1

I'd like to verify that core.img lies between the MBR and the start of my first partition, /dev/sda1.

Using

sudo dd bs=512 if=/dev/sda skip=512 count=1540 | hexdump -C

I can see /sda1 referenced:

00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000c0400  00 e0 3f 00 00 1a ff 00  4c c1 0c 00 96 a3 21 00  |..?.....L.....!.|
000c0410  ed d7 3f 00 00 00 00 00  02 00 00 00 02 00 00 00  |..?.............|
000c0420  00 80 00 00 00 80 00 00  00 20 00 00 12 11 ac 5e  |......... .....^|
000c0430  70 30 ac 5e 47 00 ff ff  53 ef 01 00 01 00 00 00  |p0.^G...S.......|
000c0440  a6 15 01 5c 00 00 00 00  00 00 00 00 01 00 00 00  |...\............|
000c0450  00 00 00 00 0b 00 00 00  00 01 00 00 3c 00 00 00  |............<...|
000c0460  42 02 00 00 6b 04 00 00  e6 59 c6 2c f6 f1 4e 6f  |B...k....Y.,..No|
000c0470  b4 c4 ea 0f 76 73 e4 46  00 00 00 00 00 00 00 00  |....vs.F........|
000c0480  00 00 00 00 00 00 00 00  2f 73 64 61 31 00 00 00  |......../sda1...|
000c0490  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000c04c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 fc 03  |................|
000c04d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000c04e0  08 00 00 00 00 00 00 00  00 00 00 00 b0 a3 c5 a6  |................|
000c04f0  c6 67 43 54 92 58 c9 42  d2 f9 21 0d 01 01 00 00  |.gCT.X.B..!.....|
000c0500  0c 00 00 00 00 00 00 00  a6 15 01 5c 0a f3 02 00  |...........\....|
000c0510  04 00 00 00 00 00 00 00  00 00 00 00 00 80 00 00  |................|
000c0520  00 80 78 00 00 80 00 00  00 80 00 00 00 00 79 00  |..x...........y.|
000c0530  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000c0540  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 10  |................|
000c0550  00 00 00 00 00 00 00 00  00 00 00 00 20 00 20 00  |............ . .|
000c0560  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000c0570  00 00 00 00 04 01 00 00  a7 53 a4 1f 00 00 00 00  |.........S......|
000c0580  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000c07f0  00 00 00 00 00 00 00 00  00 00 00 00 79 1d 94 d7  |............y...|
000c0800

Is this part of core.img?

I was hoping for a magic number like MBR's 55 aa but couldn't find a mention whether core.img has that.


I'm using GRUB 2.02, uname -m gives x86_64.

1
  • You've specified bs=512 and then skip=512, so what you've dumped actually starts 512 blocks after the beginning of the disk, and covers 1540 / 2 = 770 KiB from there. You want dd bs=512 if=/dev/sda skip=1 count=600 | hexdump -C or similar.
    – telcoM
    May 3, 2020 at 18:37

1 Answer 1

3

Well, assume you have no further knowledge, you can search for it in raw data.

Some patterns to look for (and their byte offset):

# strings -n 6 -t d /boot/grub/i386-pc/core.img
    283 loading
    306  Error
   2622 RBRPQR
   3689 LH%N("
   4248 9dzj~)>
...

Repeating the same search on the boot drive:

# strings -n 6 -t d /dev/sda | grep -B 6 -F '9dzj~)>'
    395 Hard Disk
    410  Error
    795 loading
    818  Error
   3134 RBRPQR
   4201 LH%N("
   4760 9dzj~)>
--
2239165876 gcry_mpi_invm
2239165890 _gcry_mpi_alloc
2239168795 loading
2239168818  Error
2239171134 RBRPQR
2239172201 LH%N("
2239172760 9dzj~)>

So like wow, what is this stuff?

The string we searched for is 9dzj~)> which is at byte offset 4248 in the core.img file. There was a match for that at byte offset 4760 on my boot drive. That actually just happens to be the same offset + 512 bytes, so you can tell: core.img in my example is actually located at one sector offset. The boot drive in this example is still using an old-fashioned DOS partition table.

The second match at byte offset 2239171134 is just the regular file on the /boot partition.


The same exercise on another machine:

Look for some patterns in core.img:

# strings -n 6 -t d /boot/grub/i386-pc/core.img | head -n 6
    307 loading
    330  Error
   2638 RBRPQR
   3677 N8yf>W
   4228 ;E~T\4
   4367 8aDk B

grep for one of them on the boot drive:

# strings -n 6 -t d /dev/vda | grep -B 6 -F ';E~T\4'
1046494 &{$|zO.
1047463 Y 'lg4
1048883 loading
1048906  Error
1051214 RBRPQR
1052253 N8yf>W
1052804 ;E~T\4
--
141418559 normal
141418574 normal
141488435 loading
141488458  Error
141490766 RBRPQR
141491805 N8yf>W
141492356 ;E~T\4

That offset is a bit larger than 512 bytes, comes out as 1052804-4228 = 1048576 = 1 MiB ... why? Because this drive is GPT with a bios_grub partition at 1 MiB offset:

# parted /dev/vda unit b print
Model: Virtio Block Device (virtblk)
Disk /dev/vda: 20401094656B
Sector size (logical/physical): 512B/512B
Partition Table: gpt

Number  Start         End           Size         File system  Name            Flags
 1      1048576B      2097151B      1048576B                  grub            bios_grub

... and core.img is right at the start of it:

# cmp /boot/grub/i386-pc/core.img /dev/vda1
/boot/grub/i386-pc/core.img /dev/vda1 differ: byte 501, line 7
# cmp -l /boot/grub/i386-pc/core.img /dev/vda1
  501   2   1
  502   0  10
  509  62 145
  529   0  33
  530   0 146
cmp: EOF on /boot/grub/i386-pc/core.img after byte 26085

So, 26080 bytes were identical with core.img. It's something. \o/


This exercise might fail if the core.img file located in /boot is not actually the one that was installed. Some install CDs install a different version of GRUB; and some multi-boot systems, or updated instead of fresh installs, might be using a very different version of GRUB than what is installed on the filesystem (if you never re-run grub-install to actually update on-disk GRUB).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.