NaggingMachine -

나의 첫월급은 60만원

2009/07/05 17:22

[BlahBlah]

1999년이네요.

아르바이트는 아니었습니다.

하루종일, 주말에도 쉴세없이 일했던 그야말로 풀타임 잡이었습니다.

휴일없이 30일내내 근무를 했는데, 월급이 60만원.

하루 10시간 이상 일했으니

대략따져봐도 시급이 2,000원도 안되더군요.

다니던 학교를 휴학했습니다.

친구들은 군대갈 때,

학교에서 배운 것들을 직접 경험하고 싶어서

학교에서 배울 수 없는 무언가를 세상에서 배울수 있을까 싶어서

친구들과는 다른 삶을 살기로 결정하고 학교를 휴학했습니다.

첫 월급을 받던날, 펑펑 울었습니다.

기뻐서 울었냐고요?

너무 슬펐습니다.

부모님께 전화해서 너무나 서럽게 울었습니다.

시급이 2,000원도 안되는 현실이 너무 싫었습니다.

'아.. 돈버는 일이 이렇게 어려운 거구나.'

월세 방값내고 밥값하고 그랬더니 돈이 없었습니다.

첫 월급 받으면 부모님께 속옷 사드리겠다는 제 약속은

결국 양말 한켤레로 지켜드릴 수 밖에 없었습니다.

미래가 막막했습니다.

제 꿈을 모두 앗아간 블랙홀과 같았습니다.

빼앗긴 꿈은 다시 돌려받을 수 없는 블랙홀이었습니다.

아무리 계산기를 두드려도 답이 없었습니다.

그냥 한달을 그럭저럭 사는 수 밖에는요.

직장 상사가 그랬습니다.

이렇게라도 살아야 한다고.

그래도 이게 어디냐고.

이게 어디라니요.

하지만 그만두고 싶지는 않았습니다.

이왕 시작한거 끝을 봐야 하니까요.

죽도록 생활했습니다.

잠도 안자고 연구했습니다.

월급은 3개월후에 80만원으로 올랐습니다.

그리고 일년후에 100만원으로 올랐습니다.

연봉이 1,000만원이 넘는 그때.

또 다시 눈물을 흘렸습니다.

하지만 여전히 치열하게 살았습니다.

엄청나게 부딪히고 실패하고 또 부딪히고 겨우 하나 이뤄내고

또 실패하고 도전했습니다.

그런데 어느순간부터 빛이 보이기 시작했습니다.

남보다 조금씩 앞서나가는 제 자신이 보였습니다.

단기적으로 세웠던 목표도 이루게되었고

죽을만큼 열심히 하면 안되는게 없구나라는걸

피부로, 그리고 가슴으로 느끼게 되었습니다.

시간은 계속흘러,

이제는 치열하게 살지 않아도 먹고 살수 있을정도가 되었습니다.

하지만 가슴 한켠에서는 항상 불안합니다.

이런 편안함과 안락함이 오히려 더 불안합니다.

자꾸 뒤쳐지는것 같아 하루에도 여러번 식은땀이 흐릅니다.

뭔가 해야 할것 같아서 불안하고 정신없이 집중하기도 합니다.

주위에서는 그러지 말라고 합니다.

이제 편안하게 남들처럼 지내보면 어떠냐고 하지요.

치열한 삶속에서 버텨와서일까요?

스스로를 그런 삶속으로 내보내려는 제 모습이 싫을때도 있지만

그렇게, 세상 사람들과 호흡하며 또 이뤄내며 살고 싶을때가 많지요.

요즘 비정규직 법으로 많이 씨끄러운데,

비정규직으로 근무하시는 분들의 마음이 어느정도는 이해가 가네요.

월세 15만원짜리 방에서 쥐와 바퀴벌레를 친구삼아

근근히 하루를 버텨냈던 그때를 생각하면 지금도 너무 끔찍하지만,

분명 희망은 있다고. 그래서 세상은 아름다운거라고 믿고 있고, 또 그렇게 믿고 싶습니다.

하루 하루를 버티기 힘든 친구들이 있다면,

오늘 하루도 자신의 현실에 안주하지 말고 좀더 노력해 보면

결과도 좋겠지만 그런 자신의 모습을 보며 과정을 진실로 소중하게

여길줄 아는 사람이 될 수 있을거라고 말해주고 싶네요.

그리고 지금의 힘든시기가 큰 자산일 될 수 있을거라는

그래서 "이것또한 지나가리라."라는 마음으로 버텨낼 수 있으면 합니다.

모두들 화이팅.

'BlahBlah' 카테고리의 다른 글

나의 첫월급은 60만원 (10)	2009/07/05
달인 (2)	2009/07/01
방송사고 - 박지성이 전북현대 소속?? (0)	2009/06/18
캐논 500D 구입 (6)	2009/05/27

Trackback0 : Comment10

C# 4.0 스펙 정보 업데이트

2009/07/02 12:23

[Visual Studio]

2009.7 버전으로 새롭게 업데이트되었습니다.

Microsoft 사이트에서 다운로드하실 수 있어요~

'Visual Studio' 카테고리의 다른 글

C# 4.0 스펙 정보 업데이트 (0)	2009/07/02
SmallBasic Example [TurtleMachine] - 30분만에 만들어본 간단한 SmallBasic 예제 (0)	2009/07/01
SmallBasic 0.5 출시 (2)	2009/06/30
Visual Studio 애드인으로 작성된 Mono Tools (0)	2009/06/29

.net framework 4, C#, visual studio 2010, 닷넷

Trackback0 : Comment0

달인

2009/07/01 23:37

[BlahBlah]

생활의 달인이라는 TV 프로그램을 보며

세상엔 참 대단한 사람들이 많구나라는 생각을 하게됩니다.

한편으로는 난 무슨 달인일까라는 생각을 하게 되는데,

아무것도 잘하는게 없네?라는 결론에 이르게 됩니다.

저도 달인이 되어야 할텐데요. :-)

'BlahBlah' 카테고리의 다른 글

나의 첫월급은 60만원 (10)	2009/07/05
달인 (2)	2009/07/01
방송사고 - 박지성이 전북현대 소속?? (0)	2009/06/18
캐논 500D 구입 (6)	2009/05/27

달인

Trackback0 : Comment2

Reverse engineering techniques to find security bugs: Alex Sotirov

2009/07/01 17:17

[TechnoBabbler]

재미있는 역공학 강좌입니다.

출처: http://joseph2625.tistory.com/2

첫부분엔 이사람이 만든 ANI Exploit 에대해 보여주네요
간단한 HTML페이지에 자신이 만든 .ANI(Animated Cursor)파일을 올려놓고
이거로 쉘 권한 따는거에요..

지금은 패치로 막혔지만 비스타도 픽스 적용안된 컴퓨터들은 취약하다고 나오네요
참고로 User32.dll이 취약하기때문에 파이어폭스도 픽스 설치안하면 먹히는듯..

그다음 슬라이드엔 Microsoft 보안패치관련 통계가 나오네요

1998년부터 500개 넘는 보안공지(패치) 띄웠는데 패치 거의 대부분이 한꺼번에
취약점을 몇개씩 보완해서 올리는듯

매달 둘쨋주 화요일에 배포한다고 함

하지만 많은 취약점들은 공지하지도 않고 패치된다고 하네요

만약에 보안전문가가 취약점 한개를 리포팅하면 Microsoft에선 그부분도 고치고
그 주변 코드들도 다 체크해서 버그를 한번에 5-6개씩 고친다고 함
그리고 프로그램 에러날때마다 보내는Crash Report보고도 많이 고쳐진다고 함
Service Pack에도 많이 공개되지 취약점들이 패치된다네요..
공개가 된다해도 전혀 취약점에대해 자세히 설명하지 않고 대충대충 설명..

