Yep,
so,
as expected, First Sector of Physical drive is a MBR, so far there is nothing "new", this is the normal behaviour of the HP utility, i.e. place a MBR on the stick with just one partition entry, active, covering the entire capacity, formatted with the chosen filesysten, FAT16, FAT32 or NTFS (the latter in this case).
First sector of Logical drive (partition) is the standard 2K/XP/2003 NTFS bootsector.
Let's however have a look at the MBR, at first look it appears to be "standard"
(the default one in English) beginning with 33C08E, it means that it is one that comes from "Windows":
http://www.boot-land.net/forums/index.php?...c=2220&st=3more exactly, it is the version that comes with 2K/XP/2003,
though it appears to have some slight modifications:
1) bytes 202, 203 and 204 are EB1A90 instead of B80102
2) bytes 437, 438 and 439 are 000000 instead of 2C4463
(the third difference, i.e. the presence of Disk Signature 69708B00 is "normal", it only means that the stick has been mounted/accessed under a 2K/XP/2003 OS)
The 2C4463 appears is an offset for "help messages", 2C4463 is the offset for English, reference is here:
http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htmMuch more interesting is the other modification, on the same page there is a disassembly that reads:
CODE
06CA B80102 MOV AX,0201 ;| INT 13, Function 2
the code changed to EB1A90 means:
CODE
EB1A jmp E6
90 NOP
more in detail:
CODE
000000CA: EB1A jmps 0000000E6 --- (4)
000000CC: 90 nop
000000CD: BB007C mov bx,07C00;"| "
000000D0: 8B4E02 mov cx,[bp][02]
000000D3: 8B5600 mov dx,[bp][00]
000000D6: CD13 int 013
000000D8: 7351 jae 00000012B --- (5)
000000DA: 4F dec di
000000DB: 744E je 00000012B --- (6)
000000DD: 32E4 xor ah,ah
000000DF: 8A5600 mov dl,[bp][00]
000000E2: CD13 int 013
000000E4: EBE4 jmps 0000000CA --- (7)
000000E6: 8A5600 mov dl,[bp][00]
000000E9: 60 pusha
so with reference to the linked page, the code appears to jump unconditionally over a section of code:
QUOTE
06C1 7723 JA 06E6 ; Check for Extended INT 13.
06C3 7205 JB 06CA
06C5 394608 CMP [BP+08],AX
06C8 731C JNB 06E6 ; Check for Extended INT 13.
06CA B80102 MOV AX,0201 ;| INT 13, Function 2
06CA EB1A JMP 06E6 ;| SKIP UNCONDITIONALLY OVER code in RED below:
06CC 90 NOP
06CD BB007C MOV BX,7C00 ;| (ES):BX = Memory Buffer
06D0 8B4E02 MOV CX,[BP+02] ;|
06D3 8B5600 MOV DX,[BP+00] ;|
06D6 CD13 INT 13 ;| "Read 1 Sector into Memory"
06D8 7351 JNB 072B
06DA 4F DEC DI
06DB 744E JZ 072B
06DD 32E4 XOR AH,AH ;| INT 13, Function 0
06DF 8A5600 MOV DL,[BP+00] ;| DL=Drive Number
06E2 CD13 INT 13 ;| "Reset DISK System"
06E4 EBE4 JMP 06CA
; The following are the "INT 13 Extensions Installation Check" and
; the Extended READ sectors from Hard Drive (Function 42h) routines.
06E6 8A5600 MOV DL,[BP+00] ;| DL = Drive Number.
If you look at the last few lines before the modified code, you will see that they contain CONDITIONAL jumps, that only if INT13 Extensions are found, will jump to E6 (GREEN code).
Most probably this is done to workaround "defective" BIOSes that do not correctly give information about INT13 Extensions on the USB bus.
This has of course NOTHING to do with the drive being seen as A:\ or C:\, the stick thus formatted has a MBR and therefore, at least from the MBR and bootsector side, it will appear as C:\, besides the bootsector has on offset 21 the "F8" media descriptor, that corresponds to "Hard drive".
Nor it has ANYTHING to do with the reported grldr/grldr.mbr thingie.
BUT it is a
GREAT find!
This
finally explains
WHY the "HP" utility appears to boot from a larger number of systems!
It simply skips over a (probably unneeded on modern motherboards,
read motherboards with USB boot capability) check that can possibly be a cause of error with some "bad" BIOSes. (Int13h extensions,
read LBA addressing) have been implemented at least since 1995, as Windows 95 First edition came with the new 0E and 0F "LBA addressed" partitition types:
http://en.wikipedia.org/wiki/INT_13http://www.linux.com/howtos/Large-Disk-HOWTO-4.shtmlhttp://oldfiles.org.uk/powerload/tmeline2.htmhttp://www.win.tue.nl/~aeb/partitions/partition_types-1.htmlI had looked, say, several tens of times to the MBR produced by the HP utility, but since it is (except from those few bytes) identical to the standard 2K/XP/2003 MBR I always assumed (wrongly) that it was the same one.
I have no idea, nor enough Assembly knowledge, to understand why:
1) the 2C4463 has been "zeroed" out, the only effect should be that in case of a booting error no message is shown on the screen
2) why the unconditional jump has been placed AFTER two conditional ones, logic should call for placing the unconditional one BEFORE them
Maybe some member with more knowledge in this field can share some light on the above.
Anyway, a large part of the mistery has nonetheless being solved, and I am very happy about it, thanks to Mike69 for making me have this closer look at it!

jaclaz
P.S.: @Mike69 Now we can go on, can you simply try deleting the grldr.mbr/ntldr.mbr from the stick and see if it stops booting?