Hello,

I'm not very used in asm programming but I have to create a little program which will erase (or write zeros on) the firts 128 sector of a HDD. I know I've to use int 13h but not much more.

Another question : how will windows 2k react? Will it permit the zeroing without any question?

I've done a little search in the main forum but to no avail.

Can someone help me?

Tanks in advance.

Bregolhen
Posted on 2006-04-12 14:15:18 by bregolhen
win2k probably wont allow it directly, unless you use createfile or ioctls, that is of course assuming the program is a win32 executable, if its a dos exe/com file it will probably work
Posted on 2006-04-12 14:28:18 by evlncrn8
hello,

I think I will try to compile to a 16bits .exe or .com file.

I want to reassure you : I don't want to write some virus. It just a bit of homework given by one of my teacher.

Tanks

Bregolhen
Posted on 2006-04-12 14:32:12 by bregolhen
A dos program using int13 most likely will not be allowed to do this under NT systems, it certainly wasn't allowed to do it even under win9x. Under NT, you can CreateFile (see the MSDN documentation) and write directly, but of course only if you have administrative privileges.

Why would your teacher want you to make an app like this?
Posted on 2006-04-12 16:14:57 by f0dder
Why would your teacher want you to make an app like this?



I dont't know. She didn't say and we (the students) didn't think to ask. For now, it's holyday and we have to get back the results for the 1st day of school. After that it will be useless to ask for explanations.  :)

Bye,

Bregolhen
Posted on 2006-04-12 16:29:25 by bregolhen
Call/email her? Which platform must the code run under, and which assembler do you use?
Posted on 2006-04-12 16:56:13 by f0dder
Of course, you realize that once you zero the FAT, the HDD will be trashed.  Perhaps you should only zero sectors 2 through 128?  Not my hard drive but thought you might like to know.

Paul
Posted on 2006-04-12 16:59:57 by PBrennick

Of course, you realize that once you zero the FAT, the HDD will be trashed.  Perhaps you should only zero sectors 2 through 128?  Not my hard drive but thought you might like to know.

Not the HDD, just all the files on it (and still with good recovery chances based on file contents) - a format and the drive is up-and-running again. But still, it's not something you'd want to run on your drive without knowing it, and requests of this type make me suspicious.
Posted on 2006-04-12 17:08:39 by f0dder
Ahhhh, actually, once both copies of the FAT are erased, recovery becomes VERY tedious and almost impossible.  The FAT is the ONLY way to recover the chain of sectors used by any given file.  So once the first 2 sectors are erased the hard drive's data is effectively lost.  ASCII data that is in the clear is easily recovered, but programs, etc. Forget it.

I, also, tend to get suspicious when these type of requests pop up.

Paul
Posted on 2006-04-12 18:15:58 by PBrennick
I've seen GetDataBack recover some pretty trashed filesystems. Just takes longer to reconnect everything that is left.

The one thing I can suggest to you, bregolhen, is that you don't use this program outside of a controlled environment (trashable computer or emulator with 16-bit DOS)... and especially not your computer :)

I suggest using Bochs with a DOS Bootdisk in order to test this program accurately and securely.

Other than that, DOS (actually BIOS) int 13 alone is pretty useless outside of a 16-bit Real Mode environment (16-bit DOS).
Posted on 2006-04-12 18:40:52 by SpooK
Well, once the FAT is gone (in the case of FATx filesystems) or other filesystem structures (MFT in case of NTFS) is gone, recovery *does* become very tedious. But there's some applications out there that are pretty good at doing it - at least with drives that aren't too fragmented :)
Posted on 2006-04-12 18:41:02 by f0dder
I've heard about applications/devices/tools/methods/whatever that can recover files from a disk that was zeroed, 1-ed, 0-ed, 1-ed and so on, severeal times.

Where there is a will, there is a way :P
Posted on 2006-04-12 20:59:25 by ti_mo_n
ti_mo_n,
It is truly amazing as to what can be done, isn't it?

Paul
Posted on 2006-04-12 23:29:46 by PBrennick
Digital representation of a analog process :)
Posted on 2006-04-12 23:32:29 by SpooK