Booting process of Windows NT Setup before Vista

Last updated

The first screen of the Windows XP Setup process Windows XP Setup.png
The first screen of the Windows XP Setup process

The booting process of Windows NT Setup before Vista works very similarly to the one of a regular Windows NT boot except that it runs from a CD-ROM. For this boot method to work, the BIOS must be compatible with the El Torito specification. The ISO 9660 file system on the install CD is not fully compatible with the standard. Although it is "Level 1", the file names don't have the file version appended to them. The boot image is of the "no emulation" type, 1 sector long (2048 bytes) and is loaded at segment 0x7c0. [1] It can be extracted from an ISO image by using a file-extraction program such as 7-Zip or WinZip. The ISO image is also not hybridized like ISO images from most Linux distributions and therefore it does not contain any master boot record (MBR) which makes it unable to boot by just copying the image over a block device such as a pen drive.

Contents

The installer can also be run from a MS-DOS command prompt so previous versions of Microsoft Windows that are already installed can be upgraded[ dubious – discuss ]. To run the installer from a MS-DOS based operating system such as Windows 98 or Windows ME, the user must start the system "in DOS mode" and then execute I386/WINNT.EXE on the CD-ROM. [2] [3] A floppy disk containing MS-DOS can be used to start the installer. Versions of the installer in floppies were also available for sale. [4]

From Windows Vista onwards, the installer runs from BOOT.WIM which contains a bootable version of the Windows Preinstallation Environment. Windows PE 2.0 is based on the Windows Vista kernel, [5] later Windows PE versions are based on later Windows versions. [6]

CD-ROM boot image phase

On a regular CD-ROM install, the BIOS executes the POST and then searches for a boot descriptor on the CD-ROM. The boot descriptor points to a boot catalog file on the ISO 9660 file system. The BIOS searches for a boot image compatible with the current architecture, loads it into memory and then runs it. The boot image is analogous to the boot sector on a hard drive. The boot image loads SETUPLDR.BIN which is analogous to NTLDR. If this fails for any reason, a message is displayed saying that NTLDR was not found, which may of itself be misleading; moreover, the NTLDR on the CD is never used during the loading phase of the installer. The process also assumes that file versions are unavailable.

Before starting the boot loader, the boot image checks whether there is a Windows install (system) already present and, if so, it starts BOOTFIX.BIN. If no install is found, or if the disk does not have an MBR, then it starts the boot loader directly, thus obviating the need for BOOTFIX.BIN. If BOOTFIX.BIN is started, it displays the string "Press any key to boot from CD." and waits for user input. If none is detected for some seconds, then it boots the next device, and so on. This behavior is essential for booting the second stage of the installer, which starts from the hard disk.

Boot loader phase

Both SETUPLDR.BIN and NTLDR are composed of two binary files concatenated. They also can be found on the installation CD as compressed CAB files. The first file is STPBOOT.BIN, which is a flat binary file that just loads the second file. The second file is a regular EXE file in the Portable Executable format. In SETUPLDR.BIN the second file is SETUPLDR.EXE and in NTLDR the second file is OSLOADER.EXE. Both SETUPLDR.EXE and OSLOADER.EXE have embedded file system drivers for basic access on FAT, NTFS and ISO 9660. Differently from regular *.SYS drivers, the boot loader uses BIOS interrupts to access the boot disk. It also contains a built-in INI parser and CAB decompressor.

After the installer starts running, it prints the string "Setup is inspecting your computer's hardware configuration...". NTDETECT.COM is called and the system information is stored in memory. It then displays a blue screen in VGA text mode with the title "Windows Setup", or "Windows *version name here* Setup", with a white line on the bottom that serves as a status bar. NTDETECT.COMthen looks for TXTSETUP.SIF and parses it. This file works as a key-value database just like the registry or an *.INI or *.INF file. The keys may either contain a list of files associated with their install location or a script line. Therefore, the database stores data and code. During the parsing, the blank lines are ignored and sections with the same name are merged.