There is a privilege elevation vulnerability in Windows 2000 caused by improper validation of system inputs....

Security Bulletin가보면 이렇게 대충대충 설명하기때문에 자세히 알길이 없음.. 이사람 말로는 패치가 릴리즈 된 후 패치되지 않는 파일과 RE로 비교해서 찾아 낸다고 함.

이사람이 쓰는툴:

IDA Pro(전 Olly가 더좋다고 생각했는데 동영상보고 솔직히 조곰 놀랐음-_-)
BinDiff(IDA Pro Plugin)
PaiMei(디버거)
VMware(최고 乃)

취약점 찾는방법 설명부분 요약

Microsoft에서 제공하는 Debugging Symbol이 있기때문에 RE만으로도 충분히 찾을수 있다고 함
동영상 보시면 아시겠지만 플러그인 써서 프로그램의 실행 Flow비교를 해서 찾는거 같네요

커서파일 헤더부분 체크를 보여줌

ANI파일은 RIFF파일 포맷을 사용하며 헤더엔

헤더에 섹션들이 되있는데 ANI파일의 경우엔

"ANIH"태그가 파일의 첫부분에 나온다네요..

이 문자열을 비교한 후, 헤더의 사이즈를 (36바이트)체크 한후 커서 헤더를 정적으로 Allocate된 Stack에로드 하게 됩니다....

하지만!! 여기중요한게 있음... 패치 된 버전엔 이 체크하는 루틴이 포함되어있지만 패치 전버전엔 이 체크 루틴이 없다고 합니다..

로드할 메모리가 정적 메모리니 만약에 36바이트 이상 읽게되면 Stack Over Flow가 일어나겠죠..

패치되기전엔 읽어야 할 사이즈를 체크하지 않으니 이 방법을 사용할수 있다고 하네요

아이콘 관련 취약점도 동일한 원리라고 함..

이걸 이제 어떻케 Exploit을 만들때 사용할건지 설명하면서(? 설명하는 척하더니ㅡㅡ) 비스타관련 보안기능들을 설명합니다..

보시면 알겠지만 Vista에는 보안기능들이 뭐뭐 있냐면
/GS stack cookies
Address Space Layout Randomization
Data Execution Prevention
이 있는데 하나하나 설명 해 드릴게요

1. /GS stack cookies
VS에 새로 추가된 기능이라고 합니다
컴파일시 /GS를 사용하면

코드에 스택 체크 루틴이 추가되는데요 예를 들어봅시다
먼저 /GS를 사용하지 않은경우:
void foo(char *input)
{
   char buf[256];
   strcpy(buf, input);
}
보시면 알겠지만 strcpy함수는 Null Terminated String을 복사하는 함수 입니다.
그렇게 때문에 버퍼사이즈가 256바이트인 상태에서 그거 보다 더 큰 문자열을 집어넣을경우 스택 오버플로가 일어나게됩니다

하지만 Strcpy엔 이 오버플로를 체크하지 않기때문에(strcpy_s가 있긴함 근데 솔직히 쓰기 무지 귀찮-_-zz)
오버플로에 취약하죠.. 하지만 /GS를 사용할경우 컴파일러가 자동으로 아래 빨간글자로 된 코드를 추가로 넣습니다
static_cookie = rand();
void foo(char *input)
{
   int cookie = random_cookie;
   char buf[256];
   strcpy(buf,

input);
if (cookie != random_cookie)
abort();
}

자세히 봅시다.. 스택상으론 cookie변수가 buf변수 다음 위치하게 됩니다( buf [a] [b] [c] [] [] cookie [0x23] [0x53] [0x13] [0x88] retaddr [0x77] [0x94] [0x28] [0x82]) 이렇게 되고 스택 오버플로가 일어날 경우 cookie정보를 바꾸지 않는이상 retaddr를 변경할 방법이 없어집니다. 만약에 쿠키 정보가 변경이 되면 Abort()해서 스택오버플로를 방지하게 되는 것이죠.

이 ANI Exploit경우엔 이런 루틴이 없었다고 합니다. /GS를 넣었다고 해도 Array변수만 체크하고
성능 이슈때문에 헤더 (struct)는 체크하지 않는다고 하네요.. 이경우엔 /GS를 써도 무용지물..

2.ASLR (Address Space Layout Randomization)
이게 뭐냐면...

XP보시면 프로세스의 라이브러리(DLL)파일이 실행할때마다 거의 동일한 자리에 로드되어있다는걸 아시게 될것입니다.. 예를들어 Olly에서 Call CreateProcessA을 Assemble시킬경우 IAT에서 그 함수의 포인터 정보를 사용해서 함수를 호출하는것이 아니라 대충 call 74938392형식으로 어셈블 됩니다. 딱보시면 "만약 라이브러리가 로딩되는 Base Address가 변경되면 이상한데로 호출될텐데"라고 생각하시겠지만 신기하게도 계속 먹힙니다!! 이 이유는 XP에서는 메인 executable과 ntdll,kernel32.dll라이브러리 파일들은 계속 같은곳에 로딩이 되기 때문이라고 하네요.

하지만 Vista에서 써본경우(경험임) 저렇게 어셈블 할 경우 바로 다음번 실행할때 바로 Exception뜹니다 CreateProcessA가 아닌 전혀 딴데로 호출이 되있더라구요..

이 이유는 비스타에선 저 파일들 베이스 어드레스가 항상 바뀌기 때문 이라는데요 이게 왜 중요하냐면
스택 오버플로우 취약점을 이용할땐 현재 함수가 어디로 리턴되는지 정보가 담겨있는 스택을 변경해서 자기가 가고싶은곳으로 가게 하는건데(jmp esp trampolines라고 함)이렇게 프로그램이 로딩될때마다 리턴 주소가 틀려버리니(그 해당 라이브러리 Base Address가변경) 도저히 공격할 ANI파일을 만들때 돌아갈 주소를 알지 못하게 됩니다. XP에도 있었지만 Main Executable,kernel32.dll,ntdll은 안바뀌고 Vista에서야 완전히 바뀐다고 함

그러나!!
이걸 비스타에서도 피해가는 방법이 있으니..
Heap Spraying이라는 방법이 있는데 이 방법은 엄청나게 많은양의 메모리를(200MB -0-) 다 nop처리 하고 맨 아래 부분에 jmp부분을 넣어서 리다이렉팅 하게 하는건데 이경우 Randomize가 된다 하더라도 nop부분을 호출하기 때문에 Exception이 뜨지 않는다고 함.

3.DEP(Data Execution Prevention)
다 아는 부분일꺼라 짧게 설명함..xp때는 CPU선에서 DEP자체를 지원하지 않았고(2001년이져.. 인텔이랑 AMD가2004년에 처음 도입했다니까 그 사이엔..전혀 안됐었음) Software base에선 디폴트로 꺼져 있어서 DEP가 전혀 적용이 되지 않는다고 하네요..

Vista에선 이것이 다 완화 되었지만... 그래도 문제가 있음-_-! IE는 예외래요... 하도 Third Party Plugin들이 막무가내로 코딩을 해서 DEP가 켜졌을경우 저런 플러그인에 문제가 생겨서 Default로는 꺼져 있다는군요...

