1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Boot Sector Protection in XP?

Discussion in 'Windows XP' started by Richard Jones, Mar 29, 2010.

  1. Richard Jones

    Richard Jones Flightless Bird

    I just stumbled on something strange. I was using a tool called
    "MbrFix" that is capable of writing DOS/Win9x bootsectors to a partition. I
    was using it to create a FAT32 bootsector to load Win98's DOS rather than
    NTLDR. At any rate the write wouldn't stick. The write would "take", that
    is, I could see the changes via a sector editor, but a few seconds later, it
    reverted back to the previous boot sector.

    It appears there is some protection code running that is monitoring
    the boot sectors for various drives and undoes any changes made, sort of
    like system file protection. XP 32-bit does this, as well as XP x64.

    Now, the "bootsect" tool from the Win7 distribution will work fine,
    changing back and forth between BOOTMGR and NTLDR calling boot sectors. It
    must know some "special API" to get around the protection.

    I had no idea that any such protection was in XP. Can anyone here
    confirm this, and is there a way to turn it off? Thanks.
     
  2. Richard Jones

    Richard Jones Flightless Bird

    Update:

    It appears this happens only when there's a BOOTMGR (NT 6.x)
    bootsector on the partition. If I use the bootsect.exe tool to write an
    NTLDR (NT 5.2) bootsector, I can write then write the bootsector at will.
    But, change it back to Bootmgr, and that turns the protection "feature" on.
    Again, both XP x64 and 32-bit display this behavior.

    I'm guessing this is something they added in the later hotfixes over
    service pack to prevent XP or software running under it to screw up the new
    Vista/Win 7 boot loader. And the "bootsect.exe" tool apparently knows how
    to communicate with this protection.


    "Richard Jones" <nobody@nowhere.nul> wrote in message
    news:-Oplrq36zKHA.1796@TK2MSFTNGP02.phx.gbl...
    >
    >
    > I just stumbled on something strange. I was using a tool called
    > "MbrFix" that is capable of writing DOS/Win9x bootsectors to a partition.
    > I was using it to create a FAT32 bootsector to load Win98's DOS rather
    > than NTLDR. At any rate the write wouldn't stick. The write would "take",
    > that is, I could see the changes via a sector editor, but a few seconds
    > later, it reverted back to the previous boot sector.
    >
    >
     

Share This Page