• Announcements

    • xper

      MSFN Sponsorship and AdBlockers!   07/10/2016

      Dear members, MSFN is made available via subscriptions, donations and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. Alternatively, become a site sponsor and ads will be disabled automatically and by subscribing you get other sponsor benefits.
ahmad2080

HP Notebook: The recovery partition could not be found

211 posts in this topic

Hi all genious there !! :hello:

What I understand from post # 88 is he overwrite the file created by HDhacker( the special factory version of MBR) from his friend's machine. So is it possible that Ahmad share that file and I also overwrite that into my system?

Don't be angry if this option is too silly :unsure:

Actually I do not have any knowledge about this mbr kind of files.

Please help with some simple and clear steps.

Here is my bootsector created using HDhacker (if you need to see the code) :

BootSector_DriveD1.rar

Edited by Niru
0

Share this post


Link to post
Share on other sites

Hi Jaclaz!

Would be grateful to take a part :)

That is my way to point:

My Vista was damaged from unrecover disaster. It get lazy with many errors and updates stoped. No viruses found. Gaming with restore points do somesing but not a decision.

Read a tones of forums with no movement. HP discontinued my Pavilion and when I ask them get a link to third patry market to find out Recovery Disk suit.

Now what I see in replay on your question

* by pressing F11 I get normal start with a little delay in absolutely black screen till welcome

* yeap I try to recover this issue by starting a Vista installation disk with option "recover startup" cose I thougth MS is wize enought to recover their native product :(

now I now the guys who achived more sofisticated results :wacko:

* after got "help" from Microsoft I found (reading this topic) a hidden HP directory with RECOVERY and PATCH folders. Applying those *.cmd leed me to above MBR and do nothing of course.

* Then I renamed a mbr.dll into mbr.exe and it show me a screen with some options, but trying to apply them I got message -- WARNING: Recovery partition could not be located

Edited by Snack
0

Share this post


Link to post
Share on other sites

Hello everybody.....

It has been only one day since I last checked this thread and you say "abandoned"!!!!

I had alot of postponded work to do. This "recovery partition" was the reason of course.....

It seems like there are some other people "SUFFERING" from this stupid HP partition....

I would like to reply to each post....But I'm really running out of time..

BTW, I didn't pay my ISP bills.....so I don't have an internet connection at home..!!!! So please have patience!!! :whistle:

I'll upload everything you all need as soon as I have time to do it.....

@jaclaz

Tripredacus said that his method solved the F11 function (which I need to do now), but he didn't say that it'll make me able to make the recovery disks from the SofThinks application.

AND, I've already sent you my friend's C & D bootsectors and his MBR.....

I don't think that I can send them again, because during my experiments trying to return the F11 function I had to format my USBStick which had all of bootSectors and MBRs on it.

But let me tell you this...

Action: Applying his MBR on mine

Result: System did not boot

Action: Applying his C boot sector on mine

Result: system did not boot

I wanted to try applying BOTH.....but as I said..the USBStick was formatted.

I'm a little confused here.....I think that I'll restate the whole problem again to make everything clear...

I have a request: Please define the difference between bootsectors and MBR.....

See you in (1 or 2 days)...

Edited by ahmad2080
0

Share this post


Link to post
Share on other sites

Ahmad please come back soon with solution !!

@jaclaz: Ahmad is saying that he posted the MBR and botsectors from his friend. pls post those in the forum also.

0

Share this post


Link to post
Share on other sites
Here is my bootsector created using HDhacker (if you need to see the code) :

Try re-reading this:

@snack

The bootsector you posted is perfectly unuseful, a NTFS bootsector is 16 sectors.

jaclaz

:whistle:

jaclaz

0

Share this post


Link to post
Share on other sites

Hopefully a workaround :unsure: (NOT the solution) by using mbldr.

Get mbldr here:

http://mbldr.sourceforge.net/

http://mbldr.sourceforge.net/#Download

http://prdownloads.sourceforge.net/mbldr/m...46.zip?download

Unzip to a directory, then run mbldrgui.exe.

