I made a post last year Is there anyone who has a way to make hidden partitions visible in DOS?, which mentioned two ideas:
The first idea: Add a segment of program in the boot sector of the system recovery disk. After it resides in memory, it takes over Int13H. For the reading of the ID of the backup partition (1BH), it returns 0BH to make the partition visible. After the subsequent DOS starts, this partition will naturally be visible. This is a practice similar to boot-sector viruses.
The second idea: After the DOS of the system recovery disk starts, a program finds the hidden backup partition and adds it as a normal FAT32 partition to the device chain of DOS and assigns the corresponding drive letter. This is a practice similar to NTFSDOS.
I hope someone can use this idea to make some tools, but after a long time, I still haven't seen it. I myself am too lazy to care and started using batch processing to find partitions for GHOST to call.
This year I saw this post again, and finally I don't want to be lazy. Since I'm still not clear about the details of DOS, I wrote a boot program to do it. Finally, there was a result. It passed the test in Bochs-2.1.1 and VM, and can deceive DOS to assign drive letters to hidden partitions of 1B and 1C formats after startup. I bring it here and hope friends can help test it with redundant real hard drives. (Special reminder, I guarantee that there is no code writing MBR in the program, but it's hard to guarantee all accidents, it's best to use a real hard drive that doesn't save important data to do it!)
Download address:
It has been changed to the one compiled on August 23, see the attachment.
Test method:
Unzip the downloaded ZIP file and prepare a boot disk image file.
Run the image modification program in the unzipped directory, in the format
MAKEIMG <original image file> <new image file>
The generated new image file can be tested in the virtual machine. If you want to test in a real machine, you can write it to a floppy disk or use software such as VFLOPPY to do it.
VMware screenshots:



The following is the programming record:
This is a program used to boot the boot floppy disk of my system backup/restoration CD. It will be placed in the first sector of the floppy disk. When this program boots the system, a prompt appears. The user can choose to press any key to boot the tool floppy disk, or boot the operating system on the hard drive after waiting for 8 seconds. After choosing to boot DOS from the tool floppy disk, the FAT32 primary partition (0B/0C) hidden in the MBR will be assigned a drive letter and become visible, so that conventional tools can be used to make backups - back up in the hidden partition, see who can delete it!
Final version: 2005/7/23 2005/6/29
Postscript:
The version on June 29 only handled the traditional INT13 function 2, so it worked normally in the small hard disk (1B-FAT32) in the virtual machine. As soon as it came to the partition (1C-FAT32LBA, 1E-FAT16LBA) read in LBA mode, it was done. But now there are no hard drives below 8GB, and reading is almost all in LBA mode.
July 23:
Added the takeover of the extended INT3 reading (42nd) function to realize the reading of the hidden LBA partition. Since there are almost no partitions using FAT16 on current hard drives, only FAT32 is processed.
Due to the addition of the new code, my original prompt information was also cut off a part.
【Current latest version】
HFBOOT.ASM is still from September 1st, and MAKEIMG.EXE was compiled after adding options on September 5th
The new command line is as follows:
MAKEIMG source image file name
Source image file name: The floppy disk image file used to make the function of displaying hidden partitions
Destination image file name: The floppy disk image file with the function of displaying hidden partitions to be generated, which can be omitted, and the default value is YISIR.IMG
Optional parameters:
/f: The generated program directly boots from the floppy disk when the computer starts.
/b: The generated program directly activates the hidden partition and starts when the computer starts. (Note that the operating system must be installed in the hidden partition. This function also does not write MBR)
When there are no /f and /b parameters, a prompt will appear and wait for 8 seconds. During this period, press any key to boot from the floppy disk, otherwise boot from the hard drive and do not load the function of displaying hidden partitions.
/k:n: n=1-4, 6-12. Set the key used to directly activate the hidden partition and start, which can be F1-F4, F6-F12
/p:n: n=0 - 255, customize the character that constitutes the progress bar, the default is 62 which is ">", like 219 (solid square), 220, 223 are also good-looking
/r:n: n=1 - 24, customize the starting line of the prompt information on the screen, the default is line 21, that is, display the prompt on line 21 and the progress bar on line 22.
/u: Uninstall this program, restore the image file generated by this program, and save the result as an image file.
I hope friends who download and use this software will post messages or leave messages on my small station to talk about their opinions.
[ Last edited by TurboY on 2005-9-6 at 15:38 ]
The first idea: Add a segment of program in the boot sector of the system recovery disk. After it resides in memory, it takes over Int13H. For the reading of the ID of the backup partition (1BH), it returns 0BH to make the partition visible. After the subsequent DOS starts, this partition will naturally be visible. This is a practice similar to boot-sector viruses.
