[RC5] Re: rc5-digest V1 #167

John "Chris" Wren jcwren at atlanta.com
Tue Mar 17 02:23:05 EST 1998


	We're really getting off-listserver here, but here's the/an
answer.  If he were to boot from a floppy, and run FDISK /MBR it would
overwrite the MBR with the MBR image stored inside FDISK.  FDISK grabs
the physical drive parameters out of the MBR is reads from the hard
drive, places them into a "virgin" copy stored inside FDISK, and
writes the updated MBR back to the hard drive.

	Ontrack, and most other disk management software, replaces the
actual MBR with their proprietary boot record, and "hooks" the reads
and writes to the MBR.  It actually writes it somewhere else on the
drive, but when a read or write is done to cylinder 0, sector 0, the
sector *appears* as if it were really at C0, S0. 

	If the disk management software isn't loaded, then the
translation isn't done, and the disk managers boot sector gets
overwritten.

	If a program replaces the BIOS interrupt for the hard disk
reads and writes, or you use something like Norton Disk Doctor, which
(as I remember) can be told to go *straight* to the BIOS (not through
the interrupts), you can trash the disk management software.

	So, before one goes and just tells someone to replace the MBR,
you have to be aware of what state their system is in, and what
software is installed.

	As for your other comment in reply to someone to the effect of
"everyone has an opinion, help the guy", providing technical support
through the listserver isn't the way to do it.  

	And to be honest, I don't want the liability of screwing the
guys system up by trying to be "helpful" via e-mail.  The *best* way
for help like that is on-site and hands-on.  You start playing with
boot records, and it's all too easy to wind up with a system that's
trashed.

	(And how well I know.  I wrote software for a security system
called X-lock 10 that did stuff just like this.  Grabbing control of
the system before it properly booted so we could authenticate users
before the OS booted, etc.  It's all pretty much obsoleted now, but 6
years ago, it looked like a pretty decent market.)

	- Chris

On Mon, 16 Mar 1998 16:42:19 -0800, you wrote:

>Hi John!
>
>John Chris Wren wrote:
>
>> That's a pretty arbitrary thing to tell someone to go do, without more
>> knowledge of the system.  If he has some kind of disk management
>> software (to allow larger hard drives on older systems), you'll have
>> just killed his ability to boot the system.
>>
>> On Mon, 16 Mar 1998 11:54:32 -0800, you wrote:
>
>That has not been my experience.  What disk management software are you
>referring to?  I have Ontrack here, and it didn't kill my system when I just
>tried
>to verify your assertion.


---
John "Chris" Wren, KD4DTS
jcwren at atlanta.com
770-945-8288 (H)
770-840-9200 x2417 (W)

By US Code Title 47, Sec.227(a)(2)(B), a computer/modem/printer
meets the definition of a telephone fax machine. By Sec.227(b)
(1)(C), it is unlawful to send any unsolicited advertisement to
such equipment, punishable by action to recover actual monetary
loss, or $500, whichever is greater, for EACH violation.

--
To unsubscribe, send 'unsubscribe rc5' to majordomo at lists.distributed.net
rc5-digest subscribers replace rc5 with rc5-digest



More information about the rc5 mailing list