Position of next stage unclear

[Marek Jawurek]

Hi everyone,

I looked for a long time on several sources of information regarding my problem 
(google, grub sourcecode) but could not make heads and tails of my results. I 
have the dump of a MBR where Grub stage 1 is installed. I want to know where 
this stage1 refers to stage1_5 to load the kernel of a ext2 filesystem.
I found out that the offset in the MBR is 0x44 which I can verify on one linux 
system (grub 0.97) where stage1_5 lies in the second sector of the disk. The 
dump from this system's MBR is:

00000000  eb 48 90 10 8e d0 bc 00  b0 b8 00 00 8e d8 8e c0  |.H..............|
00000010  fb be 00 7c bf 00 06 b9  00 02 f3 a4 ea 21 06 00  |...|.........!..|
00000020  00 be be 07 38 04 75 0b  83 c6 10 81 fe fe 07 75  |....8.u........u|
00000030  f3 eb 16 b4 02 b0 01 bb  00 7c b2 80 8a 74 03 02  |.........|...t..|
00000040  ff 00 00 20 01 00 00 00  00 02 fa 90 90 f6 c2 80  |... ............|
00000050  75 02 b2 80 ea 59 7c 00  00 31 c0 8e d8 8e d0 bc  |u....Y|..1......|
00000060  00 20 fb a0 40 7c 3c ff  74 02 88 c2 52 be 81 7d  |. ..@|<.t...R..}|
00000070  e8 36 01 f6 c2 80 74 56  b4 41 bb aa 55 cd 13 5a  |.6....tV.A..U..Z|
00000080  52 72 4b 81 fb 55 aa 75  45 a0 41 7c 84 c0 78 3e  |RrK..U.uE.A|..x>|
00000090  75 05 83 e1 01 74 37 66  8b 4c 10 be 05 7c c6 44  |u....t7f.L...|.D|
000000a0  ff 01 66 8b 1e 44 7c c7  04 10 00 c7 44 02 01 00  |..f..D|.....D...|
000000b0  66 89 5c 08 c7 44 06 00  70 66 31 c0 89 44 04 66  |f.\..D..pf1..D.f|
000000c0  89 44 0c b4 42 cd 13 72  05 bb 00 70 eb 7d b4 08  |.D..B..r...p.}..|
000000d0  cd 13 73 0a f6 c2 80 0f  84 e8 00 e9 8d 00 be 05  |..s.............|
000000e0  7c c6 44 ff 00 66 31 c0  88 f0 40 66 89 44 04 31  ||address@hidden|
000000f0  d2 88 ca c1 e2 02 88 e8  88 f4 40 89 44 08 31 c0  |address@hidden|
00000100  88 d0 c0 e8 02 66 89 04  66 a1 44 7c 66 31 d2 66  |.....f..f.D|f1.f|
00000110  f7 34 88 54 0a 66 31 d2  66 f7 74 04 88 54 0b 89  |.4.T.f1.f.t..T..|
00000120  44 0c 3b 44 08 7d 3c 8a  54 0d c0 e2 06 8a 4c 0a  |D.;D.}<.T.....L.|
00000130  fe c1 08 d1 8a 6c 0c 5a  8a 74 0b bb 00 70 8e c3  |.....l.Z.t...p..|
00000140  31 db b8 01 02 cd 13 72  2a 8c c3 8e 06 48 7c 60  |1......r*....H|`|
00000150  1e b9 00 01 8e db 31 f6  31 ff fc f3 a5 1f 61 ff  |......1.1.....a.|
00000160  26 42 7c be 87 7d e8 40  00 eb 0e be 8c 7d e8 38  |&B|address@hidden|
00000170  00 eb 06 be 96 7d e8 30  00 be 9b 7d e8 2a 00 eb  |.....}.0...}.*..|
00000180  fe 47 52 55 42 20 00 47  65 6f 6d 00 48 61 72 64  |.GRUB .Geom.Hard|
00000190  20 44 69 73 6b 00 52 65  61 64 00 20 45 72 72 6f  | Disk.Read. Erro|
000001a0  72 00 bb 01 00 b4 0e cd  10 ac 3c 00 75 f4 c3 00  |r.........<.u...|
000001b0  00 00 00 00 00 00 00 00  59 96 06 00 00 00 80 01  |........Y.......|
000001c0  01 00 83 fe ff e0 3f 00  00 00 62 6a f3 00 00 00  |......?...bj....|
000001d0  c1 e1 05 fe ff ff a1 6a  f3 00 73 80 0c 00 00 00  |.......j..s.....|
000001e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 aa  |..............U.|
00000200


At position 0x44 it says 01 00 00 00 which stands for the second sector. At the 
second sector I found the stage1_5:

