The Windows XP PC Boot Process
<td>
Power supply switched on.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
The power supply performs a self-test – When all voltages and current levels are acceptable, the supply indicates that the power is stable and sends the Power Good signal to the processor. The time from switch-on to Power Good is usually between .1 and .5 seconds.
</td>
</tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
</td>
<td>
The microprocessor timer chip receives the Power Good signal.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
With the arrival of the Power Good signal the timer chip stops sending reset signals to the processor allowing the CPU to begin operations.
</td>
</tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
</td>
<td>
The CPU starts executing the ROM BIOS code.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
The CPU loads the ROM BIOS starting at ROM memory address FFFF:0000 which is only 16 bytes from the top of ROM memory. As such it contains only a JMP (jump) instruction that points to the actual address of the ROM BIOS code.
</td>
</tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
</td>
<td>
The ROM BIOS performs a basic test of central hardware to verify basic functionality.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
Any errors that occur at this point in the boot process will be reported by means of ‘beep-codes’ because the video subsystem has not yet been initialized.
</td>
</tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
</td>
<td>
The BIOS searches for adapters that may need to load their own ROM BIOS routines.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
Video adapters provide the most common source of adapter ROM BIOS. The start-up BIOS routines scan memory addresses C000:0000 through C780:0000 to find video ROM. An error loading any adapter ROM generates an error such as:</p>
<p>
XXXX ROM Error
</p>
<p>
where XXXX represents the segment address of the failed module.</td> </tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
</td>
<td>
The ROM BIOS checks to see if this is a ‘cold-start’ or a ‘warm-start’
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
To determine whether this is a warm-start or a cold start the ROM BIOS startup routines check the value of two bytes located at memory location 0000:0472. Any value other than 1234h indicates that this is a cold-start.
</td>
</tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
</td>
<td>
If this is a cold-start the ROM BIOS executes a full POST (Power On Self Test). If this is a warm-start the memory test portion of the POST is switched off.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
The POST can be broken down into three components:<br /> The Video Test initializes the video adapter, tests the video card and video memory, and displays configuration information or any errors.<br /> The BIOS Identification displays the BIOS version, manufacturer, and date. The Memory Test tests the memory chips and displays a running sum of installed memory.
</td>
</tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
Errors the occur during the POST can be classified as either ‘fatal’ or ‘non-fatal’. A non-fatal error will typically display an error message on screen and allow the system to continue the boot process. A fatal error, on the other hand, stops the process of booting the computer and is generally signaled by a series of beep-codes.
</td>
</tr>
<tr>
<td>
</td>
<td>
The BIOS locates and reads the configuration information stored in CMOS.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
CMOS (which stands for Complementary Metal-Oxide Semiconductor) is a small area of memory (64 bytes) which is maintained by the current of a small battery attached to the motherboard. Most importantly for the ROM BIOS startup routines CMOS indicates the order in which drives should be examined for an operating systems – floppy first, CD-Rom first, or fixed disk first.
</td>
</tr>
<tr>
<td>
<strong>Fixed Disk</strong>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
</td>
<td>
If the first bootable disk is a fixed disk the BIOS examines the very first sector of the disk for a Master Boot Record (MBR). For a floppy the BIOS looks for a Boot Record in the very first sector.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
On a fixed disk the Master Boot Record occupies the very first sector at cylinder 0, head 0, sector 1. It is 512 bytes in size. If this sector is found it is loaded into memory at address 0000:7C00 and tested for a valid signature. A valid signature would be the value 55AAh in the last two bytes. Lacking an MBR or a valid signature the boot process halts with an error message which might read:</p>
<p>
NO ROM BASIC – SYSTEM HALTED
</p>
<p>
A Master Boot Record is made up of two parts – the partition table which describes the layout of the fixed disk and the partition loader code which includes instructions for continuing the boot process.</td> </tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
<strong>MBR</strong>
</td>
<td>
With a valid MBR loaded into memory the BIOS transfers control of the boot process to the partition loader code that takes up most of the 512 bytes of the MBR.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
The process of installing multiple operating systems on a single PC usually involves replacing the original partition loader code with a Boot Loader program that allows the user to select the specific fixed disk to load in the next step of the process
</td>
</tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
<strong>Partition Table</strong>
</td>
<td>
The partition loader (or Boot Loader) examines the partition table for a partition marked as active. The partition loader then searches the very first sector of that partition for a Boot Record.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
The Boot Record is also 512 bytes and contains a table that describes the characteristics of the partition (number of bytes per sectors, number of sectors per cluster, etc.) and also the jump code that locates the first of the operating system files (IO.SYS in DOS).
