How to hook MBR in nt/2000/xp?

OSR_Community_User · February 26, 2003, 9:12pm

Hi all,

I wrote a TSR to hook MBR before OS boot, and if someone want to access
sector 0(MBR), it would be replaced to access sector “real_mbr”(a copies
of original MBR). It worked well in DOS and WINDOWS 9X(I also wrote a VSD
in 9x to hook MBR). And now, I wrote a disk filter in 2000/XP, but it
reported 0x7B error if the partition table in MBR was different as
“real_mbr”, so, can anyone tell me how to do?

Thanks in advance!
protale

David_J_Craig · February 26, 2003, 10:10pm

You need to load at boot time and keep on giving consistent information.
Trap each read and provide the good MBR.

----- Original Message -----
From: “protale”
To: “NT Developers Interest List”
Sent: Wednesday, February 26, 2003 9:19 PM
Subject: [ntdev] How to hook MBR in nt/2000/xp?

> Hi all,
>
> I wrote a TSR to hook MBR before OS boot, and if someone want to access
> sector 0(MBR), it would be replaced to access sector “real_mbr”(a copies
> of original MBR). It worked well in DOS and WINDOWS 9X(I also wrote a VSD
> in 9x to hook MBR). And now, I wrote a disk filter in 2000/XP, but it
> reported 0x7B error if the partition table in MBR was different as
> “real_mbr”, so, can anyone tell me how to do?
>
> Thanks in advance!
> protale
>
> —
> You are currently subscribed to ntdev as: xxxxx@yoshimuni.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

OSR_Community_User · February 26, 2003, 10:47pm

Yes, I installed a MBR, it loaded before all other program and kept a consistent information. It could be descributed as follows:

BIOS INT19-> load my MBR -> load and resident my working thread -> trap each read and write operation, replace the sector 0 with sector “real mbr”. -> DOS/WIN9X/NT boot -> load my filter driver(vsd or disk filter), also doing the same thing, replace the sector 0 with sector “real_mbr”.

The partition table in sector 0 is changed to an un-standard style, and the sector “real_mbr” keep the original infomation.

Thanks for your response!
protale

----- Original Message -----
From: “David J. Craig”
To: “NT Developers Interest List”
Sent: Thursday, February 27, 2003 11:10 AM
Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?

> You need to load at boot time and keep on giving consistent information.
> Trap each read and provide the good MBR.
>
> ----- Original Message -----
> From: “protale”
> To: “NT Developers Interest List”
> Sent: Wednesday, February 26, 2003 9:19 PM
> Subject: [ntdev] How to hook MBR in nt/2000/xp?
>
>
> > Hi all,
> >
> > I wrote a TSR to hook MBR before OS boot, and if someone want to access
> > sector 0(MBR), it would be replaced to access sector “real_mbr”(a copies
> > of original MBR). It worked well in DOS and WINDOWS 9X(I also wrote a VSD
> > in 9x to hook MBR). And now, I wrote a disk filter in 2000/XP, but it
> > reported 0x7B error if the partition table in MBR was different as
> > “real_mbr”, so, can anyone tell me how to do?
> >
> > Thanks in advance!
> > protale
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@yoshimuni.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
>
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@21cn.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

OSR_Community_User · February 26, 2003, 11:04pm

Yes, I installed a MBR, it loaded before all other program and kept a
consistent information. It could be descributed as follows:

BIOS INT19-> load my MBR -> load and resident my working thread -> trap
each read and write operation, replace the sector 0 with sector “real
mbr”. -> DOS/WIN9X/NT boot -> load my filter driver(vsd or disk filter),
also doing the same thing, replace the sector 0 with sector “real_mbr”.

The partition table in sector 0 is changed to an un-standard style, and
the sector “real_mbr” contains the original infomation.

Thanks for your response!
protale

David_J_Craig · February 26, 2003, 11:56pm

If you were keeping the MBR consistent, it wouldn’t complain. Trace all the
requests to your driver and see where it gets a chance to see your bad one
at sector zero. I know of some products that do this successfully.

----- Original Message -----
From: “protale”
To: “NT Developers Interest List”
Sent: Wednesday, February 26, 2003 10:48 PM
Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?

