Skip navigation

How can I wipe the Master Boot Record?

A. The normal method is using the DOS FDISK command:

C:\> fdisk /mbr

however there are some cases where this does not work and a more direct method may be needed.

A program called DEBUG.EXE is supplied with DOS, Windows 9x and NT and can be used to run small Assembly language programs and just such a program can be used to wipe the MBR. Perform the following, but BE CAREFUL, this WILL wipe your MBR leaving your system unbootable and its data lost.

  1. Boot to 9x or DOS (this cannot be done from NT since direct disk access is not allowed)
  2. Start a command prompt
  3. Enter the following commands (in bold):
    C:\> debug
    -F 9000:0 L 200 0
    -a
    0C5A:0100 Mov dx,9000
    0C5A:0103 Mov es,dx
    0C5A:0105 Xor bx,bx
    0C5A:0107 Mov cx,0001
    0C5A:0109 Mov dx,0080
    0C5A:010A Mov ax,0301
    0C5A:010D Int 13
    0C5A:0110 Int 20
    <press Enter twice>
    -u 100 L 12   <check the code matches the above>
    -g    <executes>

    Program terminated normally
    -quit

Click here to view image

You can now install a replacement MBR via a normal installation.

Thanks to Mark Minasi for giving permission to reproduce this Assembler code and a full explanation can be found in Windows NT Magazine Summer 1999 issue

Another method from David Lynch:

C:\&gt; debug<br>
-a<br>
xxxx:0100 mov ax,0301<br>
xxxx:01xx mov cx,1<br>
xxxx:01xx mov dx,80<br>
xxxx:01xx int 13<br>
xxxx:01xx int 3<br>
xxxx:01xx &lt;CR&gt;<br>
-G

 This is much shorter. It has 2 theoretically possible failure cases

  1. ES:BX accidentally and randomly points to a valid MBR. This is extremely unlikely and probably technically impossible. I ES:BX is initialized when debug starts. BX is normally the high part of the length of the file being debugged and I think therefore 0 if there is nor file and I think ES is the same as DS, SS, CS by default.
  2. The 510th word pointed to by ES:BX is AA55. I do not know what the probability is here but it is at least 1/64K Further even if this is the case it still may not fail, just subsequent attempts to format the drive will believe there is a valid though maybe unusual MBR.

There is nothing special about filling the MBR with 0's. It just need to not be valid. Any invalid MBR is the same as no MBR.


Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish