Extracting the boot image from a CD/DVD (El Torito)

• Download project with source - 78.2 Kb

Introduction

If you need to extract a boot-image from a CD/DVD (El Torito) you can simply use this program. It only uses Win32-calls like CreateFile and ReadFile. There is no usage of ASPI-interface or other native stuff.

Background

To access the raw CD/DVD image, you can simply use the CreateFile API and specify the drive-letter as filename. This opens the drive with access to the sectors. Now, you can read the native image and also extract the boot-image if you read the "El Torito" Bootable CD-ROM Format Specification.

Using the application

The usage of the program is simple. You only need to pass the drive-letter of the CD-ROM/DVD to the program. Alternatively, you can pass a filename to an ISO-image. Here is an example of the usage, if your CD-ROM/DVD-drive is F: then:

BootExtract f:

This will store the boot-image in the current directory with the name Drive-f.NoEmulation__Segment-0000__SecCount-4.bin. The filename always contains the following elements (which can be used to write this boot-image with a burning-program like Nero):

• Drive-f: Specifies either the drive-letter of the CD/DVD-ROM or the ISO-filename.
• NoEmulation: The mode which is used by this boot-image. The possible modes are:
  • NoEmulation
  • 1.2MegDisk
  • 1.44MegDisk
  • 2.88MegDisk
• Segment-xxxx: The segment which will be stored in the initial-entry for this boot-image (normally 0000 or 7C00).
• SecCount-y: The number of virtual sectors (512 bytes) used for this boot-image.

The complete usage-description is here:

CD/DVD-BootImage-Extractor v1.0 (c) Jochen Kalmbach
http://blog.kalmbachnet.de/

Usage:
  BootExtract [switches] <source>

  source: The source file (*.iso) or CD/DVD-drive to extract images from

  switches: -b   Also extract bootrecord and bootcatalog

Examples:
  BootExtract z:

Points of interest

Location of the boot-image

If you have sector-access to the CD/DVD, you can simple follow the "El Torito" Bootable CD-ROM Format Specification to read the boot-image. The following defines need to be known (which are stated in the spec):

• CD-sector-size: 0x800 bytes.
• Virtual-sector-size: 0x200 bytes.
• Sector-number of the boot-record-volume: 0x11.

Now, you can read the initial/default boot-image if you do the following:

1. Read the boot-record-volume (sector 0x11) and check for validity.
2. Extract the sector-number from the boot-record-volume which contains the boot-catalog (DWORD at byte-offset 0x47).
3. Read the boot-catalog (from the above extracted sector number) and check for validity.
4. Extract the boot-information from the Initial/Default-Entry in the boot-catalog (starting at byte-offset 0x20 in the boot-catalog).
5. Extract the starting-sector (DWORD relative byte-offset 0x8) and the virtual-sector-count (WORD at relative byte-offset 0x6) for the boot-image from this entry and read the boot-image.

For a detailed info, you can either read the "El Torito" Bootable CD-ROM Format Specification or take a look at the source code.

History

• 2005-08-04
  • First public release.
• 2006-01-05
  • Fixed a bug, now it is able to correctly read 1.2/1.44 and 2.88 MB boot images.