> Yes, I installed a MBR, it loaded before all other program and kept a
consistent information. It could be descributed as follows:
>
> BIOS INT19-> load my MBR -> load and resident my working thread -> trap
each read and write operation, replace the sector 0 with sector “real
mbr”. -> DOS/WIN9X/NT boot -> load my filter driver(vsd or disk filter),
also doing the same thing, replace the sector 0 with sector “real_mbr”.
>
> The partition table in sector 0 is changed to an un-standard style, and
the sector “real_mbr” keep the original infomation.
>
> Thanks for your response!
> protale
>
> ----- Original Message -----
> From: “David J. Craig”
> To: “NT Developers Interest List”
> Sent: Thursday, February 27, 2003 11:10 AM
> Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?
>
>
> > You need to load at boot time and keep on giving consistent information.
> > Trap each read and provide the good MBR.
> >
> > ----- Original Message -----
> > From: “protale”
> > To: “NT Developers Interest List”
> > Sent: Wednesday, February 26, 2003 9:19 PM
> > Subject: [ntdev] How to hook MBR in nt/2000/xp?
> >
> >
> > > Hi all,
> > >
> > > I wrote a TSR to hook MBR before OS boot, and if someone want to
access
> > > sector 0(MBR), it would be replaced to access sector “real_mbr”(a
copies
> > > of original MBR). It worked well in DOS and WINDOWS 9X(I also wrote a
VSD
> > > in 9x to hook MBR). And now, I wrote a disk filter in 2000/XP, but it
> > > reported 0x7B error if the partition table in MBR was different as
> > > “real_mbr”, so, can anyone tell me how to do?
> > >
> > > Thanks in advance!
> > > protale
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@yoshimuni.com
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> >
> >
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@21cn.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> b???v?jS??zTz?m?.z-yz?"??

OSR_Community_User · February 27, 2003, 2:30am

Please view some debug information from my disk filter driver:

//real partition infomation:
// partition[1].begin=3f(unit : sectors), type=fat32
// partition[2].begin=7d047e(unit : sector), type=fat32

//the following requests is that we received at NT boot time:

******

Get_DriveLayout, CtrlCode=7400c
return: partition[1].begin=3f, partitiontype=66 ;this
pseudo-partition is definded by us.

readorwrite=3,beign=0,num=1, i=0 ;read first sector
readorwrite=3,beign=0,num=1, i=0 ;read first sector
readorwrite=3,beign=7d047e,num=1, i=0 ;7d047e is the offset of the
second partition
readorwrite=3,beign=0,num=1, i=0
readorwrite=3,beign=0,num=1, i=0
readorwrite=3,beign=7d047e,num=1, i=0 ;7d047e is the offset of the
second partition
readorwrite=3,beign=0,num=1, i=0
readorwrite=3,beign=0,num=1, i=0
readorwrite=3,beign=7d047e,num=1, i=0

*** Fatal System Error: 0x0000006f
(0xC000003A,0x00000000,0x00000000,0x00000000)
Break instruction exception - code 80000003 (first chance)
A fatal system error has occurred.

******

Results may be concluded : The lower driver(maybe port driver) reads the
MBR and cannot be trapped by other higher filter while processing
GET_DRIVE_LAYOUT.

Does it correctly?

Thanks
protale

----- Original Message -----
From: “David J. Craig”
To: “NT Developers Interest List”
Sent: Thursday, February 27, 2003 12:56 PM
Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?

If you were keeping the MBR consistent, it wouldn’t complain. Trace all
the
requests to your driver and see where it gets a chance to see your bad one
at sector zero. I know of some products that do this successfully.

----- Original Message -----
From: “protale”
To: “NT Developers Interest List”
Sent: Wednesday, February 26, 2003 10:48 PM
Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?

> Yes, I installed a MBR, it loaded before all other program and kept a
consistent information. It could be descributed as follows:
>
> BIOS INT19-> load my MBR -> load and resident my working thread -> trap
each read and write operation, replace the sector 0 with sector “real
mbr”. -> DOS/WIN9X/NT boot -> load my filter driver(vsd or disk filter),
also doing the same thing, replace the sector 0 with sector “real_mbr”.
>
> The partition table in sector 0 is changed to an un-standard style, and
the sector “real_mbr” keep the original infomation.
>
> Thanks for your response!
> protale
>
> ----- Original Message -----
> From: “David J. Craig”
> To: “NT Developers Interest List”
> Sent: Thursday, February 27, 2003 11:10 AM
> Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?
>
>
> > You need to load at boot time and keep on giving consistent information.
> > Trap each read and provide the good MBR.
> >
> > ----- Original Message -----
> > From: “protale”
> > To: “NT Developers Interest List”
> > Sent: Wednesday, February 26, 2003 9:19 PM
> > Subject: [ntdev] How to hook MBR in nt/2000/xp?
> >
> >
> > > Hi all,
> > >
> > > I wrote a TSR to hook MBR before OS boot, and if someone want to
access
> > > sector 0(MBR), it would be replaced to access sector “real_mbr”(a
copies
> > > of original MBR). It worked well in DOS and WINDOWS 9X(I also wrote a
VSD
> > > in 9x to hook MBR). And now, I wrote a disk filter in 2000/XP, but it
> > > reported 0x7B error if the partition table in MBR was different as
> > > “real_mbr”, so, can anyone tell me how to do?
> > >
> > > Thanks in advance!
> > > protale
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@yoshimuni.com
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> >
> >
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@21cn.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >

