Extracting the boot image from a CD/DVD (El Torito)

• Download project with source - 78.2 Kb

Introduction

If you need to extract a boot-image from a CD/DVD (El Torito) you can simply use this program. It only uses Win32-calls like CreateFile and ReadFile. There is no usage of ASPI-interface or other native stuff.

Background

To access the raw CD/DVD image, you can simply use the CreateFile API and specify the drive-letter as filename. This opens the drive with access to the sectors. Now, you can read the native image and also extract the boot-image if you read the "El Torito" Bootable CD-ROM Format Specification.

Using the application

The usage of the program is simple. You only need to pass the drive-letter of the CD-ROM/DVD to the program. Alternatively, you can pass a filename to an ISO-image. Here is an example of the usage, if your CD-ROM/DVD-drive is F: then:

BootExtract f:

This will store the boot-image in the current directory with the name Drive-f.NoEmulation__Segment-0000__SecCount-4.bin. The filename always contains the following elements (which can be used to write this boot-image with a burning-program like Nero):

• Drive-f: Specifies either the drive-letter of the CD/DVD-ROM or the ISO-filename.
• NoEmulation: The mode which is used by this boot-image. The possible modes are:
  • NoEmulation
  • 1.2MegDisk
  • 1.44MegDisk
  • 2.88MegDisk
• Segment-xxxx: The segment which will be stored in the initial-entry for this boot-image (normally 0000 or 7C00).
• SecCount-y: The number of virtual sectors (512 bytes) used for this boot-image.

The complete usage-description is here:

CD/DVD-BootImage-Extractor v1.0 (c) Jochen Kalmbach
http://blog.kalmbachnet.de/

Usage:
  BootExtract [switches] <source>

  source: The source file (*.iso) or CD/DVD-drive to extract images from

  switches: -b   Also extract bootrecord and bootcatalog

Examples:
  BootExtract z:

Points of interest

Location of the boot-image

If you have sector-access to the CD/DVD, you can simple follow the "El Torito" Bootable CD-ROM Format Specification to read the boot-image. The following defines need to be known (which are stated in the spec):

• CD-sector-size: 0x800 bytes.
• Virtual-sector-size: 0x200 bytes.
• Sector-number of the boot-record-volume: 0x11.

Now, you can read the initial/default boot-image if you do the following:

1. Read the boot-record-volume (sector 0x11) and check for validity.
2. Extract the sector-number from the boot-record-volume which contains the boot-catalog (DWORD at byte-offset 0x47).
3. Read the boot-catalog (from the above extracted sector number) and check for validity.
4. Extract the boot-information from the Initial/Default-Entry in the boot-catalog (starting at byte-offset 0x20 in the boot-catalog).
5. Extract the starting-sector (DWORD relative byte-offset 0x8) and the virtual-sector-count (WORD at relative byte-offset 0x6) for the boot-image from this entry and read the boot-image.

For a detailed info, you can either read the "El Torito" Bootable CD-ROM Format Specification or take a look at the source code.

History

• 2005-08-04
  • First public release.
• 2006-01-05
  • Fixed a bug, now it is able to correctly read 1.2/1.44 and 2.88 MB boot images.

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here