LinuxQuestions.org - Absolute startaddress (sector)

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - Absolute startaddress (sector) (https://www.linuxquestions.org/questions/linux-newbie-8/absolute-startaddress-sector-687699/)

Absolute startaddress (sector)

Hello,

Can someone tell me how I can find what the absolute startaddress is of a given file? (eg /etc/fstab) (on my harddisk in sectors) ?

Thanks

If by sectors you mean LBA or block address, debugfs may be what you want.

Try this:

Find the device that /etc/fstab is on (mine is dev/mapper/vg00-lv01):

Code:

# mount

/dev/mapper/vg00-lv01 on / type ext3 (rw)

Use the debugfs command against that device:

Code:

# debugfs  -R 'stat /etc/fstab' /dev/mapper/vg00-lv01

debugfs 1.41.3 (12-Oct-2008)

Inode: 16361  Type: regular    Mode:  0644  Flags: 0x0

Generation: 934295255    Version: 0x00000000

User:    0  Group:    0  Size: 644

File ACL: 0    Directory ACL: 0

Links: 1  Blockcount: 8

Fragment:  Address: 0    Number: 0    Size: 0

ctime: 0x4910a597 -- Tue Nov  4 14:42:15 2008

atime: 0x49340141 -- Mon Dec  1 10:22:41 2008

mtime: 0x4910a12c -- Tue Nov  4 14:23:24 2008

Size of extra inode fields: 4

Extended attributes stored in inode body: 

  selinux = "system_u:object_r:etc_t:s0\000" (27)

BLOCKS:

(0):75784

TOTAL: 1

#

Since blocksize on my ext3 fs is 4k, I can do this to get to the first sector of that file:

Code:

# dd if=/dev/mapper/vg00-lv01 bs=4096 count=1 skip=75784

/dev/vg00/lv01          /                      ext3    defaults        1 1

UUID=d1527206-67d9-4a2f-8bda-6b527ddd9ba2 /boot                  ext3    defaults        1 2

UUID=4d596527-51f0-4d26-aa35-d33ee8777de4 /boot2                  ext3    defaults        1 2

tmpfs                  /dev/shm                tmpfs  defaults        0 0

devpts                  /dev/pts                devpts  gid=5,mode=620  0 0

sysfs                  /sys                    sysfs  defaults        0 0

proc                    /proc                  proc    defaults        0 0

/dev/vg00/lv00          swap                    swap    defaults        0 0

1+0 records in

1+0 records out

4096 bytes (4.1 kB) copied, 0.0005632 s, 7.3 MB/s

#

I think this might be a little more than a newbie question, and have absolutely no idea why
you would need this information, but I hope this helps.

Quote:

Originally Posted by tommylovell (Post 3361887)

If by sectors you mean LBA or block address, debugfs may be what you want.

Try this:

Find the device that /etc/fstab is on (mine is dev/mapper/vg00-lv01):

Code:

# mount

/dev/mapper/vg00-lv01 on / type ext3 (rw)

Use the debugfs command against that device:

Code:

# debugfs  -R 'stat /etc/fstab' /dev/mapper/vg00-lv01

debugfs 1.41.3 (12-Oct-2008)

Inode: 16361  Type: regular    Mode:  0644  Flags: 0x0

Generation: 934295255    Version: 0x00000000

User:    0  Group:    0  Size: 644

File ACL: 0    Directory ACL: 0

Links: 1  Blockcount: 8

Fragment:  Address: 0    Number: 0    Size: 0

ctime: 0x4910a597 -- Tue Nov  4 14:42:15 2008

atime: 0x49340141 -- Mon Dec  1 10:22:41 2008

mtime: 0x4910a12c -- Tue Nov  4 14:23:24 2008

Size of extra inode fields: 4

Extended attributes stored in inode body: 

  selinux = "system_u:object_r:etc_t:s0\000" (27)

BLOCKS:

