An Examination of the
Windows™ 7 (and Vista)
VBR ( Volume Boot Record )
or Boot Sector (and Beyond)

[ Embedded in untfs.dll,
winsetup.dll and various other
System files
; see Introduction
]


Web Presentation and Text are Copyright©2012, 2015 by Daniel B. Sedory
NOT to be reproduced in any form without Permission of the Author !

This page examines the Windows™ 7 OS's Volume Boot Record (VBR); which is considered to be only the first sector of the system area at the beginning of a Win 7 OS volume (thus, its alternate name: Boot Sector). The BOOTMGR Loader code, immediately following the VBR Sector, spans across the boundaries of eight more sectors: Seven full 512-byte sectors, plus 40 bytes at the beginning of the eighth sector. This structure is similar to the layout of the Windows XP VBR and its NTLDR Loader code. [Note: If you compare the Windows 7 BOOTMGR Loader code to the Vista BOOTMGR Loader (both of which have the same total number of bytes), there are 19 bytes different in the executable code. But, after examining all the differences, we found they were only in the offsets of jump instructions, which had to be adjusted due to the fact the Windows 7 Boot Sector had added 12 new bytes to its code, forcing many of the jump instructions in the BOOTMGR Loader to also change. Therefore, the source code instructions for both the Windows Vista and Windows 7 BOOTMGR Loaders are still identical.]


Other Microsoft OS Volume Boot Records:
  An Examination of the Windows 95B/98/98SE/Me OS Boot Record (MSWIN4.1)
  An Examination of the Windows 2000/XP OS Boot Record (NTFS)
  An Examination of the Windows Vista OS Volume Boot Record (NTFS)
  An Examination of the Windows 8 / 8.1 OS Volume Boot Record (NTFS)
  A Comparison of Windows™ Vista, 7 and 8 VBR Code

And Microsoft MBR pages:
  An Examination of the Standard MBR created by MS-DOS FDISK
  The MBR created by Windows 95B/98/98SE and ME's FDISK
  The MBR created by Windows 2000/XP/2003 Installs or Disk Management Utility
  The MBR created by Windows Vista OS Installs or Disk Management Utility
  The MBR created by Windows 7 / 8 OS's Installs or Disk Management

Confused? Send us an email if you have a specific question about the MBR or any Boot Records...

 

Just as we urged readers of our Win 7 MBR page to make a copy of their MBR sector, you may wish to create copies of your Win 7 VBR. Though more difficult to work with; considering all the details stored in this sector, there may come a time when you need/want to edit or replace this and other system sectors manually.

Some advice: Save all the data from the BIOS Parameter Block (BPB) area of the sector somewhere apart from your main hard disk or write it down on paper(!); it does no good to have data you might need to access your OS on the un-accessible HD itself! There are many ways you can do this... See our MBR Tools Page. Any good Disk Editor will allow you to manually enter data you've written down, or you can use a number of utility programs to save the binary data to a file on say a thumb drive, and later on restore the VBR and other sectors from the saved file(s).


Introduction

 Relative Sector 0 (within the Volume)

