Yet Another Target Link Question

NTFSD
1

Hi–

My task is to directly read the boot sector on the windows system drive
from the kernel on W2K & XP.

\DosDevices\PhysicalDrive0 provides access to the first sector of the
first hard drive; this is usually drive C:. But I understand that in
some cases, say SCSI drives,
\DosDevices\PhysicalDrive0 may not be drive C:.

Given a (boot disk) drive letter, I have been trying the
ZwOpenDirectoryObject () / ZwOpenSymbolicLinkObject combination but
receive back a partition link (e.g., \Device\HarddiskVolume2) which is
NOT a reference to the drive boot sector.

I’ve read the archives and gleaned info but not enough to put my finger
on what I need.

So, here’s the question:
Given a drive letter of the boot drive (e.g., C:), how does one obtain a
target link to the
boot sector of that drive that will resolve correctly for mixed fixed
drive types (SCSI, IDE).

Bob Loewer

2

The first sector of a disk isn’t a boot sector rather it has MBR. On
Windows, first 63 sectors of the disk are skipped.It is supposed to be used
by kernel mode drivers. If you want to read file system boot sector, use
IOCTLS to map from drive letter to physical drives.On NT , you can use
GET_PARTITION_INFORMATION and on 2k and above use
GET_VOLUME_DISK_EXTENTS( check for exact IOCTLS).

thanks

-----Original Message-----
From: Bob Loewer [mailto:xxxxx@jamesbimen.com]
Sent: Friday, August 02, 2002 7:33 AM
To: File Systems Developers
Subject: [ntfsd] Yet Another Target Link Question

Hi–

My task is to directly read the boot sector on the windows system drive
from the kernel on W2K & XP.

\DosDevices\PhysicalDrive0 provides access to the first sector of the
first hard drive; this is usually drive C:. But I understand that in
some cases, say SCSI drives,
\DosDevices\PhysicalDrive0 may not be drive C:.

Given a (boot disk) drive letter, I have been trying the
ZwOpenDirectoryObject () / ZwOpenSymbolicLinkObject combination but
receive back a partition link (e.g., \Device\HarddiskVolume2) which is
NOT a reference to the drive boot sector.

I’ve read the archives and gleaned info but not enough to put my finger
on what I need.

So, here’s the question:
Given a drive letter of the boot drive (e.g., C:), how does one obtain a
target link to the
boot sector of that drive that will resolve correctly for mixed fixed
drive types (SCSI, IDE).

Bob Loewer

You are currently subscribed to ntfsd as: xxxxx@Legato.COM
To unsubscribe send a blank email to %%email.unsub%%

3

Actually, if the disk is removable, the first sector IS the boot record
and not an MBR.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Pashupati Kumar
Sent: Friday, August 02, 2002 9:51 AM
To: File Systems Developers
Subject: [ntfsd] RE: Yet Another Target Link Question

The first sector of a disk isn’t a boot sector rather it has MBR. On
Windows, first 63 sectors of the disk are skipped.It is supposed to be
used
by kernel mode drivers. If you want to read file system boot sector, use
IOCTLS to map from drive letter to physical drives.On NT , you can use
GET_PARTITION_INFORMATION and on 2k and above use
GET_VOLUME_DISK_EXTENTS( check for exact IOCTLS).

thanks

-----Original Message-----
From: Bob Loewer [mailto:xxxxx@jamesbimen.com]
Sent: Friday, August 02, 2002 7:33 AM
To: File Systems Developers
Subject: [ntfsd] Yet Another Target Link Question

Hi–

My task is to directly read the boot sector on the windows system drive
from the kernel on W2K & XP.

\DosDevices\PhysicalDrive0 provides access to the first sector of the
first hard drive; this is usually drive C:. But I understand that in
some cases, say SCSI drives,
\DosDevices\PhysicalDrive0 may not be drive C:.

Given a (boot disk) drive letter, I have been trying the
ZwOpenDirectoryObject () / ZwOpenSymbolicLinkObject combination but
receive back a partition link (e.g., \Device\HarddiskVolume2) which is
NOT a reference to the drive boot sector.

I’ve read the archives and gleaned info but not enough to put my finger
on what I need.

So, here’s the question:
Given a drive letter of the boot drive (e.g., C:), how does one obtain a
target link to the
boot sector of that drive that will resolve correctly for mixed fixed
drive types (SCSI, IDE).

Bob Loewer

You are currently subscribed to ntfsd as: xxxxx@Legato.COM
To unsubscribe send a blank email to %%email.unsub%%

You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to %%email.unsub%%

4

> \DosDevices\PhysicalDrive0 provides access to the first sector of
the

first hard drive; this is usually drive C:.

No. This is first physical disk. If you will read sector 0 - you will
have MBR.
The notion of “first” is determined by miniport load order, and has
nothing to do with BIOS’s int 13h disk numbering.

ZwOpenDirectoryObject () / ZwOpenSymbolicLinkObject combination but
receive back a partition link (e.g., \Device\HarddiskVolume2) which
is
NOT a reference to the drive boot sector.

