Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 6 down vote favorite
1

I've done a lot of partitioning / dual booting on my Macbook Pro. Right now I have Mac OS X installed along with Ubuntu 12.04, with Grub installed on the Ubuntu partition.

I am wondering - what is the code in my MBR (the first 446 bytes)? Because Macs use EFI and GUID partitioning, the MBR is only a protective/hybrid MBR (in my case, it is a hybrid MBR).

Q: How can I identify what program is in my MBR (based on its hexdump)? Is there some sort of a signature? I'm guessing it's grub but I did a hexdump of it and it didn't match the code I found in this article detailing the Grub MBR ("Stage 1") code.

EDIT: I am runnning rEFInd, an EFI bootmanager program. It is an EFI application, and thus resides on my EFI system partition. This program is what runs immediately following bootup, but I do not think it places any code in the 446 bytes of the MBR.

EDIT2: I should add that I have had Windows installed for dual-boot as well.

share|improve this question
Why not simply booting from it to find out? – michas Jan 20 at 4:57
@michas Sorry, I guess I forgot to mention: I am runnning rEFInd, an EFI bootmanager program. It is an EFI application, and thus resides on my EFI system partition. This program is what runs immediately following bootup, but I do not think it places any code in the 446 bytes of the MBR. I will add this to the question. – kalaracey Jan 20 at 14:58
I think I've found the answer: I believe it is Windows boot code. Based on the readable ASCII in the hexdump ("Invalid partition table.Error loading operating system.Missing operating system.") I was able to do a Google search and found two sites which discussed windows bootloaders. The hexdump of mine matches parts of the Win2k bootloader as well as the bootloader of one of the posters in the forum. See: masm32.com/board/…, and thestarman.pcministry.com/asm/mbr/Win2kmbr.htm. – kalaracey Jan 20 at 15:25
Actually more pertinent than both of the previous links is this one, which documents the Windows 7 MBR: thestarman.pcministry.com/asm/mbr/W7MBR.htm#CODE. The MBR documented there (i.e., the Windows 7 MBR) is identical to mine, which makes sense, because I had installed Windows 7. I will post an answer to the question as soon as I can. – kalaracey Jan 20 at 15:44

2 Answers

up vote 1 down vote

I think I've found the answer: I believe it is Windows boot code. Based on the readable ASCII in the hexdump ("Invalid partition table.Error loading operating system.Missing operating system.") I was able to do a Google search and found a site which discussed windows bootloaders. The hexdump of mine matches the Windows 7 bootloader detailed at http://thestarman.pcministry.com/asm/mbr/W7MBR.htm#CODE. This makes sense, because I have installed Windows 7 in the past on my computer.

share|improve this answer
up vote 0 down vote

You could copy the first few KiB of the disk/partition to a file, and then let strings(1) or perhaps objdump(1) loose on that to find out what is in there.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.