0

I'm trying to understand where GRUB stage 2 is located on my bootable compact flash. Below is the output of the file command which was run against an image of the MBR (first 512 bytes) of the compact flash.

It says that the stage 2 address is 0x2000, or in decimal 8192 which would put it at the 16th sector ( 8192 Bytes/512 Bytes per sector).

I though that the second stage of the bootloader was supposed to be in the bootable partitions in the VBR, or PBR. If that were the case then I would expect the address for it to be 0x100000, which is the beginning of the bootable partition at sector 2048. (2048 sectors x 512 Bytes = 1048576 = 0x100000 )

So in the output below, what does the stage 2 address of 0x2000 and stage 2 segment of 0x200 mean?

[centos@centos6 ~]$ file SQFlash_MBR
SQFlash_MBR: x86 boot sector; GRand Unified Bootloader, stage1 version 0x3,
stage2 address 0x2000, stage2 segment 0x200;
partition 1: ID=0x83, active, starthead 1, startsector 2048, 1880064 sectors, code offset 0x48
[centos@centos6 ~]$
1
  • Grub is installed in the MBR & the sectors after the MBR for core.img, if MBR(msdos) partitioned. Grub does not normally use PBR, but Windows does. Grub2 does not like any install into PBR, but 10 years ago, if multiple installs, may have had a second install of grub legacy in PBR. With grub2 it does not really fit a PBR and it uses blocklists which are not recommended nor reliable. Systems since 2012 are UEFI since Microsoft required Windows 8 to be UEFI to gpt partitioned drives. If using gpt partitioning, the core.img is in the bios_grub partition which can be just about anywhere on drive.
    – oldfred
    Sep 20, 2021 at 19:35

1 Answer 1

1

Since the output mentions stage1 and stage2, we're talking about GRUB Legacy (i.e. GRUB version 0.97 or older) here. Modern versions would have a "core image" and a set of modules instead.

stage2 address and stage2 segment don't refer to disk sectors; they refer to the memory address stage 2 will be loaded to. The address is in the segment:offset format used by the x86 processors in 8086-compatibility mode ("real mode").

Since this is GRUB Legacy, the number of the next disk block GRUB will read was embedded into the MBR code when GRUB was installed to your compact flash as a single 32-bit value. MBR is block #0, and the next block GRUB will read will typically be block #1: it will contain the GRUB blocklist that defines sequence(s) of disk blocks to read for the next stage. That next stage could be either a "stage1.5" (a single read-only filesystem driver) or the full "stage2".

If stage1.5 is used, it will then in turn have embedded (disk,partition) identifier + pathname that identifies the location of stage2 as a regular file in a filesystem on a particular partition. The disk part might be omitted, in which case the disk is assumed to be the same that contains the stage1.5 component. Typically the pathname will be /grub/stage2 if a separate /boot partition is used, or /boot/grub/stage2 if /boot is just a regular directory on the root filesystem.

The information displayed by file is not sufficient to find out where the next stage is: you would need the contents of the blocklist block to find it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.