Re: Virus détecté au boot après installation de lilo
Thus spake Helios de Creisquer on Thu, Dec 27, 2001 at 05:31:46PM +0100:
> Lu '
>
> On Thu, Dec 27, 2001 at 01:26:20PM +0000, Christophe Baillon wrote:
> > Normal, le MBR ne fait que 512 octets. Le noyau ne s'y trouve pas.
>
> exact,
>
> > Lilo ne fait qu'aiguiller le démarrage du système. Je ne sais pas
> > exactement comment il procède, mais je pense que l'emplacement du
> > noyau doit se trouver sur le premier secteur de la partition linux (et
> > non du mbr).
>
> moins exact, il me semble que le noyau lui meme n'a pas a se trouver sur
> un secteur particulier. Quelqu'un confirme ? :)
La doc de LILO:
(extraits de /usr/share/doc/lilo/Manual.txt.gz)
* LILO does not know how to read a file system. Instead, the map
installer asks the kernel for the physical location of files (e.g. the
kernel image(s)) and records that information. This allows LILO to work
with most file systems that are supported by Linux.
<...>
When booting from a hard disk, the very first sector of that disk, the
so-called master boot record (MBR) is loaded. This sector contains a loader
program and the partition table of the disk. The loader program usually
loads the boot sector, as if the system was booting from a floppy.
<...>
Disk sector addresses are conveyed from the Map Installer (lilo executable)
to the boot loaders, first- and second-stages through a 5 byte structure:
<...>
Et surtout:
The image files can reside on any media that is accessible at boot time.
There's no need to put them on the root device, although this certainly
doesn't hurt.
--
I have discovered that all human evil comes from this, man's being unable
to sit still in a room.
-- Blaise Pascal
Reply to: