闪存驱动器的第一个扇区(MBR)在插入计算机后是否得到执行 [英] Does the first sector (MBR) of a flash drive get executed on insertion into a computer
问题描述
每当我将闪存驱动器插入任何计算机时，是否会执行前512个字节?如果是(应该是这种情况)，那么我想如果我解压缩MBR并放入一个引用中，该引用指向已存储的可执行文件(在闪存驱动器上)的存储位置，即使该可执行文件也将，只要将其插入计算机即可执行..
我该怎么做?我的意思是，仅执行简单的call <address>就不会这样做.我也想了解更多有关闪存驱动器MBR的信息，因为它们与引导操作系统的MBR不同.谷歌搜索它并没有显示任何有用的东西.所以我想到问社区，是否有人以前做过这样的事情.
- 否
- 在某些操作系统中有一个自动运行"功能，已过时.
闪存驱动器基于传统技术的层次，从而避免了对驱动器的需求.
在最低级别上，有USB数据包(请参阅大容量存储设备规范，根据Pascal Cuoq)
每个USB事务都是一个SCSI命令/响应对.
操作系统将闪存驱动器视为SCSI磁盘(例如，在Linux中，您将看到/dev/sdX).
由于闪存驱动器似乎是普通的SCSI磁盘，因此它通常具有MBR/分区表. 但是，大多数操作系统都支持超级软盘"模式，在这种情况下，磁盘以FAT引导扇区开头.某些较小的闪存驱动器，或使用旧版实用程序格式化的闪存驱动器，可能处于该配置中.
您可以使用Microsoft的DSKPROBE实用程序(使用PhysicalDrive选项)或使用dd.exe(使用.\ PhysicalDriveX(其中X是数字..通常为2)，基于Windows)上的Windows上的闪存驱动器MBR作为示例你有很多硬盘)
在配置正确的计算机上，插入设备后无法执行代码.
即使默认启用了自动运行"功能，您也需要使用看起来像CDROM的设备.
(SCSI命令集使设备可以说出它是CD还是HD，并且闪存驱动器固件可以轻松说谎)
Do the first 512 bytes get executed whenever I insert the flash drive into any computer? If yes (which should be the case), then I suppose if I extract and disassemble the MBR and put in a reference that points to a memory location of a stored executable (on the flash drive), even that executable will be executed whenever its plugged in a computer..?
How could I do that? I mean, only by doing a simple call <address> won't do it.. I also wanna know more about MBRs of flash drives since they are different from those MBRs which bootstrap an Operating System. Googling for it doesn't show up anything useful at all..So I thought of asking the community, if anybody has done something like this before.
- No
- There's an "autorun" feature in some Operating Systems, which is deprecated.
Flash drives are based on layers of legacy technology, to avoid the need for drivers.
At the lowest level, there are USB packets (see the Mass Storage Device spec, as per Pascal Cuoq)
Each of the USB transactions is a SCSI command/response pair.
The OS treats the flash drive as a SCSI disk (you'll see /dev/sdX in Linux, for example).
Since the flash drive appears to be a normal SCSI disk, it usually has a MBR/partition table. However, most operating systems support a "superfloppy" mode, in which case the disk starts with the FAT bootsector. Some smaller flash drives, or those formatted with legacy utilities, might be in that configuration.
You can example the flash drive MBR on windows with the DSKPROBE utility from Microsoft (Use the PhysicalDrive option), or with 'dd.exe' using .\PhysicalDriveX (where X is a number ..typically 2, based on how many hard drives you have)
On properly configured computers, there is no way to execute code when a device is plugged in.
Even when 'autorun' capability was default-on, you needed to use a device which appeared to be a CDROM.
(The SCSI command-set allows a device to say whether it's a CD or HD, and the flash-drive firmware can easily lie)
这篇关于闪存驱动器的第一个扇区(MBR)在插入计算机后是否得到执行的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
