How to Verify that the Bootloader (GRUB) is Installed correctly

Asset ID:	1-71-1528222.1
Update Date:	2017-07-11
Keywords:

Solution Type Technical Instruction Sure

Solution 1528222.1 : How to Verify that the Bootloader (GRUB) is Installed correctly

Applies to:

Oracle Fabric Interconnect F1-15 - Version All Versions and later
Oracle Fabric Interconnect F1-4 - Version All Versions and later
Information in this document applies to any platform.

Goal

How to Verify that the Bootloader (GRUB) is Installed correctly. This is useful to verify the integrity of a SAN booted disk.

Fix

Find the device that you want to check. In this case it is /dev/sda. Then use 'dd' to dump the Master Boot Record (MBR). This is at offset 0 on the raw disk (not a partition device).

Notice the text near the end of the block (just before the partition table start at 0x1be). It shows that this is the GRUB boot loader. This is the text that is printed to the tty when the loader starts. You are looking at the x86 machine code for the program called 'stage1'.

The 16-bit number at the end of the block is the MBR signature. This number is used by the BIOS to determine if the disk is bootable or not. The number is 0xaa55. If this is absent then the disk is not bootable.

If you don't see output like this in the MBR then the disk cannot be booted as no bootloader has been installed.

[root@pound ~]# dd if=/dev/sda bs=512 count=1 | hexdump -C
1+0 records in
1+0 records out
00000000 eb 48 90 00 8e d0 bc 00 7c fb 8e d8 fc b9 80 00 |.H......|.......|
00000010 8b f4 bf 00 06 8e c0 f3 66 a5 ea 2f 06 00 00 10 |........f../....|
00000020 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 |................|
00000030 03 00 cd 10 bf ef 06 33 db 33 c9 80 bf be 03 02 |.......3.3......|
00000040 80 00 00 80 41 b8 02 00 00 08 fa 80 ca 80 ea 53 |....A..........S|
00000050 7c 00 00 31 c0 8e d8 8e d0 bc 00 20 fb a0 40 7c ||..1....... ..@||
00000060 3c ff 74 02 88 c2 52 be 79 7d e8 34 01 f6 c2 80 |<.t...R.y}.4....|
00000070 74 54 b4 41 bb aa 55 cd 13 5a 52 72 49 81 fb 55 |tT.A..U..ZRrI..U|
00000080 aa 75 43 a0 41 7c 84 c0 75 05 83 e1 01 74 37 66 |.uC.A|..u....t7f|
00000090 8b 4c 10 be 05 7c c6 44 ff 01 66 8b 1e 44 7c c7 |.L...|.D..f..D|.|
000000a0 04 10 00 c7 44 02 01 00 66 89 5c 08 c7 44 06 00 |....D...f.\..D..|
000000b0 70 66 31 c0 89 44 04 66 89 44 0c b4 42 cd 13 72 |pf1..D.f.D..B..r|
000000c0 05 bb 00 70 eb 7d b4 08 cd 13 73 0a f6 c2 80 0f |...p.}....s.....|
000000d0 84 f0 00 e9 8d 00 be 05 7c c6 44 ff 00 66 31 c0 |........|.D..f1.|
000000e0 88 f0 40 66 89 44 04 31 d2 88 ca c1 e2 02 88 e8 |..@f.D.1........|
000000f0 88 f4 40 89 44 08 31 c0 88 d0 c0 e8 02 66 89 04 |..@.D.1......f..|
00000100 66 a1 44 7c 66 31 d2 66 f7 34 88 54 0a 66 31 d2 |f.D|f1.f.4.T.f1.|
00000110 66 f7 74 04 88 54 0b 89 44 0c 3b 44 08 7d 3c 8a |f.t..T..D.;D.}<.|
00000120 54 0d c0 e2 06 8a 4c 0a fe c1 08 d1 8a 6c 0c 5a |T.....L......l.Z|
00000130 8a 74 0b bb 00 70 8e c3 31 db b8 01 02 cd 13 72 |.t...p..1......r|
00000140 2a 8c c3 8e 06 48 7c 60 1e b9 00 01 8e db 31 f6 |*....H|`......1.|
00000150 31 ff fc f3 a5 1f 61 ff 26 42 7c be 7f 7d e8 40 |1.....a.&B|..}.@|
00000160 00 eb 0e be 84 7d e8 38 00 eb 06 be 8e 7d e8 30 |.....}.8.....}.0|
00000170 00 be 93 7d e8 2a 00 eb fe 47 52 55 42 20 00 47 |...}.*...GRUB .G|
00000180 65 6f 6d 00 48 61 72 64 20 44 69 73 6b 00 52 65 |eom.Hard Disk.Re|
00000190 61 64 00 20 45 72 72 6f 72 00 bb 01 00 b4 0e cd |ad. Error.......|
000001a0 10 ac 3c 00 75 f4 c3 00 00 00 00 00 00 00 00 00 |..<.u...........|
000001b0 00 00 00 00 00 00 00 00 80 00 00 00 00 00 80 01 |................|
000001c0 01 00 83 fe 3f 0c 3f 00 00 00 8e 2f 03 00 00 00 |....?.?..../....|
000001d0 01 0d 8e fe ff ff cd 2f 03 00 ac 2e 14 11 00 00 |......./........|
000001e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.|
00000200