00000200  52 56 be 03 21 e8 2a 01  5e bf f8 21 66 8b 2d 83  |RV..!.*.^..!f.-.|
00000210  7d 04 00 0f 84 ca 00 80  7c ff 00 74 3e 66 8b 1d  |}.......|..t>f..|
00000220  66 31 c0 b0 7f 39 45 04  7f 03 8b 45 04 29 45 04  |f1...9E....E.)E.|
00000230  66 01 05 c7 04 10 00 89  44 02 66 89 5c 08 c7 44  |f.......D.f.\..D|
00000240  06 00 70 50 66 31 c0 89  44 04 66 89 44 0c b4 42  |..pPf1..D.f.D..B|
00000250  cd 13 0f 82 9f 00 bb 00  70 eb 56 66 8b 05 66 31  |........p.Vf..f1|
00000260  d2 66 f7 34 88 54 0a 66  31 d2 66 f7 74 04 88 54  |.f.4.T.f1.f.t..T|
00000270  0b 89 44 0c 3b 44 08 7d  74 8b 04 2a 44 0a 39 45  |..D.;D.}t..*D.9E|
00000280  04 7f 03 8b 45 04 29 45  04 66 01 05 8a 54 0d c0  |....E.)E.f...T..|
00000290  e2 06 8a 4c 0a fe c1 08  d1 8a 6c 0c 5a 52 8a 74  |...L......l.ZR.t|
000002a0  0b 50 bb 00 70 8e c3 31  db b4 02 cd 13 72 46 8c  |.P..p..1.....rF.|
000002b0  c3 8e 45 06 58 c1 e0 05  01 45 06 60 1e c1 e0 04  |..E.X....E.`....|
000002c0  89 c1 31 ff 31 f6 8e db  fc f3 a4 1f be 14 21 e8  |..1.1.........!.|
000002d0  60 00 61 83 7d 04 00 0f  85 3c ff 83 ef 08 e9 2e  |`.a.}....<......|
000002e0  ff be 16 21 e8 4b 00 5a  ea 00 22 00 00 be 19 21  |...!.K.Z.."....!|
000002f0  e8 3f 00 eb 06 be 1e 21  e8 37 00 be 23 21 e8 31  |.?.....!.7..#!.1|
00000300  00 eb fe 4c 6f 61 64 69  6e 67 20 73 74 61 67 65  |...Loading stage|
00000310  31 2e 35 00 2e 00 0d 0a  00 47 65 6f 6d 00 52 65  |1.5......Geom.Re|
00000320  61 64 00 20 45 72 72 6f  72 00 bb 01 00 b4 0e cd  |ad. Error.......|
00000330  10 46 8a 04 3c 00 75 f2  c3 00 00 00 00 00 00 00  |.F..<.u.........|
00000340  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000003f0  00 00 00 00 00 00 00 00  02 00 00 00 0e 00 20 02  |.............. .|
00000400


Now my problem with the other system at hand. It is a SUSE 10.3 linux 
installation with grub 0.97 as boot loader. Its MBR looks like this:

00000000  31 c0 8e d0 bc 00 7c 8e  c0 8e d8 bf 1e 06 be 1e  |1.....|.........|
00000010  7c 50 57 b9 e2 01 f3 a4  b9 00 02 f3 ab cb 80 fa  ||PW.............|
00000020  8f 7e 02 b2 80 52 52 bb  94 07 8d af 2a 00 8a 46  |.~...RR.....*..F|
00000030  04 66 8b 7e 08 66 03 3e  b3 06 84 c0 74 0b 80 7e  |.f.~.f.>....t..~|
00000040  00 80 75 05 66 89 3e 84  0b 83 c5 10 83 c3 09 80  |..u.f.>.........|
00000050  fb b8 75 da b8 e1 00 c1  e0 02 89 c6 66 8b ac 00  |..u.........f...|
00000060  08 66 85 ed 75 19 b8 c5  06 be bb 06 e8 a5 00 89  |.f..u...........|
00000070  c6 e8 9a 00 5a 31 c0 cd  13 cd 18 fb f4 eb fc 66  |....Z1.........f|
00000080  89 2e b3 06 be ab 06 b4  42 5a 52 cd 13 b8 d9 06  |........BZR.....|
00000090  72 d7 a0 00 7c 84 c0 74  03 a1 fe 7d 3d 55 aa b8  |r...|..t...}=U..|
000000a0  e9 06 75 c5 66 89 ee 5a  e9 55 75 10 00 01 00 00  |..u.f..Z.Uu.....|
000000b0  7c 00 00 00 00 00 00 00  00 00 00 45 72 72 6f 72  ||..........Error|
000000c0  20 00 0d 0a 00 4e 6f 20  61 63 74 69 76 65 20 70  | ....No active p|
000000d0  61 72 74 69 74 69 6f 6e  00 44 69 73 6b 20 72 65  |artition.Disk re|
000000e0  61 64 20 65 72 72 6f 72  00 4e 6f 20 6f 70 65 72  |ad error.No oper|
000000f0  61 74 69 6e 67 20 73 79  73 74 65 6d 00 49 6e 76  |ating system.Inv|
00000100  61 6c 69 64 20 43 48 53  20 72 65 61 64 00 e8 03  |alid CHS read...|
00000110  00 be c2 06 60 ac b4 0e  bb 01 00 cd 10 ac 84 c0  |....`...........|
00000120  75 f4 61 c3 00 00 00 00  00 00 00 00 00 00 00 00  |u.a.............|
00000130  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000190  1c 80 b6 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001b0  00 00 00 00 00 00 00 00  5d 23 0b 00 e1 b5 00 01  |........]#......|
000001c0  01 00 82 fe 3f 82 3f 00  00 00 84 1c 20 00 80 00  |....?.?..... ...|
000001d0  01 83 83 fe ff ff c3 1c  20 00 16 c9 1f 01 00 00  |........ .......|
000001e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 aa  |..............U.|
00000200  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Here at position 0x44 it says 84 3e 89 66 which in direct LBA addressing would 
point to a sector beyond the size of the disk. Am I right in the assumption 
that 4 bytes are used? This is what I gathered from stage1.S in the grub 
sources. 

Where will I find stage1_5 on this system? 

I appreciate your help.

Marek

-- 
Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: 
http://www.gmx.net/de/go/multimessenger