</td>
</tr>
<tr>
<td>
<strong>Operating System</strong>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
<strong>Boot Record</strong>
</td>
<td>
The active partition’s boot record is checked for a valid boot signature and if found the boot sector code is executed as a program.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
The loading of Windows XP is controlled by the file NTLDR which is a hidden, system file that resides in the root directory of the system partition. NTLDR will load XP in four stages:</p>
<p>
1) Initial Boot Loader Phase<br /> 2) Operating System selection<br /> 3) Hardware Detection<br /> 4) Configuration Selection</td> </tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
<strong>NTLDR<br /> Initial Phase</strong>
</td>
<td>
During the initial phase NTLDR switches the processor from real-mode to protected mode which places the processor in 32-bit memory mode and turns memory paging on. It then loads the appropriate mini-file system drivers to allow NTLDR to load files from a partition formatted with any of the files systems supported by XP.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
Windows XP supports partitions formatted with either the FAT-16, FAT-32, or NTFS file system.
</td>
</tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
<strong>NTLDR<br /> OS Selection<br /> BOOT.INI</strong>
</td>
<td>
If the file BOOT.INI is located in the root directory NTLDR will read it’s contents into<br /> memory. If BOOT.INI contains entries for more than one operating system NTLDR will stop the boot sequence at this point, display a menu of choices, and wait for a specified period of time for the user to make a selection.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
If the file BOOT.INI is not found in the root directory NTLDR will continue the boot<br /> sequence and attempt to load XP from the first partition of the first disk, typically C:.
</td>
</tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
<strong>F8</strong>
</td>
<td>
Assuming that the operating system being loaded is Windows NT, 2000, or XP pressing F8 at this stage of the boot sequence to display various boot options including “Safe Mode” and “Last Known Good Configuration”
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
After each successful boot sequence XP makes a copy of the current combination of driver and system settings and stores it as the Last Known Good Configuration. This collection of settings can be used to boot the system subsequently if the installation of some new device has caused a boot failure.
</td>
</tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
<strong>NTLDR<br /> Hardware Detection</strong>
</td>
<td>
If the selected operating system is XP, NTLDR will continue the boot process by locating and loading the DOS based NTDETECT.COM program to perform hardware detection.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
NTDETECT.COM collects a list of currently installed hardware components and returns this list for later inclusion in the registry under the HKEY_LOCAL_MACHINEHARDWARE key.
</td>
</tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
<strong>NTLDR<br /> Configuration Selection</strong>
</td>
<td>
If this computer has<br /> more than one defined Hardware Profile the NTLDR program will stop at<br /> this point and display the Hardware Profiles/Configuration Recovery<br /> menu.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
Lacking more than one Hardware Profile NTLDR will skip this step and not display this menu.
</td>
</tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
<strong>Kernel Load</strong>
</td>
<td>
After selecting a hardware configuration (if necessary) NTLDR begins loading the XP kernel (NTOSKRNL.EXE).
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
During the loading of the kernel (but before it is initialized) NTLDR remains in control of the computer. The screen is cleared and a series of white rectangles progress across the bottom of the screen. NTLDR also loads the Hardware Abstraction Layer (HAL.DLL) at this time which will insulate the kernel from hardware. Both files are located in the system32 directory.
</td>
</tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
<strong>NTLDR<br /> Boot<br /> Device Drivers</strong>
</td>
<td>
NTLDR now loads device drivers that are marked as boot devices. With the loading of these drivers NTLDR relinquishes control of the computer.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
Every driver has a registry subkey entry under HKEY_LOCAL_MACHINE<br /> SYSTEMServices. Any driver that has a Start value of SERVICE_BOOT_START is considered a device to start at boot up. A period is printed to the screen for each loaded file (unless the /SOS switch is used in which case file names are printed.
</td>
</tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
<strong>Kernel Initialization</strong>
</td>
<td>
NTOSKRNL goes through two phases in its boot process – phase 0 and phase 1. Phase 0 initializes just enough of the microkernel and Executive subsystems so that basic services required for the completion of initialization become available.. At this point, the system display a graphical screen with a status bar indicating load status.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
XP disables interrupts during phase 0 and enables them before phase 1. The HAL is called to prepare the interrupt controller; the Memory Manager, Object Manager, Security Reference Monitor, and Process Manager are initialized.</p>
<p>
Phase 1 begins when the HAL is called to prepare the system to accept interrupts from devices. If more than one processor is present the additional processors are initialized at this point. All Executive subsystems are reinitialized in the following order:
</p>
<p>
1) Object Manager<br /> 2) Executive<br /> 3) Microkernel<br /> 4) Security Reference Monitor<br /> 5) Memory Manager<br /> 6) Cache Manager<br /> 7) LPCS<br /> 8) I/O Manager<br /> 9) Process Manager</td> </tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
<strong>I/O Manager</strong>
</td>
<td>
The initialization of I/O Manager begins the process of loading all the systems driver files. Picking up where NTLDR left off, it first finishes the loading of boot<br /> devices. Next it assembles a prioritized list of drivers and attempts to load each in turn.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
The failure of a driver to load may prompt NT to reboot and try to start the system using the values stored in the Last Known Good Configuration.
</td>
</tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
<strong>SMSS</strong>
</td>
<td>
The last task for phase 1 initialization of the kernel is to launch the Session Manager Subsystem (SMSS). SMSS is responsible for creating the user-mode environment that provides the visible interface to NT.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
SMSS runs in user-mode but unlike other user-mode applications SMSS is considered a trusted part of the operating system and is also a native application (it uses only core Executive functions). These two features allow SMSS to start the graphics subsystem and login processes.
</td>
</tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
<strong>win32k.sys</strong>
</td>
<td>
SMSS loads the win32k.sys device driver which implements the Win32 graphics subsystem.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
Shortly after win32k.sys starts it switches the screen into graphics mode. The Services Subsystem now starts all services mark as Auto Start. Once all devices and services are started the boot is deemed successful and this configuration is saved as the Last Known Good Configuration.
</td>
</tr>
<tr>
<td>
</td>
<td align="center">
<img loading="lazy" src="https://i1.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/darrow.gif?resize=16%2C16" alt="darrow" title="darrow" width="16" height="16" class="aligncenter size-full wp-image-876" data-recalc-dims="1" />
</td>
<td>
</td>
<td>
</td>
</tr>
<tr>
<td>
<strong>Logon</strong>
</td>
<td>
The XP boot process is not considered complete until a user has successfully logged onto the system. The process is begun by the WINLOGON.EXE file which is loaded as a service by the kernel and continued by the Local Security Authority (LSASS.EXE) which displays the logon dialog box.
</td>
<td>
<img loading="lazy" src="https://i0.wp.com/chaoticneutron.com/blog/wp-content/uploads/2005/12/rarrow.gif?resize=16%2C16" alt="rarrow" title="rarrow" width="16" height="16" class="aligncenter size-full wp-image-874" data-recalc-dims="1" />
</td>
<td>
This dialog box appears at approximately the time that the Services Subsystem starts the network service.
</td>
</tr></table> </div>
<p>
</p>
Choosing good passwords
<p>
Remember security starts at the keyboard in front of you:
</p>
<p>
A 6 character password has about fifty six billion (56,800,235,584) possibilities and the average computer (the G5 is even faster) can try all combinations (crack them) in 2.5 hours.
</p>
<p>
A 7 character password has about three and a half trillion (3,521,614,606,208) possibilities and a computer can try all combinations in about 1 week.
</p>
<p>
An 8 character password has about two hundred trillion (218,340,105,584,896) possibilities and a computer can try all its combinations in about a year.
</p>
<p>
A 9 character password would take about 70 years for a computer to try all combinations.
</p>
<p>
They say the chips coming in about a year could half these times! Now if you do not want to wait for next year’s chip, you can always put 2 computers in parallel and half the time. In theory you could put 365 computers in parallel and break 8 character passwords in just over a day (Virginia Tech just put 1100 G5s in parallel). Do you think hackers have friends?
</p>
<p>
Computers have a lot more time on their hands than we do and most of the bad guys don’t have jobs. The next person asking for your social security number could be just a few clicks away from your stock options.
</p>
<p>
If you just got a chill down your back or just got a little paranoid; good, my work is done.
</p>
<p>
Use an 8 character password (9 characters is better)… You would make this security professional very happy if you would change your passwords after you read this e-mail : )
</p>
Sines And Cosines are history !
I am not drunk and babbling gibberish. This is news. One fundamental theory which aims to make the use of trigonometry easier and more accurate. Proposed by Dr Norman Wildberger, a professor at University of New South Wales, this theory replaces angles to which we are so much used to by now, with a concept called as ‘spread’.
Here’s an excerpt from an article about this theory.
Established by the ancient Greeks and Romans, trigonometry is used in surveying, navigation, engineering, construction and the sciences to calculate the relationships between the sides and vertices of triangles.
“Generations of students have struggled with classical trigonometry because the framework is wrong,” says Wildberger, whose book is titled Divine Proportions: Rational Trigonometry to Universal Geometry (Wild Egg books).
Dr Wildberger has replaced traditional ideas of angles and distance with new concepts called “spread” and “quadrance”.