—
You are currently subscribed to ntdev as: xxxxx@21cn.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Maxim_S_Shatskih · February 27, 2003, 4:27am

int 13h is not used under NT OSes.
Write a disk filter driver to do this.

Max

----- Original Message -----
From: “protale”
To: “NT Developers Interest List”
Sent: Thursday, February 27, 2003 5:19 AM
Subject: [ntdev] How to hook MBR in nt/2000/xp?

> Hi all,
>
> I wrote a TSR to hook MBR before OS boot, and if someone want to
access
> sector 0(MBR), it would be replaced to access sector “real_mbr”(a
copies
> of original MBR). It worked well in DOS and WINDOWS 9X(I also wrote
a VSD
> in 9x to hook MBR). And now, I wrote a disk filter in 2000/XP, but
it
> reported 0x7B error if the partition table in MBR was different as
> “real_mbr”, so, can anyone tell me how to do?
>
> Thanks in advance!
> protale
>
> —
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to
xxxxx@lists.osr.com
>

David_J_Craig · February 28, 2003, 12:08pm

When the request for partition info is processed by your driver, you may
need to do it yourself and not pass it down. The other option is to install
a lower filter to DISK.SYS and give the correct MBR when sector zero is
requested.

----- Original Message -----
From: “protale”
To: “NT Developers Interest List”
Sent: Thursday, February 27, 2003 2:37 AM
Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?

> Please view some debug information from my disk filter driver:
>
> //real partition infomation:
> // partition[1].begin=3f(unit : sectors), type=fat32
> // partition[2].begin=7d047e(unit : sector), type=fat32
>
> //the following requests is that we received at NT boot time:
>
> ***
>
> Get_DriveLayout, CtrlCode=7400c
> return: partition[1].begin=3f, partitiontype=66 ;this
> pseudo-partition is definded by us.
>
> readorwrite=3,beign=0,num=1, i=0 ;read first sector
> readorwrite=3,beign=0,num=1, i=0 ;read first sector
> readorwrite=3,beign=7d047e,num=1, i=0 ;7d047e is the offset of the
> second partition
> readorwrite=3,beign=0,num=1, i=0
> readorwrite=3,beign=0,num=1, i=0
> readorwrite=3,beign=7d047e,num=1, i=0 ;7d047e is the offset of the
> second partition
> readorwrite=3,beign=0,num=1, i=0
> readorwrite=3,beign=0,num=1, i=0
> readorwrite=3,beign=7d047e,num=1, i=0
>
> Fatal System Error: 0x0000006f
> (0xC000003A,0x00000000,0x00000000,0x00000000)
> Break instruction exception - code 80000003 (first chance)
> A fatal system error has occurred.
>
> ******
>
> Results may be concluded : The lower driver(maybe port driver) reads the
> MBR and cannot be trapped by other higher filter while processing
> GET_DRIVE_LAYOUT.
>
> Does it correctly?
>
> Thanks
> protale
>
>
> ----- Original Message -----
> From: “David J. Craig”
> To: “NT Developers Interest List”
> Sent: Thursday, February 27, 2003 12:56 PM
> Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?
>
>
> If you were keeping the MBR consistent, it wouldn’t complain. Trace all
> the
> requests to your driver and see where it gets a chance to see your bad one
> at sector zero. I know of some products that do this successfully.
>
> ----- Original Message -----
> From: “protale”
> To: “NT Developers Interest List”
> Sent: Wednesday, February 26, 2003 10:48 PM
> Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?
>
>
> > Yes, I installed a MBR, it loaded before all other program and kept a
> consistent information. It could be descributed as follows:
> >
> > BIOS INT19-> load my MBR -> load and resident my working thread -> trap
> each read and write operation, replace the sector 0 with sector “real
> mbr”. -> DOS/WIN9X/NT boot -> load my filter driver(vsd or disk filter),
> also doing the same thing, replace the sector 0 with sector “real_mbr”.
> >
> > The partition table in sector 0 is changed to an un-standard style, and
> the sector “real_mbr” keep the original infomation.
> >
> > Thanks for your response!
> > protale
> >
> > ----- Original Message -----
> > From: “David J. Craig”
> > To: “NT Developers Interest List”
> > Sent: Thursday, February 27, 2003 11:10 AM
> > Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?
> >
> >
> > > You need to load at boot time and keep on giving consistent
information.
> > > Trap each read and provide the good MBR.
> > >
> > > ----- Original Message -----
> > > From: “protale”
> > > To: “NT Developers Interest List”
> > > Sent: Wednesday, February 26, 2003 9:19 PM
> > > Subject: [ntdev] How to hook MBR in nt/2000/xp?
> > >
> > >
> > > > Hi all,
> > > >
> > > > I wrote a TSR to hook MBR before OS boot, and if someone want to
> access
> > > > sector 0(MBR), it would be replaced to access sector “real_mbr”(a
> copies
> > > > of original MBR). It worked well in DOS and WINDOWS 9X(I also wrote
a
> VSD
> > > > in 9x to hook MBR). And now, I wrote a disk filter in 2000/XP, but
it
> > > > reported 0x7B error if the partition table in MBR was different as
> > > > “real_mbr”, so, can anyone tell me how to do?
> > > >
> > > > Thanks in advance!
> > > > protale
> > > >
> > > > —
> > > > You are currently subscribed to ntdev as: xxxxx@yoshimuni.com
> > > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > > >
> > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@21cn.com
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@21cn.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> You are currently subscribed to ntdev as: xxxxx@yoshimuni.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

