1. 计算机系 信息处理实验室 Lecture 5 Startup and Shutdown xlanchen@03/18/2005

2. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 2 Contents Boot Process Safe Mode Recovery Console Shutdown System Crashes

3. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 3 Background BIOS (Basic Input/Output System) Typically placed on a ROM chip of the computer Low-level routines specific to the hardware supplied with the motherboard POST (Power On Self Test) routines Boot up the system

4. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 4 Boot from power-on Power-on or reset The processor is pre-programmed, the value in IP register is 0xFFFFFFF0 The instruction tells the processor: “jump to the real BIOS startup program at XXXXX” POST … Search for a boot device For disk, MBR (Master Boot Record) The code in MBR controls the processor

5. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 5 MBR (Master Boot Record) The first sector on the disk: cylinder 0, head 0, sector 1 Master partition table (only 4 entries) Primary partitions Active (primary) partitions, only one Extended partitions

6. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 6 Hard disk layout MBR

7. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 7 Master Boot Code Find an active partition, and boot Volume/partition boot sector

8. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 8 Volume boot sector Disk parameter block Size Sector numbers Label name Sectors per cluster … Volume boot code Boot an operating system or a boot manager This is operating specific

9. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 9 Windows setup Writes MBR Formats the boot partition with user specified file system format (FAT, FAT32, or NTFS ) Writes volume boot sector Copies files including two boot files: Ntldr and Ntdetect.com Create a boot menu file, Boot.ini, in the root directory of the boot partition …

10. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 10 Boot.ini Contains options for starting the version of Windows 2000 and any preexisting Windows 2000 installations Example: [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINNT [operating systems] multi(0)disk(0)rdisk(0)partition(1) \WINNT=“Microsoft windows 2000 professional“ /fastdetect C:\="Microsoft 燱 indows"

11. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 11 Windows 2000 boot sector The content depends on the file system format FAT, FAT32 or NTFS The role of the boot-sector code To give Windows 2000 information about the structure and format of a logical disk drive to read in Ntldr

12. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 12 Ntldr Real mode  protected mode 20bits memory access  32bits memory access creating enough page tables to make memory below 16 MB accessible enables paging Read Boot.ini loads and executes Ntdetect.com

13. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 13 Background Real mode vs. protected mode

14. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 14 Ntldr Loading the files needed to start the kernel initialization Ntoskrnl.exe, Hal.dll Determine, locate, and load the necessary boot device drivers May need to adds the necessary file system driver for those boot device drivers Prepares CPU registers for Ntoskrnl.exe

15. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 15 Call Ntoskrnl Ntldr passes the following parameters: The selected menu option The memory tables The in-memory copy of the HARDWARE and SYSTEM registry hives The list of loaded boot drivers

16. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 16 Ntoskrnl Initializing the Kernel and Executive Subsystems Phase0 To build the rudimentary structures required to allow the services needed in phase 1 to be invoked. phase1 Initialize

17. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 17 Smss start the Win32 subsystem Csrss Winlogon THE END

18. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 18 Boot Process Boot Process Components Master boot record (MBR) code Boot sector Ntldr Ntoskrnl.exe Smss Winlogon Service control manager (SCM)

19. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 19 Safe Mode Safe mode is a concept Windows 2000 borrows from Consumer Windows—a boot configuration that consists of the minimal set of device drivers and services. By relying on only the drivers and services that are necessary for booting, Windows 2000 avoids loading third- party and other nonessential drivers that might crash. Key “F8”

20. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 20 Recovery Console In some situations a safe-mode boot won't help the system boot The Recovery Console allows you to boot into a limited command-line shell from the Windows 2000 CD or boot disks to repair an installation without having to boot the installation.

21. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 21 Shutdown ExitWindowsEx Winlogin Csrss NtSetSystemPowerState

22. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 22 System Crashes Why ? unhandled exception in kernel mode reschedule when IRQL is DPC/dispatch level or higher. A page fault on memory backed by data in a paging file or a memory mapped file occurs at an IRQL of DPC/dispatch level or above explicitly crash after detecting an internal error condition hardware error

23. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 23 The Blue Screen

24. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 24 Crash Dump Files Default option Three levels of information can be recorded on a system crash Complete memory dump Kernel memory dump Small memory dump