Booting is the process of loading the operating system into memory. This process takes place during a computer's boot sequence. A bootloader can help load the OS into memory. However, how does the system know what hard drive or partition to boot from? Two options help load your OS. The first option that has become outdated is the Master Boot Record or MBR. The second method we see on new computer systems is UEFI.
What takes place before the OS is loaded into memory is complex and happens relatively quickly:
The system clock initializes the CPU.
CPU locates the system's start-up program in the BIOS.
The first instruction is run from POST (Power-On Self-Test)
POST checks the BIOS and CMOS RAM.
POST performs an inventory of hardware devices and determines if they are functional.
BIOS now determines the drive where the OS is installed.
BIOS checks the drive's boot record to determine where the start of the OS is located.
BIOS copies files into memory after the OS is initialized.
OS takes over control of the boot process.
OS will inventory hardware, load device drives, and continue starting up.
The MBR is stored in the first sector of a hard drive. You can tell if you have a valid boot sector; the last two bytes will be 0x55AA. This is all referred to as a boot sector signature. The MBR contains a lot of information, even though it is only 512 bytes. The MBR has both the master partition table and the master boot code.
An MBR can only have four primary partitions, and support drives up to 2 TB.
A partition table can easily be read:
Byte 0: Active has a value of 0x80. Inactive has a value of 0x00.
Bytes 1- 3: Start of Partition: Head, Sector Cylinder each are allocated 1-byte.
Byte 4: Partition Type
Byte 5 - 7: End of Partition: Head, Sector Cylinder each are allocated 1-byte.
Bytes 8 - 12: LBA Addressing
Bytes 13 - 16: Number of sectors in the partition (think size)
Before we can do a calculation using the number of sectors to determine the size, we must first understand Endianness.
There are two different byte ordering formats that are used: Big Endian and Little Endian.
Big Endian: In this format, the most significant byte (the "big end") is stored at the lowest memory address, while the least significant byte is stored at the highest address. It's like writing numbers from left to right, with the most significant digit first.
Little Endian: Here, the least significant byte (the "little end") is stored at the lowest memory address, and the most significant byte is stored at the highest address. It's akin to writing numbers from right to left, starting with the least significant digit.
For example, the 32-bit integer "0x12345678" would be stored as:
Big Endian: 12 34 56 78
Little Endian: 78 56 34 12
In the partition table, if we had bytes 13 - 16 stored in Little Endian as:
0x86 39 01 00
We would first need to convert this to Big Endian:
0x00 01 39 86
Converting this value to decimal would give us 80,262 sectors and a sector is 512 bytes:
80262 * 512 = 41,094,144 bytes or about a 40MB partition.
Please remember that each partition size is a 32-bit value. This means that the maximum size of a system with a BIOS is 2 terabytes.
As the MBR is only 512 bytes and can be extracted from a hard drive quickly, I always like to use dd. In the video, I demo how to use dd to extract the MBR, and then I open this for us to view the MBR in hexadecimal.
Please read this blog post, which explains the code used in the demo.
The Unified Extensible Firmware Interface (UEFI) replaces the traditional BIOS as a crucial bridge between a computer's firmware and its operating system. With many newer devices exclusively supporting UEFI, understanding its fundamentals is essential in modern computing.
Similar to BIOS, UEFI resides as firmware on the mainboard. It initializes the system and verifies hardware components upon startup. Notably, UEFI offers enhanced security features while maintaining compatibility with legacy BIOS systems.
One key aspect of UEFI is its utilization of an EFI partition, also known as an EFI System Partition (ESP), on the hard drive. This partition stores initialization data and employs a more flexible partitioning scheme than the traditional Master Boot Record (MBR). By adopting the Globally Unique Identifier Partition Table (GPT), UEFI facilitates greater scalability, supporting up to 128 partitions and accommodating drives of immense sizes, up to 9.4 zettabytes.
Furthermore, GPT utilizes 64-bit values for partition information and mandates using the FAT file system (FAT16, FAT32, or vFAT) for the EFI partition. This partition, integral to the boot process, is typically included when imaging the entire drive, ensuring the preservation of crucial system data.