OSR_Community_User · March 2, 2003, 8:35pm

Thanks David for your responses. I had solved the problem last week.

“When the request for partition info is processed by your driver, you may need to do it yourself and not pass it down” is right, and “The other option is to install a lower filter to DISK.SYS and give the correct MBR when sector zero is requested.” is wrong. I installed a lower filter to disk.sys and received nothing but some devicecontrol and pnp requests, any ideas about it?

Best regards,
protale.

----- Original Message -----
From: “David J. Craig”
To: “NT Developers Interest List”
Sent: Saturday, March 01, 2003 1:08 AM
Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?

> When the request for partition info is processed by your driver, you may
> need to do it yourself and not pass it down. The other option is to
install
> a lower filter to DISK.SYS and give the correct MBR when sector zero is
> requested.
>
> ----- Original Message -----
> From: “protale”
> To: “NT Developers Interest List”
> Sent: Thursday, February 27, 2003 2:37 AM
> Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?
>
>
> > Please view some debug information from my disk filter driver:
> >
> > //real partition infomation:
> > // partition[1].begin=3f(unit : sectors), type=fat32
> > // partition[2].begin=7d047e(unit : sector), type=fat32
> >
> > //the following requests is that we received at NT boot time:
> >
> > ***
> >
> > Get_DriveLayout, CtrlCode=7400c
> > return: partition[1].begin=3f, partitiontype=66 ;this
pseudo-partition is definded by us.
> >
> > readorwrite=3,beign=0,num=1, i=0 ;read first sector
> > readorwrite=3,beign=0,num=1, i=0 ;read first sector
> > readorwrite=3,beign=7d047e,num=1, i=0 ;7d047e is the offset of the
> > second partition
> > readorwrite=3,beign=0,num=1, i=0
> > readorwrite=3,beign=0,num=1, i=0
> > readorwrite=3,beign=7d047e,num=1, i=0 ;7d047e is the offset of the
> > second partition
> > readorwrite=3,beign=0,num=1, i=0
> > readorwrite=3,beign=0,num=1, i=0
> > readorwrite=3,beign=7d047e,num=1, i=0
> >
> > Fatal System Error: 0x0000006f
> > (0xC000003A,0x00000000,0x00000000,0x00000000)
> > Break instruction exception - code 80000003 (first chance)
> > A fatal system error has occurred.
> >
> > ******
> >
> > Results may be concluded : The lower driver(maybe port driver) reads the
> > MBR and cannot be trapped by other higher filter while processing
> > GET_DRIVE_LAYOUT.
> >
> > Does it correctly?
> >
> > Thanks
> > protale
> >
> >
> > ----- Original Message -----
> > From: “David J. Craig”
> > To: “NT Developers Interest List”
> > Sent: Thursday, February 27, 2003 12:56 PM
> > Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?
> >
> >
> > If you were keeping the MBR consistent, it wouldn’t complain. Trace all
the
> > requests to your driver and see where it gets a chance to see your bad
one
> > at sector zero. I know of some products that do this successfully.
> >
> > ----- Original Message -----
> > From: “protale”
> > To: “NT Developers Interest List”
> > Sent: Wednesday, February 26, 2003 10:48 PM
> > Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?
> >
> >
> > > Yes, I installed a MBR, it loaded before all other program and kept
a
> > consistent information. It could be descributed as follows:
> > >
> > > BIOS INT19-> load my MBR -> load and resident my working thread ->
trap
> > each read and write operation, replace the sector 0 with sector “real
> > mbr”. -> DOS/WIN9X/NT boot -> load my filter driver(vsd or disk filter),
> > also doing the same thing, replace the sector 0 with sector “real_mbr”.
> > >
> > > The partition table in sector 0 is changed to an un-standard style,
and
> > the sector “real_mbr” keep the original infomation.
> > >
> > > Thanks for your response!
> > > protale
> > >
> > > ----- Original Message -----
> > > From: “David J. Craig”
> > > To: “NT Developers Interest List”
> > > Sent: Thursday, February 27, 2003 11:10 AM
> > > Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?
> > >
> > >
> > > > You need to load at boot time and keep on giving consistent
information.
> > > > Trap each read and provide the good MBR.
> > > >
> > > > ----- Original Message -----
> > > > From: “protale”
> > > > To: “NT Developers Interest List”
> > > > Sent: Wednesday, February 26, 2003 9:19 PM
> > > > Subject: [ntdev] How to hook MBR in nt/2000/xp?
> > > >
> > > >
> > > > > Hi all,
> > > > >
> > > > > I wrote a TSR to hook MBR before OS boot, and if someone want to
access
> > > > > sector 0(MBR), it would be replaced to access sector “real_mbr”(a
copies
> > > > > of original MBR). It worked well in DOS and WINDOWS 9X(I also
wrote a VSD
> > > > > in 9x to hook MBR). And now, I wrote a disk filter in 2000/XP, but
it
> > > > > reported 0x7B error if the partition table in MBR was different as
> > > > > “real_mbr”, so, can anyone tell me how to do?
> > > > >
> > > > > Thanks in advance!
> > > > > protale
> > > > >
> > > > > —
> > > > > You are currently subscribed to ntdev as: xxxxx@yoshimuni.com
> > > > > To unsubscribe send a blank email to
xxxxx@lists.osr.com

David_J_Craig · March 2, 2003, 10:11pm

If the read requests are being directly sent down another channel, then you might not see them. I have been involved with floppies and there is a direct fdc,flpydisk,fastfat relationship. I would suggest you see where the IO requests go when sent from DISK.SYS and the “lower” filter might have to be an “upper” filter of the device it uses. Since the source code for DISK.SYS is available, I don’t see why handling the IOCTL can’t be done.
----- Original Message -----
From: protale
To: NT Developers Interest List
Sent: Monday, March 03, 2003 11:42 AM
Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?

Thanks David for your responses. I had solved the problem last week.

“When the request for partition info is processed by your driver, you may need to do it yourself and not pass it down” is right, and “The other option is to install a lower filter to DISK.SYS and give the correct MBR when sector zero is requested.” is wrong. I installed a lower filter to disk.sys and received nothing but some devicecontrol and pnp requests, any ideas about it?

Best regards,
protale.

----- Original Message -----
From: “David J. Craig”
To: “NT Developers Interest List”
Sent: Saturday, March 01, 2003 1:08 AM
Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?

