Windows XP boot Process

When switch on the power of a PC, system clock send clock ticks to start the CPU, then the CPU checks the startup program in ROM BIOS and starts the POST (Power On Self Test) which is tests all the hardware devices functionality of the PC and check whether the PC is good condition to operate. If the POST completed successfully it finishes the initialization of the CPU. During the POST process it checks whether this power on process occurred due to soft/warm or hard/cold start. (Cold start is when the machine start occurs with an in proper shutdown, whereas soft start happens when the machine is restarting with proper execution of commands when it is on) If it is a cold start POST perform a full test and if it is a warm start it omit the memory test part during the POST.

BIOS check the disk and load the MBR (Master Boot Record) to the memory, and then MBR take over the boot process. Boot Loader in the MBR searches the partition table for active partition and reads first sector to locate Boot Record. NTLDR (NT Loader) is a system file which is stored in the system root start the XP loading in following phases;

Initial Boot Loading – Processor is turned to real mode from the protected mode and switched on the memory paging. NTLDR will detect and load Boot.ini into memory.

Operating System selection – Boot.ini check whether it has more than one operating systems configured in the system and if it identified two or more it stops the process and allow user to select a OS.

Hardware detection – When XP is selected, NTLDR loads the Ntdelect.com program which detect the hardware profiles configured for the system. If there are many hardware profiles detected, it gives a time period to select a hardware profile for the system before proceeding with the 1^st profile. Then NTLDR is loading Ntoskrnl.exe.

Configuration selection – It loads drives which are selected as boot drivers to the system, while ntoskrnl.exe in first phase disable interrupts and call HAL (Hardware Abstraction Layer) to setup interrupt controller, then it enables the interrupts before the next phase. During the 2^nd phase below processes execute and re-initialization occurs in the given sequence.

a. Object manager

b. Executive

c. Microkernel

d. Security Reference Monitor

e. Memory manager

f. Cache manager

g. LPCS

h. I/O Manager

i. Process Manager

I/O manager first finishes loading boot drivers and system drivers and prioritized and load all other drivers. Session Manager Subsystem (SMSS) loads win23k.sys devices driver which change screen into graphical mode. After successful loading of all the device drivers and services it saves its configuration as “Last Know Good Configuration”. Hence logging process is started by Winlogon.exe, and lsass.exe (Local Security Authority) displays the logon screen.