| Boot Sequence Process |
|
It is extremely important for a good technician to understand the boot sequence in every system, particularly Windows XP and Windows Vista. With that knowledge we will be able to solve any problem when the system cant start. The files executed during the boot process are:
Pre-boot sequenceDuring the start of any computer, the BIOS looks for the boot sector of the hard drive (MBR – Master Boot Record) in the following way:
Start sequence (Boot)After loading the NTLDR in memory, the boot sequence looks for information about the hardware and drivers to prepare the load phases of the operative system. The boot sequence uses the following files:
The boot sequence is executed in 4 phases;
Initial Boot Loader – During this phase, NTLDR changes the processors working mode from real to protected mode (32 bit flat memory mode). Then, the NTLDR loads the minidrivers of the system included inside the NTLDR. This minidrivers help the NTLDR to load Windows from FAT, FAT32 and NTFS partitions. Operative System election – During the boot sequence, NTLDR reads the BOOT.INI file. and if the file has more than one line of the SO, a screen appears during the execution of the BOOT.INI file to select the Operative System. If we dont select any system, NTLDR loads the default operative system that is specified in the BOOT.INI file. As default is the last installation of Windows. Remember this section is seen only when there is more than one line of the Operative System installed in the BOOT.INI. If the BOOT.INI doesnt exists, the NTLDR always tries to load the operative system of the first active partition of the hard drive. Hardware Detection – NTDETECT.COM and NTOSKRNL.EXE are in charge of detecting the hardware. NTDETECT runs immediately after we selected the operative system to start with. If we select a W9X core system instead of NT/W2000/XP, the NTLDR loads and executes the BOOTSECT.DOS. Is a copy of the boot sector that existed in the partition of the system when was installed for first time. This sector corresponds to a partition previously formatted with MSDOS or with a W9X/ME system. NTDETECT.COM builds a list of the hardware installed, and gives the list to the NTLDR program to inclued it in the registry by the key HKEY_LOCAL_MACHINEHARDWARE NTDETECT detects the following components:
Configuration election After the NTLDR starts loading Windows and has collected the hardware information, the system loader shows the Hardware Profile screen if there is more than one user defined in the system. If there is only one Hardware profile this screen will not appear, and Windows continues the boot process using the configuration of the default hardware profile. Kernel LoaderIt is loaded after the election of Kernel configuration (NTOSKRNL.EXE). Is the moment when the election of the system disappear and white rectangles appear in the bottom of the screen, indicating the load process of NTOSKRNL. During the boot phase, NTLDR makes the following:
Kernel Initialization After the Kernel finishes loading, it initializes and NTLDR gives control to the core (NTOSKRNL.EXE). In this moment the system opens a screen showing a bar with boot process. Four tasks occur in this phase:
The possible values are: 0x0 (Ignore) – The start sequence ignores the error and continues without showing a message. 0x1 (Normal) – The start sequence shows a message, but ignores the error and continues the boot process. 0x2 (Sever) – The start sequence fails and continues, but using the control set of the Last good configuration known. The error is ignored and continues. 0x3 (Critic) – The same than 0x2 but if in this case the error repeats, the Last good configuration known stops the start sequence with an error message. The values of ErrorControl appear in the registry by the subkeys HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNombre_del_servicio_o_dispositivoErrorControl Services Initialization After the Kernel loads and initializes the device drivers, the Session Manager Program (SMSS.EXE) starts this subsystems and Windows Services. SMSS executes the instructions of the BootExecute key, Memory Management, DOS Devices and the subkeys of BootExecute Subsystem. Executes the commands of this key before starting any service. Memory Management Key Creates the information of the pagination file, necessary for the Virtual Memory Manager. DOS Device Key Creates the symbolic links that associate commands with the correct component of the system. SubSystems Key Starts the Win32 subsystem. This controls every I/O and the access to the Video screen, and then starts the WinLogon process. LOGON The Logon process starts after the initialization phase of the Kernel finishes. The system automatically starts the WINLOGON.EXE program, opens the Local Security Authority (LSASS.EXE) and the Logon screen. Then, the service controller executes and makes a final search in the services key of the registry looking for the services with a 0x2 value in the entry. This services, including the Workstation service and the Server service, are configured as default to automatically load HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices. Windows boot process its not finished until the user has logged. After the logon is correct, the system copies the Clone Control Set to the LastKnownGood keys.
( 1 Vote ) |
