TECHIE ZONE

BOOT PROCESS OF WINDOWS XP:

 POST -  First step in boot sequence (the POST) for any computer with an operating system. If POST is successful, computer boots itself .If the tests are unsuccessful, the computer reports error. Software that performs POST resides in called the CMOS (complementary metal oxide semiconductor)

  BIOS - BIOS program is stored in ROM .BIOS stores information as to the order in which drives are checked to see which is the startup drive (as stored in CMOS). In Windows XP, BIOS no longer stores information about devices and drivers connected to system (replaced by the HAL) . The BIOS finds the first sector of the first hard drive which contains the Master Boot Record (MBR) and transfers control to it

   MBR -    It is the job of MBR ultimately to load the Ntldr program (the boot loader program) and pass control of the boot process on to it (either directly or indirectly)

 NTLDR -  Ntldr is stored on the system partition .This is the partition where the MBR expects to find the system, it is the boot loader

¡  Primary functions of the boot loader are to:

1.       Select the operating system to load if there is more than one from which to choose

2.       Detect hardware

3.       Select a configuration

¡  Ntldr stays in control throughout boot loader process until it loads and passes control to Windows XP kernel (Ntoskrnl.ext)

 BOOT.INI 

Ntldr reads Boot.ini and displays the Boot selection menu (if necessary).Contains operating system choices, if more that one, from which the user may choose.If the user selects Windows XP (or if it is the only O/S present), Ntldr executes Ntdetect.com

 NTDETECT.COM  

Used to collect a list of hardware currently installed in computer. From hardware list, creates system profile. Later will be compared to Windows XP Registry entries for discrepancies that could lead to problems.NTDETECT.COM collects a list of currently installed hardware components and returns this list for later inclusion in the registry under the HKEY_LOCAL_MACHINE\HARDWARE key.

¡  Next boot loader selects a configuration

¡  Known as the hardware profile

¡  If there is one hardware profile, it is selected

¡  If there is more than one, system tries to select one that matches detected hardware

¡  If system cannot make automatic selection, user is prompted for manual selection

NTOSKRNL  

Once Windows XP is selected as O/S to boot, a "Starting Windows…" text message and the XP splash screen are displayed

¡  During this time the boot loader loads the kernel into memory (consists of):

l  Windows XP kernel (Ntoskrnl.exe)

l  Hardware abstraction layer (HAL), the file that is named Hal.dll

l  The kernel is the central module of an operating system:

l  Loads first and remains in main memory at all times

 HAL.DLL    

The Hardware Abstraction Layer (HAL) is an O/S programming component.Functions as an interface between the system’s hardware and software.Applications do not access hardware directly but access the abstract layer provided by the HAL

¡  Registry key HKLM\HARDWARE created by kernel using information it received from boot loader program Ntdetect.com

¡  Creates CloneControlSet by making a copy of CurrentControlSet .It is Never modified—intended as a backup

¡  Initializes drivers that were loaded by the boot loader

  WINLOGON.EXE  

The XP boot process is not considered complete until a user has successfully logged onto the system. The process is begun by the WINLOGON.EXE file which is loaded as a service by the kernel

 LSASS 

Continued by the Local Security Authority (LSASS.EXE) which displays the logon dialog box. This dialog box appears at about the time that the Services Subsystem starts the network service.

  The user logs on successfully with logon name, as well as a password if required

  Clone control set is copied to the Last Known Good control set completing the boot process

DESKTOP SCREEN  appears.