Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to track down the MBR on a scavenged Hard Drive. The hard drive won't boot so I've been trying to change the MBR through DEBUG.exe. The problem starts with my 64 bit machine because debug.exe is a 16-bit program that is no longer supported unless you have DosBox.

I understand that DosBox is an emulator and I have a basic knowledge of the division between User mode and Kernel mode as well as some fragmented research into the NT internal architecture.

My main question is; If I run DosBox and mount the hard drive I'm trying to debug. Am I viewing the memory on the hard drive if I run the Debug.exe from the mounted drive through DosBox or simple viewing the host 64 bit machine which is running DosBox?

I'm using this as a learning opportunity so any help or direction is appreciated.

share|improve this question

migrated from stackoverflow.com Jul 11 '13 at 3:26

This question came from our site for professional and enthusiast programmers.

    
The reason I need to clarify this is because I am trying to use an assembly script in order to redirect the MBR to a new location. I do not want the program to corrupt the host machine. –  Ccorock Jul 11 '13 at 1:51

1 Answer 1

up vote 1 down vote accepted

A program called HxD will let you hex-edit sector 0 like good old sector editors back in the day under Windows. Under Linux you have bvi which is like vi but in hex - simply open /dev/sdb or whatever the root drive device is (while it is unmounted) and hack away.

I don't believe DosBOX emulates low-level access to mounted drives - everything works on the file level - so using debug.exe won't work. Also, from what I recall, you have to load a sector into RAM using the l command or something similar, edit it in memory, and then write the sector back.

Keep in mind the utility Testdisk which I've used more than once to extract files from drives with overwritten partition tables.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.