PDA

View Full Version : Let's try this from another angle...



unitron
05-08-2010, 12:09 AM
What's in the first 512 bytes on a Tivo drive?

What's in the second 512 bytes?

Are the partitions necessarily on the disk in the order in which pdisk numbers them, i.e., 2 comes right after 1, 3 comes right after 2, etc.?

Are there some utilities/programs that start counting the partitions at 0 instead of 1, or ignore the partition map and call the partition after that 1 instead of 2?


(and on a slight tangent, any hex editor recommendations, other than "don't"? In other words, which program?)

Thanks in advance to any who respond for your informative and thought-provoking replies.

mike_s
05-08-2010, 06:09 AM
1. TiVo specific, starts with signature 0x1492, also contains boot params.
2. The Apple Partition Map (http://developer.apple.com/legacy/mac/library/documentation/mac/Devices/Devices-121.html#MARKER-2-27)
3. No, although AFAIK they always are from the factory.
4. No. Other than very low level utils, like pdisk, access should always be through the OS driver (i.e. /dev/hdx ), not through manual interpretation of the partition map.

Jamie
05-08-2010, 09:03 AM
...
3. No, although AFAIK they always are from the factory.
...Actually, they aren't. A factory drive normally has one media partition (11 or 13) at the start of the disk and the other at the end of the disk, with all the other partitions in the middle. This is also what mfstools will likely do if you "optimize" the partition layout with -p.

4. No. Other than very low level utils, like pdisk, access should always be through the OS driver (i.e. /dev/hdx ), not through manual interpretation of the partition map.mfstools and mfs-utils both are capable of reading raw disks without needing the kernel to interpret the partition map. This is useful if you have a kernel without support for the tivo bootpage variant of APM or with byteswapped disks.

As mike_s suggested, look at the first two bytes in block zero and see if they are 0x1492 or 0x9214. That will tell you if you have a byte swapped disk.
If you don't see either of these, then it sounds like it either isn't a tivo disk, or the bootpage is messed up.

As to a hexeditor: hexedit for linux is a basic hex editor, e.g. the vi equivalent for hex editing. If you want a flashy gui, I've heard people praise ultraedit. hexdump -C is good for just browsing through binary data.

Here's a hexdump of the first two blocks from one of my working S2 tivos:

bash-2.02# hexdump -C -n 1024 /dev/hda
00000000 14 92 06 03 72 6f 6f 74 3d 2f 64 65 76 2f 68 64 |....root=/dev/hd|
00000010 61 37 20 64 73 73 63 6f 6e 3d 74 72 75 65 20 63 |a7 dsscon=true c|
00000020 6f 6e 73 6f 6c 65 3d 30 2c 31 31 35 32 30 30 20 |onsole=0,115200 |
00000030 75 70 67 72 61 64 65 73 6f 66 74 77 61 72 65 3d |upgradesoftware=|
00000040 66 61 6c 73 65 00 00 00 00 00 00 00 00 00 00 00 |false...........|
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000080 00 00 00 00 75 6e 6e 61 6d 65 64 00 00 00 00 00 |....unnamed.....|
00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000000a0 00 00 00 00 0a 6e 00 85 01 7a dc 72 7e 4d 3c 00 |.....n...z.r~M<.|
000000b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200 50 4d 00 00 00 00 00 10 00 00 00 01 00 00 00 3f |PM.............?|
00000210 41 70 70 6c 65 00 00 00 00 00 00 00 00 00 00 00 |Apple...........|
00000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000230 41 70 70 6c 65 5f 70 61 72 74 69 74 69 6f 6e 5f |Apple_partition_|
00000240 6d 61 70 00 00 00 00 00 00 00 00 00 00 00 00 00 |map.............|
00000250 00 00 00 00 00 00 00 3f 00 00 00 33 00 00 00 00 |.......?...3....|
00000260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000400

unitron
05-10-2010, 02:44 AM
...
Are there some utilities/programs that start counting the partitions at 0 instead of 1, or ignore the partition map and call the partition after that 1 instead of 2?...


The "Partition Check" which occurs during the boot sequence of the Jenkins cd lists the Apple Partition Map, but assigns it no number and begins at 1 with "Bootstrap 1".


P.S. Thanks as always to mike_s and Jamie!