In-depth understanding of XP mysterious boot file NTLDR

NTLDR is generally stored in the root directory of the C drive. It is a system file with hidden and read-only attributes. Its main responsibility is to parse the Boot.ini file. If your understanding of it is not very clear, then we will use Windows XP as an example to introduce the role of NTLDR in the system boot process.

Windows XP will undergo three stages of pre-booting, booting and loading the kernel during the boot process. This is completely different from the way Windows 9X directly reads the boot sector to boot the system. NTLDR is in these three. The guiding process of the phases will play a crucial role.

1. Pre-boot phase

The work done by the computer during the pre-boot phase is: running the POST program, POST will detect the total memory of the system and the status of other hardware devices, and load the first physical sector of the disk into the memory. , load the hard disk master boot record and run, the master boot record will find the starting position of the active partition. The boot sector of the active partition is then loaded and executed, and finally the NTLDR file is loaded and initialized from the boot sector.

2. Boot Phase

During the boot phase, Windows XP will go through the four small phases of the initial boot loader phase, the operating system selection phase, the hardware detection phase, and the configuration selection phase.

(1) In the initial bootloader phase, NTLDR will convert the computer's microprocessor from real mode to 32-bit flat memory mode. In real mode, the system will reserve 640KB for MS-DOS. The memory space, the rest of the memory is seen as extended memory, in the 32-bit flat mode, the system treats all memory as available memory, then NTLDR executes the appropriate small file system driver, then NTLDR can identify each use A file system partition in NTFS or FAT format, at which point the initial boot loader phase ends.

(2) When the initial bootloader phase is over, it will enter the operating system selection phase. If multiple operating systems are installed on the computer, since NTLDR loads the correct Boot.ini file, it is started. The menu that asks for the operating system will appear. NTLDR finds the partition location of the system file from the boot.ini file. If the NT system is selected, NTLDR will run the NTDETECT.COM file, otherwise NTLDR will load BOOTSECT.DOS and then pass control to BOOTSECT.DOS. If there is only one operating system in the Boot.ini file or the timeout value is 0, the menu screen of the operating system will not appear. If the Boot.ini file is illegal or does not exist, NTLDR will try to boot from the default system volume. system.

Tip: After NTLDR starts, if Hiberfil.sys file is found in the system root directory and the file is valid, NTLDR will read the information in Hiberfil.sys file and let the system recover to sleep before State, this does not process the Boot.ini file.

(3) When the operating system selection phase is over, it will enter the hardware detection phase. At this time, the NTDETECT.COM file will collect the hardware information list in the computer, and then return the list to NTLDR, so NTLDR will put these The hardware information is loaded into Hardware in the registry "HKEY_LOCAL_MACHINE".

(4) After the hardware detection phase is over, the configuration selection phase will be entered. If there are multiple hardware configuration lists, the configuration file selection menu will appear. If there is only one, it will not be displayed.

3. Loading the kernel stage

During the loading kernel phase, NTLDR will load the NTOKRNL.EXE kernel, then NTLDR will load the hardware abstraction layer (HAL.dll), and the system will load the "HKEY_MACHINESystem" key in the registry. At this point, NTLDR will read the "HKEY_MACHINESystemselect" key to determine which ControlSet will be loaded. The loaded ControlSet will contain the driver for the device and the services that need to be loaded. Then NTLDR loads the underlying device driver with the start key value of 0 under the registry "HKEY_LOCAL_MACHINESystemservice". When the ControlSet's image CurrentControlSet is loaded, NTLDR will pass control to NTOSKRNL.EXE, and the boot process will end.

Tip: If you press F8 at startup, we will see multiple selection startup modes in the boot menu. At this time, NTLDR will load the NT kernel with the startup parameters according to the user's choice. Users can also set startup parameters in the Boot.ini file.