The second idea: After the DOS of the system recovery disk starts, a program finds the hidden backup partition and adds it as a normal FAT32 partition to the device chain of DOS and assigns the corresponding drive letter. This is a practice similar to NTFSDOS.
I hope someone can use this idea to make some tools, but after a long time, I still haven't seen it. I myself am too lazy to care and started using batch processing to find partitions for GHOST to call.
This year I saw this post again, and finally I don't want to be lazy. Since I'm still not clear about the details of DOS, I wrote a boot program to do it. Finally, there was a result. It passed the test in Bochs-2.1.1 and VM, and can deceive DOS to assign drive letters to hidden partitions of 1B and 1C formats after startup. I bring it here and hope friends can help test it with redundant real hard drives. (Special reminder, I guarantee that there is no code writing MBR in the program, but it's hard to guarantee all accidents, it's best to use a real hard drive that doesn't save important data to do it!)
Download address:
It has been changed to the one compiled on August 23, see the attachment.
Test method:
Unzip the downloaded ZIP file and prepare a boot disk image file.
Run the image modification program in the unzipped directory, in the format
MAKEIMG <original image file> <new image file>
The generated new image file can be tested in the virtual machine. If you want to test in a real machine, you can write it to a floppy disk or use software such as VFLOPPY to do it.
VMware screenshots:



The following is the programming record:
This is a program used to boot the boot floppy disk of my system backup/restoration CD. It will be placed in the first sector of the floppy disk. When this program boots the system, a prompt appears. The user can choose to press any key to boot the tool floppy disk, or boot the operating system on the hard drive after waiting for 8 seconds. After choosing to boot DOS from the tool floppy disk, the FAT32 primary partition (0B/0C) hidden in the MBR will be assigned a drive letter and become visible, so that conventional tools can be used to make backups - back up in the hidden partition, see who can delete it!
Final version: 2005/7/23 2005/6/29
Postscript:
The version on June 29 only handled the traditional INT13 function 2, so it worked normally in the small hard disk (1B-FAT32) in the virtual machine. As soon as it came to the partition (1C-FAT32LBA, 1E-FAT16LBA) read in LBA mode, it was done. But now there are no hard drives below 8GB, and reading is almost all in LBA mode.
July 23:
Added the takeover of the extended INT3 reading (42nd) function to realize the reading of the hidden LBA partition. Since there are almost no partitions using FAT16 on current hard drives, only FAT32 is processed.
Due to the addition of the new code, my original prompt information was also cut off a part.
【Current latest version】
HFBOOT.ASM is still from September 1st, and MAKEIMG.EXE was compiled after adding options on September 5th
The new command line is as follows:
MAKEIMG source image file name
Source image file name: The floppy disk image file used to make the function of displaying hidden partitions
Destination image file name: The floppy disk image file with the function of displaying hidden partitions to be generated, which can be omitted, and the default value is YISIR.IMG
Optional parameters:
/f: The generated program directly boots from the floppy disk when the computer starts.
/b: The generated program directly activates the hidden partition and starts when the computer starts. (Note that the operating system must be installed in the hidden partition. This function also does not write MBR)
When there are no /f and /b parameters, a prompt will appear and wait for 8 seconds. During this period, press any key to boot from the floppy disk, otherwise boot from the hard drive and do not load the function of displaying hidden partitions.
/k:n: n=1-4, 6-12. Set the key used to directly activate the hidden partition and start, which can be F1-F4, F6-F12
/p:n: n=0 - 255, customize the character that constitutes the progress bar, the default is 62 which is ">", like 219 (solid square), 220, 223 are also good-looking
/r:n: n=1 - 24, customize the starting line of the prompt information on the screen, the default is line 21, that is, display the prompt on line 21 and the progress bar on line 22.
/u: Uninstall this program, restore the image file generated by this program, and save the result as an image file.
I hope friends who download and use this software will post messages or leave messages on my small station to talk about their opinions.
[ Last edited by TurboY on 2005-9-6 at 15:38 ]
Recent Ratings for This Post
( 1 in total)
Click for details
| Rater | Score | Time |
|---|---|---|
| — | +1 | 2010-03-22 20:16 |
从95年开始用DOS3.2,96年在Windows3.1里认识了鼠标,97年开始用Win95,98年装过NetWare,99年迷过Linux,现在用WinXP、WinME和DOS7.1。一回首,从盲到忙,从忙到茫。


