The Windows Startup and Shutdown Process
Total Page:16
File Type:pdf, Size:1020Kb
The Windows Startup and Shutdown Process Introduction Have you ever wondered what Windows does when it starts up, or when it shuts down? In this thread I will be covering and going in-depth (to a certain extent) the process of Windows startup and shutdown. I must warn you, there will be some X rated content – if you faint at the sight of raw, naked technical information, I would advise you do not read this thread. ...who am I kidding, this is Overclock.net after all! This thread covers the Windows startup and shutdown process in Windows NT 6.1 (i.e. Windows 7 and Windows Server 2008 R2). It does not cover the startup and shutdown process of previous or later versions, however with Windows Vista or Windows 8, you can expect minimal changes. Versions prior to Windows Vista (e.g. Windows XP) differ quite a bit, however. I would expect that some of you probably already know much of this, but I am hoping that for those who do there are some extra tidbits that you didn’t know, and perhaps were even curious about. I know I certainly was asking many of the questions a long time ago that if I could go forward in time, would have been able to answer from this thread. Topics covered Windows boot installation BIOS boot process o Windows setup program interaction o Getting up off the ground o The Windows Boot Manager UEFI boot process The Windows Boot Loader Windows startup process o Kernel initialization . Phase zero initialization . Phase one initialization o Subsystem startup and interactive logon Windows shutdown process o Initiating shutdown . User process termination Windows GUI applications Console applications and services . Powering off the system Windows boot installation Before we even begin to describe the startup (or shut down for that matter!) process of Windows, there must be some steps prior. These steps are part of the Windows setup process, and while this thread will not be going into detail about the Windows setup process, this topic on Windows boot installation will briefly describe how the Windows setup process prepares the primary storage device (hard disk or solid state) on a legacy BIOS system, or UEFI nonvolatile RAM (NVRAM) with the code that begins the Windows boot process. It is important to note here the term “boot process”. This is different from the Windows “startup process”, although they are often treated as encompassing of each other. There are two ways that Windows currently boots the system and this depends on your hardware: 1. The legacy BIOS boot process. 2. The newer UEFI boot process. This thread will describe both boot processes, and then describe the unified Windows “startup process”, and finally the shutdown process. BIOS boot process Going back to days when MS-DOS was dominant, and since then, there has been a standard on x86 computers that specifies the way that physical storage devices such as hard disks are separated. This is known as partitioning and recognized in Windows as logical storage devices. The Windows BIOS boot components are primarily made up of the Master Boot Record (MBR) and the system volume (also known as the boot partition). It is this boot partition that contains the bootable code for the rest of the system. NOTE: Do not be confused between the system volume and the system partition. The system partition is where Windows is installed itself, while the system volume is of the type “System Partition”. From here, I will refer to the system volume as the boot partition, and system partition (where Windows files are actually installed) as itself. Windows setup program interaction Booting starts with the Windows setup program – the first time you install Windows. When the Windows setup program writes the Master Boot Record, it also writes to this bootable partition the file system boot code (which is part of the boot sector, also known as the Volume Boot Record, on this bootable partition). Before the Windows setup program writes to the boot sector it must check to make sure that this boot partition is formatted with NTFS, which is the only file system that Windows supports booting (again, this is not the same as the system partition where Windows is installed, which can be formatted with any file system that Windows supports, e.g. FAT32). If the boot partition is not formatted with NTFS, Windows setup will format it, erasing anything on that partition. After this stage, the Windows setup program then formats the partition to install Windows, copies the BOOTMGR file to the boot partition and initializes the Boot Configuration Database (BCD) which is also stored on the boot partition. The BCD stores information about the operating systems installed on the computer and how to boot them (even non-Microsoft ones). This is what the Windows Boot Manager uses to display a menu and then, or, boot the selected or default operating system. Getting up off the ground The first sector of the boot partition (described above as the boot sector) contains the code needed to load the Windows Boot Manager. The way these two parts of the storage device interact during the boot process is described below. When a legacy BIOS-based computer starts, the first piece of code that is executed is the BIOS itself, after which it selects a storage device and proceeds to read the MBR from it. If there is no MBR present, the BIOS will continue to try other storage devices, if any. If it exhausts them all without success, or there weren’t any more, an error message is displayed on the screen and the boot process stops here. Assuming the BIOS has loaded a valid Master Boot Record into memory, the next task is for the MBR to find the boot partition that is described above. To start, the MBR scans the primary partition table which is located inside the MBR itself, looking for one with a special flag called “active”. This flag is the sign to the MBR code that the partition is bootable. The next stage now is to execute the code in the boot sector, which involves reading the Windows Boot Manager into memory and executing it. The Windows Boot Manager As already described, the boot partition contains the BOOTMGR file (the Windows Boot Manager executable) and the Boot Configuration Database (BCD). The first sector of this partition, the boot sector, contains the minimal code necessary that is able to read the simple NTFS boot partition to load and begin executing the Windows Boot Manager. The file system code is only just enough – i.e. it can only simply read files on the NTFS partition and it cannot read more than one directory level. Once the boot sector code has finished reading the BOOTMGR file into memory, it transfers the control of the processor (CPU) to the entry point of BOOTMGR. If this file cannot be found on the boot partition, the boot sector code then displays an error message that is dreaded by many of us – “BOOTMGR is missing”. The process then stops here – otherwise, the boot sector code has finished its job and the Windows Boot Manager now takes control of continuing to boot the system. BOOTMGR will be referred to as the Windows Boot Manager from now on. NOTE: The BOOTMGR file is actually two files joined together: The first is STARTUP.COM and the second is BOOTMGR.EXE. When BOOTMGR is first executed, it begins in what is called the x86 real mode. In this mode, there is no such thing as virtual memory – all programs that run in this mode use memory addresses as direct physical addresses and only the first one megabyte (1MB) of physical memory is accessible. The first thing that the Windows Boot Manager does is switch the x86 operation mode to what is called protected mode. There is still no virtual memory, but a full 32-bit physical address space is available. After protected mode is enabled, the Windows Boot Manager is active, but BIOS functions are still required for it to access devices such as the display and IDE storage. When the Windows Boot Manager must interface with the BIOS, it will temporarily switch back into real mode to perform the operation – BIOS services can only be executed in real mode. The Windows Boot Manager then creates enough page table structures to be able to access memory below 16MB with paging turned on. After this, the Windows Boot Manager enables paging and executes in a mode called protected mode with paging. This is also the mode that Windows executes in normally. The next stage for the Windows Boot Manager is to read what is in the Boot Configuration Database (BCD). After this, the screen is cleared, and what happens next depends what lives inside the BCD. If the system was put into hibernation, there will be a flag set in the BCD and when the Windows Boot Manager notices this flag, it transfers execution to the WINRESUME.EXE program. This program will then read the contents of the HIBERFIL.SYS file into memory. After reading the hibernation state into memory (which contains a copy of the previously running kernel), WINRESUME.EXE transfers control to the portion of that kernel that is responsible for resuming the system, which will then restart all device drivers that were previously active and the boot process then ends here. If this is a clean boot (i.e. no hibernation state), then the Windows Boot Manager will check the Boot Configuration Database (BCD) for operating system entries.