Extract boot image from bootable "El Torito" CD-ROM : phaq : http://phaq.phunsites.net

This page was exported from phaq [ http://phaq.phunsites.net ]
Export date: Sat Apr 20 5:29:57 2024 / +0000 GMT

Bootable "El Torito" CD-ROMs usually use a boot loader such as isolinux. The loader will allow to boot any particular disk image located inside the iso9660 filesystem.

This makes it very easy to change a particular boot image. It's merely a matter of picking the right file, changing it and burning a new CD-ROM.

Now there are also CD-ROMs which do not rely upon a boot loader or images inside the iso9660 filesystem.
Instead, the bootable image is stored within the first sectors of the CD-ROM, referenced only from the boot catalog by it's sector offset. This actually means, that the boot image is hidden and neither visible from the iso9660 filesystem nor loaded from there.

This drawing should get you the basic idea (have a look at the El Torito Specification for further Details):

               +-------------------------+

    Sector 0:  |          SYSTEM         |

               |-------------------------|

    Sector 16: |      Primary Volume     |

               |-------------------------|

    Sector 17: |    Boot Record Volume   |-------+

               |-------------------------|       |

               |                         |       |

               |-------------------------|       |

               | Set Termination Volume  |       |

               |-------------------------|       |

               |     Boot Catalog        | <-----+

               |                         |-------+

               |-------------------------|       |

               |  Bootable Disk/Loader   | <-----+

               |-------------------------|

               |   CD-ROM File System    |

               +-------------------------+

So to change the boot image, it needs to be extracted from the CD-ROM first.

This is where geteltorito comes in, a perl utility by Rainer Krienke, which serves exactly this purpose.

Luckily enough I found this one before I started writing an image dumper on my own...