Fat32 格式分析简明

ID:284918 · 发表于 2018-2-23 11:13

Fat32 格式分析简明

一、读取0号扇区MBR，获取DBR位置

1 33 c0 8e d0 bc 00 7c fb-- 50 07 50 1f fc be 1b 7c

2 bf 1b 06 50 57 b9 e5 01-- f3 a4 cb bd be 07 b1 04

3 38 6e 00 7c 09 75 13 83-- c5 10 e2 f4 cd 18 8b f5

4 83 c6 10 49 74 19 38 2c-- 74 f6 a0 b5 07 b4 07 8b

5 f0 ac 3c 00 74 fc bb 07-- 00 b4 0e cd 10 eb f2 88

6 4e 10 e8 46 00 73 2a fe-- 46 10 80 7e 04 0b 74 0b

7 80 7e 04 0c 74 05 a0 b6-- 07 75 d2 80 46 02 06 83

8 46 08 06 83 56 0a 00 e8-- 21 00 73 05 a0 b6 07 eb

9 bc 81 3e fe 7d 55 aa 74-- 0b 80 7e 10 00 74 c8 a0

10 b7 07 eb a9 8b fc 1e 57-- 8b f5 cb bf 05 00 8a 56

11 00 b4 08 cd 13 72 23 8a-- c1 24 3f 98 8a de 8a fc

12 43 f7 e3 8b d1 86 d6 b1-- 06 d2 ee 42 f7 e2 39 56

13 0a 77 23 72 05 39 46 08-- 73 1c b8 01 02 bb 00 7c

14 8b 4e 02 8b 56 00 cd 13-- 73 51 4f 74 4e 32 e4 8a

15 56 00 cd 13 eb e4 8a 56-- 00 60 bb aa 55 b4 41 cd

16 13 72 36 81 fb 55 aa 75-- 30 f6 c1 01 74 2b 61 60

17 6a 00 6a 00 ff 76 0a ff-- 76 08 6a 00 68 00 7c 6a

18 01 6a 10 b4 42 8b f4 cd-- 13 61 61 73 0e 4f 74 0b

19 32 e4 8a 56 00 cd 13 eb-- d6 61 f9 c3 49 6e 76 61

20 6c 69 64 20 70 61 72 74-- 69 74 69 6f 6e 20 74 61

21 62 6c 65 00 45 72 72 6f-- 72 20 6c 6f 61 64 69 6e

22 67 20 6f 70 65 72 61 74-- 69 6e 67 20 73 79 73 74

23 65 6d 00 4d 69 73 73 69-- 6e 67 20 6f 70 65 72 61

24 74 69 6e 67 20 73 79 73-- 74 65 6d 00 00 00 00 00

25 00 00 00 00 00 00 00 00-- 00 00 00 00 00 00 00 00

26 00 00 00 00 00 00 00 00-- 00 00 00 00 00 00 00 00

27 00 00 00 00 00 00 00 00-- 00 00 00 00 00 00 00 00

28 00 00 00 00 00 2c 44 63-- c0 d2 0f a6 00 00 00 01

29 01 00 0b fe 3f 0f 3f 00-- 00 00 d1 eb 03 00 00 00

30 00 00 00 00 00 00 00 00-- 00 00 00 00 00 00 00 00

31 00 00 00 00 00 00 00 00-- 00 00 00 00 00 00 00 00

32 00 00 00 00 00 00 00 00-- 00 00 00 00 00 00 55 aa

从图中看出，所在位置为（3f 00 00 00），整个存储为（d1 eb 03 00）个扇区，由于低字节在前，所以DBR实际扇区为 00 00 00 3f，存储空为 512字节* 00 03 eb d1 = 125MB

二、读取00 00 00 3f 扇区数据，获取FAT地址

1 eb 58 90 4d 53 44 4f 53-- 35 2e 30 00 02 02 68 18

2 02 00 00 00 00 f8 00 00-- 3f 00 ff 00 3f 00 00 00

3 d1 eb 03 00 cc 03 00 00-- 00 00 00 00 02 00 00 00

4 01 00 06 00 00 00 00 00-- 00 00 00 00 00 00 00 00

5 80 01 29 b1 54 89 d6 4e-- 4f 20 4e 41 4d 45 20 20

6 20 20 46 41 54 33 32 20-- 20 20 33 c9 8e d1 bc f4

7 7b 8e c1 8e d9 bd 00 7c-- 88 4e 02 8a 56 40 b4 41

8 bb aa 55 cd 13 72 10 81-- fb 55 aa 75 0a f6 c1 01

9 74 05 fe 46 02 eb 2d 8a-- 56 40 b4 08 cd 13 73 05

10 b9 ff ff 8a f1 66 0f b6-- c6 40 66 0f b6 d1 80 e2

11 3f f7 e2 86 cd c0 ed 06-- 41 66 0f b7 c9 66 f7 e1

12 66 89 46 f8 83 7e 16 00-- 75 38 83 7e 2a 00 77 32

13 66 8b 46 1c 66 83 c0 0c-- bb 00 80 b9 01 00 e8 2b

14 00 e9 2c 03 a0 fa 7d b4-- 7d 8b f0 ac 84 c0 74 17

15 3c ff 74 09 b4 0e bb 07-- 00 cd 10 eb ee a0 fb 7d

16 eb e5 a0 f9 7d eb e0 98-- cd 16 cd 19 66 60 80 7e

17 02 00 0f 84 20 00 66 6a-- 00 66 50 06 53 66 68 10

18 00 01 00 b4 42 8a 56 40-- 8b f4 cd 13 66 58 66 58

19 66 58 66 58 eb 33 66 3b-- 46 f8 72 03 f9 eb 2a 66

20 33 d2 66 0f b7 4e 18 66-- f7 f1 fe c2 8a ca 66 8b

21 d0 66 c1 ea 10 f7 76 1a-- 86 d6 8a 56 40 8a e8 c0

22 e4 06 0a cc b8 01 02 cd-- 13 66 61 0f 82 75 ff 81

23 c3 00 02 66 40 49 75 94-- c3 42 4f 4f 54 4d 47 52

24 20 20 20 20 00 00 00 00-- 00 00 00 00 00 00 00 00

25 00 00 00 00 00 00 00 00-- 00 00 00 00 00 00 00 00

26 00 00 00 00 00 00 00 00-- 00 00 00 00 00 00 00 00

27 00 00 00 00 00 00 00 00-- 00 00 00 00 0d 0a 52 65

28 6d 6f 76 65 20 64 69 73-- 6b 73 20 6f 72 20 6f 74

29 68 65 72 20 6d 65 64 69-- 61 2e ff 0d 0a 44 69 73

30 6b 20 65 72 72 6f 72 ff-- 0d 0a 50 72 65 73 73 20

31 61 6e 79 20 6b 65 79 20-- 74 6f 20 72 65 73 74 61

32 72 74 0d 0a 00 00 00 00-- 00 ac cb d8 00 00 55 aa

保留扇区数 18 68

隐藏扇区数 00 3f

FAT扇区数 03 cc

FAT的位置 FAT1: 18 68 + 00 3f = 18 a7 FAT2: 18 68 + 00 3f + 03 cc = 1C 73

数据区起始位置 18 68 + 00 3f+ 03 cc + 03 cc = 20 3f

帐号		自动登录	找回密码
密码			立即注册