(0):75784

TOTAL: 1

#

Since blocksize on my ext3 fs is 4k, I can do this to get to the first sector of that file:

Code:

# dd if=/dev/mapper/vg00-lv01 bs=4096 count=1 skip=75784

/dev/vg00/lv01          /                      ext3    defaults        1 1

UUID=d1527206-67d9-4a2f-8bda-6b527ddd9ba2 /boot                  ext3    defaults        1 2

UUID=4d596527-51f0-4d26-aa35-d33ee8777de4 /boot2                  ext3    defaults        1 2

tmpfs                  /dev/shm                tmpfs  defaults        0 0

devpts                  /dev/pts                devpts  gid=5,mode=620  0 0

sysfs                  /sys                    sysfs  defaults        0 0

proc                    /proc                  proc    defaults        0 0

/dev/vg00/lv00          swap                    swap    defaults        0 0

1+0 records in

1+0 records out

4096 bytes (4.1 kB) copied, 0.0005632 s, 7.3 MB/s

#

I think this might be a little more than a newbie question, and have absolutely no idea why
you would need this information, but I hope this helps.

Thanks tommylovell,

This is what I am looking for !

Why I need this ?

I am studying the working of Grub.
And Grub starts the second stage after executing the first one.
I ask myself : How is it possible that the first stage find the second one?
=> there must be a "hard coded" link in stage 1. (absolute block list I believe) I want to find this link in stage 1.

And afterward : How do stage 2 find its menu.lst (grub.conf).
This must also be "coded" : but now within the filesystem.

I want to know fow stage 2 finds this menu.lst (I got one the grub> prompt, and I asked myself : where is grub looking for its menu.lst?
When I give grub> configfile hd(0,6)/grub/menu.lst it starts this file.
So the original link must be missing. I want to correct this by hand.

OKe OKE

I know

I can correct this by reinstalling grub.
I will do this when I understand how grubs works.

For the record, I have to say that this is one of the most educational posts I've ever seen in the newbie forums and maybe even on the whole site. Thanks for the great tips tommylovell!

I tried to do this on "stage2"

And this is what I get :

What will be the absolute startsector of this file ?

Quote:

$ su -c "/sbin/debugfs -R 'stat /grub/stage2' /dev/sda7"
Password:
debugfs 1.41.3 (12-Oct-2008)
Inode: 8037 Type: regular Mode: 0644 Flags: 0x0
Generation: 836761593 Version: 0x00000000
User: 0 Group: 0 Size: 110532
File ACL: 33022 Directory ACL: 0
Links: 1 Blockcount: 220
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x49295fac -- Sun Nov 23 14:50:36 2008
atime: 0x49328f64 -- Sun Nov 30 14:04:36 2008
mtime: 0x48e7e2e3 -- Sat Oct 4 23:40:51 2008
BLOCKS:
(0-11):36391-36402, (IND):36403, (12-107):36404-36499
TOTAL: 109

Who can help ?

Maybe something like

Code:

DEVICE=/dev/sda7

BLOCKSIZE=$(tune2fs -l $DEVICE|awk '/Block s/ {print $3}'); 

BLOCKS=$(/sbin/debugfs -R 'stat /grub/stage2' $DEVICE 2>&1|grep -A1 BLOCKS|cut -d ':' -f 2)

FIRSTBLOCK=(${BLOCKS//-/ })

echo first block is $FIRSTBLOCK

dd if=$DEVICE bs=$BLOCKSIZE count=1 skip=$[${FIRSTBLOCK}-1]

Once grub is installed, I don't think you can think of stages 1 and 2 as files---they are not visible with normal filesystem tools. e.g.: Stage 1 is simply the first sector of the drive (or--in some cases--the partition)

the stage1 and stage1.5 code that is actually executed at boot time are not visible as files.
(The grub install copies /boot/grub/stage1 and possibly /boot/grub/e2fs_stage1_5 to new disk
locations.) If /boot is in an ext2/3 filesystem, I think 'stage2' is executed from there.