Reading sector 0 from \Device\HarddiskVolume2 must return an
FS-specific boot sector.
\Device\HarddiskVolume2 is usually just a partition, but can also be
an NT4-style software RAID.

Given a drive letter of the boot drive (e.g., C:), how does one
obtain a
target link to the
boot sector

Open \.\C: and read 512 bytes.

Max

5

…unless it is a super-floppy (magneto-optical or such), for which
MBR is emulated.

----- Original Message -----
From: “Jamey Kirby”
To: “File Systems Developers”
Sent: Friday, August 02, 2002 9:21 PM
Subject: [ntfsd] RE: Yet Another Target Link Question

> Actually, if the disk is removable, the first sector IS the boot
record
> and not an MBR.
>
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Pashupati
Kumar
> Sent: Friday, August 02, 2002 9:51 AM
> To: File Systems Developers
> Subject: [ntfsd] RE: Yet Another Target Link Question
>
> The first sector of a disk isn’t a boot sector rather it has MBR. On
> Windows, first 63 sectors of the disk are skipped.It is supposed to
be
> used
> by kernel mode drivers. If you want to read file system boot sector,
use
> IOCTLS to map from drive letter to physical drives.On NT , you can
use
> GET_PARTITION_INFORMATION and on 2k and above use
> GET_VOLUME_DISK_EXTENTS( check for exact IOCTLS).
>
> thanks
>
>
> -----Original Message-----
> From: Bob Loewer [mailto:xxxxx@jamesbimen.com]
> Sent: Friday, August 02, 2002 7:33 AM
> To: File Systems Developers
> Subject: [ntfsd] Yet Another Target Link Question
>
>
> Hi–
>
> My task is to directly read the boot sector on the windows system
drive
> from the kernel on W2K & XP.
>
> \DosDevices\PhysicalDrive0 provides access to the first sector of
the
> first hard drive; this is usually drive C:. But I understand that in
> some cases, say SCSI drives,
> \DosDevices\PhysicalDrive0 may not be drive C:.
>
> Given a (boot disk) drive letter, I have been trying the
> ZwOpenDirectoryObject () / ZwOpenSymbolicLinkObject combination but
> receive back a partition link (e.g., \Device\HarddiskVolume2) which
is
> NOT a reference to the drive boot sector.
>
> I’ve read the archives and gleaned info but not enough to put my
finger
> on what I need.
>
> So, here’s the question:
> Given a drive letter of the boot drive (e.g., C:), how does one
obtain a
> target link to the
> boot sector of that drive that will resolve correctly for mixed
fixed
> drive types (SCSI, IDE).
>
>
> Bob Loewer
>
>
>
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@Legato.COM
> To unsubscribe send a blank email to %%email.unsub%%
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to %%email.unsub%%
>

6

> Windows, first 63 sectors of the disk are skipped.It is supposed to
be used

by kernel mode drivers.

This is IIRC due to DOS compatibility, DOS requires the partition to
start on cylinder boundary.

Max

7

Max, could you explain your statement (or point to some docs).

-htfv

----- Original Message -----
From: “Maxim S. Shatskih”
To: “File Systems Developers”
Sent: Saturday, August 03, 2002 1:29 AM
Subject: [ntfsd] RE: Yet Another Target Link Question

> …unless it is a super-floppy (magneto-optical or such), for which
> MBR is emulated.
>
> ----- Original Message -----
> From: “Jamey Kirby”
> To: “File Systems Developers”
> Sent: Friday, August 02, 2002 9:21 PM
> Subject: [ntfsd] RE: Yet Another Target Link Question
>
>
> > Actually, if the disk is removable, the first sector IS the boot
> record
> > and not an MBR.
> >
> >
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf Of Pashupati
> Kumar
> > Sent: Friday, August 02, 2002 9:51 AM
> > To: File Systems Developers
> > Subject: [ntfsd] RE: Yet Another Target Link Question
> >
> > The first sector of a disk isn’t a boot sector rather it has MBR. On
> > Windows, first 63 sectors of the disk are skipped.It is supposed to
> be
> > used
> > by kernel mode drivers. If you want to read file system boot sector,
> use
> > IOCTLS to map from drive letter to physical drives.On NT , you can
> use
> > GET_PARTITION_INFORMATION and on 2k and above use
> > GET_VOLUME_DISK_EXTENTS( check for exact IOCTLS).
> >
> > thanks
> >
> >
> > -----Original Message-----
> > From: Bob Loewer [mailto:xxxxx@jamesbimen.com]
> > Sent: Friday, August 02, 2002 7:33 AM
> > To: File Systems Developers
> > Subject: [ntfsd] Yet Another Target Link Question
> >
> >
> > Hi–
> >
> > My task is to directly read the boot sector on the windows system
> drive
> > from the kernel on W2K & XP.
> >
> > \DosDevices\PhysicalDrive0 provides access to the first sector of
> the
> > first hard drive; this is usually drive C:. But I understand that in
> > some cases, say SCSI drives,
> > \DosDevices\PhysicalDrive0 may not be drive C:.
> >
> > Given a (boot disk) drive letter, I have been trying the
> > ZwOpenDirectoryObject () / ZwOpenSymbolicLinkObject combination but
> > receive back a partition link (e.g., \Device\HarddiskVolume2) which
> is
> > NOT a reference to the drive boot sector.
> >
> > I’ve read the archives and gleaned info but not enough to put my
> finger
> > on what I need.
> >
> > So, here’s the question:
> > Given a drive letter of the boot drive (e.g., C:), how does one
> obtain a
> > target link to the
> > boot sector of that drive that will resolve correctly for mixed
> fixed
> > drive types (SCSI, IDE).
> >
> >
> > Bob Loewer
> >
> >
> >
> >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@Legato.COM
> > To unsubscribe send a blank email to %%email.unsub%%
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to %%email.unsub%%
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to %%email.unsub%%
>

