MBR
and Boot Records Index The Starman's Realm Index PageThe MS-DOS 5.0
Floppy Disk Boot Record
(on
a 1200 KiB floppy diskette)
Web Presentation and Text are Copyright©2003-2021 by Daniel
B. Sedory
NOT to be reproduced in any form without Permission
of the Author !
Introduction
Since floppy disks never have an MBR, the first sector of any diskette (that's Absolute Sector 0 or CHS 0,0,1) normally contains the Boot Record for some OS. And since they are floppy disks, you'll most likely read about Tracks (instead of Cylinders) and Sides (instead of Heads) when dealing with them. These terms seem to make more sense, since you can actually hold the removable media in your hands and easily observe that the jacket (or hard plastic shell) contains a circular disc having two sides, without ever having to think about the heads and mechanical parts inside a floppy drive.
Disk Editor View
This section is a disk editor view of how the Boot Record is stored on a 1200 KiB Floppy Diskette (often incorrectly called a 1.2 mb floppy).
The bytes between the
two dark blue bands
(from offsets 00Bh
through 03Dh)
in this disk editor view are called the BPB (or BIOS
Parameter Block); a detailed explanation
of the BPB is found below. Most of
the Boot Record is executable code; from offsets 03Eh
through 19Dh. The code is followed by one long error
message and the two system filenames: IO.SYS
and MSDOS.SYS. Finally, the sector ends with the
Word-sized signature ID (or Magic number) of AA55
hex (remember hex Words for Intel x86 type CPUs are stored in memory with
the Lowest-byte first and the Highest-byte last to make processing quicker).
Absolute Sector 0 (Track 0, Side 0, Sector 1) BPB OEM System Name | | 0 1 2 3 4 5 6 7 8 9 A B C D| E F | | | 0000 EB 3C 90 4D 53 44 4F 53 35 2E 30 00 02 01 01 00 .<.MSDOS5.0..... 0010 02 E0 00 60 09 F9 07 00 0F 00 02 00 00 00 00 00 ...`............ 0020 00 00 00 00 00 00 29 FC 18 52 21 4E 4F 20 4E 41 ......)..R!NO NA 0030 4D 45 20 20 20 20 46 41 54 31 32 20 20 20 FA 33 ME FAT12 .3 0040 C0 8E D0 BC 00 7C 16 07 BB 78 00 36 C5 37 1E 56 .....|...x.6.7.V 0050 16 53 BF 3E 7C B9 0B 00 FC F3 A4 06 1F C6 45 FE .S.>|.........E. 0060 0F 8B 0E 18 7C 88 4D F9 89 47 02 C7 07 3E 7C FB ....|.M..G...>|. 0070 CD 13 72 79 33 C0 39 06 13 7C 74 08 8B 0E 13 7C ..ry3.9..|t....| 0080 89 0E 20 7C A0 10 7C F7 26 16 7C 03 06 1C 7C 13 .. |..|.&.|...|. 0090 16 1E 7C 03 06 0E 7C 83 D2 00 A3 50 7C 89 16 52 ..|...|....P|..R 00A0 7C A3 49 7C 89 16 4B 7C B8 20 00 F7 26 11 7C 8B |.I|..K|. ..&.|. 00B0 1E 0B 7C 03 C3 48 F7 F3 01 06 49 7C 83 16 4B 7C ..|..H....I|..K| 00C0 00 BB 00 05 8B 16 52 7C A1 50 7C E8 92 00 72 1D ......R|.P|...r. 00D0 B0 01 E8 AC 00 72 16 8B FB B9 0B 00 BE E6 7D F3 .....r........}. 00E0 A6 75 0A 8D 7F 20 B9 0B 00 F3 A6 74 18 BE 9E 7D .u... .....t...} 00F0 E8 5F 00 33 C0 CD 16 5E 1F 8F 04 8F 44 02 CD 19 ._.3...^....D... 0100 58 58 58 EB E8 8B 47 1A 48 48 8A 1E 0D 7C 32 FF XXX...G.HH...|2. 0110 F7 E3 03 06 49 7C 13 16 4B 7C BB 00 07 B9 03 00 ....I|..K|...... 0120 50 52 51 E8 3A 00 72 D8 B0 01 E8 54 00 59 5A 58 PRQ.:.r....T.YZX 0130 72 BB 05 01 00 83 D2 00 03 1E 0B 7C E2 E2 8A 2E r..........|.... 0140 15 7C 8A 16 24 7C 8B 1E 49 7C A1 4B 7C EA 00 00 .|..$|..I|.K|... 0150 70 00 AC 0A C0 74 29 B4 0E BB 07 00 CD 10 EB F2 p....t)......... 0160 3B 16 18 7C 73 19 F7 36 18 7C FE C2 88 16 4F 7C ;..|s..6.|....O| 0170 33 D2 F7 36 1A 7C 88 16 25 7C A3 4D 7C F8 C3 F9 3..6.|..%|.M|... 0180 C3 B4 02 8B 16 4D 7C B1 06 D2 E6 0A 36 4F 7C 8B .....M|.....6O|. 0190 CA 86 E9 8A 16 24 7C 8A 36 25 7C CD 13 C3 0D 0A .....$|.6%|..... 01A0 4E 6F 6E 2D 53 79 73 74 65 6D 20 64 69 73 6B 20 Non-System disk 01B0 6F 72 20 64 69 73 6B 20 65 72 72 6F 72 0D 0A 52 or disk error..R 01C0 65 70 6C 61 63 65 20 61 6E 64 20 70 72 65 73 73 eplace and press 01D0 20 61 6E 79 20 6B 65 79 20 77 68 65 6E 20 72 65 any key when re 01E0 61 64 79 0D 0A 00 49 4F 20 20 20 20 20 20 53 59 ady...IO SY 01F0 53 4D 53 44 4F 53 20 20 20 53 59 53 00 00 55 AA SMSDOS SYS..U. 0 1 2 3 4 5 6 7 8 9 A B C D E F |