Then:

  • Select the drive.
  • Add> first the RECOVERY partition and specify the "RECOVERY" label for it - it will be the smallest of the two and probably listed as second on the left window
  • Add> second the "Normal" partition (and specify the "Normal" label for it) - press "Mark current" button
  • Uncheck "Hide other primary partitions at boot"
  • Change the drop-down box on the left "Progress bar" from "Decreasing digits" to "Dots"
  • Change the drop-down box on the right "Keis choosing what to boot" from "1,2,3" to "Custom scan code"
  • A popup will show, READ it's contents and click OK then replace the "59" with "87"

Now edit the text:

  • delete line "mbldr v1.46" - a popup will show, READ it's contents and click OK
  • delete line "RECOVERY"
  • delete line "*Normal"
  • Enter a line "Press F11 for Emergency Recovery"

mbldrsettingsh.jpg

Now backup and save:

  • Press the "Backup MBR", this means that you are saving to a file the current MBR of the chosen drive.
  • Press the "Save MBR", this means that you are saving to a file the NEW MBR that you just built with mbldr.

Now write the NEW MBR:

  • Change the small drop-down box on bottom left corner from "file" to "sector"
  • A popup will appear, READ it's contents and click OK.
  • Press the "Save MBR", this means that you are saving to a sector the NEW MBR that you just built with mbldr, a popup will appear with already the preset "0" sector, leave it as is and press OK.
  • Another popup will show for confirmation, click OK.

Try rebooting, you should be able by pressing F11 to boot to the "RECOVERY" partition, and by waiting or pressing [ENTER] to boot normally.

DON'T EVEN THINK of messing with the MBR if you have not a tested alternative way of booting the PC (see a few posts before for an easy one using a USB stick).

Report if this workaround works.

jaclaz

0

Share this post


Link to post
Share on other sites

( to clarify at risk of offending... )

( MBR = 1st sector of Physical HDD, e.g. Disk0, Disk1, etc )

( Partition Boot "Sector" for NTFS = 1st 16 Logical Sectors of Logical Disk, e.g. Partition, e.g. C-drive, D-drive, etc )

( each Physical HDD, in this case ONE, will have one or more Partitions, in this case TWO! )

( sequence of events -

BIOS points to HDD as set inside

HDD MBR-code ALSO has Partition Definitions - MBR "boots" to Active Partition

Partition Boot "boots" the Operating System )

( SO! 3 hex listings necessary -

1 - 1st Sector of HDD

2 - 1st 16 Sectors of C-drive

3 - 1st 16 Sectors of D-drive )

Edited by submix8c
0

Share this post


Link to post
Share on other sites

Hi

Make it twice, for sure but nothing happened :(

* F11 make a black screen for a while and then boot normally

* Disk creator sing the same song "Recovery partition could not be located"

* F8 show standart Vista Boot Manager, and when I choose "System Reparation" goes to error

0xc000000F

The boot selection failed because a required devices is inaccessible :blink:

(see post #115)

pressing ESC resume normal booting

note: Booting with PE disk all content of recovery disk D: can be viewed and accessible.

-------------

next attempt I tried to increase User Timer to 5 second and was able to see text message Press F11.. with dot progress bar working. Pressing different keys do nothing exсept resume to normal booting.

Edited by Snack
0

Share this post


Link to post
Share on other sites
Make it twice, for sure but nothing happened :(

Make it what? :unsure:

The posted workaround? <-this is the thing that needs to be tested! :whistle:

Or running MBRINST.EXE or MBR.DLL renamed? <- this is the thing for which there is NO solution (yet ;))

jaclaz

0

Share this post


Link to post
Share on other sites

Sure - mbldr (Post #106)

MBR from HP is for testing purposes only

One more thing - pressing F1 while F11 progress bar switch me to "chose operating system" WBM window with only choices Starting Vista and Memory Diagnostic. Without Recovery item

Edited by Snack
0

Share this post


Link to post
Share on other sites
Hi Ahmad .... I have the same problem as u faced.

Is there any way out to get rid of that "recovery partition could not be found" error and create the recovery discs?

I don't have any friend here who has HP+Vista :(

Please let me know if can be done from my own machine......by changing any files.

Thanks in advance.

Actually I am (was) a PATIENT not a DOCTOR here :blushing: ......However, I'll do my best to help.

Greetings Ahmad!

Sleel nerves. I am tired from mentioned service and "patches" trying resolve the similar problem :wacko:

Think may be helpfull attach those ridiculos MBRs from HP to this forum.

Comparing take to find this "special" code. No choice find solution in a usual way :(

Recovery can't be created...

OK,..... http://ultrashare.net/hosting/fl/dcd3f5f89...riend_s_sectors

I don't recommend applying these MBR and boot sectors on your notebook without having a bootable USBStick from which you can restore your original MBR. Read post #73.

If you want to try the "silly" solution here are the steps:

  1. Create a bootable USBStick using ALL instructions in POST#73.[and make sure that you can boot from it]
  2. Save your current MBR and boot sectors (using HDhacker) on your Stick and computer.
  3. Try applying my friend's D: drive boot sector on yours.
  4. Launch the CD creator software. It should (as in my case) see the partition now. If not, Undo step 3 by restoring your saved D: drive boot sector.

In my case, Applying the attached MBR or C: boot sector made the system unbootable. TAKE CARE.

If you messed up with your MBR you can restore it using the bootable USBStick:

  1. Boot into the FreeDOS
  2. Type:
    MBRWIZ /disk=1 /Restore=C:\your_original_MBR.dat


I thought the whole point was to find the way to run the original app to re-install a working MBR as in factory. :unsure:

Using the way Tripredacus suggested before (using the MBR.EXE from Terabyte) or using grub4dos, you could have done the same.

So, I am happy :) that your initial problem was solved, but still we haven't found the solution :( .

Once you have done the recovery disks, try applying the attached MBR and post results.

Also, I seem to be missing two things:

  • the bootsector form your Recovery partition (16 sectors)
  • the bootsector from the recovery partition of your friend (the first one) also 16 sectors.

I need them, when you have time, in order to try and understand which mods (if any) are made to them.

jaclaz

So you need all 16 sectors.......I'll upload my CURRENT 16 sectors and my first friend's soon.

NOTE: My first friend's notebook is not as similar as the second where his recovery partition size differs from mine. The second friend had the exact partition size as mine.

I'll try applying the attached MBR and post the results soon.

<LI>from factory there is a "special" MBR on HP/Compaq laptops that allows when booting to press F11 to access 2nd partition (Recovery) and from it start ..... (please fill the gap, what is supposed to do when F11 is pressed? Should the option to Recover the drive or create the disk start?

When F11 is pressed, the option that should start is " Recovering your system to factory settings". You can burn the Recovery disks ONLY from the SofThinks application inside Windows.

I have some questions here:

  1. Can modifying MBR change the boot sectors of the partitions?
  2. Are these statements accurate:

  • The "Recovery partition could not be found" problem is caused by modifications in the recovery partiton boot sectors and can't be solved by modifying MBR. [if true then why are you -jaclaz- doing MBR experiments, what's your point of view?]
  • The F11 problem is caused from either a modified MBR or modified recovery partiton boot sectors.

IMHO, by answering those questions we should be able to put our hands on what we should fix and how to fix it.....

Ahmad

Edited by ahmad2080
0

Share this post


Link to post
Share on other sites

I want to comment on a few things.

1. The Boot Sector contains the MBR and other stuff.

2. The above is the reason I believe simply reapplying the MBR.INI with MBRINST (or MBR.DLL) is not enough to make the partition work. There is additional information in the sectors that need to be applied as well. In my experience, simply applying the MBR.INI that the SoftThinks software has in the recovery partition is not enough to activate the function key process. Of course my experience with this is different than yours, as I tried to make this work when using Imagex (file based imaging, as opposed to Ghost, which I use for images with these partitions, which is sector based) to image drives with recovery partitions.

3. My use of Terrabyte's MBR.EXE was not tested on a SoftThinks recovery partition. As noted in my thread, I used it to create my own custom recovery partition what used Win PE 2.1 and Imagex to do a recovery. I had created this because my company does not seem interested in upgrading our licensing agreement to support recovery options for Vista. Plus, if I can streamline this solution, we can dump them altogether. Because we have to pay for SoftThinks but we wouldn't have to pay for our own thing.

4. Concerning point 3, the MBR commands posted in my thread are based upon how I set up the custom recovery partition. Using this on a SoftThinks partition may be totally different. This is because my custom partition is still a hidden ID 7 volume, while SoftThinks is a hidden ID 12 partition. So if you want to test out this program, some different testing of the partition ID to set to may be in order. So this is saying that going from 0xC to 0x1C may not work for a SoftThinks partition

5. Don't get us wrong, we are glad you were able to make your recovery media. Helping out other users is our number 1 priority (other than keeping out the spam lol). The point that Jaclaz was trying to make earlier (I agree as well) is that while you have somewhat solved your problem, you used a workaround and not a real fix. So our initial issue, how to properly resolve a broken recovery partition is still unsolved. The main reason is that you are fortunate to know someone else with a similar computer to you. Many people are not so fortunate, so we still wish to know the true answer, so that we may help others who do not have access to the same model computer.

6. THE MOST IMPORTANT. Before attempting ANYTHING in this thread, make sure to back up your data. Also your MBR if at all possible. Using other MBRs, these programs and boot sectors, etc, may cause your computer not to boot. ahmad2080 had taken the proper precautions prior to doing any fiddling, and (correct me if I am wrong) was willing to accept the fact that this process could render his computer unusable without purchasing the recovery media from HP. So if you are looking for a quick fix to your problem here, be warned that this is all very technological stuff. I'm not trying to downgrade anyone here, but if you are unsure of what you are doing, then you best not do anything until you understand what is possible. As I noted in point 5, we have no clear cut solution at this time to this issue.

7. The F11 problem is caused by the fact that the MBR.INI does not have the code in it that tells it what to do with the partitions. This may be something that is added into the Boot Sector at the time of recovery partition creation. If you look in my custom Recovery Partition thread, you will see the code I use with MBR.EXE. It basically says that when you press (function key) change the boot drive to hidden, and change the hidden drive to bootable. After my recovery partition loads, I had to add another command that resets these values back to normal so that you can boot to Windows again after running the recovery. If you look at the MBR.INI, this type of information is not present. There is no such place where it shows options that change the partition ID at all.

I would say that I would like to try testing out this process using the MBR.EXE program next week, but I have about 15 projects I have to work on besides my regular job. I don't think I'll get around to it. I will put it on my list, but it might be a while before I get around to it. Hopefully this will be solved by then, if not, I'll bring this thread back up.

0

Share this post


Link to post
Share on other sites

NEW ERROR --- NEW ERROR --- NEW ERROR

I have wrote Ahmad's friend's D drive bootsector and the "recovery partition could not found" disappears.

Wait wait ... there is no success !!!

But I am getting A NEW ERROR ...."This computer does not have a drive capable of creating CDs or DVDs. Contact HP support."

0

Share this post


Link to post
Share on other sites

PROBLEM SOLVED

:thumbup

Finally, I am able to create the recovery discs for my notebook.

I just re-wrote Ahmed's friend's D drive bootsector on my D drive(recovery drive) using HDhack.

Here is the link to download the D drive bootsector http://ultrashare.net/hosting/fl/dcd3f5f89...riend_s_sectors

I did not change anything in C drive bootsector or any mbr files. And please take a backup before rewriting.

I got rid of that error ("This computer does not have a drive capable of creating CDs or DVDs. Contact HP support.") by re installing Cyberlink DVD Suit.

Note : My notebook is Compaq V3780TU

Edited by Niru
0

Share this post


Link to post
Share on other sites

I found were the problem with "recovery partition could not be located" is buried by HP.

Analysing boot sector drive D: from Ahmad2080 friend in compare with mine ---> there must be a word RECOVERY at offcet 1F0.

Adding this code with HEX editor and saving it to disk using HDhack (no need rebooting) I start Recovery Disk Creator and voila - I have a set of recovery disks. ;)

tips:

* Since SoftThinks uses Roxio open it and change speed defaults to x1. May be helpfull with older DVD-RW.

* Disable any virtual CD/DVD

* Check presence of boot.sdi in folder SMINST\bootdisk\boot\ - if not there is a copy in c:\windows\boot\

* To repeat burning run the code from command prompt or make .cmd file

 del /a:h d:\hpcd.sys c:\windows\sminst\hpcd.sys

* Or while looking at writing disk progress bar open c:\temp folder and copy .iso file to safe location

* HDhack from post #88 or #57 HEX editor HxD

Edited by Snack
0

Share this post


Link to post
Share on other sites
SUCCESS SUCCESS SUCCESS

PROBLEM SOLVED

:thumbup:thumbup:thumbup

Finally, I am able to create the recovery discs for my notebook.

I just re-wrote Ahmed's friend's D drive bootsector on my D drive(recovery drive) using HDhack.

Here is the link to download the D drive bootsector http://ultrashare.net/hosting/fl/dcd3f5f89...riend_s_sectors

I did not change anything in C drive bootsector or any mbr files. And please take a backup before rewriting.

I got rid of that error ("This computer does not have a drive capable of creating CDs or DVDs. Contact HP support.") by re installing Cyberlink DVD Suit.

Note : My notebook is Compaq V3780TU

I'm glad you solved the problem Niru. I'm surprised that my friend's recovery disk bootsector could fix your recovery partition in a completely different notebook. :rolleyes:

I hope it works with Snacks as well, although I beleive that his problem is some different.

@Niro

Does the F11 function at booting up work??

As Tripredacus and jaclaz said, the problem hasn't been solved yet.

@Tripredacus

1. The Boot Sector contains the MBR and other stuff.

Great. Now everything is obvious.

5. Don't get us wrong, we are glad you were able to make your recovery media. Helping out other users is our number 1 priority (other than keeping out the spam lol). The point that Jaclaz was trying to make earlier (I agree as well) is that while you have somewhat solved your problem, you used a workaround and not a real fix. So our initial issue, how to properly resolve a broken recovery partition is still unsolved. The main reason is that you are fortunate to know someone else with a similar computer to you. Many people are not so fortunate, so we still wish to know the true answer, so that we may help others who do not have access to the same model computer.

I agree totally. :sneaky:

ahmad2080 had taken the proper precautions prior to doing any fiddling, and (correct me if I am wrong) was willing to accept the fact that this process could render his computer unusable without purchasing the recovery media from HP.

Actually, I thought that the baching up my MBR and boot sectors + the bootable USBStick can return everything to normal whenever I need to. :ph34r:

7. The F11 problem is caused by the fact that the MBR.INI does not have the code in it that tells it what to do with the partitions. This may be something that is added into the Boot Sector at the time of recovery partition creation.

mmmmm,I'll try writing the whole 16 boot sectors from my friend's recoverydisk on mine. If it didn't work I'll try another Full recovery and see what wil happen.

0

Share this post


Link to post
Share on other sites

WOW, This is a magical solution.....

Does your F11 function work Snacks??

0

Share this post


Link to post
Share on other sites

To resolve F11 need those 16 clasters from your friend and some experiments with SoftThinks software, that was implemented in an unusual mode by HP.

I take a look on mine 16s and saw mass of zero's instead of info.

As I posted above I found a hidden HP folder with a patch.cmd file in it. After some modifications to make it point to MBRinst (MBR.exe) in folder C:\windows\SMINST and run it I get error in a log file: "Sorry, could not add Auto Failover to Vista's BCD"

After all F11 working .... with reboot as a result. Normal booting remain unaffected.

0

Share this post


Link to post
Share on other sites

I see it's absolutely of no use participating to this game. :(

It has been fun while it lasted. :)

So long and thanks for all the sectors....;)

:hello:

jaclaz

0

Share this post


Link to post
Share on other sites
see it's absolutely of no use participating to this game. :(

It has been fun while it lasted. :)

So long and thanks for all the sectors.... ;)

:hello:

jaclaz

May be it can last......

I still didn't restore the F11 function....

AND I offer my assistant to make some experiments that may reveal the mystery of this partition.

Also, I seem to be missing two things:

  • the bootsector form your Recovery partition (16 sectors)
  • the bootsector from the recovery partition of your friend (the first one) also 16 sectors.

Here you are : http://rapidshare.com/files/220509011/Reco...ctorsr.rar.html

0

Share this post


Link to post
Share on other sites

Playing games :):};)

I have no enought knowledge but

let's try more efforts to resolve issue, thinking the problem is worldwide...

Applying WAUfix.bat from C:\hp\recovery\bin folder finally I can see F11 WBM window with three line menu.

But the first one is "ramdisk option" instead of Recovery Manager. Do nothing of coarse.

Little left to do...

I suspect this menu item points to a Vista BCD file. Any idea?

Ahmad8020 more things to be missing:

* the MBR and bootsector __C:__ from your friend 16 sectors.

* C:\boot\bcd

And by the way have you pass through Complete Factory Restore?

That should return your computer to be boot with F11 enabled and running without problem. Or I missed somewhat in discussions :unsure:

Edited by Snack
0

Share this post


Link to post
Share on other sites

Though I am now out of the game, I guess that the preliminary work and maybe some of the conclusions I got to might be of use to someone willing to take part in it.

This post will be extremely long, and in some parts will be more similar to a RANT :realmad: than to a valid technical post, please try forgiving my verbosity and my critical attitude.

Let me state beforehand a few facts and personal opinions:

I find HP has been for yesrs the best firm in the world for pocket calculators (in my life I bought several tens of them)

I find HP has been for years the best firm in world for Laser printers (as well in my life I bought several tens of them)

I find HP has been for years the best firm in the world for plotters (as well in my life I bought several tens of them)

I find Compaq has been for years the best firm in the world for plotters (as well in my life I bought several tens of them - in the years 1992 up to 1995)

I find current HP policies with software and particularly with OS simply appalling :ph34r: .

HP was facing to be condemned for similar practices in a Class action and opted for a settlement:

http://web.archive.org/web/20060402204440/...settlement.com/

It seems like it is a common practice for HP to close with a settlement cases where they were accused to provide defective products and/or failed to give Customers satisfacting repairs/fixes:

http://barrettgrider-v-hpcompaq.com/index.html

In Italy there are currently several cases opened against HP following its refusal to reimbourse customers that do not want Vista on their PC's (Italian):

http://punto-informatico.it/1354479/PI/New...unciata-hp.aspx

http://punto-informatico.it/2096808/PI/New...rso-dovuto.aspx

http://punto-informatico.it/2341415/PI/New...-tribunale.aspx

and an appeal to the Antitrust European Committee has been filed.

(but the above bears no connection to the issue at hand)

Let's get back to topic.

From what I have seen and understood from the reports, the "Softthinks" MBRINST.EXE ( in some cases renamed to MBR.DLL) is a MBR installing utility that works roughly this way:

  1. writes a "special" MBR
  2. analyzes the partitions on the hard disk
  3. if a partition with certain (unknown at the moment) settings/data is found, THEN:
  4. adds to the partition bootsector the word "RECOVERY"
  5. changes some data in the MBR accordingly

The above procedure is NOT repeatable, i.e. once the "RECOVERY" partition is made, the MBRINST.EXE does not recognize it as "RECOVERY" anymore.

Additionally, a bit seems like being set in the MBR if, even once, the MBR is booted and the "Recovery" partition is not found. (to be more exact byte 1B4h changes from 01 to 00)

Of course by disassembling or reverse engineering the MBRINST.EXE it should be possible to find out which checks are made, and thus being able to re-create the conditions where MBRINST.EXE recognizes the partition, but this procedure is out of the scope of the thread/board. (at least as I see it)

On the other hand, no Law prohibits trying to find how the thing works. :)

Some notes:

There are several versions of the MBRINST.EXE file.

I was able to find/examine three of them:

  1. 147,456 bytes in size dated 30-09-2005
  2. 159,744 bytes in size dated 12-03-2008
  3. 165,248 bytes in size dated 16-10-2008

They are all the same thing, but with "added options".

#1 has 4 options for "While counting display":

  1. nothing
  2. Digit
  3. Dots
  4. Qplay

#2 has 7 options for "While counting display":

  1. nothing
  2. Digit
  3. Dots
  4. Qplay HP
  5. Qplay GW
  6. HP F11 NTFS
  7. HP F11 BITL

#3 has 8 options for "While counting display":

  1. nothing
  2. Digit
  3. Dots
  4. Qplay HP
  5. Qplay GW
  6. HP F11 NTFS
  7. HP F11 BITL
  8. HP F11 BL;QP

Now again my personal opinion:

  • the tool was initially programmed "properly" (in a version before the first one listed)
  • then it was "customized" and options were added to it (in the "wrong place", it simply makes no sense to have options in "While counting display"
  • in my opinion this is the result of lazy programmers that do quick and dirty hacks instead of doing properly something

The app contains a number of different MBR's and also a few bootsectors.

