Getting an image
Type the command mount to verify the location of the /boot file system.
The /boot file system of a Raspberry Pi is formatted as a FAT16 file system. It’s a small file system so we’re just going to make a copy of it. This is the only time, we’ll need to use the sudo command.
…$ sudo dd if=/dev/mmcblk0p1 of=/tmp/boot.img bs=1M
We’ve stored the image of /boot into the file boot.img The file boot.img should be about the same size as the /boot file system. Use df to verify this.
Change the ownership of /tmp/boot.img so you won’t have to sudo any longer. Also, make it read-only, so you won’t accidently overwrite it.
The reference
Download a copy of the Microsoft EFI FAT32 File System Specification. It is the only reference we will use.
The specification is in MS Word format. You will have to accept a license agreement.
The BPB and its fields
Read pages 7 and 8 which talks about the BPB (BIOS Parameter Block), which is contained in the first 512 bytes of the file system image. Use the dd command to copy those first 512 bytes into a file called boot.BPB.img.
…$ dd if=boot.img of=boot.BPB.img bs=512 count=1
1+0 records in
1+0 records out
512 bytes (512 B) copied, 0.00834778 s, 61.3 kB/s
Take a look at the contents of the BPB.
…$ od boot.BPB.img …$ od -c boot.BPB.img …$ od -t a -N 100 -t d2 boot.BPB.img
The BPB contains many fields that specify the layout of the file system. We are going to get copies of the ones we will need in our task. We will use od to get these fields and assign them to shell variables. We are using the variable name of the Microsoft specification.
This is going to be tedious.
Bytes per sector
Sectors are the smallest unit of disk allocation.
…$ od -A d -j 11 -N 2 -t d2 boot.BPB.img 0000011 512 0000013 …$ BPB_BytsPerSec=512
I am using the variable names of the Microsoft document.
Also, it might be a lot easier just to start up an interactive session of Python to do this arithmetic.
Sectors per cluster
However, files are allocated in clusters. Sectors are just too small for efficient file allocation.
…$ od -A d -j 13 -N 1 -t d1 boot.BPB.img 0000013 16 0000014 …$ BPB_SecPerClus=16
Number of reserved sectors
This is the number of sectors reserved for BPB and, presumably, other stuff. The Microsoft specification states that it should “never be anything other than 1” for a FAT16 file system.
…$ od -A d -j 14 -N 2 -t d2 boot.BPB.img 0000014 1 0000016 …$ BPB_RsvdSecCnt=1
Number of FATs
The FAT file system is named after the File Allocation Table which tells you the clusters where files and directories are stored. There ought to be only two of these.
…$ od -A d -j 16 -N 1 -t d1 boot.BPB.img 0000016 2 0000017 …$ BPB_NumFATs=2
Root directory entry count
This is a count of the number of root directory entries for FAT12 and FAT16 file systems. Each of these entries is 32-bytes long. Expect to find 512 entries.
…$ od -A d -j 17 -N 2 -t d2 boot.BPB.img 0000017 512 0000019 …$ BPB_RootEntCnt=512
Total sectors
This one can be tricky because the number of sectors may by larger than the maximum number (65535 or 216-1) that can be stored in 16 bits. If the 16-bit field stored at offset 19 is 0, you must look at the 32-bit field stored at offset 32.
…$ od -A d -j 19 -N 2 -t d2 boot.BPB.img 0000019 0 0000021 …$ BPB_TotSec16=0 …$ od -A d -j 32 -N 4 -t d4 boot.BPB.img 0000032 114688 0000036 …$ BPB_TotSec32=114688 …$ TotSec=$BPB_TotSec32 …$ echo $TotSec 114688
Sanity check
If you multipy the number of sectors by the number of bytes per sectors, you will find out the size of the file system. The ought to be the same size as the file system image. It certainly can’t be bigger.
…$ echo $(( $TotSec * $BPB_BytsPerSec )) 58720256 …$ ls -l boot.img -rw-r--r-- 1 root root 58720256 Mar 24 09:17 boot.img
Isn’t arithmetic a bash in this shell! In any case, that one looks good.
What kind of FAT
We’ve made it to pages 13 & 14 of the specification where we can take our first look at the File Allocation Table or FAT.
However, we better first figure out where the data sectors really are located. That requires knowing the sizes of the root directory (for FAT16) and FAT structures.
Number of root directory sectors
In a FAT12 or FAT16 file system, a number of sectors are allocated for the root directory. You’ll have to do some arithmetic to figure out how many.
…$ RootDirSectors=$(( ( ( $BPB_RootEntCnt * 32 ) + ( $BPB_BytsPerSec - 1 ) ) / $BPB_BytsPerSec )) …$ echo $RootDirSectors 32
If you perform this calculation for a FAT32 system, it will always assign 0 because BPB_RootEnCnt is 0.
Number of FAT sectors
We have to read some more BPB fields to determine the number of sectors used to store a single copy of the FAT.
…$ od -A d -j 22 -N 2 -t d2 boot.BPB.img 0000022 32 0000024 …$ BPB_FATSz16=32 …$ FATSz=$BPB_FATSz16
First data cluster
The first data cluster follows the reserved sectors, the FAT sectors and the root directory sectors (for FAT16). Determine the first data sector and the number of data sectors.
…$ FirstDataSector=$(( $BPB_RsvdSecCnt + ( $BPB_NumFATs * $FATSz ) + $RootDirSectors )) …$ echo $FirstDataSector 112 …$ DataSec=$(( $TotSec - ( $BPB_RsvdSecCnt + ( $BPB_NumFATs * $FATSz ) + $RootDirSectors ) )) …$ echo $DataSec 114576
What FAT
The official MS-sanctioned way to determine FAT type is to calculate the number of sectors and compare that number to 212, 216 and 232.
…$ CountofClusters=$(( $DataSec / $BPB_SecPerClus )) …$ echo $CountofClusters 7161
This is officially a FAT16 file system.
Root directory
Finally, let’s copy the root directory.
…$ rootDirStart=$(( $BPB_RsvdSecCnt + $BPB_NumFATs * $FATSz )) …$ echo $rootDirStart 80 …$ echo $RootDirSectors 32 …$ dd if=boot.img of=boot.rootdir.img bs=512 count=$RootDirSectors skip=$rootDirStart 32+0 records in 32+0 records out 16384 bytes (16 kB) copied, 0.00549986 s, 3.0 MB/s
This is going to be weird because most files in this directory do have long names. On page 24 of the Microsoft document, you will find the directory entry structure, but on page 26 you find the long directory entry structure.
Type the following command to look at the directory entires. You will find another one every 32 bytes.
…$ od -A d -t a boot.rootdir.img | more
Keep looking until you find one for issue.txt stored in all caps. If will look something like the following:
0000672 I S S U E sp sp sp T X T sp nul d E G 0000688 r H r H nul nul E G r H q ht g nul nul nul
The numbers on the right are the byte offsets of the entry. Copy that single entry with a command similar to the following:
…$dd if=boot.rootdir.img of=issue.txt.direntry.txt bs=1 skip=offset count=32
Look at the 32-bit integer stored at offset 28 of the directory entry and make sure it matches the size of issue.txt.
…$od -A d -j 28 -N 4 -t d4 issue.txt.direntry.txt
0000028 103
0000032
To be continued.....