I'm sure you've probably seen this in the 0.97 Grub Manual:

Code:

Chapter 10: GRUB image ﬁles 29 



10 GRUB image ﬁles 



GRUB consists of several images: two essential stages, optional stages called Stage 1.5, one 

image for bootable CD-ROM, and two network boot images. Here is a short overview of 

them. See Appendix D [Internals], page 75, for more details. 



‘stage1’ This is an essential image used for booting up GRUB. Usually, this is embedded 

        in an MBR or the boot sector of a partition. Because a PC boot sector is 512 

        bytes, the size of this image is exactly 512 bytes.  



        All ‘stage1’ must do is to load Stage 2 or Stage 1.5 from a local disk. Because 

        of the size restriction, ‘stage1’ encodes the location of Stage 2 (or Stage 1.5) 

        in a block list format, so it never understand any ﬁlesystem structure. 



‘stage2’ This is the core image of GRUB. It does everything but booting up itself. 

        Usually, this is put in a ﬁlesystem, but that is not required. 



‘e2fs_stage1_5’ 

‘fat_stage1_5’ 

‘ffs_stage1_5’ 

‘jfs_stage1_5’ 

‘minix_stage1_5’ 

‘reiserfs_stage1_5’ 

‘vstafs_stage1_5’ 

‘xfs_stage1_5’ 

        These are called Stage 1.5, because they serve as a bridge between ‘stage1’ 

        and ‘stage2’, that is to say, Stage 1.5 is loaded by Stage 1 and Stage 1.5 loads 

        Stage 2. The diﬀerence between ‘stage1’ and ‘*_stage1_5’ is that the former 

        doesn’t understand any ﬁlesystem while the latter understands one ﬁlesystem 

        (e.g. ‘e2fs_stage1_5’ understands ext2fs). So you can move the Stage 2 image 

        to another location safely, even after GRUB has been installed. 



        While Stage 2 cannot generally be embedded in a ﬁxed area as the size is so 

        large, Stage 1.5 can be installed into the area right after an MBR, or the boot 

        loader area of a ReiserFS or a FFS.

If you did what is a fairly typical install of Linux into an ext2/3 filesystem with a small
'/boot' ext2/3 partition, you would have: the 'stage1' in the MBR, sector0; and 'e2fs_stage1_5'
in the "the area right after an MBR". On my system it's not there. I don't know where it is,
but by virtue of the "block list", 'stage1' can find and pass control to it. 'e2fs_stage1_5'
understands the ext2/3 filesystem, so it can easily find files.

If you want the sector address from the beginning of the filesystem (i.e. partition), it's the
blockaddress from debugfs times 8, as the blocksize is 4096 (on my system) and a sector is 512 bytes...

Code:

[root@athlon4k6 ~]# debugfs -R 'stat grub/stage2' /dev/sda1

debugfs 1.40.2 (12-Jul-2007)

Inode: 29255  Type: regular    Mode:  0644  Flags: 0x0  Generation: 1083286271

User:    0  Group:    0  Size: 104924

File ACL: 9190    Directory ACL: 0

Links: 1  Blockcount: 224

Fragment:  Address: 0    Number: 0    Size: 0

ctime: 0x46a13081 -- Fri Jul 20 18:00:33 2007

atime: 0x484948a5 -- Fri Jun  6 10:24:37 2008

mtime: 0x46a13081 -- Fri Jul 20 18:00:33 2007

BLOCKS:

(0-11):34807-34818, (IND):34819, (12-25):34820-34833

TOTAL: 27

So, starting sector, relative to the start of the partition is 34807 * 8 = 278,456.

To find the absolute sector, you need to know where the partition starts.