8

For removable media sitting under Disk.sys class driver (called
“super-floppy”), the media itself does not contain MBR. MBR is
emulated in IoReadPartitionTable code, so, MBR-related IOCTLs can work
to some extent.

Max

----- Original Message -----
From: “Alexey Logachyov”
To: “File Systems Developers”
Sent: Wednesday, August 07, 2002 3:40 PM
Subject: [ntfsd] RE: Yet Another Target Link Question

> Max, could you explain your statement (or point to some docs).
>
> -htfv
>
> ----- Original Message -----
> From: “Maxim S. Shatskih”
> To: “File Systems Developers”
> Sent: Saturday, August 03, 2002 1:29 AM
> Subject: [ntfsd] RE: Yet Another Target Link Question
>
>
> > …unless it is a super-floppy (magneto-optical or such), for
which
> > MBR is emulated.
> >
> > ----- Original Message -----
> > From: “Jamey Kirby”
> > To: “File Systems Developers”
> > Sent: Friday, August 02, 2002 9:21 PM
> > Subject: [ntfsd] RE: Yet Another Target Link Question
> >
> >
> > > Actually, if the disk is removable, the first sector IS the boot
> > record
> > > and not an MBR.
> > >
> > >
> > >
> > > -----Original Message-----
> > > From: xxxxx@lists.osr.com
> > > [mailto:xxxxx@lists.osr.com] On Behalf Of Pashupati
> > Kumar
> > > Sent: Friday, August 02, 2002 9:51 AM
> > > To: File Systems Developers
> > > Subject: [ntfsd] RE: Yet Another Target Link Question
> > >
> > > The first sector of a disk isn’t a boot sector rather it has
MBR. On
> > > Windows, first 63 sectors of the disk are skipped.It is supposed
to
> > be
> > > used
> > > by kernel mode drivers. If you want to read file system boot
sector,
> > use
> > > IOCTLS to map from drive letter to physical drives.On NT , you
can
> > use
> > > GET_PARTITION_INFORMATION and on 2k and above use
> > > GET_VOLUME_DISK_EXTENTS( check for exact IOCTLS).
> > >
> > > thanks
> > >
> > >
> > > -----Original Message-----
> > > From: Bob Loewer [mailto:xxxxx@jamesbimen.com]
> > > Sent: Friday, August 02, 2002 7:33 AM
> > > To: File Systems Developers
> > > Subject: [ntfsd] Yet Another Target Link Question
> > >
> > >
> > > Hi–
> > >
> > > My task is to directly read the boot sector on the windows
system
> > drive
> > > from the kernel on W2K & XP.
> > >
> > > \DosDevices\PhysicalDrive0 provides access to the first
sector of
> > the
> > > first hard drive; this is usually drive C:. But I understand
that in
> > > some cases, say SCSI drives,
> > > \DosDevices\PhysicalDrive0 may not be drive C:.
> > >
> > > Given a (boot disk) drive letter, I have been trying the
> > > ZwOpenDirectoryObject () / ZwOpenSymbolicLinkObject combination
but
> > > receive back a partition link (e.g., \Device\HarddiskVolume2)
which
> > is
> > > NOT a reference to the drive boot sector.
> > >
> > > I’ve read the archives and gleaned info but not enough to put my
> > finger
> > > on what I need.
> > >
> > > So, here’s the question:
> > > Given a drive letter of the boot drive (e.g., C:), how does one
> > obtain a
> > > target link to the
> > > boot sector of that drive that will resolve correctly for mixed
> > fixed
> > > drive types (SCSI, IDE).
> > >
> > >
> > > Bob Loewer
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@Legato.COM
> > > To unsubscribe send a blank email to %%email.unsub%%
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as:
xxxxx@storagecraft.com
> > > To unsubscribe send a blank email to %%email.unsub%%
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> > > To unsubscribe send a blank email to %%email.unsub%%
> > >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to %%email.unsub%%
>