The first three bytes
of the 512-byte Boot Sector are often called the Jump Instruction (but
the third byte, which has always been a 90h in
all of the IBM PC and MS-DOS OS releases, hasn't ever been part of
the actual Jump code itself; it's a NOP which simply means "No Operation,"
it's just there so programmers could use the three-byte "Direct" form of the
JMP instruction if they ever wanted to).
This is followed by the OEM System
Name which happens to be "MSDOS5.0"
in this case, but could be anything as far as the code is concerned (CAUTION:
Any diskette that is not write-protected, will have these bytes overwritten
by any Microsoft Win 9x or later OS; for more info see: Notes
about the "IHC" string under DEBUG's Load Instruction here
).
Next we have the 1200 KiB _ BIOS Parameter Block _
(or BPB); some of which dates back to the release of (IBM PC/MS) DOS version 2.0.
Beginning at offset 0Bh, the BPB data on this diskette
is interpreted as follows:
0 1 2 3 4 5 6 7 8 9 A B C D E F 0B: 00 02 01 01 00 ..... 10: 02 E0 00 60 09 F9 07 00 0F 00 02 00 00 00 00 00 ...`............ 20: 00 00 00 00 00 00 29 FC 18 52 21 4E 4F 20 4E 41 ......)..R!NO NA 30: 4D 45 20 20 20 20 46 41 54 31 32 20 20 20 ME FAT12 Hex As seen OFFSET on Disk HEX value Meaning / Description ------ ------- --------- ----------------------------------------------- 0B-0C 00 02 0200h = 512 Bytes per Sector, 0D 01 01h = 1 Sector per Cluster, 0E-0F 01 00 0001h = 1 Reserved sector (starting at Sector 0), 10 02 02h = 2 FATs on the diskette, 11-12 E0 00 00E0h = 224 possible Root Directory entries, 13-14 60 09 0960h = 2400 Total Sectors on the diskette (2400 x 512 = 1,228,800 bytes total; 1200 KiB), 15 F9 => Media Descriptor Byte: F9 means this is either a Double-Sided diskette with 15 Sectors per Track, or a Double-Sided (720 KiB) diskette with only 9 Sectors per Track! ( Obviously you need more info than just this one byte to know for sure what type and capacity it is. Perhaps this fact signaled the end of its usefulness.*) 16-17 07 00 0007h = 7 Sectors per FAT, 18-19 0F 00 000Fh = 15 Sectors per Track, 1A-1B 02 00 0002h = 2 Sides (or Heads). 1C-1F 00 00 00 00 => See the text below (must be all zero bytes). 20-23 00 00 00 00 => See the text below (must be all zero bytes). 24-25 00 00 => “Reserved” (should both be zero bytes). 26 29 => Extended BPB Signature Byte (if present, then the following strings will also have meaning): 27-2A xx xx xx xx = Volume Serial Number. 2B-35 (11 bytes) = Volume Label. 36-3D ( 8 bytes) = File System ID (see discussion below). ______________ * FF=DS,8 SPT (a 320 KiB); FE=SS,8 SPT (a 160 KiB); FD=DS,9 SPT (a 360 KiB); FC=SS,9 SPT (180 KiB); F9 = DS,HD,9 SPT (720 KiB) or DS,HD,15 SPT (1200 KiB). ( As noted above, since F9 can mean either of these last two diskette types, it became far less useful for identifying the type of diskette in use.) |
The first sector of the floppy disk is copied into Memory at location 0000:7C00 by a "bootstrap" routine in the computer's BIOS chip.