Code:

[root@athlon4k6 ~]# fdisk -lu /dev/sda



Disk /dev/sda: 500.1 GB, 500106780160 bytes

255 heads, 63 sectors/track, 60801 cylinders, total 976771055 sectors

Units = sectors of 1 * 512 = 512 bytes



  Device Boot      Start        End      Blocks  Id  System

/dev/sda1  *          63    2104514    1052226  83  Linux

/dev/sda2        2104515  136327589    67111537+  83  Linux

/dev/sda4      270550665  976768064  353108700    5  Extended

/dev/sda5      270550728  291515489    10482381  8e  Linux LVM

/dev/sda6      291515553  312480314    10482381  8e  Linux LVM

/dev/sda7      312480378  333445139    10482381  8e  Linux LVM

/dev/sda8      333445203  354409964    10482381  8e  Linux LVM

/dev/sda9      354410028  356546609    1068291  83  Linux

/dev/sda10      356546673  456567299    50010313+  8e  Linux LVM

/dev/sda11      456567363  556587989    50010313+  8e  Linux LVM

/dev/sda12      556588053  656608679    50010313+  8e  Linux LVM

/dev/sda13      656608743  756629369    50010313+  8e  Linux LVM

/dev/sda14      756629433  856650059    50010313+  8e  Linux LVM

/dev/sda15      856650123  956670749    50010313+  8e  Linux LVM

So, in this case /boot/grub/stage2 would start at 63 + 278,456 = 278,519.

And here it is accessed by absolute address.

Code:

[root@athlon4k6 ~]# dd if=/dev/sda bs=512 count=1 skip=278519 | xxd | head

1+0 records in

1+0 records out

512 bytes (512 B) copied, 9.4696e-05 s, 5.4 MB/s

0000000: 5256 be03 81e8 2801 5ebf f881 668b 2d83  RV....(.^...f.-.

0000010: 7d04 000f 84ca 0080 7cff 0074 3e66 8b1d  }.......|..t>f..

0000020: 6631 c0b0 7f39 4504 7f03 8b45 0429 4504  f1...9E....E.)E.

0000030: 6601 05c7 0410 0089 4402 6689 5c08 c744  f.......D.f.\..D

0000040: 0600 7050 6631 c089 4404 6689 440c b442  ..pPf1..D.f.D..B

0000050: cd13 0f82 9f00 bb00 70eb 5666 8b05 6631  ........p.Vf..f1

0000060: d266 f734 8854 0a66 31d2 66f7 7404 8854  .f.4.T.f1.f.t..T

0000070: 0b89 440c 3b44 087d 748b 042a 440a 3945  ..D.;D.}t..*D.9E

0000080: 047f 038b 4504 2945 0466 0105 8a54 0dc0  ....E.)E.f...T..

0000090: e206 8a4c 0afe c108 d18a 6c0c 5a52 8a74  ...L......l.ZR.t

And here it is accessed as a file.

Code:

[root@athlon4k6 ~]# xxd /boot/grub/stage2 | head

0000000: 5256 be03 81e8 2801 5ebf f881 668b 2d83  RV....(.^...f.-.

0000010: 7d04 000f 84ca 0080 7cff 0074 3e66 8b1d  }.......|..t>f..

0000020: 6631 c0b0 7f39 4504 7f03 8b45 0429 4504  f1...9E....E.)E.

0000030: 6601 05c7 0410 0089 4402 6689 5c08 c744  f.......D.f.\..D

0000040: 0600 7050 6631 c089 4404 6689 440c b442  ..pPf1..D.f.D..B

0000050: cd13 0f82 9f00 bb00 70eb 5666 8b05 6631  ........p.Vf..f1

0000060: d266 f734 8854 0a66 31d2 66f7 7404 8854  .f.4.T.f1.f.t..T

0000070: 0b89 440c 3b44 087d 748b 042a 440a 3945  ..D.;D.}t..*D.9E

0000080: 047f 038b 4504 2945 0466 0105 8a54 0dc0  ....E.)E.f...T..

0000090: e206 8a4c 0afe c108 d18a 6c0c 5a52 8a74  ...L......l.ZR.t

[root@athlon4k6 ~]#