Re: Retriving info from stage 1 and 2

[Andrey Borzenkov]

В Fri, 28 Jun 2013 18:32:36 +0200
Alessandro MACUZ <address@hidden> пишет:

> Hi all,
> 
> I sought the Internet and the grub mailing lists for such an answer but I
> couldn't find it.
> 
> I'd like to know which tool to use to extract info from the first 440 bytes
> in the 1st sector and then code in the following 62 sectors (speaking of a
> MBR-structured disk).
> 

bootinfoscript may be a starting point.

> The idea behind is "not to trust" (don't take me wrong) the files grub.cfg,
> menu.lst and the likes and retrieve information from the real source.
> Think of a dump of an HD that you can investigate on without the need to
> boot the machine or takes this as an academic exercise.
> You may consider also the case where configuration files are not accessible
> but still early stages are (I could use dd from another OS to extract such
> GRUB stage and investigate on another Linux machine, etc etc)
> 
> Thanks in advance,
> 
> Alessandro