Win Boot process


boot type
cold boot (hard boot): starting a computer from a powered-down or off state
warm boot(soft boot): reboot by Ctrl+Alt+Del, skip memory test


boot process
1.check BIOS firmware
2.BIOS start a POST(Power-on self-test)
3.add-on adapters perform a self-test for integration with the system
4.loads the MBR for BCD(boot configuration data)

...

MBR tiggers/ boot load manager
NTLDR: for Windows NT/2000/XP
bootmgr : for vista and later
refer
http://resources.infosecinstitute.com/windows-booting-process/

MBR tiggers NTLDR(NT Loader)
1. NTLDR first action is to read the Boot.ini file
2. the Ntdetect.com file is executed, which identifies information about the computer's hardware
3. the Ntoskrnl.exe file is executed, which is the kernel of the Windows system
refer
https://en.wikipedia.org/wiki/NTLDR


MBR tiggers bootmgr
1.winload.exe(windows loader) is triggered
2.windows loader loads ntoskrnl.exe
3.kernel start running,windows loader loads hal.dll, and system registry hive into memory
4.kernel call SMSS.exe(session manager process) load other registry hives
5.SMSS.exe triggers winlogon.exe for presents user logon screen
6.SMSS.exe initiates Service control manager
7.once user logs in, a session is created
8. service control manager start the explorer.exe and DWM(desktop windows manager)

ps:
DOS 啟動
1.MBR
2.IO.SYS - 包含所有與硬體溝通的命令
3.MSDOS.SYS - MS-DOS Kernel
4.command.com - 提供DOS命令
5.config.sys - 包含啟動所需的命令
6.autoexec.bat
refer
http://wenku.baidu.com/view/da7fbcd0360cba1aa811da11.html?re=view

...


essential windows system files
ntsokrnl.exe : executive and kernel
hal.dll : hardware abstraction layer
gdi32.dll : win32 subsystem DLL files
advapi32.dll : win32 subsystem DLL files
kernel32.dll : win32 subsystem DLL files
user32.dll: win32 subsystem DLL files
bootvid.dll


Net Logon
Filename: lsass.exe
Command: C:Wndowssystem32lsass.exe
Description:
Microsoft service that supports pass-through authentication of account logon events for computers in a domain.
為使用者和服務身份驗證維護此電腦和網域控制站之間的秘密頻道。如果此服務被停用,電腦可能無法驗證使用者和服務身份並且網域控制站無法註冊 DNS 記錄。如果此服務被禁用,任何依賴它的服務將無法啟動。登陸活動目錄時,和域服務通訊驗證的一個服務,一般驗證通過之後,域伺服器會註冊你的 DNS 記錄,推送軟體補丁和策略等等,登陸域會用到它。工作組環境可以設為禁用。
refer
http://www.pczone.com.tw/vbb3/archive/t-146898.html


ps:
BOOT.SYS
A powerful DOS configuration manager before win98
refer
http://www.salvisberg.com/boot.sys

2015-10-18 13:29:24發表 0000-00-00 00:00:00修改   

數據分析
程式開發
計算機組織與結構
資料結構與演算法
Database and MySql
manage tool
windows

unix-like
linux service
network
network layer3
network layer2
network WAN
network service
作業系統
數位鑑識
資訊安全解決方案
資訊安全威脅
Cisco security
Cisco network
Cisco layer3
Cisco layer2



  登入      [牛的大腦] | [單字我朋友] Powered by systw.net