Look at offset 0x44 into the MBR. This contains a little endian 4 byte number. The value here is 0x0002b841. In the hexdump, the order is '41 b8 02 00'. This value is the block number of the start of the next phase boot loader. When anaconda installs grub it points this to the start of the program called 'stage2'.

You now want to convert that number of decimal and use another 'dd' command to dump the disk block at that address. You can use a calculator to do that or use the 'printf' shell command. The block address is used as the value of 'skip=' in the 'dd' command.

[root@pound ~]# dd if=/dev/sda bs=512 count=1 skip=`printf "%d" 0x02b841` | hexdump -C
1+0 records in
1+0 records out
00000000 52 56 be 03 81 e8 28 01 5e bf f8 81 66 8b 2d 83 |RV....(.^...f.-.|
00000010 7d 04 00 0f 84 ca 00 80 7c ff 00 74 3e 66 8b 1d |}.......|..t>f..|
00000020 66 31 c0 b0 7f 39 45 04 7f 03 8b 45 04 29 45 04 |f1...9E....E.)E.|
00000030 66 01 05 c7 04 10 00 89 44 02 66 89 5c 08 c7 44 |f.......D.f.\..D|
00000040 06 00 70 50 66 31 c0 89 44 04 66 89 44 0c b4 42 |..pPf1..D.f.D..B|
00000050 cd 13 0f 82 9f 00 bb 00 70 eb 56 66 8b 05 66 31 |........p.Vf..f1|
00000060 d2 66 f7 34 88 54 0a 66 31 d2 66 f7 74 04 88 54 |.f.4.T.f1.f.t..T|
00000070 0b 89 44 0c 3b 44 08 7d 74 8b 04 2a 44 0a 39 45 |..D.;D.}t..*D.9E|
00000080 04 7f 03 8b 45 04 29 45 04 66 01 05 8a 54 0d c0 |....E.)E.f...T..|
00000090 e2 06 8a 4c 0a fe c1 08 d1 8a 6c 0c 5a 52 8a 74 |...L......l.ZR.t|
000000a0 0b 50 bb 00 70 8e c3 31 db b4 02 cd 13 72 46 8c |.P..p..1.....rF.|
000000b0 c3 8e 45 06 58 c1 e0 05 01 45 06 60 1e c1 e0 04 |..E.X....E.`....|
000000c0 89 c1 31 ff 31 f6 8e db fc f3 a4 1f be 12 81 e8 |..1.1...........|
000000d0 5e 00 61 83 7d 04 00 0f 85 3c ff 83 ef 08 e9 2e |^.a.}....<......|
000000e0 ff be 14 81 e8 49 00 5a ea 00 82 00 00 be 17 81 |.....I.Z........|
000000f0 e8 3d 00 eb 06 be 1c 81 e8 35 00 be 21 81 e8 2f |.=.......5..!../|
00000100 00 eb fe 4c 6f 61 64 69 6e 67 20 73 74 61 67 65 |...Loading stage|
00000110 32 00 2e 00 0d 0a 00 47 65 6f 6d 00 52 65 61 64 |2......Geom.Read|
00000120 00 20 45 72 72 6f 72 00 bb 01 00 b4 0e cd 10 46 |. Error........F|
00000130 8a 04 3c 00 75 f2 c3 00 00 00 00 00 00 00 00 00 |..<.u...........|
00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
000001f0 5b b8 02 00 b6 00 00 0b 42 b8 02 00 17 00 20 08 |[.......B..... .|
00000200
[root@pound ~]#

Again look near the end of the block. If you see the text 'Loading stage2' then you are looking at the first block of the 'stage2' program and GRUB is correctly installed. If you see 'Loading stage1.5' it is also OK. The program 'stage1.5' is used as a filesystem-aware loader for 'stage2' and may be used by the installer.

If you are interested, look at offset 0x1f8 in the block. This is a little endian 4 byte number that should be 1 greater than the one you are looking at. This is the block address of the second block of stage2.

Attachments

This solution has no attachment