The file BIOSINFO.INF is also loaded to resolve hardware quirks.

The key-value syntax in the SourceDisksFiles section is as follows: [7] [8] [9] 

filename_on_source=disk_id,subdir,upgrade_code,new_install_code,spare,spare,new_filename

The installer asks if any additional drivers need to be loaded and loads text mode drivers.

If so, they can be loaded from a floppy disk only. There is a hidden feature that shows a screen prompting the user to select a computer type if F5 is pressed during the first message. [10]

Text mode drivers are different from PnP drivers as they are loaded regardless if the hardware is present or not. The loading phase of the installer displays some messages on the screen about the current file being loaded. The message is "Setup is loading files ([the file description])...". The files loaded in this phase are those located in sections ending in .Load. In those sections, the key gives a driver name and the value gives a file. The driver name is then looked up in the same section without the .Load suffix to find the driver's user-friendly name. The kernel also needs a registry hive mounted to load the registry from, so SETUPREG.HIV is also loaded. All the file names of the files loaded by the boot loader are hard-coded except for the drivers.

As for PnP devices, after being identified by a bus driver, the address in checked in the section HardwareIdsDatabase and a corresponding driver name is given. But those are not used in this step.

Kernel phase

After all boot files are loaded by the boot loader, the message "Setup is starting Windows" is displayed and the kernel starts. Just like a normal install, it starts the drivers and loads the only service which is setupdd.sys. It runs in kernel mode and starts a GUI still in text mode. From now on, all the drivers are NT based and BIOS interrupts are not used anymore.

The user is asked to choose a file system layout. The selected partition is formatted if necessary and the files from TXTSETUP.SIF are copied to the system. Then it creates the registry hives and automatically restarts the system so the NT system can start and bootstrap itself. The section HiveInfs points to the files used to fill the hives with the default values. On a fresh install this section is named HiveInfs.Fresh. The files are not reg files but are also ini files that can be understood by the ini interpreter bundled with the installer. The disk formatter program is statically linked with setupdd.sys.

Remastering

There are many freeware tools available on the internet that customize TXTSETUP.SIF for the creation of unattended installs or to integrate drivers and hotfixes. This process is sometimes referred as slipstreaming.

The following command shows how a remastered CD can be created with a minimum set of options on Linux. It assumes that the current directory is the CD mount point. The image will be created at the home directory.

mkisofs-bBootable_NoEmulation.img-no-emul-boot-N.>~/ntsetup.iso

The file winnt.sif can be used to make the install unattended but it is not required to be present. There is a model file on the CD named UNATTEND.TXT. Setup tries to detect winnt.sif in the I386 directory or on the root directory of a floppy disk. [11]

See also

Related Research Articles

<span class="mw-page-title-main">Windows 95</span> Microsoft computer operating system released in 1995

Windows 95 is a consumer-oriented operating system developed by Microsoft as part of its Windows 9x family of operating systems. The first operating system in the 9x family, it is the successor to Windows 3.1x, and was released to manufacturing on July 14, 1995, and generally to retail on August 24, 1995, almost three months after the release of Windows NT 3.51. Windows 95 is the first version of Microsoft Windows to include the start button. Windows 95 merged Microsoft's formerly separate MS-DOS and Microsoft Windows products, and featured significant improvements over its predecessor, most notably in the graphical user interface (GUI) and in its simplified "plug-and-play" features. There were also major changes made to the core components of the operating system, such as moving from a mainly cooperatively multitasked 16-bit architecture to a 32-bit preemptive multitasking architecture, at least when running only 32-bit protected mode applications.

<span class="mw-page-title-main">Drive letter assignment</span> Alphabetical assignment to logical drives on computers (e.g., C:\)

In computer data storage, drive letter assignment is the process of assigning alphabetical identifiers to volumes. Unlike the concept of UNIX mount points, where volumes are named and located arbitrarily in a single hierarchical namespace, drive letter assignment allows multiple highest-level namespaces. Drive letter assignment is thus a process of using letters to name the roots of the "forest" representing the file system; each volume holds an independent "tree".

