Layout of Modern Syslinux

Here is a bit of detail regarding the on-disk and in-memory layout of modern Syslinux, such as 4.06 and 5.00.  This only applies to SYSLINUX- and EXTLINUX-based installations (the so-called "HDD variants").

• ldlinux.bin's physical (file) layout:
  • Volume boot record (512 bytes).
    BIOS or an MBR is typically responsible for loading a VBR and executing its code.
    This contains code which the installer patches into a volume's actual boot record.  The code ranges are:
    • [0, 2]
    • [0x5A, 0x1FD]
  • 512 bytes of padding, used for alignment purposes
  • ldlinux.sys, which is:
    • "Sect1" code (494 bytes).  This contains a patch area, checksum, and code which is responsible for loading the rest of ldlinux.sys.
    • At the end of "Sect1" is enough room (18 bytes) for at least one extent (10 bytes), which the installer populates with the location of the next chunk of ldlinux.sys.  "Sect1" ranges from [0x400, 0x5FF] relative to ldlinux.bin or, relative to only ldlinux.sys, [0, 0x1FF]
    • The entire extent map (which includes the previously-described 18 bytes of "Sect1") ranges from [0x5EE, 0xD6E] relative to ldlinux.bin or, relative to only ldlinux.sys, [0x1EE, 0x96D] (1920 bytes).
    • The rest of the ldlinux.sys code is the rest of the Syslinux core.  It includes the filesystem drivers, for example.
      For Syslinux 5.00, some of what used to be "core" in Syslinux 4.06 has been moved out into ldlinux.c32, but this fact should be irrelevant, as long as that file is available in the filesystem that Syslinux is installed to.
• ldlinux.bin's in-memory layout:
  • VBR @ 0:0x7C00 (or wherever else a crazy BIOS might put it)
  • 512 bytes of padding @ 0:0x7E00
  • ldlinux.sys @ 0:0x8000
    • "Sect1" @ 0:0x8000 (ranging [0x8000, 0x8200]
    • Extent pointers @ 0:0x81EE (ranging [0x81EE, 0x896D])
    • The rest of the code @ 0:0x896E

Enjoy!

So the sequence of events [roughly] goes:

1. Syslinux VBR is loaded and executed by BIOS or MBR (or whatever else)
2. VBR has an 8-byte LBA describing where the first sector (hence "Sect1") of ldlinux.sys lives.  It loads and executes this sector
3. "Sect1" has at least one extent (8-byte LBA + length) describing where the next sector of ldlinux.sys lives.  It loads this sector.
4. That next sector has more extents, so "Sect1" is able to load the rest of ldlinux.sys