13 # define NT_SUCCESS(_Status) (((NTSTATUS)(_Status)) >= 0) 16 #define SECTOR_SIZE 512 17 #define BOOT_RECORD_SIGNATURE 0xAA55 23 unsigned char magic0,
res0, magic1;
24 unsigned char OEMName[8];
39 unsigned char Res3[12];
44 unsigned char VolumeLabel[11], SysType[8];
45 unsigned char Res2[420];
89 UCHAR MasterBootRecordCodeAndData[0x1B8];
118 if (Sector->
Media != 0xf0 &&
119 Sector->
Media != 0xf8 &&
120 Sector->
Media != 0xf9 &&
121 Sector->
Media != 0xfa &&
122 Sector->
Media != 0xfb &&
123 Sector->
Media != 0xfc &&
124 Sector->
Media != 0xfd &&
125 Sector->
Media != 0xfe &&
126 Sector->
Media != 0xff)
163 for (
k = 0;
k < 7;
k++)
172 for (
k = 0;
k < 4;
k++)
263 printf(
"Sector 0 seems to be FAT boot sector\n");
268 printf(
"Sector 0 seems to be NTFS boot sector\n");
273 printf(
"Sector 0 might be MBR\n");
278 printf(
"Sector 0 not recognized\n");
323 printf(
"Seems to be a FAT partittion\n");
328 printf(
"Seems to be a NTFS partition\n");
333 printf(
"Seems to be MBR\n");
338 printf(
"Not recognized\n");
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES ObjectAttributes
USHORT MasterBootRecordMagic
struct _MASTER_BOOT_RECORD MASTER_BOOT_RECORD
#define OBJ_CASE_INSENSITIVE
BOOL CheckAgainstNTFS(PNTFSBootSector Sector)
unsigned short ReservedSectors
ULONG PartitionSectorCount
BOOL CheckAgainstMBR(PMASTER_BOOT_RECORD Sector)
ULONGLONG MftMirrLocation
unsigned char ExtBootSignature
ULONG SectorCountBeforePartition
struct PARTITION_TABLE_ENTRY * PPARTITION_TABLE_ENTRY
unsigned short FSInfoSector
_Check_return_opt_ _CRTIMP int __cdecl fprintf(_Inout_ FILE *_File, _In_z_ _Printf_format_string_ const char *_Format,...)
int main(int argc, char **argv)
CHAR ClustersPerMftRecord
NTSYSAPI NTSTATUS NTAPI NtOpenFile(OUT PHANDLE phFile, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK pIoStatusBlock, IN ULONG ShareMode, IN ULONG OpenMode)
#define BOOT_RECORD_SIGNATURE
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
struct FATBootSector * PFATBootSector
#define FILE_SHARE_DELETE
unsigned short SectorsPerTrack
unsigned short BytesPerSector
struct NTFSBootSector * PNTFSBootSector
unsigned long FATSectors32
CHAR ClustersPerIndexRecord
unsigned char SectorsPerCluster
USHORT MasterBootRecordMagic
unsigned long SectorsHuge
static OUT PIO_STATUS_BLOCK IoStatusBlock
unsigned short BootBackup
#define FILE_SYNCHRONOUS_IO_NONALERT
#define NT_SUCCESS(_Status)
struct MASTER_BOOT_RECORD * PMASTER_BOOT_RECORD
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
#define InitializeObjectAttributes(p, n, a, r, s)
BOOL CheckAgainstFAT(PFATBootSector Sector)
unsigned short Signature1
#define RtlCompareMemory(s1, s2, l)
NTSTATUS NTAPI NtReadFile(HANDLE FileHandle, HANDLE Event, PIO_APC_ROUTINE ApcRoutine, PVOID ApcContext, PIO_STATUS_BLOCK IoStatusBlock, PVOID Buffer, ULONG Length, PLARGE_INTEGER ByteOffset, PULONG Key)
struct _PARTITION_TABLE_ENTRY PARTITION_TABLE_ENTRY
unsigned long RootCluster