Extracting disk images from an El Torito ISO

calendar Nov 2, 2022 · 3 min read  ·
Share on: linkedin copy

While attempting to extract firmware for my Lenovo T500 laptop from an ISO obtained from the Lenovo support site I noticed that the ISO appeared empty.

 1jeff@xyz:~/LenovoBIOS$ file 6fuj46uc.iso
 26fuj46uc.iso: ISO 9660 CD-ROM filesystem data '6FET93US' (bootable)
 3
 4jeff@xyz:~/LenovoBIOS$ sudo mount -o loop 6fuj46uc.iso mount/
 5mount: ~/LenovoBIOS/mount: WARNING: device write-protected, mounted read-only.
 6
 7jeff@xyz:~/LenovoBIOS$ ls -l mount/
 8total 0
 9
10jeff@xyz:~/LenovoBIOS$ umount mount/

To investigate further I installed the genisoimage package in Debian which includes the "isoinfo" tool to examine the ISO.

 1jeff@xyz:~/LenovoBIOS$ isoinfo -i 6fuj46uc.iso -d
 2CD-ROM is in ISO 9660 format
 3System id:
 4Volume id: 6FET93US
 5Volume set id:
 6Publisher id:
 7Data preparer id:
 8Application id: NERO BURNING ROM
 9Copyright File id:
10Abstract File id:
11Bibliographic File id:
12Volume set size is: 1
13Volume set sequence number is: 1
14Logical block size is: 2048
15Volume size is: 19126
16El Torito VD version 1 found, boot catalog is in sector 20
17Joliet with UCS level 3 found
18NO Rock Ridge present
19Eltorito validation header:
20    Hid 1
21    Arch 0 (x86)
22    ID 'NERO BURNING ROM'
23    Key 55 AA
24    Eltorito defaultboot header:
25        Bootid 88 (bootable)
26        Boot media 4 (Hard Disk Emulation)
27        Load segment 7C0
28        Sys type 6
29        Nsect 1
30        Bootoff 1B 27

It turned out that the file was using El Torito to store a hard drive image containing the boot files. You can read more about El Torito at this Wikipedia link: https://en.wikipedia.org/wiki/ISO_9660#El_Torito

To extract the hard drive image in a usable form I used "geteltorito" (also part of the genisoimage package) to extract it to a file. I then ran the "file" command to determine the file system starting position (sector 32). Using this information I was able to use the loop mount with an offset to mount the image successfully.

 1jeff@xyz:~/LenovoBIOS$ geteltorito 6fuj46uc.iso > image.img
 2Booting catalog starts at sector: 20
 3Manufacturer of CD: NERO BURNING ROM
 4Image architecture: x86
 5Boot media type is: harddisk
 6El Torito image starts at sector 27 and has 75776 sector(s) of 512 Bytes
 7Image has been written to stdout ....
 8
 9jeff@xyz:~/LenovoBIOS$ file image.img
10image.img: DOS/MBR boot sector; partition 1 : ID=0x4, active, start-CHS 
11(0x0,1,1), end-CHS (0x24,63,32), startsector 32, 75744 sectors
12
13jeff@xyz:~/LenovoBIOS$ mkdir mount
14
15jeff@xyz:~/LenovoBIOS$ sudo mount -o loop,offset=$((32*512)) image.img mount/
16
17jeff@xyz:~/LenovoBIOS$ ls -l mount/
18total 184
19drwxr-xr-x 2 jeff jeff  2048 Sep  5  2012 '$RECYCLE.BIN'
20-rwxr-xr-x 1 jeff jeff    58 Aug  2  2012  AUTOEXEC.BAT
21-rwxr-xr-x 1 jeff jeff 54654 Dec 30  1993  COMMAND.COM
22-rwxr-xr-x 1 jeff jeff   123 Apr 15  2009  CONFIG.SYS
23drwxr-xr-x 4 jeff jeff  2048 Sep 26  2012  FLASH
24-rwxr-xr-x 1 jeff jeff 14160 Nov 18  1994  HIMEM.SYS
25-r-xr-xr-x 1 jeff jeff 40758 Dec 30  1993  IBMBIO.COM
26-r-xr-xr-x 1 jeff jeff 37174 Dec 30  1993  IBMDOS.COM
27-rwxr-xr-x 1 jeff jeff 12663 Apr 23  1999  RAMDRIVE.SYS
28drwxr-xr-x 2 jeff jeff  4096 Apr  4  2008  Recycled
29drwxr-xr-x 4 jeff jeff  2048 Apr  4  2008 'System Volume Information'
30-rwxr-xr-x 1 jeff jeff  9349 Dec 30  1993  WINA20.386