Windows 98 SE (Second Edition) MBR

Abstract

This is a continuation of Windows 95b MBR which discusses the PC boot sequence and the MBR (Master Boot Record) from a PC running Windows 95 OSR2. This page concentrates on the Windows 98SE MBR and the minor differences from the Windows 95 OSR2 MBR.

Table of Contents

• Introduction
• Entire MBR record in hex and ASCII
• Partition Table (as 4 16-byte entries)
• Entry 1 - Details
• Notes
• Entry 2 - Details
• MBR - System Indicator
• MBR - Program

Introduction

There are only minor differences between the Windows 95 (OSR2) MBR and the Windows 98 SE MBR. This page will only highlight the differences. See Windows 95b MBR for more in-depth information. The MBR show here was acquired from a new hard drive with a virgin installation of the retail version of Windows 98SE using 32-bit FAT on a Maxtor 30GB hard drive on 23 April 2001. Both Windows 98SE and the hard drive were bought new just previous to the installation.

Three partitions were created, a primary partition of 8184 MB using a 4 KB cluster size, and an extended partition with two logical partitions. The first logical partition was 8184 MB using 4 KB clusters and the second was 14353 MB using 8 KB clusters.

Entire MBR record in hex and ASCII

The following is the MBR from the first physical sector (Cylinder 0, Side 0, Sector 1) of a hard drive with Windows 98SE installed. The entire first track was examined but only the first sector contained non-zero values.

• Program code is found at hex offset locations 00000 to 0010E.
• The message area is at hex offset locations 0010F to 00174.
• Hex offsets 00175 to 00182 contain all 0's.
• Additional program code is found at hex offset locations 00183 to 00189.
• Hex offsets 0018A to 001BD contain all 0's.
• The partition table is located at 001BE to 001FD (64 bytes).
• The signature 55AA occupies the last two bytes, 001FE and 001FF.

• The Program code at offset locations 000DA to 000DF, which appear to be unused as previously shown in Disassembly of MBR Program Code for Windows 95b, are slightly different. These bytes are found at memory locations 006DA to 006DF in the program code. The boot sector does not refer to these bytes either, but they probably serve some purpose.

  For Windows 95b,   hex values at 000DA to 000DF are: 000080193008
  For Windows 98SE, hex values at 000DA to 000DF are: 000080065319

• The message area is larger, occupying offset locations 0010F to 00174 instead of 0010F to 0015D, and with slightly different text.
• As expected, the partition table values at 001BE to 001FD are different but the structure is still the same.

OFFSET  0  1  2  3  4  5  6  7    8  9  A  B  C  D  E  F   0123456789ABCDEF
---------------------------------------------------------------------------
00000  33 C0 8E D0 BC 00 7C FB - 50 07 50 1F FC BE 1B 7C   3.....|.P.P....|
00010  BF 1B 06 50 57 B9 E5 01 - F3 A4 CB BE BE 07 B1 04   ...PW...........
00020  38 2C 7C 09 75 15 83 C6 - 10 E2 F5 CD 18 8B 14 8B   8,|.u...........
00030  EE 83 C6 10 49 74 16 38 - 2C 74 F6 BE 10 07 4E AC   ....It.8,t....N.
00040  3C 00 74 FA BB 07 00 B4 - 0E CD 10 EB F2 89 46 25   ..t...........F%
00050  96 8A 46 04 B4 06 3C 0E - 74 11 B4 0B 3C 0C 74 05   ..F.....t.....t.
00060  3A C4 75 2B 40 C6 46 25 - 06 75 24 BB AA 55 50 B4   :.u+@.F%.u$..UP.
00070  41 CD 13 58 72 16 81 FB - 55 AA 75 10 F6 C1 01 74   A..Xr...U.u....t
00080  0B 8A E0 88 56 24 C7 06 - A1 06 EB 1E 88 66 04 BF   ....V$.......f..
00090  0A 00 B8 01 02 8B DC 33 - C9 83 FF 05 7F 03 8B 4E   .......3.......N
000A0  25 03 4E 02 CD 13 72 29 - BE 75 07 81 3E FE 7D 55   %.N...r).u....}U
000B0  AA 74 5A 83 EF 05 7F DA - 85 F6 75 83 BE 3F 07 EB   .tZ.......u..?..
000C0  8A 98 91 52 99 03 46 08 - 13 56 0A E8 12 00 5A EB   ...R..F..V....Z.
000D0  D5 4F 74 E4 33 C0 CD 13 - EB B8 00 00 80 06 53 19   .Ot.3.........S.
000E0  56 33 F6 56 56 52 50 06 - 53 51 BE 10 00 56 8B F4   V3.VVRP.SQ...V..
000F0  50 52 B8 00 42 8A 56 24 - CD 13 5A 58 8D 64 10 72   PR..B.V$..ZX.d.r
00100  0A 40 75 01 42 80 C7 02 - E2 F7 F8 5E C3 EB 74 49   .@u.B......^..tI
00110  6E 76 61 6C 69 64 20 70 - 61 72 74 69 74 69 6F 6E   nvalid partition
00120  20 74 61 62 6C 65 2E 20 - 53 65 74 75 70 20 63 61    table. Setup ca
00130  6E 6E 6F 74 20 63 6F 6E - 74 69 6E 75 65 2E 00 45   nnot continue..E
00140  72 72 6F 72 20 6C 6F 61 - 64 69 6E 67 20 6F 70 65   rror loading ope
00150  72 61 74 69 6E 67 20 73 - 79 73 74 65 6D 2E 20 53   rating system. S
00160  65 74 75 70 20 63 61 6E - 6E 6F 74 20 63 6F 6E 74   etup cannot cont
00170  69 6E 75 65 2E 00 00 00 - 00 00 00 00 00 00 00 00   inue............
00180  00 00 00 8B FC 1E 57 8B - F5 CB 00 00 00 00 00 00   ......W.........
00190  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00   ................
001A0  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00   ................
001B0  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 80 01   ................
001C0  01 00 0B FE FF E2 3F 00 - 00 00 E4 E7 F3 00 00 00   ......?.........
001D0  C1 E3 0F FE BF 96 23 E8 - F3 00 B4 A9 9F 02 00 00   ......#.........
001E0  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00   ................
001F0  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 55 AA   ..............U.

