How can I find the MBR sector in a VMDK file?

Question

I am trying to understand how the vmware BIOS finds the MBR before it downloads it.

On physical hard drives, this is easy - MBR is in the first sector.
But .. what happens in the VM?

I created 2 VMs. In the first vmdk (with a Linux-based system installed on it), I found an MBR with an offset of 0x2A0000.
In the second vmdk file (with Windows XP installed on it), I found MBR more than once, but all found offsets cannot be divided into 512 (sector size), which is rather strange (as far as I know, MBR should start from the beginning of sector + sector size - 512 bytes in vmdk => The initial MBR offset MUST be divided by 512. correct me if I am wrong). <w> So they were probably backup copies, I think .. Needless to say, the @ offset 0x2A0000 in xp.vmdk was nothing interesting.

So how does the vmware BIOS find the MBR? Where is this custom parameter \ which it calculates?

Additional Information:
- Both VMDKs are files with 1 file and a hard disk (and can grow up to 40 GB).
The systems they serve use them and only they (XP uses xp.vmdk, and linux uses linux.vmdk, without additional VMDKs).

- @Windows VM I used WinHex for \. \ PhysicalDrive0 to get MBR.it looked fine (signature, etc.).
- @Linux VM I used the command "dd if = / dev / sda of = mbr.bin bs = 512 count = 1", then looked at the hex bytes to get the MBR. I looked at it and it looked fine (GRUB, signature at the end, etc.).
Having received the MBR from the virtual machines, I searched in each corresponding .vmdk file for the MBR on the PC host (with a hex editor), and the offsets were as I mentioned above.

Any help would be greatly appreciated. Thanks!

Answer 1

People who were considering this issue drank and still have not commented or answered, so I did a little work.
We got the following conclusions (which ultimately answer my question):

1. When creating a XXX GB virtual hard disk with a VMware file (.VMDK file), it can be one of two types: flat or sparse (they can also be divided into several .VMDK files, but I did not consider them in my research).
- flat = all hard disk space (XXX GB) is allocated once during creation.
The .VMDK file size on the disk is XXX GB.

- sparse = the file on the hard disk is consumed (up to XXX GB).
The .VMDK file size is small at the beginning and grows if necessary.

As I said in my question in the additional info, both .VMDK were sparse .

2. As mentioned in the question, the MBR is at the beginning of the first sector of the physical hard disk , and I wondered where it is in the .VMDK file and how VMware calculates it.
It turns out that on a flat .VMDK file, it is also at the beginning of the first sector!
This is a pretty direct introduction when you look at them ... but mine were not flat. So what happens in rare .vmdk? where is the mbr?

The 3.sparse.vmdk file has a different structure (for a detailed structure, you can read the VMware virtual disk specification with an emphasis on struct SparseExtentHeader.
Could not find the logic of how MBR \ first sector is calculated, but as far as I saw (explained in 5 how I got to it), it looks like this:

@ .VMDK offset 0x38 - 0x3F (8 bytes in length) sits gdOffset.it stores the offset (****) of metadata.
The first 4 bytes of metadata are the next offset (****) to go to.
There, the next 4 bytes are the offset (****) of the MBR .
(****) means displacement in sectors. for example 1 means offset 512, 2 means 1024, etc.

To summarize everything, it looks like this:
Say, "data stored at offsets 0x38-0x3F (8 bytes in length)", as [(0x38): 8].

Then,
MBR Offset = 512 X [(512 X [(512 X [(0x38): 8]): 4]): 4]

4. I created 2 new VMs (Windows xp and Linux) with sparse .VMDK, and this method of calculating MBR also showed itself to both of them (as you can see in the attached images in 7).

5. How did I get to this formula?
Using SysInternal Process Monitor when filtering:
-Process contains vmware
-Operation - CreateFile \ ReadFile
-Path contains <.vmdk file path>

I got every .vmdk read (and it is biased).
I looked where he reads the MBR offset (on Linux, I knew that the offset was 0x2A0000), and what he already read before. Jumped to the offsets, which looked as if they would help me understand what was happening there .. and they certainly did :)

6. What I did not explain is why the MBR in the xp system in my original question was a strange bias (which cannot be divided by 512).
Well, to be honest, I don’t have a complete reason, but I forgot to mention that before MBR checks I removed the original MBR from this system and powered up the virtual machine. He asked me if I want to run windows normally, and only then did he appear at a strange bias (copied it there for backup or something else). The strange thing here is that I could not find this MBR at normal offset. I had some progress, but no solid answer.
If anyone knows, feel free to comment (:

7. Attached Images: