Windows XP startup process details

 

[Pre-start stage]
1> post self-check: This is the first thing that must be done after each computer is powered on. post
The system checks the hardware, memory, keyboard, and scsicard. Although this is not related to the operating system
But it is the first step to ensure the normal startup of the system.
2> once the self-check is completed, the computation is about to find the Startup Device and tune the MBR mainbootrecord (Master Boot Record ).
Memory.
Typical Fault: blue screen after startup, "operating system not found", mention
"Invalidpartitiontable"
This error message occurs because Mbr is damaged;
Solution: use the system boot disk (floppy disk or CD) to start the computer, and then execute the following command:
Fdisk.exe/mbr
The Fdisk/mbr command can be unconditionally written to the master boot program and partition table on the hard disk, and does not guide the dos
Sector Dbr (dos boot record), file allocation table and directory partition initialization; that is, execute
After fdisk/mbr, The Master Boot Program and partition table can be rebuilt without breaking the original data information on the bad hard disk;
For hard disks infected with the embedded boot zone virus, the virus can be cleared;
Fdisk is a standard command in msdos, windows95/98/me, windowsNT/2 k/XP, you can use the following
Solution:
Start the system fault recovery console, enter fixmbr at the command prompt, and press Y when the warning message appears.
Finally, enter exit to exit the fault recovery console;
3> calculate the active partition to be searched, boot the sector, and load it into the memory;
4> start to call Ntldr. Ntldr is the system loader and is a key part of the second stage;
Plus: Mbr, or (masterbootrecord) abbreviation. Chinese meaning is the Master Boot Record, hard disk 0 track
The first sector is called MBR, and its size is 512 bytes. This region can be divided into two parts: I, preboot
Startup zone), accounting for 446 Bytes: ii. The second part is that the Partition Table area (Partition Table) occupies 64 bytes, which is equivalent
In a small program, the function is to judge that partition is marked as an active partition, and then read the start zone of that partition,
And run the code in this area. The last two bytes are an identifier to indicate the end of this sector. Its binary
The value is 0x55AA.
[Start stage]
1> when Ntldr starts running, it first changes the real mode of the processor to the 32-bit smooth memory mode;
Explanation: real mode and 32-bit smooth memory mode:
Both are the addressing mode of the computer system. The real mode refers to the 16-Bit mode, which runs stably. The smooth memory mode
It has obvious advantages in addressing range and speed.
2> Start the file system (such as fat and ntfs) to access files from the disk;
3> then, Ntldr will access the first file: boot. ini, and display the startup
Dynamic menu;
4> If the selected operating system is not win2k (or winXp), Ntldr will call bootsect. dos,
Give control to her and start the operating system. Otherwise, Ntldr will run the Ntdetect.com file;
[Typical faults:]
I. When you select another operating system, an error message is displayed: I/O error accessing bootsect or.
File Muti (0) disk (0) rdisk (0) partiton (1) // BOOTSS
This problem is caused by the failure to find the boot partition, which usually occurs on a computer with multiple operating systems installed.
When you install win2k on an existing operating system such as win98, the installer will (
Usually 0 partitions) Save as bootsect. dos, and then the installer will put the win2k startup partition on the 0 partition.
Therefore, bootsect. dos is created during startup, and cannot be used from the disc like other lost files.
How can this problem be solved if I copied it above?
Re-generate a boot partition for the original operating system. For example, for win98, you only need to start
Run sysc :,
Create bootsect. dos:
A. Add the win2k installation disc to the optical drive and start the computer;
B. Press the R key twice when the welcome screen appears;
C. When the installer is running and the repair task is selected, select the "check startup Sector" option and move the optical bar
Press enter on "continue (execute the selected task;
D. Follow the Installation Wizard and you will see the prompt "the installation program has been fixed;
E, Reset;
5> Ntdetect.com collects information about computer hardware, including the computer ID and adapter card.
Type, video card, keyboard, mouse, floppy disk, comport, and parallel port. Once the information is collected, Ntdetect.com
The information is transmitted to Ntldr and written to the hkeylocalmachine/hardware branch in the registry;
We can see that three very important files are called in the startup phase: Ntdetect.com, boot. ini, and
Bootsect. dos. This process is often caused by the installation of multiple operating systems;
[Typical fault:] When the computer is started:
No Startup menu is displayed;
In this case, the display time of the operating system list is set to 0 seconds. The solution is: My computer, attributes,
Advanced, start fault recovery, display the operating system list... (modify the time value), my solution is to press F8
In, select the operating system list.
[Typical fault:] occurs when the computer is started:
Ntldr is missing, press any key to restart...
Ntldr file loss. If an error occurs, this fault may occur.
Yes, Ntdetect. comismissing... and so on. Use the following solution:
Use win2k to install the disc. The file is stored in the i386 directory of the system installation disc.
The hard disk is ready;
A. Enter the win2k CD and start win2k installation;
B. When the welcome page appears, press R;
C. On the win2k repair options page, press R;
D. When you are prompted to select the Repair Option, press M; (manual repair)
E. Select to verify the win2k system file;
F. Select continue (execute the selected task) and press Enter,
G. The Emergency Repair Disk page appears. If you have an Emergency Repair Disk, insert it and follow the prompts to fix and install it.
, Reset;
H. If there is no urgent repair disk, press L and use the disc for repair;
Use Console: Enter map and write down the drive letter L of the win2k installation disc;
Input: copy L:/i386/ntldr c :/
Indicates whether to overwrite, Y;
Enter exit to restart;
[Kernel call stage]
1. In this stage, ntldrwill use ntoskrnl.exe and pass hardware information collected by Ntdetect.com
It is also called by the hal. dll file. If you have multiple hardware configuration files
You will see the information about the hardware configuration file on the screen. In addition, Ntldr will also be called from the registry.
