2

I was trying to override the MBR of my hard drive with an image. I wrote a C# program to do just that, and it worked, but it doesn't allow me to override more than ~104KB of the hard drive. The important data on this image was smaller that that, so everything got copied over successfully, but it still makes no sense to me. If Windows allows me to override the Master Boot Record with whatever I want, why does it not allow me to override more than 104KB? I'm testing it on Windows 10(installed in legacy BIOS mode on VirtualBox).

Here is the code I used

private const uint GenericAll = 0x10000000;
private const uint FileShareRead = 0x1;
private const uint FileShareWrite = 0x2;
private const uint OpenExisting = 0x3;        

public static void OverrideMBR()
        {

            var mbr = CreateFile(
                "\\\\.\\PhysicalDrive0",
                GenericAll,
                FileShareRead | FileShareWrite,
                IntPtr.Zero,
                OpenExisting,
                0,
                IntPtr.Zero);

            if (mbr == (IntPtr)(-0x1))
            {
                Console.WriteLine("Fail: Please run this as an administrator");
                return false;
            }
            uint filesize = 0150000u;
            uint sizeRemaining = filesize;
            byte[] imageFile = new byte[filesize];
            /*Here is the image definition*/
            uint overriden = 0;
            while (sizeRemaining > 0)
            {
                uint towrite = 512;
                if (WriteFile(
                mbr,
                imageFile,
                towrite,
                out uint lpNumberOfBytesWritten,
                IntPtr.Zero))
                {
                    Console.WriteLine("Successfully written 512 bytes");
                }
                else
                {
                    Console.WriteLine("Failed to write 512 bytes. Successfully overriden {0} bytes.", overriden);
                    return;
                }
                sizeRemaining -= lpNumberOfBytesWritten;
                overriden += lpNumberOfBytesWritten;

                byte[] dst = new byte[imageFile.Length - (int)lpNumberOfBytesWritten];
                Array.Copy(imageFile, lpNumberOfBytesWritten, dst, 0, dst.Length);
                imageFile = dst;
            }
            Console.WriteLine("DONE!");
            return;
        }
    }
Xyz
  • 212
  • 2
  • 9
  • I don't completely understand what you are trying to do. As far as I know MBRs are only 512 bytes. THATS IT! Unless I missed something.. [Wikipedia](https://en.wikipedia.org/wiki/Master_boot_record) just verified this for me. – Señor CMasMas Mar 03 '20 at 16:18
  • Yes. You're right. I meant to say, I meant to say, I was trying to override the MBR(first sector on the drive), and everything after it. My code does just that. It first overrides the MBR with the first 512 bytes of the image, and then overrides the next 512 bytes of the hard drive with the next 512 bytes of the image, etc.. – Xyz Mar 03 '20 at 16:31
  • What's the point of writing 512 bytes, copying the remainder of the image to a new array, then rinsing and repeating? Why not just write everything in one go? – dumetrulo Mar 04 '20 at 13:21
  • I tried that, and the function WriteFile allows me to only write 512 bytes in one go, otherwise it just fails. – Xyz Mar 05 '20 at 11:40
  • Have you tried a memory-mapped file with a view stream? Haven't got around to testing it myself yet but google ``MemoryMappedFile.CreateViewStream`` which should get you started. – dumetrulo Mar 13 '20 at 10:36

0 Answers0