[syslinux] Structure of VBR in FAT32?

[Gene Cumm]

On Tue, Jan 2, 2018 at 1:03 PM, Avi Deitcher <avi at deitcher.net> wrote:
> Thanks for the response, Gene. Much appreciated. I didn't get all of it;
> mind if I follow on below?
>
>> ldlinux.sys is ldlinux.bin without the VBR (Volume Boot Record) code.
>
> Makes sense.
>
>> > 1. Where is the code that goes in the VBR or Block Group 0 padding?
>>
>> diskboot.inc.
>
> which appears to be included in diskstart.inc. I will have to dig in and see
> how this all gets compiled (pointers always appreciated :-) ).

Yes.

> An install on Linux (before I run "syslinux --install") actually doesn't
> have ldlinux.sys or ldlinux.bin anywhere. Are they embedded into the
> syslinux binary and it installs bytes, vs copying from the local filesystem?

As Ady said, embedded within the syslinux/extlinux installer.

>> > 2. What does it execute? Does it just find the ldlinux.sys and execute
>> > it?
>>
>> Set up the basic environment, load blocks of ldlinux.sys, check
>> integrity (weakly but works well enough) and jump to a further point.

Actually, mildly more complex but similar.  Setup some basics, the
first sector of ldlinux.sys, execute it.

The first sector of ldlinux.sys sets up some more stuff, loads the
rest of ldlinux.sys, checks integrity then continues.

>> The installer patches in a block map of ldlinux.sys into the VBR plus
>> ldlinux.sys.

Actually, only the first sector of ldlinux.sys, computed after
ldlinux.sys is copied and patched into the VBR by the installer.  The
block map is in ldlinux.sys.

>> At least one record stating N sectors at volume offset M
>> needs to live in the VBR.  Often, only 1 record is needed.
>
> I didn't get this part. Record?

It's more of a list.  The list has rows or records.  Each record
indicates data about a block of the file ldlinux.sys.  This data is in
fields for offset sector number of start and how many sectors are
within the block.

>> > 3. How does it know to find the ldlinux.sys (and, at the least,
>> > ldlinux.c32) if it cannot read the filesystem? Does syslinux --install
>> > copy
>> > them over and then read the filesystem to know precisely what blocks
>> > they
>> > are in and then embed the precise block number in the VBR? Where? And if
>> > so, does it not leave it vulnerable to the files being moved around?
>>
>> Files moving from directories shouldn't be an issue (unless it's a
>> copy/delete).  It certainly is vulnerable to moving the underlying
>> blocks hence why ldlinux.sys resides in the special reserved space in
>> btrfs.
>
> But wouldn't work in FAT32 (VBR = 512 bytes) or ext4 (1024 bytes in Block
> Group 0).
>
> Thanks again for the explanation.
> Avi

Correct, this technique of storing the entire boot loader in reserved
space wouldn't work there.

-- 
-Gene