DEP Bypassing:
DEP가 켜져 있다고 해도 피해갈수 있다는 방법이 있다고 합니다

ntdll어딘가에 DEP를 끄는 함수가 있는데 거기를 호출할경우 무용지물이 된다고 하네요

또 VirtualProtect함수를 사용해서 Heap에서도 Execute가 되도록 할수 있데요..

이사람은 ASLR이랑 DEP를 피해 갈수 있었던 이유는 DEP는 기본적으로 꺼져있기때문에 상관없고 ASLR경우엔 ExceptionHandler가 있기때문에 Access Violations생기더라도 전혀 문제가 없었다고 하네요..

'TechnoBabbler' 카테고리의 다른 글

Reverse engineering techniques to find security bugs: Alex Sotirov (0)	2009/07/01
FAT 파일 구조 (0)	2009/06/30
호주·캐나다, IT개발자 이민 환영! (6)	2009/06/29
초보자를 위한 WinDbg (12)	2009/06/25

bindiff, IDAPro, Reversing, 역공학, 취약점

Trackback1 : Comment0

SmallBasic Example [TurtleMachine] - 30분만에 만들어본 간단한 SmallBasic 예제

2009/07/01 00:42

[Visual Studio]

On the previous article, you can download the latest SmallBasic version(currently 0.5) from MSDN site. This time, I made a simple program to get the idea of the way to use SmallBasic. There is no simpler way to feel and smell the new feature of a programming language than learning through example. In this simple code, you can learn a few programming technique like using Timer object and implemeting mouse event.

Very funny and easy. You can download the full source code from here.

SmallBasic이 어떤놈인지 알아볼겸 간단한게 만들어봤습니다. 역시나 예제를 만들어보면서 배우는것 만큼 확실한 방법도 없는것 같네요. Basic 생각도 나고 말입니다. 예제는 SmallBasic에서 기본제공하는 Turtle 객체를 마우스 움직임에 따라 이동시킵니다. Timer등을 사용해서 이벤트 처리하는 방법, GraphicsWindow에서 마우스 이벤트 처리하는 방법등을 배우실 수 있습니다.

참 쉽죠~ 전체 소스 코드는 http://smallbasic.com/smallbasic.com/program/?QLM601에서 확인하실 수 있습니다.

'-----------------------
' Author: Naggingmachine
' Blog: http://naggingmachine.tistory.com
' Email: wooseok.seo@gmail.com
'-----------------------

'-----------------------
' Timer setup
'-----------------------
Timer.Interval = 50
Timer.Tick = onTimerTick

'-----------------------
' Mouse setup
'-----------------------
GraphicsWindow.MouseMove = onMouseMove
mouseX = GraphicsWindow.MouseX
mouseY = GraphicsWindow.MouseY

'-----------------------
' Turtle setup
'-----------------------
turtleX = GraphicsWindow.Width/2
turtleY = GraphicsWindow.Height/2
Turtle.X = turtleX
Turtle.Y = turtleY
Turtle.Show()

'-----------------------
' Initialize
'-----------------------
GraphicsWindow.Title = "Having fun with Turtle"
GraphicsWindow.BrushColor = GraphicsWindow.GetColorFromRGB(127,127,127)
GraphicsWindow.FontName="arial"
GraphicsWindow.FontSize=30
GraphicsWindow.Fontbold="true"
GraphicsWindow.DrawText(0, 0, "Move mouse, then the turtle will follow you.")

moveHorizontal = 5
moveVerticle = 5

Sub onTimerTick

  ' Get the new X position of the turtle
  If (mouseX < turtleX) Then
    If (turtleX - mouseX < 5) Then
      turtleX = mouseX
    Else
      turtleX = turtleX - moveHorizontal
    EndIf
  ElseIf (mouseX > turtleX) Then
    If (mouseX - turtleX < 5) Then
      turtleX = mouseX
    Else
      turtleX = turtleX + moveHorizontal
    EndIf
  EndIf

  ' Get the new Y position of the turtle
  If (mouseY < turtleY) Then
    If (turtleY - mouseY < 5) Then
      turtleY = mouseY
    Else
      turtleY = turtleY - moveVerticle
    EndIf
  ElseIf (mouseY > turtleY) Then
    If (mouseY - turtleY < 5) Then
      turtleY = mouseY
    Else
      turtleY = turtleY + moveVerticle
    EndIf
  EndIf

  ' Move the turtle to new position
  Turtle.X = turtleX
  Turtle.Y = turtleY

EndSub

Sub onMouseMove
  mouseX = GraphicsWindow.MouseX
  mouseY = GraphicsWindow.MouseY
EndSub

'Visual Studio' 카테고리의 다른 글

C# 4.0 스펙 정보 업데이트 (0)	2009/07/02
SmallBasic Example [TurtleMachine] - 30분만에 만들어본 간단한 SmallBasic 예제 (0)	2009/07/01
SmallBasic 0.5 출시 (2)	2009/06/30
Visual Studio 애드인으로 작성된 Mono Tools (0)	2009/06/29

Event, Mouse, smallbasic, turtle, 스몰베이직

Trackback0 : Comment0

SmallBasic 0.5 출시

2009/06/30 23:34

[Visual Studio]

출처: http://msdn.microsoft.com/en-us/devlabs/cc950524.aspx

몇달은 된것 같습니다. SmallBasic 동영상을 Channel9에서 본게 말이죠. 그때는 버전이 0.1인가 그랬던것 같은데 개발 UI도 꽤 신선했고 이런 프로젝트를 내부적으로 진행하는 모습도 참 인상깊었습니다.

그런데 벌써 버전 5.0이 나왔네요.

사용자들이 요구했던 많은 기능들이 추가되었고, 가장 매력적인건 바로 개발툴의 모습이죠. 업그레이드가 되어가는 모습니다. ^^ 멋져요.

#저도 어렸을 땐 베이직 좀 다룰줄 알았는데 말입니다. :-)

# 스몰베이직 자가 학습 사이트: http://wotudo.net/blogs/how2/archive/2009/02/16/intro-to-programming-microsoft-small-basic.aspx

'Visual Studio' 카테고리의 다른 글

SmallBasic Example [TurtleMachine] - 30분만에 만들어본 간단한 SmallBasic 예제 (0)	2009/07/01
SmallBasic 0.5 출시 (2)	2009/06/30
Visual Studio 애드인으로 작성된 Mono Tools (0)	2009/06/29
C# Interactive Shell (0)	2009/06/29

smallbasic, 스몰베이직

Trackback0 : Comment2

FAT 파일 구조

2009/06/30 16:44

[TechnoBabbler]

출처: http://neworder.box.sk/newsread.php?newsid=3305

굉장히 자세하게 소개해 놓았네요. ^^

----------------

I wrote this a while back and never finished it. later I figured people maybe interested. fat16 is old I know, but is similar in structure to fat32 and fat12 (floppy disk). this article is about fat16 with additional comments regarding windows 98. certain things will appear/handle differently in other oses.

special thanks go to jon fox who helped me out on calculating the hdd serial number, the lfn checksum and making some worthy comments while in draft form, I really appreciate it.
overview

	master boot record
	sectors 1 - 62
	boot record
	fat 1
	fat2
	root directory
	sub directory
	data

1 block = 512 bytes

this is a scale diagram of the start of the disk with a small fat16 partition at the beginning. this partition is just over 20mb in size, to save space not all the data/subdir/surplus area is shown - there would be 44,815 blocks or ~=896 lines if this part was shown completely.
master boot record diagram

