用于查看16进制文件的winhex软件

template "Boot Sector NTFS" // Template by Paul Mullen, pcguru@the-answer.com // last modified Jul 16, 2000 // To be applied to sector 0 of an NTFS-formatted // logical drive or to the mirror copy of the boot // sector, which will be located near then end of // the partition. // See Microsoft KB article Q153973, "Recovering NTFS boot Sector" // http://support.microsoft.com/support/kb/articles/Q153/9/73.asp description "Boot sector of an NTFS partition" applies_to disk sector-aligned requires 0x00 "EB" // bytes 0 to 2 are requires 0x02 "90" // JMP instruction requires 0x03 "4E 54 46 53 20" // ID must be "NTFS" requires 0x1FE "55 AA" // "magic" signature begin read-only hex 3 "JMP instruction" //00 char[8] "SystemID" //03 uint16 "Bytes per sector" //0B uint8 "Sectors per cluster" //0D uint16 "Reserved sectors" //0E hex 3 "(always zero)" //10 read-only hex 2 "(unused)" //13 hex 1 "Media descriptor" //15 read-only hex 2 "(unused)" //16 uint16 "Sectors per track" //18 uint16 "Heads" //1A uint32 "Hidden Sectors" //1C read-only hex 4 "(unused)" //20 read-only hex 4 "(always 80 00 80 00)" //24 int64 "Total sectors" //28 move -8 hex 8 "Total sectors (hex)" //28 int64 "Start C# $MFT" //30 int64 "Start C# $MFTMirr" //38 uint32 "Clust per MFT rec" //40 uint32 "Clust per index block" //44 uint32 "Serial number (int)" //48 move -4 hex 4 "Serial number (hex)" //48 goto 0x1FE //boot load code follows read-only hex 2 "Signature (55 AA)" //1FE end