CC2 7417          JZ      7CDB         ; If zero, we're done.
7CC4 3CFF          CMP     AL,FF        ; Check for FFh bytes.
7CC6 7409          JZ      7CD1         ; Yes, so do last line.
7CC8 B40E          MOV     AH,0E        ; Output One Character.
7CCA BB0700        MOV     BX,0007
7CCD CD10          INT     10           ; Video Display Interrupt
7CCF EBEE          JMP     7CBF         ; Repeat until all of the
                                        ;    string is displayed.
7CD1 A0FB7D        MOV     AL,[7DFB]    ; [7DFB]->AL, so AX=7DCC
                                        ; Causes SI -> 0D,0A,
                                        ; "Press any key to restart"
7CD4 EBE5          JMP     7CBB         ; Strt displaying last line.
 
7CD6 A0F97D        MOV     AL,[7DF9]    ; [7DF9]->AL, so AX=7DAC
                                        ; Causes SI -> 0D,0A,
                                        ; "NTLDR is missing"
7CD9 EBE0          JMP     7CBB         ; Begin displaying message.
 
7CDB 98            CBW                  ; Convert Byte to Word
7CDC CD16          INT     16           ; Wait until getting a key-
                                        ; stroke from Keyboard.
7CDE CD19          INT     19           ; If a key was pressed, then
                                        ;  Start over again with
                                        ;  System BOOTSTRAP LOADER.
 
;==================================================================
;                  S U B R O U T I N E
;==================================================================
7CE0 6660        * PUSHAD
7CE2 663B46F8    * CMP     EAX,[BP-08]
7CE6 0F824A00    * JB      7D34
7CEA 666A00      * PUSH    00000000
7CED 6650        * PUSH    EAX
7CEF 06            PUSH    ES
7CF0 53            PUSH    BX
7CF1 666810000100 * PUSH   00010010
7CF7 807E0200      CMP     BYTE PTR [BP+02],00
7CFB 0F852000    * JNZ     7D1F
7CFF B441          MOV     AH,41          ; INT 13, Func. 41h
7D01 BBAA55        MOV     BX,55AA        ; 
7D04 8A5640        MOV     DL,[BP+40]
7D07 CD13          INT     13
 
7D09 0F821C00    * JB      7D29
7D0D 81FB55AA      CMP     BX,AA55        ;
7D11 0F851400    * JNZ     7D29
7D15 F6C101        TEST    CL,01
7D18 0F840D00    * JZ     7D29
7D1C FE4602        INC     BYTE PTR [BP+02]
7D1F B442          MOV     AH,42          ; INT 13, Func. 42h
7D21 8A5640        MOV     DL,[BP+40]
7D24 8BF4          MOV     SI,SP
7D26 CD13          INT     13
 
7D28 B0F9          MOV     AL,F9
7D2A 6658        * POP     EAX
7D2C 6658        * POP     EAX
7D2E 6658        * POP     EAX
7D30 6658        * POP     EAX
7D32 EB2A          JMP     7D5E
7D34 6633D2      * XOR     EDX,EDX
7D37 660FB74E18  * MOVZX   ECX,Word [BP+18]
7D3C 66F7F1      * DIV     ECX
7D3F FEC2          INC     DL
7D41 8ACA          MOV     CL,DL
7D43 668BD0      * MOV     EDX,EAX
7D46 66C1EA10    * SHR     EDX,10
7D4A F7761A        DIV     WORD PTR [BP+1A]
7D4D 86D6          XCHG    DL,DH
7D4F 8A5640        MOV     DL,[BP+40]
7D52 8AE8          MOV     CH,AL
7D54 C0E406      * SHL     AH,06
7D57 0ACC          OR      CL,AH
7D59 B80102        MOV     AX,0201
7D5C CD13          INT     13
 
7D5E 6661        * POPAD
7D60 0F8254FF    * JB      7CB8         ; If <, then NTLDR not found.
7D64 81C30002      ADD     BX,0200
7D68 6640        * INC     EAX
7D6A 49            DEC     CX
7D6B 0F8571FF    * JNZ     7CE0
7D6F C3            RET
 
 
 
 

Location of Data and
Error Messages in Memory

From Logical Sector 0:

       0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F

7D70  4E 54 4C 44 52 20 20 20 20 20 20 00 00 00 00 00  NTLDR      .....
7D80  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
7D90  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
7DA0  00 00 00 00 00 00 00 00 00 00 00 00 0D 0A 4E 54  ..............NT
7DB0  4C 44 52 20 69 73 20 6D 69 73 73 69 6E 67 FF 0D  LDR is missing..
7DC0  0A 44 69 73 6B 20 65 72 72 6F 72 FF 0D 0A 50 72  .Disk error...Pr
7DD0  65 73 73 20 61 6E 79 20 6B 65 79 20 74 6F 20 72  ess any key to r
7DE0  65 73 74 61 72 74 0D 0A 00 00 00 00 00 00 00 00  estart..........
7DF0  00 00 00 00 00 00 00 00 00 AC BF CC 00 00 55 AA  ..............U.
 
       0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F

Note:
Each of the three sectors that make up this Boot Record has an End of Sector Word-sized 'signature' of 0xAA55 (remember that low-bytes appear first and high-bytes last for every 'Word' stored on a Disk or found in Memory).


Last Update: June 8, 2007.  [2007.06.08]


You can write to us using this: contact form (opens in a new window).

The MSWIN 4.1 Boot Record Revealed

MBR and Boot Records Index Page

The Starman's Realm Index Page