Windows Vista start 2

When Windows Vista is started, ntldr is no longer used. Instead, it is replaced by winload, And the startup project is no longer read from boot. ini, but from the registry.

We need to implement a function, restart Vista, and then let it enter the security mode with a network link, so that we can control the computer from the remote end into the security mode for some maintenance and repair work. Previously, this task was implemented by adding the/safeboot parameter to the boot items related to boot. ini.

Microsoft defines a set of data types named Boot config data to help us control the startup of the system. The Startup type is defined below.

Typedef Enum bcdosloaderelementtypes
{
Bcdosloaderdevice_osdevice = 0x21000001,
Bcdosloaderstring_systemroot = 0x22000002,
Bcdosloaderboolean_detectkernelandhal = 0x26000010,
Bcdosloaderstring_kernelpath = 0x22000011,
Bcdosloaderstring_halpath = 0x22000012,
Bcdosloaderstring_dbgtransportpath = 0x22000013,
Bcdosloaderinteger_nx policy = 0x25000020,
Bcdosloaderinteger_paepolicy = 0x25000021,
Bcdosloaderboolean_winpemode = 0x26000022,
Bcdosloaderboolean_disableverifier = 0x26000023,
Bcdosloaderboolean_disablecrashautoreboot = 0x26000024,
Bcdosloaderboolean_uselastgoodsettings = 0x26000025,
Bcdosloaderboolean_nolowmemory = 0x26000030,
Bcdosloaderinteger_removememory = 0x25000031,
Bcdosloaderinteger_increaseuserva = 0x25000032,
Bcdosloaderboolean_usevgadriver = 0x26000040,
Bcdosloaderboolean_disablebootdisplay = 0x26000041,
Bcdosloaderboolean_disablevesabios = 0x26000042,
Bcdosloaderinteger_clustermodeaddressing = 0x25000050,
Bcdosloaderboolean_usephysicaldestination = 0x26000051,
Bcdosloaderinteger_restrictapiccluster = 0x25000052,
Bcdosloaderboolean_usebootprocesssoronly = 0x26000060,
Bcdosloaderinteger_numberofprocessors = 0x25000061,
Bcdosloaderboolean_forcemaximumprocessors = 0x26000062,
Bcdosloaderinteger_usefirmwarepcisettings = 0x26000070,
Bcdosloaderinteger_safeboot= 0x25000080,
Bcdosloaderboolean_safebootalternateshell = 0x26000081,
Bcdosloaderboolean_bootloginitialization = 0x26000090,
Bcdosloaderboolean_verboseobjectloadmode = 0x26000091,
Bcdosloaderboolean_kerneldebuggerenabled = 0x26824a0,
Bcdosloaderboolean_debuggerhalbreakpoint = 0x26824a1,
Bcdosloaderboolean_emsenabled = 0x26824b0
} Bcdosloaderelementtypes;

 

It seems that the security mode is fixed, and there is still a small problem. We need the network security mode.

Typedef Enum bcdlibrary_safeboot
{
Safemodeminimal = 0,
Safemodenetwork = 1,
Safemodedsrepair = 2
} Bcdlibrary_safeboot;

For how to use these structures, see

The content in HKLM/bcd00000000/objects is clear.