Windows XP Startup Process and Common Startup faults

 

1. Windows XP system on disk

The Windows installation system writes boot-boot related components to the disk partition of the computer and stores them in the system volume boot volume ). A hard disk generally has two partitioning Methods: one is four primary partitions, each of which can be used as an active partition; the other is three primary partitions and one extended partition, logical partitions are organized in a logical chain mode in extended partitions. The number of logical partitions is not limited. Windows system volumes can only be primary partitions. If you start a volume, the primary partition or logical partition can be used.

Windows InstallationProgramSelect the first bootable primary partition (active partition) on the disk as the system volume. Write the MBR (Master Boot Record, the first sector of the disk, generally 512 bytes in size)CodeAt the at the same time, write Boot Sector in the first sector of the partition. The system components include ntldr, boot. ini, drivers, bootvid. dll, Hal. dll, and boot device drivers. If necessary, the system volume also contains the SCSI driver ntbootdd. sys.

All other components in the Windows system will be placed in the boot volume. During installation, the user selects to determine the partition. The system environment variable % systemdrive % indicates the partition, all Windows files are installed in the % SystemRoot % directory. The core components of windows are located in the <windows \ system32> subdirectory, such as ntoskrnl.exe (initialization executor subsystem), Hal. DLL (kernel mode DLL), smss.exe (Session Manager), winlogon.exe (logon process), win32k. sys (Windows subsystem). The driver is located in the DRIVERS directory, and the Registry file is located in the config directory.

In most cases, the system volume and the start volume are a partition. But there are always exceptions. For example, if XP is installed on a logical partition, the two volumes are separated and the related components are written in the corresponding partition. Can I install multiple XP systems on one machine at the same time? Theoretically, the starting volume can be located in different partitions, but if the active partition is not changed, the system volume is always in the same partition. As a result, the components in the system volume will be overwritten, and multiple XP systems share system volume components, which is different from the number of fully independent XP systems. After experiments, I have verified my analysis. I can indeed Install Multiple XP systems on one machine, but the system volumes are shared, that is, ntldr and boot. INI (multiple startup items), ntdetect.exe is shared.

Ii. Windows XP Startup Process

From powering on the system to logging on to the desktop, Windows has roughly gone through the following stages.

1. Pre-boot phase

After the system is powered on, the computer immediately runs the post self-check program to detect and initialize the system hardware. Then, the BIOS locates the boot device of the computer, reads the MBR to the memory 0x7c00, and then jumps to 0x7c00 for execution.

2. Pilot phase

MBR pilot code scans the partition table, finds the volume of the XP system, reads the Boot Sector of the corresponding partition into the memory, and gives control to it. After the Boot Sector Code loads ntldr into the memory, it gives control to ntldr, and then ntldr controls the boot process.

The first action of ntldr is to switch the system to the protection mode, enable the paging mechanism, and the system enters the standard state of windows. Then, ntldr uses the BIOS service to access the disk. For a SCSI disk, You need to load the ntbootdd. SYS file and use it instead of the bootstrap code function to access the disk. Ntldr reads the boot. ini boot menu file under the root directory of the system volume. If multiple boot items exist, a boot selection menu is displayed. One-line boot is fixed. ntldr.exe and ntdetect.exe are executed. It uses the system BIOS to query basic devices and configuration information. These information is collected to ntldr and stored in the registry HKLM \ hardware \ description later in the boot process.

3. kernel Loading

At this stage, ntldr performs the following tasks:

(1) Check the kernel and hal (ntoskrnl.exe and Hal. dll ).

(2) read the system registry nest, which is located in \ windows \ system32 \ config \ System and determines the driver to be loaded.

(3) scan the system registry nest in the memory to find all the boot device drivers.

(4) Add the file system driver accessing the system directory to the boot driver list.

(5) load the boot driver.

(6)cpu, and use ntoskrnl.exe.

4. initialize the kernel

Ntoskrnl displays the Windows Startup logo on the screen. Then, it completes kernel subsystem initialization through two phases: the first stage completes the initialization of the object definition (process, thread, driver, etc) and core data structure; in the second stage, object initialization and subsystem startup are completed. These two processes are subsequently completed by the kernel system thread of "system idle process.

I/O manager loads the "boot-start" driver and "system-start" Driver in sequence, information about each driver is stored in the registry HKLM \ System \ CurrentControlSet \ Services. Finally, ntoskrnl creates the Session Manager Process (\ windows \ system32 \ smss.exe), which is the first user-state process.

SMSs runs the program specified in bootexecute, such as autochk and chkdsk, processes the "delayed move/rename" command, initializes paging files and other registry items, load and initialize the Win32 subsystem (win32k.sys.pdf in kernel mode, start csrss.exe (win32subsystem in user mode, and start winlogon.exe.

5. logon phase

Winlogon.exe loads Gina (graphical identification and authentication) and waits for the user to log on. By default, Gina is MSGINA. dll, which displays the Windows logon dialog box. Then, winlogincreates the Service Control Manager services.exe process, loading all the services and drivers identified as auto-starting, and the local security authentication subsystem LSASS (Local Security Authority ).

After the user logs on correctly, Winlogon loads the Registry nest from the profile of the login user, maps it to hkcu, and then sets the user environment variable. Winloginnotifies ginato execute user-defined programs userinit.exe and shell scripts, which are specified by HKLM \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ userinit and shell to load various Automatic startup items.

Now, after Windows is started, the user will control various activities on the computer.

Iii. Windows XP Common Startup faults

Some problems may occur during XP startup, including MBR damage, Boot Sector damage, System File loss or damage, boot. INI missing or configuration error, system crash or blue screen, system service or driver loading failure, user login problems, and so on. These problems may be caused by hard disk damage, file damage, missing files, and third-party driver errors. For boot problems, Windows provides a variety of diagnostic and repair solutions, mainly including the last known good configuration) driver loading and Recovery Console in security mode and security mode ). The Recovery Console provides many practical tools, such as fixmbr, fixboot, bootcfg, and chkdsk. For advanced users, you can use kd.exe1_windbg.exe, the internal kernel of the Windows Firewall tool, to diagnose and repair the crash dump files, local fault systems, and remote fault systems.

Iv. References

[1] in-depth analysis of Windows operating system, Mark E. russinovich and David A. Solomon.

[2] Windows Startup Process .ppt, Yu Yong (www.yuyong.net ).
[3] Windows XP startup process. Doc, producer name.

Source: Windows XP Startup Process and Common Startup faults-Liu aigui's column-csdn blog