-> executable code

-> boot indicator

-> starting head

-> starting sector & cylinder

-> partiton type

-> ending head

-> ending sector & cylinder

-> the starting sector

-> no. of sectors in partition

-> executable signature

1 partition entry is as follows:

and reads as:

mbr in general ( =512 bytes )

the master boot record (mbr) is located in the first data sector on the hard disk. the mbr can have upto 4 primary partitions, each entry occupies 16 bytes. if the slot is unused, the space is filled with 00. each entry sets out the addressing parameters for the partition. hard disks have grown considerably in size since they were first invented, this has caused some strange addressing techniques to be used to ensure compatibility. hard drives used to be addressed by cylinder, head and sector (chs). as cylinders increased, instead of addressing it literally, the addressing values became virtual. example: 16 heads are specified on the drive and in bios, but when opened up there were only 6 physical heads. this is converted by the hard disks controller card to real values. however virtual chs addressing is also limited, when these values are exceeded, logical block addressing (lba) is used by partitions. lba is achieved by addressing each sector on the disk by number, the first sector is 0.
executable code ( =446 bytes )

this is the first piece of software that runs when a computer loads up. it can be less than 446 bytes; the remainding bytes will filled with 00. the bios checks for the executable signature, if absent a hardware error is displayed, else the code is run. it looks for and loads partition parameters in the four areas and checks that only one is bootable. it then checks the active partition's boot record for the executable signature before running it. if this is absent the error: missing operating system will appear.
boot indicator ( =1 byte )

determines which partition to boot from. 00 = inactive and 80 = active
there must only be one partition marked as 80. if more than one are marked the system will halt with the error: invalid partition table. if none are marked the system will display a hardware error like: operating system not found; this will vary from machine.
starting head ( =1 byte )

states the starting head for the partition in hex.
eg, 01 = head 1; and another example: 3f = head 63
if these values are incorrect the system will halt with: error loading operating system. the maximum number of heads is 256. if the partition is in lba mode the head will be one less than the maximum.
starting sector/cylinder ( =2 bytes )

states the sector and cylinder on which the partition begins. though it looks like the first byte states the sector and the second the cylinder in hex, this is not the case.
example: 62 sectors and 690 cylinders; from the disk read: be,b2
first convert to binary: be,b2 -> 1011 1110,1011 0010

the last 6 bits of the first byte: 11 1110 = 3e -> decimal = 62 sectors
6 bits gives a potential maximum of 63 sectors, 1 - 63 inclusively.

join the first 2 bits of the first byte with the whole second byte:
10 1011 0010 = 2b2 -> decimal = 690 cylinders
10 bits gives a potential maximum of 1024 cylinders, 0-1023 inclusively.
if these values are incorrect the system will halt with: error loading operating system.
partition type ( =1 byte )

states the type of partition, there are others, but for different systems.
the maximum number of heads = 256, the maximum number of sectors is 63 and the maximum number of cylinder is 1024. hard disk are formatted with 512 byte sectors. therefore the maximum partition is 1024 * 256 * 63 * 512 = 8,455,716,864. anything addressed over this will be a lba partition.

	fat16	fat32	extended	fat16lba	fat32lba	extended lba
visible	06	0b	05	0e	0c	0f
hidden	16	1b	15	1e	1c	1f

if a partition is marked as active and has a operating system installed and the partition is marked as hidden the system will load the io.sys and then prompt: type the name of the command interpreter (eg., c:\windows\command.com) a>_
ending head ( =1 byte )

as the starting head, but ending.
ending sector/cylinder ( =2 bytes )

as the starting sector/cylinder, but ending.
the starting sector ( =4 bytes )

this is the logical sector jump to the partition. this sector contains the partition's boot record. from the disk:
40,03,07,01 flip -> 01,07,03,40 convert to decimal = sector 17,236,800sectors in the partition ( =4 bytes )

states the number of sectors in the partition, the last sector will be one less than the total as the first sector is sector 0. from the disk: f0,ae,24,00 flip -> 00,24,ae,fo convert to decimal = 2,404,080 sectors
executable signature ( =2 bytes )

these two bytes indicate that the sector is executable, the system will check for them. if incorrect a hardware error will be displayed. example; on a toshiba satellite:
insert system disk in drive.
press any key when ready....
and on a hi-grade ultinote: operating system not found; if they are present the code will run.
sectors 1 - 62 ( =31,744 bytes )

sectors 1 - 62 inclusively are normally left empty. applications that do use it include: multi boot loaders like ranish advanced boot manager. security programs such as reflex-magnetics disknet. viruses that copy themselves to the master boot record so that they can load every time, sometimes move the real mbr into this area, plus any more virus code. full disk encryption programs and disk translation software for very large hard disks may also reside here.
boot record diagram

-> jumpcode

-> oem/id name

-> bytes per sector

-> sectors per allocation

-> resevered sectors

-> no. of fats

-> root entries

-> total sectors(16)

-> media type

-> sectors per fat

-> sectors per track

-> no. of heads

-> hidden sectors

-> total sectors(32)

-> drive id

-> nt reserved

-> extended boot signature

-> volume serial number

-> volume/partition name

-> fat type

-> executable boot(strap) code

-> executable signature

jumpcode ( =3 bytes )

the offset jump to the boot(strap) executable code plus a nop. from the disk: eb,3e,90 -> translates to: |jumpshort(to)|offset 3e|no operation|
oem/id name ( =8 bytes )

some indication to what system formatted the partition, not checked, but set for compatibility. mswin4.0 and mswin4.1 as formatted by windows 95 and 98 respectfully.
bytes per sector ( =2 bytes )

normally set to 512 bytes; from the disk: 00,02 flip -> 02,00 convert to decimal = 512 bytes. 1024, 2048 and 4096 are also valid, but are not generally used.
sectors per cluster ( =1 byte )

states the number of sectors per cluster. this will vary depending on the size of the partition. example: 10 convert to decimal = 16 sectors
for hard disks:

size ranges (mb)	fat type	no. sectors	cluster size
0 - 15	12	8	4,096 bytes
16 - 127	16	4	2,048 bytes
128 - 255	16	8	4,096 bytes
256 - 511	16	16	8,192 bytes
512 - 1023	16	32	16,384 bytes
1024 - 2047	16	64	32,768 bytes

note that in this table the cluster size is calculated with a sector size of 512, which is most common. cluster sizes should not exceed 32,768 bytes
resevered sectors ( =2 bytes )

states the number of reserved sectors. on fat12/16: 01,00 flip -> 00,01 convert to decimal = 1 sector - the boot record is this.
no. of fats ( =1 byte )

states the number fats used. normally set to 2 in case of bad sectors, which could lead to data errors. however >=1 is also valid - unsure of maximum.
root entries ( =2 bytes )

states the maximum number of 32byte entries in the root directory; unused for fat32 and set to 00,00; however for fat16: 00,02 flip -> 02,00 convert to decimal = 512; 512 * 32(bytes) = 16384 bytes - data is stored after this point.
total sectors(16) ( =2 bytes )

set if the partiton is less than 33,554,432 bytes (32mb) in size - mainly for a floppy disk: 40,0b flip -> 0b,40 convert to decimal = 2880 sectors; fat16 partitions may also use this entry. if number of sectors is above this will be set to 00,00
media type ( =1 byte )

states the physical media type; f8 = hard drive; f0 = (standard) floppy drive
sectors per fat ( =2 bytes )

number of sectors in one fat; for a floppy: 09,00 flip -> 00,09 covert to decimal = 9 * 512(bytes per sector) = 4608; there are two copies of the fat thus 4608 * 2 = 9,216 bytes - the jump to the root directory.
sectors per track ( =2 bytes )

states the number of sectors per track.
no. of heads ( =2 bytes )

