China DOS Union

Sender: microbe (wonderful microorganism), Board: DOS
Title: The linked-list structure of hard disk partitions
Posting station: BBS Shuimu Tsinghua Station (Wed Sep 17 14:09:05 1997)

【 Mentioned in the post by watch (乾坤一剑): 】
: The various partition tables are stored in a linked-list manner.
: And each one is separately in the first sector of its own partition?
: You can use the DEBUG command to first bring up the first one, then use the size of this partition to calculate the position of the next partition.
: And so on (though a bit troublesome) you can find them all out!!
: I did it before.
: You can also use NORTON's DISKEDIT,.

No need to calculate. If the flag byte of a table entry is 06 (meaning extended partition), it contains a pointer to
the next partition table. These pointers form a linked-list structure on the hard disk.

Take a typical hard disk that contains only a DOS primary partition and extended partitions as an example. Suppose there are 1000 cylinders in total, the first
partition (that is, logical C drive) is 500 cylinders, the first extended partition (logical D drive) is 200 cylinders,
and the second extended partition (logical E drive) is 300 cylinders. Then the first partition table, the one at cylinder 0 head 0 sector 1,
has two entries: the flag of the first entry is BIGDOS (05), and of course it is bootable, pointing
to the boot sector of drive C, at cylinder 0 head 1 sector 1; the flag of the second entry is extended partition (06), pointing to
cylinder 500 head 0 sector 1, that is, the address of the second partition table. This partition table also contains two entries: the first entry
is also BIGDOS, pointing to cylinder 500 head 1 sector 1, the boot sector of drive D; the second entry is again an extended partition, pointing
to the address of the third partition table, at cylinder 700 head 0 sector 1. This is also the last partition table. In this
partition table, there is only one entry, with flag BIGDOS, pointing to the boot sector of drive E, at cylinder 700 head 1 sector 1.

In short, when there are only DOS partitions, if the hard disk has N logical drive letters, there are N partition tables corresponding to them.
Except for the last partition table, all have two entries. One points to the boot sector of the actual logical drive (usually on
the reverse side of this partition table, that is, head 1 sector 1 of the same cylinder), and one points to the next partition table. Partition tables are always
located at head 0 sector 1, while the boot sector of the specific logical drive is located at head 1 sector 1.

Whether booting from hard disk or floppy disk, a section of code in DOS's IO.SYS must search this linked list to establish
logical drives. It can be seen that if there is a problem with this linked list, the boot process may fail. For example,
if a certain partition table does not contain an entry pointing to the boot sector of some logical drive, but contains only an entry whose flag
is extended partition and points to itself, then DOS will never find the correct boot sector, and will loop
forever. This is what the KV300 bomb exploits.


--
Having traveled to the ends of the earth in the end I still turn back
Having seen flowers like a sea falling like snow


※ Source: ·BBS Shuimu Tsinghua Station bbs.net.tsinghua.edu.cn·

(This article was copied using the S-Term article copy script)
==================================================