Windows - boot process & simple troubleshooting

[Agent]

how can write commmand in my own bootloader?
i want to run a code to access pagefile.sys so before windows is booted i can access this file!
do you have any idea to access pagefile ?
i wan to write bootloader !but i donot know anything?

Why do you want to access the page file in such a manor?

If you want to get rid of it, just disable your pagefile (not recommended). It's very unlikely you need to access that file if you're asking how to do it

[lodore]

Why do you want to access the page file in such a manor?

If you want to get rid of it, just disable your pagefile (not recommended). It's very unlikely you need to access that file if you're asking how to do it

or set it to be wiped at shutdown but it does mean shutdown time does take longer.

[Paul Adams]

how can write commmand in my own bootloader?
i want to run a code to access pagefile.sys so before windows is booted i can access this file!
do you have any idea to access pagefile ?
i wan to write bootloader !but i donot know anything?

PAGEFILE.SYS is actually a special case too - during the startup of Windows if the last shutdown was not clean, this file is checked to see if it contains a memory dump, and if it finds one then the file is renamed and a new one intialized (then the memory dump extracted to %systemroot%\MEMORY.DMP from the renamed pagefile during/after startup).
If the system was shut down cleanly, then the file is one of the first to be opened & locked, its initial and maximum size taken from the registry.

Not quite sure what you would hope to use the pagefile contents for, and you sure can't open it before the OS does, or you'll likely bugcheck the machine.

[mahzad]

or set it to be wiped at shutdown but it does mean shutdown time does take longer.

thanks for your payattention!
i want to create a folder and cut pagefile.sys from drive c:\ into this folder!
it is my duty !but another groups shoude wipe this folder that contains pagefile.sys

[Danko]

Hi everybody, i have one question. Does somebody have a full text of explanation of the process for dual booting windows? I must write a project for my college, and i must finished that by tomorrow evening. I will be veeeeery thankfull if somebody give me that sort of text. Thank you a lot ahead!!

[Agent]

Hi everybody, i have one question. Does somebody have a full text of explanation of the process for dual booting windows? I must write a project for my college, and i must finished that by tomorrow evening. I will be veeeeery thankfull if somebody give me that sort of text. Thank you a lot ahead!!

No - without wanting to sound harsh, We are not here to do your late homework for you.

There is plenty out there on the Windows boot process. Use Google, do some reading and you'll actually learn something as opposed to copy and pasting whatever someone does for you into your project.

[RBCC]

Has anybody figured out the boot sequence of Windows 7/VISTA? John

[Paul Adams]

Has anybody figured out the boot sequence of Windows 7/VISTA? John

Minor changes, really:

BIOS: performs Power On Self Test (POST)
BIOS: loads MBR from the boot device specified/selected by the BIOS

MBR: contains a small amount of code that reads the partition table, the first partition marked as active is determined to be the system volume
MBR: loads the boot sector from the system volume

BOOT SECTOR: reads the root directory of the system volume at loads the Boot Manager (bootmgr)

BOOTMGR: loads the Boot Configuration Database (BCD) from HarddiskVolumeX\BOOT to see the list of Boot Loaders

Now a decision is made based on the contents of the BCD and optionally a choice made by the user:
If the single pre-Vista NTLDR entry is selected, then the original actions posted at the very top are followed (including reading BOOT.INI), otherwise...

BOOTMGR: The osdevice and path properties in the Boot Loader entry determine how the OS continues the boot process - by default these are C: and \Windows\system32\winload.exe respectively.

WINLOAD.EXE: loads NTOSKRNL.EXE, HAL.DLL, BOOTVID.DLL, KDCOM.DLL, CI.DLL, CIFS.SYS from the boot (Windows) volume
WINLOAD.EXE: loads \WINDOWS\SYSTEM32\CONFIG\SYSTEM which becomes the system hive HKEY_LOCAL_MACHINE\System
WINLOAD.EXE: loads drivers flagged as "boot" defined in the system hive, then passes control to NTOSKRNL.EXE

NTOSKRNL.EXE: brings up the loading splash screen and initializes the kernel subsystem
NTOSKRNL.EXE: starts the boot-start drivers and then loads & starts the system-start drivers
NTOSKRNL.EXE: creates the Session Manager process (SMSS.EXE)

SMSS.EXE: the first instance (0) of the Session Manager starts a copy of itself (1) the first interactive logon session (session 0 is now only for services and no longer the "console" session)
SMSS.EXE(0): starts the kernel-mode portion of the Win32 subsystem (WIN32K.SYS)
SMSS.EXE(0): starts the user-mode portion of the Win32 subsystem (CSRSS.EXE)
SMSS.EXE(0): starts WININIT.EXE
SMSS.EXE(1): starts CSRSS.EXE and WINLOGON.EXE (this is also done for any other sessions created, in the case of Windows Server, each session gets its own pair of these processes)

