Prev: Retrieving data from an inactive Registry
Next: Problems While Installing Java Successfull Revisted by Author
From: Richard Jones on 29 Mar 2010 22:08


I just stumbled on something strange. I was using a tool called
"MbrFix" that is capable of writing DOS/Win9x bootsectors to a partition. I
was using it to create a FAT32 bootsector to load Win98's DOS rather than
NTLDR. At any rate the write wouldn't stick. The write would "take", that
is, I could see the changes via a sector editor, but a few seconds later, it
reverted back to the previous boot sector.

It appears there is some protection code running that is monitoring
the boot sectors for various drives and undoes any changes made, sort of
like system file protection. XP 32-bit does this, as well as XP x64.

Now, the "bootsect" tool from the Win7 distribution will work fine,
changing back and forth between BOOTMGR and NTLDR calling boot sectors. It
must know some "special API" to get around the protection.

I had no idea that any such protection was in XP. Can anyone here
confirm this, and is there a way to turn it off? Thanks.


From: Richard Jones on 30 Mar 2010 00:10
Update:

It appears this happens only when there's a BOOTMGR (NT 6.x)
bootsector on the partition. If I use the bootsect.exe tool to write an
NTLDR (NT 5.2) bootsector, I can write then write the bootsector at will.
But, change it back to Bootmgr, and that turns the protection "feature" on.
Again, both XP x64 and 32-bit display this behavior.

I'm guessing this is something they added in the later hotfixes over
service pack to prevent XP or software running under it to screw up the new
Vista/Win 7 boot loader. And the "bootsect.exe" tool apparently knows how
to communicate with this protection.


"Richard Jones" <nobody(a)nowhere.nul> wrote in message
news:Oplrq36zKHA.1796(a)TK2MSFTNGP02.phx.gbl...
>
>
> I just stumbled on something strange. I was using a tool called
> "MbrFix" that is capable of writing DOS/Win9x bootsectors to a partition.
> I was using it to create a FAT32 bootsector to load Win98's DOS rather
> than NTLDR. At any rate the write wouldn't stick. The write would "take",
> that is, I could see the changes via a sector editor, but a few seconds
> later, it reverted back to the previous boot sector.
>
>


 | 
Pages: 1
Prev: Retrieving data from an inactive Registry
Next: Problems While Installing Java Successfull Revisted by Author