Reading the boot sector
This program will read the first 512 bytes of a disk and print the results as decimal values, hex, and a string. The io.ReadFull() function is like a normal read, but it ensures that the byte slice you provide with for data is completely filled. It returns an error if there are not enough bytes in the file to fill the byte slice.
A practical use for this is to check a machine's boot sector to see if it has been modified. Rootkits and malware may hijack the boot process by modifying the boot sector. You can manually inspect it for anything strange or compare it to a known good version. Perhaps a backup image of the machine or a fresh install can be compared to see if anything has changed.
Note that you can technically ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access