All device drivers whose startup value is 0x0. If you have the "/sos" parameter in the boot. ini file
After "/fastdetect", you will see the list of called devices;
[Typical faults]
An error message is displayed at startup: "Ntoskrnl.exe missing or currupt on bootup"
(Ntoskrnl.exe is lost or damaged)
If the ntoskrnl.exe error appears:
Add a new hard disk or change the original partition, for example, delete the original partition or
Merging Two partitions may cause the default value of [bootloader] In the boot. ini file to be lost or
The file is invalid and cannot be found during startup;
The Ntoskrnl.exe file is deleted or damaged;
[Solution:]
Use the boot disk to start the operating system, edit the boot. ini file, and check whether the Command similar to the following is correct.
Error:
Muti (0) disk (0) rdisk (0) partition (1)
/WINNT = "microsoftwindows2000professional"/fastdetect
This line indicates that Windows 2 k is installed in the first partition of rdisk (0) on the first hard disk of the ide.
Check whether the value in your boot. ini file is correct based on this rule;
If no error is found, place the win2k installation disc into the optical drive and enter the following command line:
Expand x:/i386/ntoskrnl. ex _ c:/ntoskrnl.exe
Press enter, prompting that the file has been released, and the disc is removed and reset;
[Typical fault:] Hal. dllismissing...
The fault is caused by the lack of hal. dll files. The solution is as follows:
A. Start the fault recovery console;
B. Input: expand x:/i386/hal. dl _ c:/windows/system32/hal. dll
C. Enter exit and press Enter;
In the internal verification section, ntldr.exe is called the ntokrnl.exe of Windows XP. The System Loads
But it is not initialized, then ntldr loads the hardware abstraction layer (HAL, hal. dll), and then the system continues to load
HKEY_LOCAL_MACHINE/system key. NTLDR reads the select key to determine which ControlSet will be loaded.
The control set contains the driver of the device and the services to be loaded, and NTLDR is loaded.
HKEY_LOCAL_MACHINE/system/service/... the driver of the underlying device whose start key value is 0. When serving
When the CurrentControlSet of the ControlSet image is loaded, ntldr passes the control to the kernel and initializes the kernel.
The phase begins;
2. kernel initialization. This step initializes the kernel and the hardware driver called in the previous step.
Initialization Process:
At the beginning of the kernel initialization stage, the color Windows XP logo and progress bar are displayed in the center of the screen.
At this stage, the system has completed the three tasks started;
1> the kernel uses the data collected during HARDWARE detection to create the HKEY_LOCAL_MACHINE/HARDWARE key;
2> the kernel copies the ControlSet by referencing the default value of HKEY_LOCAL_MACHINE/system/Current.
CloneControlSet is created. The CloneControlSet configuration is a backup of computer data, excluding changes during startup.
And will not be modified;
3> the system completes initialization, loads device drivers, and initializes those loaded during the kernel loading process.
Underlying driver, then kernel Scan
HKEY_LOCAL_MACHINE/system/CurrentControlSet/service /...
Drivers. These device drivers are initialized when they are loaded. If an error occurs, the kernel uses
ErrorControl key value to determine how to handle ....
When the value is 3, the error is marked as crisis/critical. When the system encounters an error for the first time, it will be re-configured with LastKnownGoodControlSet.
Start. If an error still occurs when you start with LastKnownGoodControlSet, the system reports an error or an error.
Information will be displayed, and the system will stop starting;
If the value is 2, the error is serious. The system fails to start and restarts with LastKnownGoodControlSet, as shown in figure
If the value of LastKnownGood is already used for system startup, the system will ignore the error and continue to start;
When the value is 1, the error is normal. The system will generate an error message, but the error will still be ignored and
Restart;
When the value is 0, the system does not display any error information and continues to run;
Plus: Hal. dll, short for the hardware abstraction layer
The excuse between drivers and hardware can prevent applications from directly accessing computer system memory, cpu and hardware.
Devices (such as sound cards and video cards) enable the system to run across multiple hardware platforms;
[Service call stage]
This step will start the session manager (smss.exe). session management will read the list of programs that must be called.
In the bootExecute item of the table, set the memory paging and start the win32 subsystem;
SessionManager starts WindowsXP advanced subsystems and services, and SessionManager starts to control all
Input and Output devices, Win32 subsystem accessing the display screen, and Winlogon processes. kernel Initialization is complete.
[Win32 subsystem startup phase]
When a new win32's system is started, winlogon.exewill be automatically run. At the same time, the mobile firewall security management (lsass.exe)
In addition, the following figure shows the Login Dialog Box. Then, run the service controller screg.exe. The service controller checks
A service project with a dynamic value of 0x2 and then call these services. A service with a value of 0x3 indicates that it needs to be started manually, and its value is 0x4.
Indicates that the service is disabled;
ServiceController final execution and Scanning
HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Servives to check whether there are any service requirements
For a service whose start key value is 2 or higher, ServiceController queries the service according to the value of start and
Value of DependOnGroup and DepandOnService to load;
[User login stage]
The last step is the user login phase. Once the user can log on to the system, it indicates that the entire startup process has been
After successful login, the current settings are automatically saved as "Last correct lastknowngood configuration"
For later use;
Winlogon.exe starts Local Security Authority and Windows XP Professional Welcome Screen
Or the Login Dialog Box is displayed. At this time, the system may continue to initialize the unfinished driver in the background;
Prompt to enter a valid user name or password;