WININIT.EXE: starts the services controller (SERVICES.EXE)
WININIT.EXE: starts the Local Security Authority (LSASS.EXE)
WININIT.EXE: starts the Local Session Manager (LSM.EXE)
WININIT.EXE: initializes the rest of the registry and does user-mode initialization tasks

SERVICES.EXE: starts all services marked as automatic

WINLOGON.EXE: (per session, remember) launches LOGONUI.EXE to display the credentials entry form (i.e. when the Secure Attention Sequence* is hit to logon or unlock a session)

* Probably known better as CTRL+ALT+DEL


Notes on the BCD:
- it replaces BOOT.INI, and Windows Vista and later will not boot without a good BCD
- it is mounted as a registry hive (HKLM\BCD00000000) in the running OS
- it can be viewed and edited using BCDEDIT.EXE

With Windows 7:
- we moved the BOOT folder to a separate partition so that the OS partition can be encrypted with BitLocker, this is why you get a 100MB "System" partition created during installation on a clean disk, and it makes multi-booting much easier as it is safe to format the partition each Windows installation resides on without affecting the other installations being able to boot

- it is possible to have a Boot Loader entry which points to a virtual hard disk (VHD), so long as the OS on it is Windows 7 or Server 2008R2 ("native VHD boot")


I think that's pretty much it for the differences, but I can add a bit on hybrid sleep:

Hybrid sleep is where we write the hibernation file and do a suspend-to-RAM, leaving the system in power state S3 for quick recovery - but as this continue to draw (little) power, laptops can actually drop to S4 (off) safely or a power cut will have no ill effect other than to increase the resume time.

If resuming from hibernation (S4 - powered off), instead of WINLOAD.EXE the Boot Manager calls WINRESUME.EXE which loads the saved RAM contents from HIBERFIL.SYS and the system carries on where it left off.

If resuming from sleep (S3 - blinking power light) then the resume time is <2 seconds as the RAM is already populated.


Much of his information is in Chapter 13 of Windows Internals, Fifth Edition if you are interested in going deeper.

[RBCC]

What file runs the Windows 7 boot animation? John

[Paul Adams]

What file runs the Windows 7 boot animation? John

winload.exe loads bootres.dll which contains the animation files.

[RBCC]

Excuse me when does the boot process load the file bootres.dll? Or does it? John

[Paul Adams]

Excuse me when does the boot process load the file bootres.dll? Or does it? John

The Boot Manager launches the Windows 7 Boot Loader winload.exe, which loads bootres.dll which contains the animation which the Boot Loader displays whilst loading the other images mentioned above.

If you mean exactly when winload.exe loads bootres.dll and the animation started in relation to the other files it loads, I would hazard a guess that it's immediately after bootvid.dll to initialize graphics mode.

[pipTheGeek]

I wish you had posted this a few months ago. I had installed XP, then realised that my BIOS drive boot order was wrong, changed it, installed win 7. Sadly win 7 then didn't do its magic for a dual boot. I spent a couple of evenings trying to figure out what I needed to do to make the win 7 MBR offer the option of XP and MAKE IT WORK. I managed to edit the win 7 bcd okay (thanks to easybcd) but couldn't get XP to load. I found out I needed to copy ntldr and boot.ini and something else I think onto the system partition (as determined by the bios HDD boot order) but I got stuck trying to tell boot.ini where the rest of OS lived. In the end I gave up and stuck with using the BIOS boot popup to just pick the correct HDD.

I recently re-installed both OSes becuase of drive changes, this time I made sure that Win7 could work its magic at install time.

[balaam]

Hi, Paul,
May I correct this statement:
"The SYSTEM volume is the partition from which the boot process starts, containing the MBR, boot sector, NTLDR, NTDETECT.COM & BOOT.INI"?
to read :
"The SYSTEM volume is the [primary] partition from which the boot process starts, containing NTLDR, NTDETECT.COM & BOOT.INI"
The MBR is on the first sector of any disk once it is partitioned. All partitions contain a boot sector, only the boot sector of the Active partition is read.
It is the Active marking of a primary partition recorded in the partition table that directs loading to that active partition, which is thus the System Drive. Why a primary partition? They are the only partitions fully described in the MBR. Logical partitions are chained.
As far as Sata disks go, BIOS will automatically select Sata0 as the boot disk; it is up to the user to change the order.
Yep, it's a 4yold thread but I guess that, being still on the web, it is relevant.
Cheers.

[RBCC]

What file has the bootscreen background and the repositioning of the boot animation? How does one change these things? And have the bootscreen with BSOD? John