Join Us!

Notifications
Clear all

Weird CD ...  

  RSS
athulin
(@athulin)
Community Legend

Find a copy of the Kali 1.1.0 amd CD (Looks like 1.0.9 also works.)

Look at it with your favourite forensic file system viewer.

What do you see?

The weirdness is that the ISO image has an MBR, containing a partition table with two entries, but also the standard ISO 9660 volume descriptors.

Some tools show one but not the other, some show both.

Could be confusing …

Quote
Posted : 23/07/2015 10:30 pm
thefuf
(@thefuf)
Active Member

That's a hybrid ISO 9660 image (http//www.syslinux.org/wiki/index.php/Isohybrid).

ReplyQuote
Posted : 23/07/2015 11:08 pm
jaclaz
(@jaclaz)
Community Legend

@athulin

Yep ) , nothing particularly "weird", as a matter of fact these isohybrid images are pretty much common in Linux "live" distributions as the same image can be burned/imaged indifferently on CD/DVD or USB stick, being bootable on both.
The recent addition of UEFI firmware have added a layer of complexity to them, as a FAT partition is needed for UEFI booting, but the generic idea of having a same image that can be deployed to both media is the same.

@thefuf
JFYI, besides the "canonical" you linked to, there are other "mixed mode" CD/DVD's, some of which may actually appear "weird", a good example are some Acronis .iso's (though nto strictly speaking isohybrid, as they have no MBR), recently our fellow member Cybergonzo (Author of Isobuster) introduced a few change to the Isobuster tool to allow inspecting parts of them
http//www.msfn.org/board/topic/172655-strange-or-odd-multi-or-single-boot-cddvd-el-torito-images/

Still FYI, there is also an approach that can be considered the "reverse" of isohybrid, that is to create in the MBR an entry for the .iso as if it was a partition "Iso fake partition"
http//reboot.pro/topic/9916-grub4dos-isohybrided/
Skip to here
http//reboot.pro/topic/9916-grub4dos-isohybrided/?p=88531
(the thread includes the "weird" "isohybrided grub4dos" and the "isoless boot CD")

jaclaz

ReplyQuote
Posted : 24/07/2015 1:23 am
Share: