0

I am trying to track down the MBR on a scavenged Hard Drive. The hard drive won't boot so I've been trying to change the MBR through DEBUG.exe. The problem starts with my 64 bit machine because debug.exe is a 16-bit program that is no longer supported unless you have DosBox.

I understand that DosBox is an emulator and I have a basic knowledge of the division between User mode and Kernel mode as well as some fragmented research into the NT internal architecture.

My main question is; If I run DosBox and mount the hard drive I'm trying to debug. Am I viewing the memory on the hard drive if I run the Debug.exe from the mounted drive through DosBox or simple viewing the host 64 bit machine which is running DosBox?

I'm using this as a learning opportunity so any help or direction is appreciated.

1
  • The reason I need to clarify this is because I am trying to use an assembly script in order to redirect the MBR to a new location. I do not want the program to corrupt the host machine.
    – Ccorock
    Jul 11, 2013 at 1:51

1 Answer 1

2

A program called HxD will let you hex-edit sector 0 like good old sector editors back in the day under Windows. Under Linux you have bvi which is like vi but in hex - simply open /dev/sdb or whatever the root drive device is (while it is unmounted) and hack away.

I don't believe DosBOX emulates low-level access to mounted drives - everything works on the file level - so using debug.exe won't work. Also, from what I recall, you have to load a sector into RAM using the l command or something similar, edit it in memory, and then write the sector back.

Keep in mind the utility Testdisk which I've used more than once to extract files from drives with overwritten partition tables.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .