Modifying the MBR of Windows

Question

I need to modify the MBR of Windows, and I would really like to do this from Windows.

Here are my questions. I know that I can get a handle on a physical device with

Answer 1

Maybe a PXE boot scenario could help you? Simply boot on your crafted PXE image which modify the hardware registers you need to modify, and then return the control to the Master Boot Record or to the active partition's boot record.

This way you don't have to modify the boot records.

Answer 2

Modifying the bootloader is bad, bad idea. Here are just a few of the possible gotcha's:

• it will potentially kill full disk encryption products (Truecrypt, PGP, Vista's BitLocker, etc)
• it will potentially trip up AV products (scaring users)
• it will potentially kill complicated booting scenarios (chained boot loaders, etc)
• it will kill off the chain of trust when using the TPM module (because it checks the MBR for change before executing it)
• direct disk access is not allowed starting from Vista (only using drivers)

Alternatives (like modifying the hardware register during the Windows bootup via a driver which is set to load at boot time or after Windows has booted) should really be considered. If the modification is as simple as writing to a port, ie:

OUT AX, BL

then drivers exists for all versions of Window which can do this (reading/writing a value from/to a certain port) which can be called from user mode.

Answer 3

Once the OS is started the MBR is typically protected for virus reasons - this is one of the oldest virus tricks in the books - goes back to passing viruses from floppy to floppy.

Even if it wasn't restricted, you have to write low level code - it isn't part of the file system, but exists on a specific location on the hard drive.

Due to that, you pretty much are restricted to writing low level (most programs implement this in assembly) or C code targeting 16 bit DOS.

Most of these programs use the BIOS interface (13h, I believe) to access the sectors of the disk directly. You can access these in C using some inline assembly, or compiler provided interfaces. You will generally not get access to BIOS without the cooperation of the OS, though, so your program, again, will be restricted to DOS. If you can access these you're almost home free - the nice thing about BIOS is you don't have to worry about what type of HD is in the system - even RAID cards often insert themselves into the BIOS routines so they can be accessed without knowing where in memory the ATA or SATA controller is, and executing commands on that low level.

If you absolutely must access it within an OS, though, you pretty much have to write a device driver to access the BIOS or the memory space where the HD controllers exist. I wouldn't recommend it, though, as this is very tricky to deal with - modern computers put the HD controllers in different spots in memory, with different IRQs, and each chipset has become a little more esoteric because they can provide a minimum interface to bios for bootup, and then a specific driver for Windows. They skip all the other interface niceties that would be considered compatible with other controllers because it's more expensive to be compatible.

You may find that at the driver level inside windows you'll have methods for accessing the drive sectors directly (or pseudo directly), but again, they are likely very well protected due to the aforementioned virus issues.

Good luck!