Go back to the Table of Contents.

MBR - Partition Table structure

The partition table is 64 bytes consisting of 4 16-byte entries. Each entry has the following format:

• Boot indicator and BIOS drive number (1 byte: must be 0x00 or > 0x80)
• Starting head number (1 byte, 0 to 255)
• Starting cylinder number (10 bits, 0 to 1023) and starting sector number (6 bits, 1 to 63, 0 being invalid)
• System indicator (1 byte, see examples below)
• Ending head number (1 byte, 0 to 255)
• Ending cylinder number (10 bits, 0 to 1023) and ending sector number (6 bits, 1 to 63, 0 being invalid)
• Starting sector (4 bytes, relative to beginning of disk)
• Number of sectors in the partition (4 bytes)

Partition Table (as 4 16-byte entries):

• Entry 1 - 80 01 01 00 0B FE FF E2 3F 00 00 00 E4 E7 F3 00
• Entry 2 - 00 00 C1 E3 0F FE BF 96 23 E8 F3 00 B4 A9 9F 02
• Entry 3 - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
• Entry 4 - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Entry 1 - Details:

The values in the first column in the following table are bytes in the order found in the table entry.

Notes:

• For Starting/Ending Cylinder, just drop the 6 least significant bits in the first byte denoted by the *'s and convert to decimal, e.g.
  

       FFE2 = 11|******|11100010 = 1111100010 = 994d

• For Starting/Ending Sector, just use the 6 least significant bits in the first byte and convert to decimal.

       FFE2 = **|111111|******** = 111111 = 63d

• The last two entries, Starting sector and Number of sectors, are 4-byte numbers which are stored in backwards order, i.e. LSB (Least Significant Byte) first and MSB (Most Significant Byte) last. Thus the order of the bytes must be reversed before converting to decimal, e.g.
  E4E7F300 -> 00F3E7E4h = 15,984,612d
• Be careful in that an assembler command such as:
  

       B80042       MOV   AX, 4200

  the bytes are in the correct order, i.e. AH=42 and AL=00. However they are stored in memory or on disk in backwards order, e.g. B80042.

Entry 2 (Extended partition) - Details:

The values in the first column in the following table are bytes in the order found in the table entry. Note that the Ending cylinder number is meaningless since it is less than the Starting cylinder number. However the Starting sector and the Number of sectors in partition are correct and enough to identify the partition. The 0F System Indicator requires INT 13 Extensions which use these last two numbers as LBA addresses and not the other INT 13 CHS numbers. The Ending cylinder number of 662 is probably a wrap around artifact of using a 10-bit cylinder number since it should be 3734 and 3734 - (3 * 1024) = 662.

Go back to the Table of Contents.

MBR - System Indicator

The following table is taken from Microsoft KB article Q69912. The Partition size of 0-2 GB given for System Indicator 0F appears to be meaningless as this hard disk had much larger logical partitions in the extended partition.

Go back to the Table of Contents.

MBR - Program

Since as noted above the code portion is identical to that discussed in MBR - Program for Windows 95b, see that document for further info.

Go back to the Table of Contents.

If you have comments or suggestions, email me at Ray Knights

MBR/Boot Index

Home Page

This page was created on 4 May 2001, last updated on 26 June 2001.