Boot sector
 | This article includes a list of references, related reading, or external links, but its sources remain unclear because it lacks inline citations. (November 2007) |
 | This article needs attention from an expert in Computing. Please add a reason or a talk parameter to this template to explain the issue with the article. (June 2011) |
 | It has been suggested that this article be merged into Volume boot record. (Discuss) Proposed since July 2011. |
A boot sector or boot block is a region of a hard disk, floppy disk, solid-state drive, or similar data storage device that contains machine code intended to be executed by a computer's built-in firmware. This region has a size and location (perhaps corresponding to a single logical disk sector in the CHS addressing scheme) specified by the design of the computing platform. The usual purpose of a boot sector is to boot a program (usually, but not necessarily, an operating system) stored on the same storage device.
On an IBM PC compatible machine, the BIOS selects a boot device, then copies the first sector from the device (which may be a MBR, VBR or any executable code), into physical memory at memory address 0x7C00. On other systems, the process may be quite different.
- NOTE: This article is IBM PC-centric and does not explain the use of a boot sector on other types of computer systems.
Kinds of boot sectors
Several major kinds of boot sectors could be encountered on IBM PC compatible hard disks, floppy disks and similar storage devices:
- A master boot record (MBR) is the first sector of a data storage device that has been partitioned. The MBR sector may contain code to locate the active partition and invoke its Volume Boot Record.
- A volume boot record (VBR) is the first sector of a data storage device that has not been partitioned, or the first sector of an individual partition on a data storage device that has been partitioned. It may contain code to load and invoke an operating system (or other standalone program) installed on that device or within that partition.
To be a valid boot sector, the two-byte hexadecimal sequence 0x55, 0xAA (called the boot sector signature) must exist at the end of the sector; otherwise, either the BIOS or MBR code will report an error message and halt any OS bootstrapping process.
- CD-ROMs usually have their own structure of boot sectors, for IBM PC compatible systems this is subject to El Torito specifications.
- Non IBM PC compatible systems may have different boot sector formats on their disk devices.
Operation
On IBM PC compatible machines, the BIOS is ignorant of the distinction between VBRs and MBRs, and of partitioning. The firmware simply loads and runs the first sector of the storage device.[1] If the device is a floppy or USB flash drive, that will be a VBR. If the device is a hard disk, that will be an MBR. It is the code in the MBR which generally understands disk partitioning, and in turn, is responsible for loading and running the VBR of whichever primary partition is set to boot (the active partition). The VBR then loads a second-stage bootloader from another location on the disk.
Furthermore, whatever is stored in the first sector of a floppy diskette, USB device, hard disk or any other bootable storage device, is not required to immediately load any bootstrap code for an OS, if ever. The BIOS merely passes control to whatever exists there, as long as the sector meets the very simple qualification of having the boot record signature of 0x55, 0xAA in its last two bytes. This is why it's easy to replace the usual bootstrap code found in an MBR with more complex loaders, even large multi-functional boot managers (programs stored elsewhere on the device which can run without an operating system), allowing users a number of choices in what occurs next. With this kind of freedom, abuse often occurs in the form of boot sector viruses.
Boot sector viruses
Since code in the boot sector is executed automatically, boot sectors have historically been a common attack vector for computer viruses. To combat this behavior, the BIOS often includes an option to prevent writing to the boot sectors of attached hard drives.
See also
- Master boot record (MBR)
- Volume boot record (VBR)
References
External links
- Mary Landesman. "Boot sector viruses".
- Microsoft. "How to Protect Boot Sector from Viruses in Windows". KnowledgeBase.
- Denny Lin. "Inexpensive boot sector virus detection and prevention techniques".
- Kaspersky Lab. "Boot sector viruses". Virus Encyclopedia / Malware Descriptions / Classic Viruses.
- Arman Catacutan. "Glossary of Virus Terms". Boot Viruses.
- Greg O'Keefe. "Sample to build a boot program on x86 real mode".
- Susam Pal. "Writing boot sector code using GNU tools".
- Pierre Ancelot. "Bootsector assembly code with detailed explanation".