The Birth of Windows Desktop

Introduction 

Haveyou ever thought of how your operating system(windows) is loaded? It’squite interesting to know about the miniature details that are involvedin the process. This article will shed some light on this topic. 

Process 

The actual execution of the processor begins when you power on the system. Following are the major steps involved.

1.       BIOS performs some initial check and read the Zero sector of the hard disc, This Zero sector has a special name - MBR(Master Boot Record)

2.       MBR contains two sections 

2.1.    Boot Code(446 bytes)

2.2.    Partition Table Entries(16 bytes colored entries in the bottom)

3.       Thepurpose of boot code is to iterate over all the partition table entriesand check for a bootable partition (if the first byte of the partitionentry is 0x80 then it is a bootable partition. Also called as bootpartition or system volume)(There can be only four entries specified inthe MBR, does it mean we are limited with 4 drives ?)(this is where extended partitions come into picture)

4.       Nowbesides locating the boot partition it will know exactly from whichsector the boot partition begins. This is done by examining the 8^th-12^th bytes in the partition entry(so in the above picture 3f 00 00 00converted to little endian we get 0000003f = 63^rd Sector). In general it will be 63rd sector.

5.       Again the first sector(63^rd) of the bootable partition is called as Boot Sector which contain enough code to read a special file named ntldr (NT loader) fromthe root (c:\) drive. This is the time where you may at times see“NTLDR is missing” error message. Following are the tasks performed by ntldr

5.1.    The main purpose of ntldr is to setup the stage for the windows kernel to load.

5.2.    It enables paging and preliminary hardware detection using BIOS routines(int) and ntdetect.com

5.3.    Reads boot.ini  to display boot menu

5.4.    If the system is hibernated during the last shutdown it will resumed from hiberfil.sys

5.5.    Mostimportantly it loads boot start drivers ( these are the core driversfor proper functioning of OS) following are the examples for boot startdrivers 

5.6.    Sets CPU registers e.t.c and pass on the control to ntoskrnl.exe(NT OS Kernel). This ends the life of ntldr

6.       Ntoskrnl is mainly responsible for setting up following OS services ( here you will see windows XP logo progress bar)

6.1.    Phase 0 Initialization

6.1.1. Memory Management Services

6.1.2. Process Management Services(First kernel mode process the system process is created)

6.1.3. Object Manger Services

6.1.4. Plug and Play Management Services

6.1.5. Security Reference Monitor Services

6.2.    Phase 1 Initialization

6.2.1. Hal initialization (Hardware Abstraction Layer)

6.2.2. Multi processor support

6.2.3. Scheduler support (inherently dependent on processor architecture)

6.2.4. Power management 

7.       Now the control is passed on to smss.exe(Session Manager Subsystem), It is the first user mode process that is created in the life span of windows.

7.1.    

7.2.    The following are the tasks performed by smss process

7.2.1.  Runs check disk ( disc check )

7.2.2.  Pendingfile copy and file deletes ( some softwares need to overwrite the fileswhich are in use by the OS and they will ask you for reboot) and thisis the phase where those pending copy and deletes will be performed.

7.2.3. Page file is created(pagefile.sys)

7.3.    Loads registry hives from \Windows\System32\Config\*.*

7.4.    Finally it creates two processes csrss.exe(Client Server Run-Time Subsystem), Winlogon.exe

7.4.1. Csrss.exe is responsible for user mode functionality of the system and sits as an interface for windows API)

7.4.2. Winlogon.exe is responsible for starting all auto-start services (services.exe) and creating thelsass.exe(Local Security and Authentication Subsystem)  this process is for authenticating the user logins

7.4.3. Next winlogon will show the logon screen to the user, upon successful logon winlogon will load the explorer.exe under the current user profile. This is where you will see the desktop

Thoughthe actual process involves more complicated steps I have oversimplified the overall flow in favor of novice users and tried not tolose the brevity of the content. Please feel free to comment on thepost. +ve criticism is most welcome.