0

Do the first 512 bytes get executed whenever I insert the flash drive into any computer? If yes (which should be the case), then I suppose if I extract and disassemble the MBR and put in a reference that points to a memory location of a stored executable (on the flash drive), even that executable will be executed whenever its plugged in a computer..?

How could I do that? I mean, only by doing a simple call <address> won't do it.. I also wanna know more about MBRs of flash drives since they are different from those MBRs which bootstrap an Operating System. Googling for it doesn't show up anything useful at all..So I thought of asking the community, if anybody has done something like this before.

nobody
  • 19,814
  • 17
  • 56
  • 77
Rushil Paul
  • 2,010
  • 4
  • 26
  • 39
  • 3
    No, the MBR does not get executed on insertion. – Pascal Cuoq Sep 05 '11 at 20:54
  • Then how does the computer know which driver to load and the label and other things..something must get read in order for that to happen.. – Rushil Paul Sep 05 '11 at 20:57
  • 1
    The driver is already in the OS. The label is partition scheme-/filesystem- specific and certainly does not require executing anything. http://en.wikipedia.org/wiki/USB_mass-storage_device_class – Pascal Cuoq Sep 05 '11 at 20:58
  • that din't answer my question, anyway, what is the purpose of MBR for a flash drive then? – Rushil Paul Sep 05 '11 at 21:04
  • 3
    Your question is "Does the first sector (MBR) of a flash drive get executed on insertion into a computer?" and the answer is "No". The MBR may be executed when the computer boots, assuming that is has been configured to do so in firmware. – Pascal Cuoq Sep 05 '11 at 21:06
  • Presumably, an external drive's MBR is used when booting off that drive. – Michael Petrotta Sep 05 '11 at 21:07

1 Answers1

2
  1. No
  2. There's an "autorun" feature in some Operating Systems, which is deprecated.

Flash drives are based on layers of legacy technology, to avoid the need for drivers.
At the lowest level, there are USB packets (see the Mass Storage Device spec, as per Pascal Cuoq)
Each of the USB transactions is a SCSI command/response pair.
The OS treats the flash drive as a SCSI disk (you'll see /dev/sdX in Linux, for example).

Since the flash drive appears to be a normal SCSI disk, it usually has a MBR/partition table. However, most operating systems support a "superfloppy" mode, in which case the disk starts with the FAT bootsector. Some smaller flash drives, or those formatted with legacy utilities, might be in that configuration.

You can example the flash drive MBR on windows with the DSKPROBE utility from Microsoft (Use the PhysicalDrive option), or with 'dd.exe' using .\PhysicalDriveX (where X is a number ..typically 2, based on how many hard drives you have)

On properly configured computers, there is no way to execute code when a device is plugged in.
Even when 'autorun' capability was default-on, you needed to use a device which appeared to be a CDROM.
(The SCSI command-set allows a device to say whether it's a CD or HD, and the flash-drive firmware can easily lie)

nobody
  • 19,814
  • 17
  • 56
  • 77
Michael Rho
  • 311
  • 1
  • 2
  • Is it possible to make my USB flash drive send customized packets? – Rushil Paul Sep 06 '11 at 19:41
  • USB is "host/target", the flash drive can only respond. The flash drive firmware can respond with anything, and you can replace the firmware on some devices if you want to be creative. Usually each flash-drive controller has special SCSI commands (non-standard), and some controllers will accept USB packets that aren't included in the specification. What would you like your flash drive to do? – Michael Rho Sep 07 '11 at 01:14