These new concepts mean that trigonometric problems can be done with algebra,” says Wildberger, an associate professor of mathematics at UNSW.
He has also written a book called ‘The Divine Proportions : Rational Trigonometry to Universal Geometry‘ by N J Wildberger. There is a chapter available for preview.
On first look, the concepts are straightforward in a logical sense. But i do not see how it simplifies and eliminates the calculations that are presently being done with sines and cosines. Well that’s just me and i could be wrong ! Maybe this is a revolutionary theory that is going to change how we look at things in the future.
A Briefer History of Time.
<p>
</p>
Impressions on Devdays India 2004
‘DevDays’ – my first MS event in my short software career till now. I definitely was excited about it and after reading through the agenda covering Whidbey and Yukon, I had expectated quite a bit of mental workout. I got a pass for Devdays Bangalore after a lot of nail-biting suspenses and finally on May 5, i hoped all that was expected was about to happen.
The opening keynote was very normal, not something i had expected after reading through some of the opening notes that have been delivered recently in many conferences. hmm.. Well after that, another developer who spoke, promised us to show the nitty-gritties of programming because this is ‘DevDays’ ! Ha, there’s something assuring, i thought.
Then we moved on to the technical sessions … the interesting bits eh !!
The first one was about ASP.NET 2.0. They spoke about Master pages, personalisation, Role based authentication as all inbuilt features in the upcoming ASP.NET versions. Thats cool. But haven’t i already read all that online. Show me something else interesting, something thought provoking, some complex application where it could be used, saving valuable developer time. But ahem, to my dissapointment, the session ended very soon without any surprises. Even the question and answer session at the end of it was very short 🙁
Then was the session on Winforms and CLR 2.0. The speaker detailed about Generics, partial types and Iterators. Wow cool ! Again, can’t anyone read the online entries from innumerable people talking about these basics. This is not what i want or expected. What happened to the anonymous delegates, and details on all that was mentioned and all the other really neat stuff that the MS devs have spent hours to include in the upcoming release ?! Not a word. Very dissapointing really … About Winforms, there was something new, some new controls but not anything other than that they have shown in the Winforms site.
Ok. Now comes the hands on session. How cool ! Am gonna do some cool code in Whidbey finally. I do not have to toil anymore with collections that are loosely typed with Objects. We can create strongly typed Generic classes over which we could apply constraints and manage to create a robust collection !!! With all that hope we entered the hall, only to find that there weren’t enough seats left. Ugh. Share the computer with a fellow programmer. Ok. Not bad. We could do something like XP here, aha. Or so i thought. The instructor got onto the podium and started dictating exactly what to do. Hello ! These are not kids here for God’s sake. Do give us the requirements, and we will code it out. If we need help, we will look into Google, MSDN or ask help from someone who knows this stuff. Don’t and Never dictate. After 10 mins, i lost all the vigor with which i entered into the place. So much for hands-on sessions …
After the lunch there was the Yukon session. There were quite a bit of surprisingly new things. But probably IMHO there was quite a bit of focus of the Reporting services, which could have been dealt with in later sessions. But anyway this one was good ! Ah at last. Then came the hands-on for Yukon. Oh God will these people never change their ways … More dictation again …
It was in the back of my mind that we have the ‘Ask the experts’ session anyway to clear all our doubts. No problem. Since this was scheduled for more than an hour, we were expecting to see some interesting questions and some thought provoking answers here. But, it was dissapointing again ! Not on the part of the experts, but on the developer’s side.
Certain things dawned upon me then. Ofcourse I was not the only guy who was bugged by this contentless showcase but then we have all been following blogs and all the discussion that has been happening in the past year. May be that is the reason why these sessions weren’t interesting at all. As someone said in the Keynote, I was expecting to see some hardcore nitty-gritties of programming in Whidbey and Yukon but instead it just turned out to be an overview of the basics. There could have also been an indepth session on the CLR 2.0 which covers behind the scenes on the exact kind of things that the CLR does for each of the new constructs and how it is being handled. That would have been very interesting. Also, I would have certainly liked it a lot if the speakers didn’t treat the developers like kids and start popularising the absolute ‘drag-drop-build an application’ philosophy.
Well, at the end of the day, for all the money’s worth, we got a bunch of 4 CDs containing Whidbey, ASP.NET Resource Kit and an Infopath SDK ! Cool ! But wait, where’s my Yukon ??! Hey, please give me a copy … Why did you forget that ?!
There goes my perfect sessions. What a start 🙁
Scoble, is there any reason or background why the DevDays sessions were like this in India ?! I’m sure i am not the only one with this opinion. Mahesh, Babu shared my opinion about the event and so did many others who had come over. Any thoughts or comments anyone ?