For the curious ones, I wrote a small batch that, using gsar and dumphex, can extract these sectors from the app and "divide" them in three categories:

  • MBR's
  • BS's
  • UNKNOWN's (most probably parts of a multisector MBR)

Here it is. :)

You will need in the same directory of the batch, besides MBRINST.EXE, gsar and dumphex:

gsar:

http://home.online.no/~tjaberg/

dumphex:

http://rbach.priv.at/DumpHex/


@ECHO OFF
SETLOCAL ENABLEEXTENSIONS
SETLOCAL ENABLEDELAYEDEXPANSION
CD "%~dp0"
IF "%~nx1"=="" GOTO :Nofile
ECHO All files in current directory with extension .sec and .dmp will be deleted.
ECHO to abort press Ctrl+C NOW!
PAUSE
Del *.sec
Del *.dmp
PAUSE
Set Source="%~dpnx1"
Set /A Counter=0
FOR /F "tokens=3 delims=:" %%A IN ('gsar -b -s:x00:x00:x55:xAA %Source% ^|FIND /V "found"') DO (
SET /A Counter=!Counter!+1
SET /A FoundOffset=%%A
SET /A Offset=!FoundOffset!-508
IF !Counter! lss 10 (SET Number=0!Counter!) ELSE (SET Number=!Counter!)
dsfo %Source% !Offset! 512 !Number!_!FoundOffset!.sec
)
Del *.dmp
FOR /F %%? IN ('DIR /B *.sec') DO (
ECHO %%?
CALL :Dorename %%?
CALL :Checktype !NewName!.sec
)
GOTO :EOF

:Dorename
FOR /F "tokens=2,3 delims=: " %%B IN ('dumphex -s1B6 /l2 /nc %1 2^>nul') DO (
SET NewName=%~n1_%%B%%C
REN %1 !NewName!.sec
)
GOTO :EOF

:CheckType
FOR /F "tokens=2,3 delims=: " %%D IN ('dumphex /l1 /nc %1 2^>nul') DO (
SET Type=UNKNOWN
IF /I %%D==33 SET Type=MBR
IF /I %%D==E9 SET Type=BS
SET NewerName=%~n1_!Type!
REN %1 !NewerName!.sec
dumphex /o!NewerName!.dmp !NewerName!.sec
)
GOTO :EOF

:Nofile
ECHO you must supply a target file!
ECHO example %~nx0 MBRINST.EXE
PAUSE
GOTO :EOF

Result will be a number of "couples" of files, named in the form:

(progressive number)_(Offset within_MBRINST.EXE)_(value of bytes 1B6h&1B7h)_(Type of sector).sec

(progressive number)_(Offset within_MBRINST.EXE)_(value of bytes 1B6h&1B7h)_(Type of sector).dmp

The .sec files are the binary sectors, the .dmp files are dumps, that you can open in Notepad or any tect editor.

Bytes at offset 1B6h&1B7h appear to be a way to "categorize the different MBR's.

Another interesting thing to do with the file is running BinText against it:

http://www.foundstone.com/us/resources/proddesc/bintext.htm

An interesting number of things can be found from reading the output, most noticeably the text description of the various MBR's (which is often truncated in the text box when running the tool):

0001D394 0041D394 0 unknown MBR

0001D3A0 0041D3A0 0 Special D*OEM MBR

0001D3B4 0041D3B4 0 MBR1STD (one sector, standard MBR, boot active partition)

0001D3F0 0041D3F0 0 MBR1STD

0001D3F8 0041D3F8 0 MBR1STH (one sector, force Stealth mode on "SMIMG ")

0001D430 0041D430 0 MBR1STH

0001D438 0041D438 0 MBR1sNSd (one sector, RP anywhere, dotted count)

0001D46C 0041D46C 0 MBR1sNGWQP: one sector, RP anywhere, Gateway, QuickPlay, quiet)

0001D4AC 0041D4AC 0 MBR1sNHPBLQP: one sec, RP any, HP F11, NTFS, QuickPlay, quiet, standard boot (BitLocker))

0001D508 0041D508 0 MBR1sNHPBL: one sector, RP anywhere, HP F11, NTFS, quiet, standard boot (BitLocker))

0001D560 0041D560 0 MBR1sNHPNT: one sector, RP anywhere, HP F11, NTFS, quiet)

0001D59C 0041D59C 0 MBR1sNHPQP: one sector, RP anywhere, HP, QuickPlay, quiet)

0001D5D8 0041D5D8 0 MBR1sNqC: one sector, RP anywhere, quiet count)

