Apparently the MBR is a 512 Byte data structure.
- 446 bytes for the BootCode.
- 64 bytes for The Partition Table
- 2 bytes for the signature a the very end.
The Partition Table structure has four entries of 16 bytes each used to identify the type and location of partitions on a hard disk.
According to Microsoft
The first element of the partition table, the Boot Indicator field, indicates whether or not the volume is the active partition. Only one primary partition on the disk can have this field set.
Partition 1\ 0x01BE(446)
Partition 2\ 0x01CE(462)
Partition 3\ 0x01DE(478)
Partition 4\ 0x01EE(494)
As the Partition Table's four entries of 16 bytes each completely use up all available 64 bytes of space, how can there be any room left for the Boot Indicator Field?
Is the Boot Indicator Field crammed into whichever partition is active entry field space?(I cant imagine a regex operation to sniff out the Boot Indicator Field being ran for each entry...)
Perhaps I am visualizing this wrong but something seems illegal?