number of disk drive heads; eg on a floppy disk: 02,00 flip -> 02,00 convert to decimal = 2 heads. on a hard disk this will be much more; eg f0,00 flip -> 00,f0 convert to decimal = 240 heads
hidden sectors ( =4 bytes )

this will matchup with the starting sector stated in the partitions' entry in the mbr. it states the number of hidden sectors from the beginning of the drive to the boot record of the partition. normally set to 3f,00,00,00 flip -> 00,00,00,3f convert to decimal = 63, for a primary partition. note that sector 63 will contain the boot record, as sector numbers start at zero. another example from disk: 40,03,07,01 flip -> 01,07,03,40 convert to decimal = 17,236,800
total sectors(32) ( =4 bytes )

no of sectors in the partition eg, 10,ec,03,00 flip -> 00,03,ec,10 convert to decimal = 257040 sectors (normally 512 bytes) this entry is used if total sectors(16) is set to 00,00
drive id ( =1 byte )

set to 00 for floppy disks and 80 for hard disks. also refered to as the logical drive number.
nt reserved ( =1 byte )

set at format to 00 and not checked thereafter.
extended boot signature ( =1 byte )

set to 29 indicating that the serial, label and type data is present.
volume serial number ( =4 bytes )

when a partition is formatted; quick or full, it will display the newly assigned serial such as: 15e7-2a35. this is written in reverse on the disk as: 35,2a,e7,15. calculated by combining the date and time at the point of format, it is an unique identifier to keep track of drives in use. it is not possible to retrive the date and time from the serial number.

time: 2:22:32.50p | date: (oct)10-03-2001 | serial on disk: 35,2a,e7,15

first byte is calculated as follows:
milliseconds + days -> convert to hex
50 + 3 = 53 -> = 35

the second byte is calculated as follows:
months + seconds -> convert to hex
10 + 32 = 42 -> = 2a

last two bytes are calculated as follows:
(hours [if pm + 12] * 256) + minutes + years -> convert to hex & flip
(2 + 12 = 14 * 256 = 3584) + 22 + 2001 = 5607 -> 15,e7 -> e7,15
volume/partition name ( =11 bytes )

the volume label can be up to 11 characters. it also has to be referenced in the root directory as a 32 byte entry with the volume attribute to be displayed. "no name" will normally be used when the label is unused.
fat type ( =8 bytes )

normally set to: fat12, fat16 and fat(32); this is not used to determine the fat type and can be changed, though some non-ms drivers use it. usefull as a quick reference of the fat type; though not always accurate.
executable boot code ( =448 bytes )

sets out the aforementioned partition infomation and checks for the first file to start the system; normally io.sys. if this is not present; the stated error message (or modified one) will apppear. normally as follows:
invalid system disk
replace the disk, and then press any key
od,oa meaning carriage-return and linefeed respectfully; derived from a typewritters actions. the system will look in two places for this 11 character dos named file, which can be renamed. the first 11 and 2 bytes from the end. the file must have an extension which is >= 1 letter.
executable signature ( =2 bytes )

the mbr checks for this signature: 55,aa - if absent: "missing operating system" error.
the fat diagrams

-> media type
-> partition state
-> cluster 2
-> cluster 3
-> cluster 4
-> cluster 5
-> cluster 6
-> cluster 7

-> cluster 8

-> cluster 9

-> cluster 10

-> cluster 11

-> cluster 12

-> cluster 13

-> cluster 14

-> cluster 15

-> media type

-> partition state

-> 1st of a 6 cluster entry

-> 3 cluster entry

-> 2 to 5 of a 6 cluster entry

-> 10 cluster entry

-> last cluster of 6 entry

-> available cluster

-> 2 bad clusters

fat in general

the file allocation tables (fat) are positioned between the boot record and the root directory. there are normally two identical copies made of the fat; fat1 and fat2; designed to try and prevent storage errors when disks were less reliable. the smallest size fat16 seems to be 256*512bytes
media type ( =2 bytes )

the first 2 bytes of fat16 state the media type; f8 = hard disk; floppy disks are f0; this value must match up with the media type stated in the boot record.
partition state ( =2 bytes )

set to ff,ff at format and at shut down; it means that the partition is "clean" not mounted or hasn't been written to. browsing the directories, getting properties and opening files will not mount the disk; even if the last accessed date is updated, the disk will not be mounted. however if data or an entry is rename or saved these two bytes will change to ff,f7 indicating that the partition is "dirty" mounted or in use. if a system starting up finds that the partition is still mounted, it will know that the system did not shut down properly and may run scandisk. this only applies to hard disks. jon fox informs me that this section is also used to indicate if an hardware occurred - i did not verify this ;-)
fat attributes ( varies in size )

data clusters starts at cluster 2 right after the root directory. on fat16 one cluster represented by 2 bytes in the fat. 2bytes->16bits->fat16 - fat32 uses 4 bytes. each 2 bytes in the fat mark a position in the data area of the partition. if the cluster is part of chain of clusters; occupying more than one cluster, they will be numbered in hex order. the numbers range from 03,00 to 99,ff; adding from the left. if the cluster is the last in the chain or if the entry only takes up one cluster it will be marked as ff,ff. if a file is resaved and it exceeds its allocated cluster, the file or directory list will be split onto two, and the extra clusters located elsewhere on the drive. the fat will be changed so that the last cluster in the first chain will point to the start of the next cluster chain. in the diagram above the first cluster points to cluster 6, (though labeled as 07,00 it is cluster 6). this is known as fragmenting, and can slow the system down a little as these pieces need to be reassembled before use. defragmenting will move the data around so that all the chains of clusters are grouped together. if there is no data stored or data has been deleted the fat will be marked as 00,00. sometimes the system cannot keep up with this; if a 20 cluster entry is deleted and then a new 5 cluster one created the data maybe located after the blank entries of the deleted 20 cluster one. a reboot maybe required for the area to be acknowledged. if the fat entries do not completely fill the last sector of the fat the remaining space will be left empty and scandisk will not check it. bad clusters are marked with f7,ff. data will not be written to these areas and a thorough scandisk will not recover these clusters, only report that they are there. data can be hidden in phoney bad clusters, such program needs to keep track of where the data is stored and replace certain fat entries and the data "disappears"
data entry diagram

-> ordinal field

-> unicode long file name

-> longfile name attribute

-> reserved for future use

-> dos name check sum

-> lfn data location

-> dos file name

-> entry attributes

-> nt reserved

-> create time

-> create date

-> access date

-> access time

-> modified time

-> modified date

-> data location

-> data length

entries in general

entries are made up of 32 bytes. if the entry is deleted the first byte is changed to e5; and the sectors are marked as free. basic computer forensics can reveal alot because of this. if this is a risk, checkhttp://www.fortunecity.com/skyscraper/true/882/Comparison_Shredders.htm for prevention programs. defraging the disk will compress the directory entries and clear any redundent ones; it will also rearrange the data so that it is grouped together, but old data will still be there. if the first byte is 00, entries are considered to have ended for that directory.
_be aware of that_
ordinal fields ( =1 byte - every 32 bytes of the lfn)

the first byte of each 32 byte string of the long file name is called the ordinal field. it tells the system which order the entries are to be read in. this is in hex and read from 01. the first byte of the _entire_ entry however is different, it defines the length of the total lfn entry.
from the root dir:

