Windows NT startup process

The Windows NT startup process is the process by which Microsoft's Windows NT, Windows 2000, Windows XP and Windows Server 2003 operating systems initialize.

Boot Sequence

• Upon POWER ON, the CPU runs the instruction located at the memory location 0xFFFF0 of the BIOS.
• 0xFFFF0 contains a JUMP Instruction pointing to the BIOS start-up program, which then runs the POST to check & initialize required devices.
• The BIOS checks a pre-configured list of Non-Volatile Storage Devices (Boot Device Sequence)
• A bootable device has the last 2 bytes of the first sector containing 0xAA55 (Boot Signature)
• Once identified, BIOS loads the Boot Sector contents (from MBR in case of a HDD) to memory & transfers execution control to the boot code.
• MBR Code looks for a bootable partition from its Partition Table.
• The MBR code loads the boot sector code from that partition and executes it.
• The Boot Sector Code is mostly OS Specific which loads and executes the OS Kernel.
• If no Active Partition or invalid Active Partition Boot Sector, the MBR loads a secondary Loader to select the partition via user input.

From that point, the boot process continues as follows:

An NTLDR file, located in the root folder of the boot disk, is composed of two parts. The first is the StartUp module and immediately followed by the OS loader (osloader.exe), both stored within that file. When NTLDR is loaded into memory and control is first passed to StartUp module, the CPU is operating in real mode. StartUp module's main task is to switch the processor into protected mode, which facilitates 32-bit memory access, thus allowing it to create the initial Interrupt descriptor table, Global Descriptor Table, page tables and enable paging. This provides the basic operating environment on which the operating system will build. StartUp module then loads and launches OS loader.