Search code examples
armraspberry-pimbr

Extracting the MBR from a raspberry Pi


I tried extracting the MBR from my raspberry pi(with raspbian loaded on the SDCARD) as I would have with any Linux machine.

dd if=/dev/<devname> of=mbr.bin bs=512 count=1

However, upon doing a file on mbr.bin I get the following message :-

mbr.bin: x86 boot sector; partition 1: ID=0xc, starthead 130, startsector 8192, 114688 sectors; partition 2: ID=0x83, starthead 0, startsector 122880, 15400960 sectors, code offset 0xb8

Why does it say that it is an x86 boot sector?

[EDIT] I also read about the boot sequence here; does the raspberry pi even use the MBR?


Solution

  • Why does it say that it is an x86 boot sector?

    Because it is. Technically even "x86" is too broad, and "IBM PC-XT compatible" is more accurate, but these days MBR is one of those lowest-common-denominator de-facto standards thanks to the ubiquity of IBM-compatibles over the years.

    does the raspberry pi even use the MBR?

    Yes and no. Since the MBR contains both (16-bit) BIOS bootstrap code and the partition table, anything that doesn't boot through an IBM-compatible BIOS* cares about the latter but can ignore the former. Thanks to the simplicity of both the MBR and FAT formats (on account of being 30 years old) it's pretty easy for firmware to simply grovel into the data structures, pull out the first partition and look for the file it wants, which is exactly what many systems including the Pi do - quoting from the page linked in the question:

    Also notice that there is no partition marked as Active (bootable). The RPi firmware is coded to look for the file bootcode.bin in the first FAT32 partition - the normal MBR - partition boot process is not followed.

    The whole complicated BIOS chained bootstrap setup is the legacy of a 16-bit machine with 128k of RAM. Now thanks to EFI and GPT it's finally going the way of other features of that machine, like ROM BASIC and the audio cassette interface ;)


    * including most x86 PCs these days, because EFI disposes of the "boot up in 16-bit real mode pretending to be an 8086" silliness