letter	the long file name's...	no. of 16 byte lines/size
a/41 b/42 c/43 d/44 e/45 f/46 g/47 h/48 i/49 j/4a k/4b l/4c m/4d n/4e o/4f p/50 q/51 r/52 s/53 t/54	length is >=001 & <=013 length is >=014 & <=026 length is >=027 & <=039 length is >=040 & <=052 length is >=053 & <=065 length is >=066 & <=078 length is >=079 & <=091 length is >=092 & <=104 length is >=105 & <=117 length is >=118 & <=130 length is >=131 & <=143 length is >=144 & <=156 length is >=157 & <=169 length is >=170 & <=182 length is >=183 & <=195 length is >=196 & <=208 length is >=209 & <=221 length is >=222 & <=234 length is >=235 & <=247 length is >=248 & <=250	02 lines 032 bytes/020 04 lines 064 bytes/040 06 lines 096 bytes/060 08 lines 128 bytes/080 10 lines 160 bytes/0a0 12 lines 192 bytes/0c0 14 lines 224 bytes/0e0 16 lines 256 bytes/100 18 lines 288 bytes/120 20 lines 320 bytes/140 22 lines 352 bytes/160 24 lines 384 bytes/180 26 lines 416 bytes/1a0 28 lines 448 bytes/1c0 30 lines 480 bytes/1e0 32 lines 512 bytes/200 34 lines 544 bytes/220 36 lines 576 bytes/240 38 lines 608 bytes/260 40 lines 640 bytes/280

the 32 byte blocks are positioned in reverse order with the last section at the beginning of the entire entry.
the long file name

the name is stored in unicode format. a double byte character system designed to handle all possible foreign and scientific characters. the orginal ascii characters are the same except they are two bytes in size, the second byte is a null; 00. checkhttp://www.unicode.org for a more in depth explaination. there can be up to 13 unicode characters per 32 byte section. if however the long file name does not fill the slot exactly a unicode null (00,00) will be added to the end, followed by ff,ff's until the section is filled. note that entries do not have to have a lfn.

as you can see from the table above a long file name in the root directory can be between 1 and 250 characters. this is alittle odd as there is still space for 10(?) more characters, also stated by microsoft that files could have upto 255 characters. total path length; tpl refered to in this text is the character length from the drive letter to the folder or file, eg: "c:\new folder" has a tpl of 13. "c:\new folder\test.dat" has a tpl of 22. a large tpl can have strange effects on explorer. a single folder in c:\ can have a tpl of 253 (250 + c:\) it can only contain files <= 4 characters in length. however if there are two folders the tpl can be up to 255, with 2 remaining for files. the maximum valid tpl for 98f16 including a file is 258. note that this value can change alittle, eg one character folders; c:\a\a\a\...etc (122 folders; maximum) can have a tpl length of 254, including 7 for a file; and even this can change, if you paste a file in it can be up to 12 characters for a file. why this varies is unclear. explorer checks the tpl on entry creation to see that it does not exceed an illegal value, however it only checks it up to that point. thus two folders could be created, and the first one renamed to a longer length so that when the subfolder is accessed the tpl is greater than allowed. while a tpl of such length will have stange effects on the system eg, inaccessable, unviewable, unmoveable, undeleteable, false properties of files and folders; scandisk will fix them by either renaming the affected files or folders and/or moving them to the root directory. one combination is of note. create a folder in the root directory with a name of 1 character, save a file of 5 characters in length into the folder, rename the folder so it has 250 characters in the name. tpl is 259. properties are correct for the file and it can be opened and resaved to the same location, however it cannot be moved out of that folder nor renamed or deleted, to do so the foldername must be shortened. this doesn't stop the file being opened and resaved to a different location. scandisk doesn't seem to mind this combination.

not all ascii (unicode) characters can be used in long file names. names cannot contain the following characters: \/:*?"<>| if the name begins with a space it will be removed, if a fullstop - prompt for a valid name. if the name ends with a fullstop or spaces they will be removed. letters from the extended character set can cause some confusion of explorer in 9x/me systems. the following acsii characters inclusively are of note in 9x: 158, 169, 176->224, 226->229, 231->240, 242->245, 247, 249, 251->252 and 254->255; 75 characters. in me: 176->180, 185->188, 191->197, 200->206, 213, 217->220, 223, 242 and 254; 31 characters. if a folder contains any of this characters you cannot access it via explorer; it errors with "the folder 'path' doesn't exist" twice. properties are displayed incorrectly. copying and deletion attempts result in "cannot delete file file system error (1026)." explorer will prevent the entering of these characters by turning them in the underscore. they can be entered in a dosbox. check numlock is on; normally by default, then press alt+type the number on the keypad - laptops normally alt+fn+no. if a file has these characters in, when opened it will prompt "cannot find the 'path\file' do you want to create a new file?" clicking no creates an untitled blank document. clicking yes creates a new blank file, but with the illegal character an underscore in the name - resave it. now, and this is quite interesting; when opening or deleting the illegal file, it will open/delete the one with the underscore in. this means that explorer, on finding a entry with a character in that it cannot handle, scans the current directory for one of the same name, but with an underscore in. folders can also be "redirected" this way and the underscore named entry will be opened with internet explorer. scandisk doesn't seem to mind this.

some whole words are also a problem. you cannot create directories or files of the following names: aux, con, nul, prn, com1, com2, com3, com4, lpt1, lpt2, lpt3, lpt4, lpt5, lpt6, lpt7, lpt8, lpt9, clock$ and config$ in total, 19 words. it will error with either: unable to create directory or cannot rename thefilename: access is denied. it seems that these values, reserved hardware device/port names, may already be in use by the operating system - they are mentioned in the io.sys. attempts to access a folder with a subfolder of both the same reserved name will crash/freeze the system for: aux\aux, con\con, nul\nul, clock$\clock$ and config$\config$. the others will result in the error: invalid directory. you cannot create files or folders in windows of these reserved words, but you can change them with a hexeditor on the disk, most result in either errors, instant freezing/crashing of the system and nondeletable, noncopiable or inaccessable entries in explorer. a lot of these entries' properties are reported as 112bytes. scandisk will rename most reserved names with a hyphen on the end. however scandisk does seem to mind the following names: lpt4 to lpt9. the names have to be in uppercase or scandisk will error and fix to uppercase. the folder 'path' does not exist error appears twice on attempted access; files cannot be opened. cannot delete file: file system error (1026). properties report the folder as a file of zero bytes. cannot copy file: file system error (1026) note that these may vary as hardware configurations may be different.
lfn attributes and location

( = 1 byte and 2 bytes respectfully; every 32 byte section of the lfn )

entire entries are read in as 32 byte blocks. to ensure compatiblity with older systems, when they introduced long file names, each section of a long file name had to "pretend" to be an entire entry. to do this the entry attribute and data location are set to the "impossible values" of 0f and 00,00 respectfully. each 32 byte section of the long file name is required to have this slotted in.
lfn reserved ( =1 byte - every 32 bytes of the lfn )

set to 00 at entry creation. it is reserved for future use; however copying or renaming a file/folder resets it to 00. resaving a file retains any changed values.
dos name checksum ( =1 byte - every 32 bytes of the lfn )

this is for checking that the dos name and the long file name match up correctly. if this value is incorrect, the lfn will be discarded and the dos name subsituted.

the steps are:

1. take the ascii value of the first character. this is your first sum
2. rotate all the bits of the sum rightward by one bit
3. add the ascii value of the next character with the value from above. this is your next sum
4. repeat steps 2 through 3 until you are all through with the 11 characters in the 8.3 filename

note that spaces (ascii value 20) are also included.

to calculate manually use calc.exe; view scientific, switch to hex mode and select the byte radiobutton under the display.

dosname: UNTITLEDTXT - lfn checksum: 44
in this section "->" means rotate all the bits, one bit to the right.