0001D608 0041D608 0 MBR1sNSq (one sector, RP anywhere, quiet)

0001D634 0041D634 0 MBR1sNS (one sector, RP anywhere, numbered count)

0001D668 0041D668 0 MBR1s0Bd (one sector, RP on start of disk, dotted count)

0001D6A4 0041D6A4 0 MBR1s0qC (one sector, RP on start of disk, quiet count)

0001D6DC 0041D6DC 0 MBR1s0Bq (one sector, RP on start of disk, quiet)

0001D710 0041D710 0 MBR1s0B (one sector, RP on start of disk, numbered count)

0001D74C 0041D74C 0 MBR1sIUd (one sector, RP in UP, dotted count)

0001D77C 0041D77C 0 MBR1sIqC (one sector, RP in UP, quiet count)

0001D7AC 0041D7AC 0 MBR1sIUq (one sector, RP in UP, quiet)

0001D7D4 0041D7D4 0 MBR1sIU (one sector, RP in UP, numbered count)

0001D804 0041D804 0 MBR8s (full featured eight sector MBR)

And some info about WHO actually wrote the tool:

0001DA00 0041DA00 0 MBRInst. Programmed for SoftThinks ©2001-2006,2008

...

00022148 00467148 0 XSS; Ulf Loesche

...

00022212 00467212 0 LegalCopyright

00022246 00467246 0 XSS 2001-2006,2007,2008

...

00022300 00467300 0 www.xss.com

0002231E 0046731E 0 ProductName

00022338 00467338 0 XSS Preinstall Environment MBR installation

Finding of other interesting strings is left to the reader.

I guess that people suffering from the problem may want to try contacting the author, Ulf Loesche through his site http://www.xss.com/ to either:

  • ask him for help in solving the matter
  • show him their appreciation for the program

A last bit of text in the .exe, that as I see describes the whole stuff very well ;):

0001DD90 0041DD90 0 ALLES GROSSE SCHEISSE!!!!

:P

jaclaz

0

Share this post


Link to post
Share on other sites

Of course, I did not understand anything from jaclaz's previous post AND I actually don't need to :thumbup

@Snack

After some little MBR experiments, my computer became unbootable. :realmad:

I did SUFFER to make it bootable again. [EDIT: Using something that I can't mention here!! -_- ]

However, I do not attend to participate in other MBR and boot sectors experiments....so if you are seeking more about MBRs and boot sectors and HP recovery partitions, you'll be on your own, sorry. :}

@ALL

THANKS AGAIN :hello:

Edited by ahmad2080
0

Share this post


Link to post
Share on other sites

Congratulations Ahmad2080! You just won a junior award from MSFN!

To wake up your Vista try to run a "Windows Vista Recovery Disc" (about 120Mb) it contain a starting part of vista instalation disk with Starup Repair option. http://www.neosmart.net/blog/2008/windows-...-disc-download/

Warning:

For lucky owners of HP PC's

If you are not in face with booting problem - use F11 or F8 option to repair your instalation.

Not even try to use above mentioned disc "Startup Repair" in that 100% legal utility from Microsoft to make some repair on HP computers because of those "advanced" HP software developers that don't take into account existence of any other soft (MS !!?) exept of theirs. You will lose the recovery F11 & F8 ability!!! :wacko:

I went no further than I was a week ago. However my experience grow up anyway.

Even with the disks created succesfully along with a "unbelievable" help from HP I am not able to perform factory restore.

It have to be healthy before creating restore disk!!! So the disks I made got wrong (they say).

What than is the purpose of restore partition? Get profits and save money on plastic disk?

* When I try to boot in D: (from advises I found across the web ) with a damaged BCD it hung or reboot.

* While booting from those DVD's by pressing ctrl + Backspace keys it displays a screen of unusefull options:

"Clear the partition table."

"Erase the Master Boot Record of drive."

"wipe all sectors of drive."

"write a DMI to drive1."

....

and goes boot Vista normally after any key was pressed :)

Solution:

The problem is missing boot.sdi file from directory SMINST\BOOTDISK\BOOT\ (in this directory must be two files: boot.sdi and a bcd). Files used by CD creator program to make a bootable image on DVD. Thats why the system should be healthy .

B) wise guys... B)

Edited by Snack
0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.