7C00 EB3C JMP 7C3E ; Jump over the BPB.
7C02 90 NOP ; Do nothing.
=========================================================================
OEM string and BIOS Parameter Block Data
========================================
0 1 2 3 4 5 6 7 8 9 A B C D E F
7C03 4D 53 44 4F 53 35 2E 30 00 02 01 01 00 MSDOS5.0.....
7C10 02 E0 00 60 09 F9 07 00 0F 00 02 00 00 00 00 00 ...`............
7C20 00 00 00 00 00 00 29 FC 18 52 21 4E 4F 20 4E 41 ......)..R!NO NA
7C30 4D 45 20 20 20 20 46 41 54 31 32 20 20 20 ME FAT12
0 1 2 3 4 5 6 7 8 9 A B C D E F
=========================================================================
7C3E FA CLI ; Disable maskable Interrupts
7C3F 33C0 XOR AX,AX ; Zero-out the Accumulator and set
7C41 8ED0 MOV SS,AX ; Stack Segment register to ZERO.
7C43 BC007C MOV SP,7C00 ; Stack Pointer top now 0000:7C00
7C46 16 PUSH SS ;|
7C47 07 POP ES ;|Makes sure Extra Segment = ZERO.
; The following code copies data from the Diskette Drive Parameters Table (which
; a far pointer (Segment:Offset) in the Interrupt Vector Table (IVT) at 0:0078
; points to) into Memory locations 7C3E thru 7C48 for later use here; thus,
; overwriting the first 11 bytes of this Boot Sector's own code in Memory:
7C48 BB7800 MOV BX,0078 ; 0078h ---> BX
7C4B 36C537 LDS SI,[SS:BX] ; SS is still zero...
; Load Far Pointer from [SS:0078]
; into DS:SI (usually 0000:0522).
7C4E 1E PUSH DS
7C4F 56 PUSH SI
7C50 16 PUSH SS
7C51 53 PUSH BX
; The following four instructions will overwrite 11 code bytes starting at 7C3Eh:
7C52 BF3E7C MOV DI,7C3E ; First Memory addres to overwrite.
7C55 B90B00 MOV CX,000B ; Copy CX (0Bh = 11) bytes from ...
7C58 FC CLD ; Clear Direction Flag (df=0).
7C59 F3A4 REP MOVSB ; ... DS:SI to ES:DI (0000:7C3E) and
; following; DI will increase to 7C49
; before REP MOVSB stops copy process.
7C5B 06 PUSH ES ; ES = zero.
7C5C 1F POP DS ; Data Segment set to ZERO.
7C5D C645FE0F MOV BYTE PTR [DI-02],0F ; 0Fh ---> [7C47].
7C61 8B0E187C MOV CX,[7C18] ; Copy SPT ([7C18]) into CX
7C65 884DF9 MOV [DI-07],CL ; Sectors/Track --> [7C42].
; The next two instructions set the Diskette Parameters Table SEG:OFF vector
; at [0:0078] from the original vector of 0000:0522 to our 0000:7C3E address,
; so any DPT look-ups will access the data created here instead:
7C68 894702 MOV [BX+02],AX ; 0000 --> [0:007A]
7C6B C7073E7C MOV WORD PTR [BX],7C3E ; 7C3E --> [0:0078]
7C6F FB STI ; Enable maskable Interrupts
; after the next instruction.
;---------------------------------------------------------------------------
; INT 13 - DISK - RESET DISK SYSTEM
; AH = 00h
; DL = drive (if bit 7 is set both hard disks and floppy disks reset)
; Return: AH = status (see #00234)
; CF clear if successful (returned AH=00h)
; CF set on error
;---------------------------------------------------------------------------
7C70 CD13 INT 13
7C72 7279 JC 7CED ; If CF set, there's a disk error,
; so jump to Error Msg. routine!
7C74 33C0 XOR AX,AX
7C76 3906137C CMP [7C13],AX
7C7A 7408 JZ 7C84
7C7C 8B0E137C MOV CX,[7C13] ; [7C13] = Total Sectors
; 960h = 2400 sectors.
