How to boot, Windows boot sequence detailed

This article elaborates on the startup sequence of the Windows operating system to facilitate the analysis and resolution of Windows startup issues by IT practitioners.

The Windows startup process includes the following stages:

Starting the self-test phase

This stage is mainly to read the BIOS, then the memory, CPU, hard disk, keyboard and other devices. Conduct a self-test. This stage displays on the screen the print information that is self-tested.

Screen display: Self-test print information

Initialization start-up phase

This stage finds the bootable device that can be started, such as the local disk, according to the boot sequence specified by the BIOS. CD Driver, USB devices, etc., then prepare to boot the system from these devices.

Screen display: black screen

Boot loading stage

This stage first loads Ntldr from the boot partition (such as C drive), then Ntldr makes the following settings:

1. Built-in memory mode, if it is x86 processor, and the operating system is 32-bit, set to 32-bit flat memory mode, if it is 64-bit operating system + 64-bit processor, set to 64-bit memory mode .

2.Start File System

3.Read boot.ini file

Screen display: Black screen, if you press F8 or multiple systems, the boot option menu will be displayed.

Detecting and Configuring Hardware Phases

This stage checks and configures some hardware devices: — system firmware such as time and date & mdash; bus and adapter — display adapter — Keyboard —communication port—disk—floppy —input device (eg mouse)—parallel —device running on ISA bus

Screen display: black screen

kernel loading stage

In the kernel loading phase, Ntldr will first load the Windows kernel Ntoskrnl.exe and the hardware abstraction layer (HAL). HAL is somewhat similar to the BSP (Borad support package) under the embedded operating system, this abstraction layer is for hardware. The underlying features are isolated and provide a unified call interface to the operating system. When the operating system is ported to different hardware, it is only necessary to change the corresponding HAL. Other kernel components do not need to be modified. This is the usual design mode of the operating system.

Next Ntldr reads the drivers installed on this machine from HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet and then loads the drivers one by one.

When the driver is loaded, Windows does the following:

1. Create system environment variables

2. Start win32.sys, which is the kernel mode of the Windows subsystem. section.

3. Start csrss.exe, which is the user mode part of the Windows subsystem.

4. Start winlogon.exe

5. Create virtual memory page file

6. Rename some necessary files (mainly driver files, if updated) , need to be renamed before the next reboot)

Screen display: display Windows logo interface and progress bar

Login phase

This stage will do the following Things:

1. Start all Windows services that need to be started automatically on the machine

2. Start local security authentication Lsass.exe

3. Display login screen< Br>

Screen display: display login screen