NTLDR is the boot loader for all releases of Windows NT operating system from 1993 with the release of Windows NT 3.1 up until Windows XP and Windows Server 2003. From Windows Vista onwards it was replaced by the BOOTMGR bootloader. NTLDR is typically run from the primary storage device, but it can also run from portable storage devices such as a CD-ROM, USB flash drive, or floppy disk. NTLDR can also load a non NT-based operating system given the appropriate boot sector in a file.

<span class="mw-page-title-main">Live CD</span> Complete, bootable computer installation that runs directly from a CD-ROM

A live CD is a complete bootable computer installation including operating system which runs directly from a CD-ROM or similar storage device into a computer's memory, rather than loading from a hard disk drive. A live CD allows users to run an operating system for any purpose without installing it or making any changes to the computer's configuration. Live CDs can run on a computer without secondary storage, such as a hard disk drive, or with a corrupted hard disk drive or file system, allowing data recovery.

The Installable File System (IFS) is a filesystem API in MS-DOS/PC DOS 4.x, IBM OS/2 and Microsoft Windows that enables the operating system to recognize and load drivers for file systems.

<span class="mw-page-title-main">Windows Registry</span> Database for Microsoft Windows

The Windows Registry is a hierarchical database that stores low-level settings for the Microsoft Windows operating system and for applications that opt to use the registry. The kernel, device drivers, services, Security Accounts Manager, and user interfaces can all use the registry. The registry also allows access to counters for profiling system performance.

<span class="mw-page-title-main">BartPE</span> Software to create a customised Windows XP

BartPE is a discontinued tool that customizes Windows XP or Windows Server 2003 into a lightweight environment, similar to Windows Preinstallation Environment, which could be run from a Live CD or Live USB drive. A BartPE system image is created using PE Builder, a freeware program created by Bart Lagerweij.

<span class="mw-page-title-main">Windows Preinstallation Environment</span> Lightweight version of Microsoft Windows for deployment

Windows Preinstallation Environment is a lightweight version of Windows used for the deployment of PCs, workstations, and servers, or troubleshooting an operating system while it is offline. It is intended to replace MS-DOS boot disks and can be booted via USB flash drive, PXE, iPXE, CD, DVD, or hard disk. Traditionally used by large corporations and OEMs, it is now widely available free of charge via Windows Assessment and Deployment Kit (WADK).

In Linux systems, initrd is a scheme for loading a temporary root file system into memory, to be used as part of the Linux startup process. initrd and initramfs refer to two different methods of achieving this. Both are commonly used to make preparations before the real root file system can be mounted.

ntdetect.com is a component of Microsoft Windows NT-based operating systems that operate on the x86 architecture. It is used during the Windows NT startup process, and is responsible for detecting basic hardware that will be required to start the operating system.

The booting process of Windows NT is the process run to start Windows NT. The process has been changed between releases, with the biggest changes being made with Windows Vista. In versions before Vista, the booting process begins when the BIOS loads the Windows NT bootloader, NTLDR. Starting with Vista, the booting process begins with either the BIOS or UEFI load the Windows Boot Manager, which replaces NTLDR as the bootloader. Next, the bootloader starts the kernel, which starts the session manager, which begins the login process. Once the user is logged in, File Explorer, the graphical user interface used by Windows NT, is started.

ntoskrnl.exe, also known as the kernel image, contains the kernel and executive layers of the Microsoft Windows NT kernel, and is responsible for hardware abstraction, process handling, and memory management. In addition to the kernel and executive mentioned earlier, it contains the cache manager, security reference monitor, memory manager, scheduler (Dispatcher), and blue screen of death.

<span class="mw-page-title-main">Recovery Console</span> Microsoft Windows feature

The Recovery Console is a feature of the Windows 2000, Windows XP and Windows Server 2003 operating systems. It provides the means for administrators to perform a limited range of tasks using a command-line interface.