U = 55 = 0101 0101 -> 1010 1010 = AA
N = 4E + AA = F8 = 1111 1000 -> 0111 1100 = 7C
T = 54 + 7C = D0 = 1101 0000 -> 0110 1000 = 68
I = 49 + 68 = B1 = 1011 0001 -> 1101 1000 = D8
T = 54 + D8 = 2C = 0010 1100 -> 0001 0110 = 16
L = 4C + 16 = 62 = 0110 0010 -> 0011 0001 = 31
E = 45 + 31 = 76 = 0111 0110 -> 0011 1011 = 3b
D = 44 + 3b = 7f = 0111 1111 -> 1011 1111 = bf
T = 54 + bf = 13 = 0001 0011 -> 1000 1001 = 89
X = 58 + 89 = e1 = 1110 0001 -> 1111 0000 = f0
T = 54 + f0 = 44
dos file name ( =11 bytes )

dos names can be >=1 and <=11 characters. any remaining bytes will be filled with spaces. if the entry also has a long file name attached the dos name is changed slightly. the name is shortened to 6 characters and a tilde~ and number are added to the end, giving a total of 8 characters. if the first 6 letters are different from all other dos names in that directory then the ending is ~1 however if they are the same the ending number will be different. the system scans the dos names in that directory for the lowest available ending number to use, incrementing by 1 (decimal) as needed. when ~10 is reached the dos name is reduced to 5 characters to make room. if a file is copied to a different directory the dos name and long file name checksum may change, as the system checks both dos and long file names already in use. process referred to in this text as tilded. the last three letters of a dos name are considered the file extension and will be divided off from the rest by a space or a fullstop. all letters are converted to uppercase. if an entry has its dos name converted to lowercase it can cause problems. while files handle okay, attempts to open a folders results in the error: c:\folder is not accessible. this folder was moved or removed. in a dosbox the result is path not found and the volume serial number and name are displayed, it can however be deleted, in dos or explorer. scandisk will fix this by converting back to uppercase. if the name contains spaces, they will be removed and the name tilded. if the name contains a fullstop, upto the first three letters thereafter are considered the extension. if the extension is more than three letters, just the first three will be used plus the name is tilded. if the name contains more than one fullstop the last one is used as the divide between the name and extension. all other fullstops are removed and the name is tilded.

lfn names cannot contain the following characters: \/:*?"<>| some can be attempted to be used in dos, but they have strange effects. tested in a dosbox; file creator is "copy con filename" typed text "crtl + z","enter"
\ creation: path not found; rename: invalid parameter
/ creation: invalid switch; rename: anything after and including the forward slash will be removed
: creation: to many parameters; rename: file not found
* creation: anything after and including the asterisk; but not the extension will be removed. * is a wildcard
? creation: the question mark is removed; rename: either the question mark will be substituted for an other letter or it will be removed; how it substitutes is unclear. ? like * is a wildcard
" creation: the double quotation mark is removed; rename: as creation
< creation: file not found; rename: as creation
> creation: splits into two different file at the greater-than sign. the first half contains the text, while the second contains the following text: " 1 file(s) copied" - the confirmation that appears after the text is saved; rename: as creation, but the second half contains nothing as there isan't a confirmation on rename. the > character pushes screen output to "somewhere" as shown in the example above a file. >> appends to "wherever"
| creation: anything after and including the vertical bar will be removed, also on save the message bad command or file name appears; rename: as creation. the | can be used to "pipe" instructions eg: echo y|del *.* >nul will quietly delete all files in the current directory (hidden, readonly and system attribute file are not deleted)
entry attributes ( =1 byte )

documented attribute values
none: 00
archive: 20
read-only: 01
system: 04
hidden: 02
directory: 10
volume: 28 (hdd)

if attribute = 00 then its treated as a file.

for archive, hidden and system attributes; add the values together: 26

archive and directory *can* also be unoffically stated as other values. read in the first nybble and convert it to decimal. if its divisible by 2 its an archive, else its a folder.

if the second nybble is >=8 and <=e the entry disappears and becomes the volume name. the volume attribute should only be stated once on the partition, offset 15h. sometimes there will be an entry already in root that will override this. this is valid if the entry has no data attached, else scandisk will delete and recover any clusters. n.b: volumes are archives; if stating it in the root (this will only work in root) so f8 is invalid here. there can only be one valid entry in the root that can have the volume attribute.

if the second nybble is =f the entry disappears completely, however its still a volume. scandisk will error if there is data attached, and delete any data.

volumes can labelled <=11 characters from explorer, however you can increase the length by saving an entry in the root directory and changing its attributes to a volume, this can have some interesting effects. volume names >=12 and <=32 will prevent renaming of the label via explorer even though the text field will be editable. error: access denied. >=33 the label will be greyed out and uneditable. volume names of >=78 will cause illegal operation errors and not enough available memory errors on attempted format in explorer. volume names of >=83 will cause scandisk to crash in a similar way, and reboot maybe needed even if the volume attribute is removed. all values above these have not been tested, but are believed to be the same. partitions can still be formatted in dos/dosbox.
ntreserved ( =1 byte )

set to 00 at entry creation and never modified or checked thereafter.
reserved for windows nt. copying the file resets the attribute, but renaming doesn't.
create time ( =3 bytes )

minimum time: 00:00:00 = 00 00 00 if zero, no time in properties
maximum time: 23:59:59 = 64 7D BF
how it calculates it:
the values on the disk are: 64,90,a6 and properties: 8:52:33pm
first flip the bytes: 64,90,a6 -> a6,90,64
convert to binary: a6,90,64 -> 10100110,10010000,01100100
divide up the sections and convert back to decimal: (from left to right)
(5bits;hour) 10100 -> = 20hrs (24hr) or - 12 = 8pm
(6bits;mins) 110100 -> = 52 minutes
(5bits;secs) 10000 -> 16; * 2 = 32 seconds
(8bits;mili) 01100100 -> = 100 milliseconds
if millisecs >=000 and <=099; seconds is correct + no. of milliseconds
if millisecs >=100 and <=199; seconds + 1 = seconds + no. of milliseconds
if millisecs >=200; seconds + 2 = seconds (etc) but its considered invalid
which gives 33 seconds exactly: 8:52:33pm
invalid times such as 2600hours simply roll fowards to become 0200hours in properties, scandisk does not error.
create date ( =2 bytes )

minimum date: 1/1/1980 = 21 00
maximum date: 2/7/2106 = 46 FC
how it calculates it:
the values on the disk are: 14,2b and properties: 20th august 2001
first flip the bytes: 14,2b -> 2b,14
convert to binary: 2b,14 -> 00101011,00010100
divide up the sections and convert back to decimal: (from left to right)
(7bits;yr) 0010101 -> 21; + 1980 = 2001
(4bits;mt) 1000 -> = 8 or august
(5bits;dy) 10100 -> = 20th
20th august 2001
invalid dates such as the 31st of september simply roll forwards to the 1st of october in properties, scandisk does not error.

the last possible create date and time is:
sunday, february 07, 2106 7:28:15am anything beyond = (unknown)
the create date and time seem to be handled together though they are separate entries.
access date ( =2 bytes )

minimum date: 1/1/1980 = 21 00
maximum date: 2/7/2106 = 46 FC
this date is highly changeable, just right clicking on it will reset to current date, however it can be correctly querried programatically.
this is calculated the same way as the modified date (see above)
access time ( =2 bytes )

minimum/maximum: 00 00
this is a strange entry, it has to be 00 00, if you change it manually, windows changes it back if you view the properties of the file, or if you resave it. therfore you can only get access properties to the day.
modifed time ( =2 bytes )