> When the request for partition info is processed by your driver, you may
> need to do it yourself and not pass it down. The other option is to
install
> a lower filter to DISK.SYS and give the correct MBR when sector zero is
> requested.
>
> ----- Original Message -----
> From: “protale”
> To: “NT Developers Interest List”
> Sent: Thursday, February 27, 2003 2:37 AM
> Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?
>
>
> > Please view some debug information from my disk filter driver:
> >
> > //real partition infomation:
> > // partition[1].begin=3f(unit : sectors), type=fat32
> > // partition[2].begin=7d047e(unit : sector), type=fat32
> >
> > //the following requests is that we received at NT boot time:
> >
> > ***
> >
> > Get_DriveLayout, CtrlCode=7400c
> > return: partition[1].begin=3f, partitiontype=66 ;this
pseudo-partition is definded by us.
> >
> > readorwrite=3,beign=0,num=1, i=0 ;read first sector
> > readorwrite=3,beign=0,num=1, i=0 ;read first sector
> > readorwrite=3,beign=7d047e,num=1, i=0 ;7d047e is the offset of the
> > second partition
> > readorwrite=3,beign=0,num=1, i=0
> > readorwrite=3,beign=0,num=1, i=0
> > readorwrite=3,beign=7d047e,num=1, i=0 ;7d047e is the offset of the
> > second partition
> > readorwrite=3,beign=0,num=1, i=0
> > readorwrite=3,beign=0,num=1, i=0
> > readorwrite=3,beign=7d047e,num=1, i=0
> >
> > Fatal System Error: 0x0000006f
> > (0xC000003A,0x00000000,0x00000000,0x00000000)
> > Break instruction exception - code 80000003 (first chance)
> > A fatal system error has occurred.
> >
> > ******
> >
> > Results may be concluded : The lower driver(maybe port driver) reads the
> > MBR and cannot be trapped by other higher filter while processing
> > GET_DRIVE_LAYOUT.
> >
> > Does it correctly?
> >
> > Thanks
> > protale
> >
> >
> > ----- Original Message -----
> > From: “David J. Craig”
> > To: “NT Developers Interest List”
> > Sent: Thursday, February 27, 2003 12:56 PM
> > Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?
> >
> >
> > If you were keeping the MBR consistent, it wouldn’t complain. Trace all
the
> > requests to your driver and see where it gets a chance to see your bad
one
> > at sector zero. I know of some products that do this successfully.
> >
> > ----- Original Message -----
> > From: “protale”
> > To: “NT Developers Interest List”
> > Sent: Wednesday, February 26, 2003 10:48 PM
> > Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?
> >
> >
> > > Yes, I installed a MBR, it loaded before all other program and kept
a
> > consistent information. It could be descributed as follows:
> > >
> > > BIOS INT19-> load my MBR -> load and resident my working thread ->
trap
> > each read and write operation, replace the sector 0 with sector “real
> > mbr”. -> DOS/WIN9X/NT boot -> load my filter driver(vsd or disk filter),
> > also doing the same thing, replace the sector 0 with sector “real_mbr”.
> > >
> > > The partition table in sector 0 is changed to an un-standard style,
and
> > the sector “real_mbr” keep the original infomation.
> > >
> > > Thanks for your response!
> > > protale
> > >
> > > ----- Original Message -----
> > > From: “David J. Craig”
> > > To: “NT Developers Interest List”
> > > Sent: Thursday, February 27, 2003 11:10 AM
> > > Subject: [ntdev] Re: How to hook MBR in nt/2000/xp?
> > >
> > >
> > > > You need to load at boot time and keep on giving consistent
information.
> > > > Trap each read and provide the good MBR.
> > > >
> > > > ----- Original Message -----
> > > > From: “protale”
> > > > To: “NT Developers Interest List”
> > > > Sent: Wednesday, February 26, 2003 9:19 PM
> > > > Subject: [ntdev] How to hook MBR in nt/2000/xp?
> > > >
> > > >
> > > > > Hi all,
> > > > >
> > > > > I wrote a TSR to hook MBR before OS boot, and if someone want to
access
> > > > > sector 0(MBR), it would be replaced to access sector “real_mbr”(a
copies
> > > > > of original MBR). It worked well in DOS and WINDOWS 9X(I also
wrote a VSD
> > > > > in 9x to hook MBR). And now, I wrote a disk filter in 2000/XP, but
it
> > > > > reported 0x7B error if the partition table in MBR was different as
> > > > > “real_mbr”, so, can anyone tell me how to do?
> > > > >
> > > > > Thanks in advance!
> > > > > protale
> > > > >
> > > > > —
> > > > > You are currently subscribed to ntdev as: xxxxx@yoshimuni.com
> > > > > To unsubscribe send a blank email to
xxxxx@lists.osr.com

—
You are currently subscribed to ntdev as: xxxxx@yoshimuni.com
To unsubscribe send a blank email to xxxxx@lists.osr.com