<span class="mw-page-title-main">Windows Boot Manager</span> Boot process used in modern Windows NT-based products

The Windows Boot Manager (BOOTMGR) is the bootloader provided by Microsoft for Windows NT versions starting with Windows Vista. It is the first program launched by the BIOS or UEFI of the computer and is responsible for loading the rest of Windows. It replaced the NTLDR present in older versions of Windows.

The booting process of Microsoft Windows varies between different releases.

<span class="mw-page-title-main">EasyBCD</span> Software for Microsoft Windows

EasyBCD is a program developed by NeoSmart Technologies to configure and tweak the Boot Configuration Data (BCD), a boot database first introduced in Windows Vista and used in all subsequent Windows releases. EasyBCD can be used to set up multi-boot environments for computers on which some versions of Windows, Linux, BSD and Mac OS X can be simultaneously installed; EasyBCD can also be used for adding entries to bootable tools and utilities, as well as modifying and controlling the behavior of the Windows boot menu. EasyBCD 2.3 introduced additional support for creating and managing entries for UEFI-based Windows entries in the boot menu. As of June 20, 2011 with the release of EasyBCD 2.1, it is no longer free for use in commercial environments which require the purchase of a paid license, however it remains free for home and non-profit use without limitations.

A System Deployment Image is a file format used primarily with Microsoft products to contain an arbitrary disk image, including boot sector information.

<span class="mw-page-title-main">Windows Setup</span> Installer that prepares a hard disk drive for a Microsoft Windows operating system installation

Windows Setup is an installer that prepares a computer for a Microsoft Windows installation by allowing the user to pick installation settings and copying the files to the drive.

Windows NT is a proprietary graphical operating system produced by Microsoft, the first version of which was released on July 27, 1993. It is a processor-independent, multiprocessing and multi-user operating system.

<span class="mw-page-title-main">Architecture of Windows 9x</span>

The Windows 9x series of operating systems refers to the monolithic kernel which powers these operating systems. The basic code is similar in function to MS-DOS. As a 16-/32-bit hybrid, it requires support from MS-DOS to operate.

References

  1. ↑ "Bootable disc". CDBurnerXP. Retrieved March 2, 2014.
  2. ↑ "How to start the Setup program from MS-DOS in Windows XP". Microsoft Support. Microsoft Corporation. Archived from the original on June 8, 2014. Retrieved March 2, 2014.
  3. ↑ "How to install Windows from the I386 folder". Microsoft Corporation. Archived from the original on March 2, 2014. Retrieved March 2, 2014.
  4. ↑ "How to obtain Windows XP Setup disks for a floppy boot installation". Microsoft Corporation. Archived from the original on 16 April 2014. Retrieved 16 March 2014.
  5. ↑ "What is Windows PE?". Previous Versions Documentation. Microsoft Corporation. 25 July 2008. Retrieved 2024-01-14. Windows Preinstallation Environment (Windows PE) 2.0 is a minimal Win32 operating system with limited services, built on the Windows Vista kernel.
  6. ↑ "What is Windows PE?". Previous Versions Documentation. Microsoft Corporation. 30 October 2012. Retrieved 2024-01-14. Windows® Preinstallation Environment (Windows PE) 3.0 is a minimal Win32® operating system with limited services, built on the Windows® 7 kernel.
  7. ↑ Siyan, Karanjit (2000). Windows 2000 professional reference (3rd ed.). Indianapolis, Ind.: New Riders. pp.  1848. ISBN   0-7357-0952-1.
  8. ↑ "Txtsetup.sif". Archived from the original on January 19, 2014. Retrieved March 16, 2014.
  9. ↑ "Switches in TXTSETUP.SIF". Archived from the original on March 31, 2014. Retrieved March 16, 2014.
  10. ↑ "How to force a Hardware Abstraction Layer during an upgrade or an installation of Windows XP". Microsoft Support. Microsoft Corporation. Archived from the original on 6 September 2014. Retrieved 31 March 2014.
  11. ↑ "Automating and Customizing Installations". Microsoft Learn. Microsoft Corporation. 11 September 2009. Retrieved 14 January 2024.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.