Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've done a lot of partitioning / dual booting on my Macbook Pro. Right now I have Mac OS X installed along with Ubuntu 12.04, with Grub installed on the Ubuntu partition.

I am wondering - what is the code in my MBR (the first 446 bytes)? Because Macs use EFI and GUID partitioning, the MBR is only a protective/hybrid MBR (in my case, it is a hybrid MBR).

Q: How can I identify what program is in my MBR (based on its hexdump)? Is there some sort of a signature? I'm guessing it's grub but I did a hexdump of it and it didn't match the code I found in this article detailing the Grub MBR ("Stage 1") code.

EDIT: I am runnning rEFInd, an EFI bootmanager program. It is an EFI application, and thus resides on my EFI system partition. This program is what runs immediately following bootup, but I do not think it places any code in the 446 bytes of the MBR.

EDIT2: I should add that I have had Windows installed for dual-boot as well.

share|improve this question
    
Why not simply booting from it to find out? –  michas Jan 20 '13 at 4:57
    
@michas Sorry, I guess I forgot to mention: I am runnning rEFInd, an EFI bootmanager program. It is an EFI application, and thus resides on my EFI system partition. This program is what runs immediately following bootup, but I do not think it places any code in the 446 bytes of the MBR. I will add this to the question. –  kalaracey Jan 20 '13 at 14:58
    
I think I've found the answer: I believe it is Windows boot code. Based on the readable ASCII in the hexdump ("Invalid partition table.Error loading operating system.Missing operating system.") I was able to do a Google search and found two sites which discussed windows bootloaders. The hexdump of mine matches parts of the Win2k bootloader as well as the bootloader of one of the posters in the forum. See: masm32.com/board/…, and thestarman.pcministry.com/asm/mbr/Win2kmbr.htm. –  kalaracey Jan 20 '13 at 15:25
    
Actually more pertinent than both of the previous links is this one, which documents the Windows 7 MBR: thestarman.pcministry.com/asm/mbr/W7MBR.htm#CODE. The MBR documented there (i.e., the Windows 7 MBR) is identical to mine, which makes sense, because I had installed Windows 7. I will post an answer to the question as soon as I can. –  kalaracey Jan 20 '13 at 15:44
add comment

2 Answers

You could copy the first few KiB of the disk/partition to a file, and then let strings(1) or perhaps objdump(1) loose on that to find out what is in there.

share|improve this answer
add comment

I think I've found the answer: I believe it is Windows boot code. Based on the readable ASCII in the hexdump ("Invalid partition table.Error loading operating system.Missing operating system.") I was able to do a Google search and found a site which discussed windows bootloaders. The hexdump of mine matches the Windows 7 bootloader detailed at http://thestarman.pcministry.com/asm/mbr/W7MBR.htm#CODE. This makes sense, because I have installed Windows 7 in the past on my computer.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.