00:00:00 = 00 00 if zero, no time in properties
23:59:58 = 24 28
this is calculated the same way as the modified time (see above) except that it does not have the same accuracy; one less byte. thus the modified time is to the nearest 2 seconds.

the last possible modified date and time is:
sunday, february 07, 2106 7:28:14am
modified date ( =2 bytes )

minimum date: 1/1/1980 = 21 00
maximum date: 2/7/2106 = 46 FC
this is calculated the same way as the modified date (see above)
data location ( =2 bytes )

the minimum can be 00 - 0 and the maximum ff - 65535
the correct value will point the os to the starting cluster of the data.
eg, 03 00
flip these values: 00 03
convert to decimal: 3
data starts at the beginning of the third cluster.

if an entry points to the same cluster they are said to be cross-linked, this is of note regarding folders. foldernames mentioned are only for reference. create a folder in root called folder1, create a subfolder within called folder2. change the location of folder2 to 00. attempts to access folder2 result in explorer looping back to root. scandisk will error and the fix is to move/recover folder2 and its contents to the root directory. scandisk can get a little muddled if you create a subfolder within folder2 called folder3 and point the location of folder3 to folder2. the default fix is to give each file a separate copy of the shared cluster(s) if this is attempted scandisk will loop at each attempt, and any data in folder3 maynot be recovered. there are, however other fix options available which will recover the data, though some directories maybe undeletable due to an exceeded total path length, just shorten the folder name.
data length ( =4 bytes )

the minimum can be 00 00 00 00 - 0 and the maximum ff ff ff ff -
4,294,967,295
gb, mb, kb, by

this entry will state the length of data to read in.
eg, AC 3B 96 00
flip these values: 00 96 3B AC
convert to decimal: 9,845,676 bytes or 9.38MB
folders have a value of: 00 00 00 00

the maximum is restricted by the size of the partition. the largest partition creatable by fdisk for fat16 is 2047.31mb (2,146,765,824 bytes) entry stated as 00,80,f0,7f. the largest file creatable in this partition is 1.99gb (2,146,467,840 bytes). not all the data area is filled, 18,944 bytes of surplus sectors were left empty at the end.
subdirectories ( =64 bytes )

at the beginning of all directories (not root) there will be two folder entries of total 64 bytes before the list of files or folders within that directory. they are dot and dotdot and are visable in dos. dot is the current folder and dotdot is the parent folder. each entry will have the following properties: a dos name of either dot or dotdot; attributes of a folder; the create, access, modified date and time, though only the modified date and time are required; the cluster location of the folder, dot will be the same as the current folder and dotdot will be the same as the parent folder or 00 if root; and a data length of zero. also these entries have to be at the beginning of the directory list. a three dot entry is not valid even though you can change to two folders up. you can add more entire "dot" entries without scandisk erroring, on the condition that the dos name, the directory attribute, the cluster location matchup and the data length is zero. these extra entries will also not be visable in explorer and they do not have to be at the beginning of the directory list. folders seem to handle okay without the dot and dotdot entries and the system doesn't check the location values when changing directory.

the root directory in fat16 is a fixed at 16,384 bytes in size. in total: 512 dosname entries of 32bytes or 256, 64byte entries with a lfn of upto 13 characters. if the maximum lfn entry is used, a maximum of 24 entries can be listed in the root directory with 256 bytes remaining. at this point errors will occur if any entries are attempted to be added or lengthen. entrycopy: "cannot copy thefile: the directory or file cannot be created." entryrename: "cannot rename thefile: access is denied. make sure the disk is not full or write-protected and that the file is not currently in use."

subfolders can have many entries. when a subfolder is created, 1 cluster is set aside for entries. when this is exceeded the directory list extends into another cluster, usually one is not avaiable right after the first section, as a result directory lists get fragmented accross the drive.

'TechnoBabbler' 카테고리의 다른 글

Reverse engineering techniques to find security bugs: Alex Sotirov (0)	2009/07/01
FAT 파일 구조 (0)	2009/06/30
호주·캐나다, IT개발자 이민 환영! (6)	2009/06/29
초보자를 위한 WinDbg (12)	2009/06/25

FAT, FAT12, FAT32, MBR

Trackback0 : Comment0

Visual Studio 애드인으로 작성된 Mono Tools

2009/06/29 22:36

[Visual Studio]

출처: http://www.mono-project.com/news/archive/2009/Jun-08.html

오.. 항상 생각해왔던 애드인이었습니다.

내가 작성한 코드가 모노와 호환이 되는지 알 수 없을까?

내가 작성한 코드를 모노 환경에서 실행할 수 없을까?

잘 만들어 주었군요. ^^ 감사히 잘 사용하겠습니다. ㅋㅋ

'Visual Studio' 카테고리의 다른 글

SmallBasic 0.5 출시 (2)	2009/06/30
Visual Studio 애드인으로 작성된 Mono Tools (0)	2009/06/29
C# Interactive Shell (0)	2009/06/29
무료 기술 서적 - Inside C# (한글 번역본) (6)	2009/06/24

Mono, Visual Studio, visual studio add-in, 모노, 비주얼 스튜디오

Trackback0 : Comment0

C# Interactive Shell

2009/06/29 22:26

[Visual Studio]

출처: http://www.mono-project.com/CsharpRepl

그렇지 않아도 얼마전에 관련글을 올린적이 있었죠.

2009/05/18 - [Visual Studio] - 동적으로 C# 코드 결과 확인하기, Interactive C# Shell

조금 더 업그레이드된것 같아 다시 소개합니다. 그나저나 1 == 1; 의 결과를 RegisterTransformHandler를 이용하여 이모티콘으로 보여주는 센스는 참 기가 막히군요. ^^

'Visual Studio' 카테고리의 다른 글

Visual Studio 애드인으로 작성된 Mono Tools (0)	2009/06/29
C# Interactive Shell (0)	2009/06/29
무료 기술 서적 - Inside C# (한글 번역본) (6)	2009/06/24
C# 업그레이드 Compiler As a Service (0)	2009/06/07

C#, interactive, Mono, Shell, 모노, 쉘

Trackback0 : Comment0

호주·캐나다, IT개발자 이민 환영!

2009/06/29 22:22

[TechnoBabbler]

출처: http://news.jknews.co.kr/article/news/20090610/8385192.htm

무슨 홍보 기사같지만, 그냥 짤방으로 하나 올려봅니다.

호주 이민성은 현재 일시적으로 IT개발자에게 이민 문호를 개방하고 있다. 해외 취업을 생각하고 있는 IT개발자면 지금이 호주의 영주권을 취득할 좋은 기회다. 호주 이민성은 C++, C#, C, CISSP, JAVA, J2EE, Network Security, Oracle, PeopleSoft, SAP, SIEBEL 등을 부족한 기술자로 정의, 경력자들에게 영주권의 혜택을 주고 있다.

아는분이 호주로 이민가시겠다고 하던데, 요런 프로그램을 이용하는 것도 좋겠군요. 영주권까지 준다니 대단한 지원인듯..

'TechnoBabbler' 카테고리의 다른 글

FAT 파일 구조 (0)	2009/06/30
호주·캐나다, IT개발자 이민 환영! (6)	2009/06/29
초보자를 위한 WinDbg (12)	2009/06/25
재미나군요. (0)	2009/06/25

IT, 개발자, 이민, 캐나다, 호주

Trackback0 : Comment6

#1 #2 #3 #4 #5 ... #50