                                          NTFS BPB          "OEM ID"
                                              |                 |
         0  1  2  3  4  5  6  7  8  9  A  B  C| D  E  F         |
 0000:  EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00  .R.NTFS    .....
 0010:  00 00 00 00 00 F8 00 00 3F 00 FF 00[00 28 03 00] ........?.......
 0020:  00 00 00 00 80 00 80 00 FF CF FC 02 00 00 00 00  ..........?.....
 0030:  00 00 0C 00 00 00 00 00 02 00 00 00 00 00 00 00  ................
 0040:  F6 00 00 00 01 00 00 00 6B E5 F9 78 1A FA 78 EA  ........k..x..x.
 0050:  00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB 68 C0 07  .....3.....|.h..
 0060:  1F 1E 68 66 00 CB 88 16 0E 00 66 81 3E 03 00 4E  ..hf......f.>..N
 0070:  54 46 53 75 15 B4 41 BB AA 55 CD 13 72 0C 81 FB  TFSu..A..U..r...
 0080:  55 AA 75 06 F7 C1 01 00 75 03 E9 DD 00 1E 83 EC  U.u.....u.......
 0090:  18 68 1A 00 B4 48 8A 16 0E 00 8B F4 16 1F CD 13  .h...H..........
 00A0:  9F 83 C4 18 9E 58 1F 72 E1 3B 06 0B 00 75 DB A3  .....X.r.;...u..
 00B0:  0F 00 C1 2E 0F 00 04 1E 5A 33 DB B9 00 20 2B C8  ........Z3... +.
 00C0:  66 FF 06 11 00 03 16 0F 00 8E C2 FF 06 16 00 E8  f...............
 00D0:  4B 00 2B C8 77 EF B8 00 BB CD 1A 66 23 C0 75 2D  K.+.w......f#.u-
 00E0:  66 81 FB 54 43 50 41 75 24 81 F9 02 01 72 1E 16  f..TCPAu$....r..
 00F0:  68 07 BB 16 68 70 0E 16 68 09 00 66 53 66 53 66  h...hp..h..fSfSf
 0100:  55 16 16 16 68 B8 01 66 61 0E 07 CD 1A 33 C0 BF  U...h..fa....3..
 0110:  28 10 B9 D8 0F FC F3 AA E9 5F 01 90 90 66 60 1E  (........_...f`.
 0120:  06 66 A1 11 00 66 03 06 1C 00 1E 66 68 00 00 00  .f...f.....fh...
 0130:  00 66 50 06 53 68 01 00 68 10 00 B4 42 8A 16 0E  .fP.Sh..h...B...
 0140:  00 16 1F 8B F4 CD 13 66 59 5B 5A 66 59 66 59 1F  .......fY[ZfYfY.
 0150:  0F 82 16 00 66 FF 06 11 00 03 16 0F 00 8E C2 FF  ....f...........
 0160:  0E 16 00 75 BC 07 1F 66 61 C3 A0 F8 01 E8 09 00  ...u...fa.......
 0170:  A0 FB 01 E8 03 00 F4 EB FD B4 01 8B F0 AC 3C 00  ..............<.
 0180:  74 09 B4 0E BB 07 00 CD 10 EB F2 C3 0D 0A 41 20  t.............A 
 0190:  64 69 73 6B 20 72 65 61 64 20 65 72 72 6F 72 20  disk read error 
 01A0:  6F 63 63 75 72 72 65 64 00 0D 0A 42 4F 4F 54 4D  occurred...BOOTM
 01B0:  47 52 20 69 73 20 6D 69 73 73 69 6E 67 00 0D 0A  GR is missing...
 01C0:  42 4F 4F 54 4D 47 52 20 69 73 20 63 6F 6D 70 72  BOOTMGR is compr
 01D0:  65 73 73 65 64 00 0D 0A 50 72 65 73 73 20 43 74  essed...Press Ct
 01E0:  72 6C 2B 41 6C 74 2B 44 65 6C 20 74 6F 20 72 65  rl+Alt+Del to re
 01F0:  73 74 61 72 74 0D 0A 00 8C A9 BE D6 00 00 55 AA  start.........U.
         0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F

Figure 1.


An Examination of the Assembly Code


Location of Error Messages and
Message Offsets in Memory


First Published: March 30, 2012. (30.03.2012).
Updated: March 28, 2012 (28.03.12), April 15, 2012 (15.04.2012); April 19, 2012 (19.04.2012); May 29, 2015 (29.05.2015); 14 JUN 2015 (14.06.2015); 12 JUL 2015 (12.07.2015); 28 JUL 2015 (28.07.2015); 19 AUG 2015 (19.08.2015); 19 MAY 2021 (19.05.2021).

Last Update: 21 September 2015. (21.09.2015). (And we're not finished yet!)


You can write to us using this: online reply form.(It opens in a new window.)

The Starman's FREE TOOLS Page

MBR and Boot Records Index

The Starman's Realm Index Page