7C80 890E207C MOV [7C20],CX
7C84 A0107C MOV AL,[7C10] ; FAT12 File System has two FATs
7C87 F726167C MUL WORD PTR [7C16] ; of 7 sectors each, plus...
7C8B 03061C7C ADD AX,[7C1C] ; zero (no "Hidden sectors"!)
7C8F 13161E7C ADC DX,[7C1E]
7C93 03060E7C ADD AX,[7C0E] ; 1 Reserved sector (VBR itself)
7C97 83D200 ADC DX,+00
7C9A A3507C MOV [7C50],AX
7C9D 8916527C MOV [7C52],DX
7CA1 A3497C MOV [7C49],AX
7CA4 89164B7C MOV [7C4B],DX
7CA8 B82000 MOV AX,0020 ; 20h = 32 bytes per Directory entry
7CAB F726117C MUL WORD PTR [7C11] ; [7C11] contains number of possible
; Root Directory entries (224).
; So, AX now contains: 1C00 hex (32 x 224 = 7,168 bytes used by Root Directory).
7CAF 8B1E0B7C MOV BX,[7C0B] ; [7C0B] is 512 Bytes per Sector.
7CB3 03C3 ADD AX,BX ; Add 1 more sector in bytes.
7CB5 48 DEC AX ; Subtract 1 byte.
7CB6 F7F3 DIV BX ; Divide by 512 to get sectors.
7CB8 0106497C ADD [7C49],AX
7CBC 83164B7C00 ADC WORD PTR [7C4B],+00
7CC1 BB0005 MOV BX,0500 ; 500h = 1,280
7CC4 8B16527C MOV DX,[7C52]
7CC8 A1507C MOV AX,[7C50]
7CCB E89200 CALL 7D60 ; Convert Absolute Sector to CHS tuple
7CCE 721D JB 7CED
7CD0 B001 MOV AL,01 ; Read only 1 sector
7CD2 E8AC00 CALL 7D81 ; -> Read Sector
7CD5 7216 JB 7CED
7CD7 8BFB MOV DI,BX
7CD9 B90B00 MOV CX,000B ; 11 characters per file name.
7CDC BEE67D MOV SI,7DE6 ; Points to: IO SYS
7CDF F3 REPZ
7CE0 A6 CMPSB ; Compare "IO.SYS" name to
; first file name in Root Directory of diskette.
7CE1 750A JNZ 7CED ; If not identical, there's a
; disk error or it's not a System disk!
; Now check if "MSDOS.SYS" is the second file in the Root Directory:
7CE3 8D7F20 LEA DI,[BX+20] ; Points to: MSDOS SYS
7CE6 B90B00 MOV CX,000B
7CE9 F3 REPZ
7CEA A6 CMPSB
7CEB 7418 JZ 7D05
7CED BE9E7D MOV SI,7D9E ; Points to Error Message
7CF0 E85F00 CALL 7D52 ; Display Character String
7CF3 33C0 XOR AX,AX
7CF5 CD16 INT 16 ; Get Keystroke from Keyboard
7CF7 5E POP SI
7CF8 1F POP DS
7CF9 8F04 POP [SI]
7CFB 8F4402 POP [SI+02]
7CFE CD19 INT 19 ; If a key was pressed, then
; Start over again with
; System BOOTSTRAP LOADER.
7D00 58 POP AX
7D01 58 POP AX
7D02 58 POP AX
7D03 EBE8 JMP 7CED
7D05 8B471A MOV AX,[BX+1A]
7D08 48 DEC AX
7D09 48 DEC AX
7D0A 8A1E0D7C MOV BL,[7C0D]
7D0E 32FF XOR BH,BH
7D10 F7E3 MUL BX
7D12 0306497C ADD AX,[7C49]
7D16 13164B7C ADC DX,[7C4B]
7D1A BB0007 MOV BX,0700
7D1D B90300 MOV CX,0003
7D20 50 PUSH AX
7D21 52 PUSH DX
7D22 51 PUSH CX
7D23 E83A00 CALL 7D60 ; Convert Absolute Sector to CHS tuple
7D26 72D8 JB 7D00 ; If there was an error,
7D28 B001 MOV AL,01 ; Read only 1 sector
7D2A E85400 CALL 7D81 ; -> Read Sector
7D2D 59 POP CX
7D2E 5A POP DX
7D2F 58 POP AX
7D30 72BB JB 7CED ; If there was an error
7D32 050100 ADD AX,0001
7D35 83D200 ADC DX,+00
7D38 031E0B7C ADD BX,[7C0B]
7D3C E2E2 LOOP 7D20 ; Loop until OS Init is in Memory
7D3E 8A2E157C MOV CH,[7C15]
7D42 8A16247C MOV DL,[7C24]
7D46 8B1E497C MOV BX,[7C49]
7D4A A14B7C MOV AX,[7C4B]
7D4D EA00007000 JMP FAR PTR 0070:0000 ; Same as jumping to
; 0000:0700 (start DOS).
; Boot Record found OS successfully... Jump to OS initialization!
; (IN) DS:SI - Pointer to Zero-terminated String
7D52 AC LODSB
7D53 0AC0 OR AL,AL
7D55 7429 JZ 7D80 ; -> RETurn from Subroutine.
7D57 B40E MOV AH,0E ; Video Function 0Eh
7D59 BB0700 MOV BX,0007 ; Page 0, Mode 7...
7D5C CD10 INT 10 ; of INT 10. "Tele-
; type Output" AL =
; character to write.
7D5E EBF2 JMP 7D52 ; Loop until done.
;================================================================================
; Converts Absolute Sector Number to Side-Track-Sector Tuple
; (IN) WORD PTR [7C18] - Number of Sectors per Track (SPT) in BPB (0x0F or "15" in this case)
; (IN) WORD PTR [7C1A] - Number of Sides in BPB ("2" Sides)
; (IN) DX, AX - Absolute Sector Number
;
; (OUT) WORD PTR [7C4D] - Track (Cylinder)
; (OUT) BYTE PTR [7C25] - Side (Head)
; (OUT) BYTE PTR [7C4F] - Sector
7D60 3B16187C CMP DX,[7C18]
7D64 7319 JNB 7D7F
7D66 F736187C DIV WORD PTR [7C18] ; Divide AX by SPT (Sectors per Track)
7D6A FEC2 INC DL ; Add 1, since sectors count from 1
7D6C 88164F7C MOV [7C4F],DL ; Store remainder in [7C4F] (used as Sector number when calling 7D81)
7D70 33D2 XOR DX,DX ; Clear DX
7D72 F7361A7C DIV WORD PTR [7C1A] ; Divide AX by number of Sides/Heads (see 7D66)
7D76 8816257C MOV [7C25],DL ; Store remainder in [7C25] (used as Side number when calling 7D81)
7D7A A34D7C MOV [7C4D],AX ; Store result in [7C4D] (used as Track number when calling 7D81)
7D7D F8 CLC ; Clear Carry Flag (CF=0); all OK.
7D7E C3 RET
7D7F F9 STC ; Set Carry Flag (CF=1); returns error state.
7D80 C3 RET
; (IN) AL - Number of sectors to read = 1 ; (IN) BYTE PTR [7C24] - Physical Drive Number ; (IN) BYTE PTR [7C25] - Side / Head ; (IN) WORD PTR [7C4D] - Track ; (IN) BYTE PTR [7C4F] - Starting Sector 7D81 B402 MOV AH,02 ; Function 02 of INT 13 7D83 8B164D7C MOV DX,[7C4D] ; Track number 7D87 B106 MOV CL,06 7D89 D2E6 SHL DH,CL 7D8B 0A364F7C OR DH,[7C4F] ; Sector number 7D8F 8BCA MOV CX,DX 7D91 86E9 XCHG CH,CL 7D93 8A16247C MOV DL,[7C24] ; Physical drive number 7D97 8A36257C MOV DH,[7C25] ; Side/Head number 7D9B CD13 INT 13 7D9D C3 RET
E F 7D9E 0D 0A .. 7DA0 4E 6F 6E 2D 53 79 73 74 65 6D 20 64 69 73 6B 20 Non-System disk 7DB0 6F 72 20 64 69 73 6B 20 65 72 72 6F 72 0D 0A 52 or disk error..R 7DC0 65 70 6C 61 63 65 20 61 6E 64 20 70 72 65 73 73 eplace and press 7DD0 20 61 6E 79 20 6B 65 79 20 77 68 65 6E 20 72 65 any key when re 7DE0 61 64 79 0D 0A 00 49 4F 20 20 20 20 20 20 53 59 ady...IO SY 7DF0 53 4D 53 44 4F 53 20 20 20 53 59 53 00 00 55 AA SMSDOS SYS..U. 0 1 2 3 4 5 6 7 8 9 A B C D E F
Updates: 18 December 2007 (18/12/2007); 24 SEP 2011 (24/09/2011); 03 March 2020 (10/03/2020); 02 DEC 2021 (02/12/2021).
You can write to me using this: online
reply form.
MBR
and Boot Records Index
The Starman's Realm Index Page