Windows XP Boot Process/Boot Sequence In A Nutshell

What about Windows XP?


● Boot Loader Phase

● Kernel loading phase

● Session Manager

● Winlogon
 
 
Windows XP and earlier


● NTLDR – the actual boot loader

● boot.ini – booting options

● presents menu options as to what OS to load

● if absent, defaults to \Windows directory of first

partition
 
What NTLDR does


● Accesses the file system on boot drive

● Looks for hiberfil.sys, the hibernation image

● Reads boot.ini and prompts the user

● Runs NTDETECT.COM

● Starts NTOSKRNL.EXE
 
 
NTOSKRNL.EXE


● Kernel image of Windows NT family

● Contains

● Cache Manager

● Executive

● Kernel

● Security Reference Monitor

● Memory Manager

● Scheduler

● Also known as:

● NTOSKRNL.EXE : 1 CPU

● NTKRNLMP.EXE : N CPU SMP

● NTKRNLPA.EXE : 1 CPU, PAE

● NTKRPAMP.EXE : N CPU SMP, PAE
 
 
Kernel Loading Phase


● HAL.DLL -- type of hardware abstraction layer

● KDCOM.DLL -- Kernel Debugger HW Extension

DLL

● BOOTVID.DLL -- for the windows logo and

side-scrolling bar

● config\system registry
 
 
Session Manager


● SMSS.EXE

● What it does:

● Creates environment variables

● Starts the kernel and user modes of the Win32 subsystem

– win32k.sys (kernel-mode)

– winsrv.dll (user-mode)

– csrss.exe (user-mode)

● Creates DOS device mappings listed at the

HKLM\System\CurrentControlSet\Control\Session

Manager\DOS Devices registry key.

● Creates virtual memory paging files.

● Starts winlogon.exe, the Windows logon manager
 
 
Windows Logon


● Winlogon starts the Local Security Authority

Subsystem Service (LSASS) and Service

Control Manager (SCM)

● Also responsible for responding to the secure

attention sequence (SAS), loading the user

profile on logon, and optionally locking the

computer when a screensaver is running.
 
What about Windows Vista?


● Windows Boot Manager (bootmgr)

● Boot Configuration Data

● replacing boot.ini

● found in \Boot\Bcd

● winload.exe

● operating system boot loader

● NTOSKRNL.EXE and device drivers