Incubator escapee wiki

NTLDR

Article Discussion

Template:Short description NTLDR (abbreviation of NT loader) is the boot loader for all releases of Windows NT operating system from 1993 with the release of Windows NT 3.1 up until Windows XP and Windows Server 2003. From Windows Vista onwards it was replaced by the BOOTMGR bootloader. NTLDR is typically run from the primary storage device, but it can also run from portable storage devices such as a CD-ROM, USB flash drive, or floppy disk. NTLDR can also load a non NT-based operating system given the appropriate boot sector in a file.

NTLDR requires, at the minimum, the following two files to be on the system volume:

  • Template:Mono, the main boot loader itself
  • Template:Mono, required for booting an NT-based OS, detects basic hardware information needed for successful boot

An additional important file is boot.ini, which contains boot configuration (if missing, NTLDR will default to \Windows on the first partition of the first hard drive).

NTLDR is launched by the volume boot record of system partition, which is typically written to the disk by the Windows Template:Mono or Template:Mono command.

HistoryEdit

Windows NT was originally designed for ARC-compatible platforms, relying on its boot manager support and providing only osloader.exe, a loading program accepting ordinary command-line arguments specifying Windows directory partition, location or boot parameters, which is launched by ARC-compatible boot manager when a user chooses to start specific Windows NT operating system. However, because IBM PC compatible machines lacked any of the ARC support, as that platform preceded ARC, the additional layer was added specifically for that platform: custom boot manager code presenting text menu allowing the user to choose from one or more operating system and its options configured in boot.ini configuration file, prepended by special StartUp module which is responsible for some preparations such as switching the CPU to the protected mode. When a user chooses an operating system from the boot menu, the following command-line arguments are then passed to the part of the osloader.exe common to all processor architectures:

Template:Pre

In Windows releases starting from Windows Vista and Windows Server 2008, NTLDR has been split off back to its boot manager and system loader parts: the Windows Boot Manager and winload.exe. The boot manager part has been completely rewritten; it no longer uses boot.ini as a configuration file, although the bootcfg utility for modifying boot.ini is still present for the case of multi-boot configurations with Windows versions up to Windows XP and Windows Server 2003.

Command-line interfaceEdit

{{#invoke:Infobox|infobox}}Template:Template other{{#invoke:Check for unknown parameters | check | showblankpositional=1 | unknown = Template:Main other | preview = Page using Template:Infobox software with unknown parameter "_VALUE_"|ignoreblank=y | AsOf | author | background | bodystyle | caption | collapsetext | collapsible | developer | discontinued | engine | engines | genre | included with | language | language count | language footnote | latest preview date | latest preview version | latest release date | latest release version | latest_preview_date | latest_preview_version | latest_release_date | latest_release_version | licence | license | logo | logo alt | logo caption | logo upright | logo size | logo title | logo_alt | logo_caption | logo_upright | logo_size | logo_title | middleware | module | name | operating system | operating_system | other_names | platform | programming language | programming_language | released | replaced_by | replaces | repo | screenshot | screenshot alt | screenshot upright | screenshot size | screenshot title | screenshot_alt | screenshot_upright | screenshot_size | screenshot_title | service_name | size | standard | title | ver layout | website | qid }}Template:Main other Template:Expand section The bootsect.exe utility program in the Windows PE tools has options /nt52 (NTLDR) and /nt60 (Vista and up) to store a NTLDR or Vista boot record in the first sector of a specified partition.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> The command can be used for FAT and NTFS based file systems. It replaces the FixFAT and FixNTFS tools.<ref name="bootsect">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>

ExampleEdit

The following example applies the NTLDR compatible master boot code to the D: volume:<ref name="bootsect" /> <syntaxhighlight lang="doscon"> C:\>bootsect /nt52 D: </syntaxhighlight>

Startup processEdit

Template:Further When a PC is powered on its BIOS follows the configured boot order to find a bootable device. This can be a harddisk, floppy, CD/DVD, network connection, USB-device, etc. depending on the BIOS. In the case of a floppy the BIOS interprets its boot sector (first sector) as code, for NTLDR this could be a NTLDR boot sector looking for the ntldr file on the floppy. For a harddisk the code in the Master Boot Record (first sector) determines the active partition. The code in the boot sector of the active partition could then be again a NTLDR boot sector looking for ntldr in the root directory of this active partition. In a more convoluted scenario the active partition can contain a Vista boot sector for the newer Vista boot manager with an {ntldr} entry pointing to another partition with a NTLDR boot sector.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref>

When booting, the loader portion of NTLDR does the following in order:

  1. Accesses the file system on the boot drive (either FAT or New Technology File System, NTFS).
  2. If Windows was put in the hibernation state, the contents of hiberfil.sys are loaded into memory and the system resumes where it left off.
  3. Otherwise, reads boot.ini and prompts the user with the boot menu accordingly.
  4. If a non NT-based OS is selected, NTLDR loads the associated file listed in boot.ini (bootsect.dos if no file is specified or if the user is booting into a DOS based OS) and gives it control.
  5. If an NT-based OS is selected, NTLDR runs ntdetect.com, which gathers information about the computer's hardware. (If ntdetect.com hangs during hardware detection, there is a debug version called ntdetect.chk that can be found on Microsoft support.<ref>{{#invoke:citation/CS1|citation

|CitationClass=web }}</ref>)

  1. Starts ntoskrnl.exe, passing to it the information returned by ntdetect.com.<ref>Template:Cite book</ref>

boot.iniEdit

NTLDR's first action is to read the boot.ini file.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> NTLDR allows the user to choose which operating system to boot from at the menu. For NT and NT-based operating systems, it also allows the user to pass preconfigured options to the kernel. The menu options are stored in boot.ini, which itself is located in the root of the same disk as NTLDR. Though NTLDR can boot DOS and non-NT versions of Windows, boot.ini cannot configure their boot options.

For NT-based OSs, the location of the operating system is written as an Advanced RISC Computing (ARC) path.

boot.ini is protected from user configuration by having the following file attributes: system, hidden, read-only. To manually edit it, the user would first have to remove these attributes. A more secure fashion to edit the file is to use the bootcfg command from a console. bootcfg will also relock the file (setting the file back to system, hidden, and read-only). Additionally, the file can be edited within Windows using a text editor if the folder view option "Show hidden files and folders" is selected, the folder view option "Hide protected operating system files" is unchecked, and the "Read-only" option is unchecked under the file's properties.

bootsect.dos is the boot sector loaded by NTLDR to load DOS, or if there is no file specified when loading a non NT-based OS.

ExampleEdit

An example of a boot.ini file: <syntaxhighlight lang="ini"> [boot loader] timeout=40 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect </syntaxhighlight>

If the boot loader timeout option in boot.ini is set to 0, the NTLDR boot menu does not appear. Extreme caution should be taken when modifying the boot loader, as erroneous information can result in an OS that fails to boot.

NT kernel switchesEdit

Template:How-to

File:Windows Advanced Options menu.png
NTLDR Bootloader's Advanced Option Menu
  • Template:Mono Template:En dash Forces x86-based systems to increase the virtual address space allocated for user programs to 3 GB, and to decrease to 1 GB allocated to the kernel and to executive components. Used for some programs that require more than the standard 2 GB allocated to user programs and 2 GB allocated to the system. Some configurations of Windows Server 2003 that run virtual memory-intensive applications such as database servers or Microsoft Exchange Server 2003 may require this switch<ref name="switches">{{#invoke:citation/CS1|citation

|CitationClass=web }}</ref> or may benefit from improved performance.<ref name="bootopts">{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Activating this option may break VMR-9 video.<ref>{{#invoke:citation/CS1|citation |CitationClass=web }}</ref> Activating this option may also cause audio problems with Creative SB X-Fi series sound cards with (X-Fi Gamer / X-Fi Titanium @ WINXP 32-bit 3/2012). These problems may be connected to the way that Creatives drivers handle memory over 2 GB.

  • Template:Mono Template:En dash Forces the system into standard 640 × 480 16-color VGA mode by using a video device driver that is compatible with any video adapter. If the operating system fails to load due to a faulty or incorrectly configured video driver, this switch allows the system to load, so the user may then remove, update, or roll back the video driver causing the problem. Using this switch in conjunction with the Template:Mono switch helps to determine the driver that is triggering a failure.<ref name="switches"/>
  • Template:Mono Template:En dash Sets the baud rate of the debug port that is used for kernel debugging. Use of this switch automatically enables the Template:Mono switch.<ref name="switches"/> Specifies an override for the default baud rate (19200) at which a remote kernel debugger host will connect.<ref name="bootopts" /> Example: Template:Mono.
  • Template:Mono Template:En dash Turns on boot logging to a file named Template:Mono.<ref name="switches"/>
  • Template:Mono Template:En dash Displays an alternate 640 × 480 16-color custom bitmap. The bitmap must be saved in the \Windows directory with the name Template:Mono. Use with the Template:Mono switch.<ref name="bootopts" />
  • Template:Mono Template:En dash Specifies the amount of memory, in megabytes, that Windows cannot use. Use this parameter to confirm a performance problem or other problems that are related to RAM depletion.<ref name="switches"/>
  • Template:Mono Template:En dash Use with the Template:Mono switch and the Template:Mono switch to selects the IEEE 1394 interface channel (numbered 0 to 62) through which kernel debugging communications will flow.<ref name="switches"/>
  • Template:Mono Template:En dash Loads the kernel debugger at OS startup, but it remains inactive until a Stop error occurs. With this switch, the COM port can be used for normal operations while Windows is running. If Windows crashes, the switch converts the port to a debug port. (This action turns on remote debugging.)<ref name="switches"/>
  • Template:Mono Template:En dash Turns on the kernel debugger when Windows starts. Unlike the Template:Mono switch, Template:Mono uses the COM port whether you use debugging or not.<ref name="switches"/>
  • Template:Mono Template:En dash Specifies the COM port to use for the debug port. By default, Template:Mono uses COM2 if it exists. Otherwise, the default is COM1. Use of this switch automatically enables the Template:Mono switch.<ref name="switches"/>
  • Template:Mono Template:En dash Turns off serial and bus mouse detection for the specified port(s), or for all ports if none are specified. Use this switch when there is a component other than a mouse attached to a serial port during the startup process. Ports may be separated with commas to turn off more than one port. (Note: In earlier versions of Windows, including Windows NT 4.0, this switch was named Template:Mono.)<ref name="switches"/>
  • Template:Mono Template:En dash Defines the Hardware Abstraction Layer that is loaded at startup. This switch is useful to try out a different HAL before you rename the file to Template:Mono. This switch is also useful when you want to try to switch between starting in multiprocessor mode and starting in single processor mode. To do this, use this switch with the Template:Mono switch. filename must be in System32 directory. It can be a simple file, hard link, but not a symbolic link or a junction point.<ref name="switches"/>
  • Template:Mono Template:En dash Defines the kernel that is loaded at startup. With this switch, the user can switch between a debug-enabled kernel that is full of debugging code and a regular kernel. Same limitations for filename location and type as for /HAL switch.<ref name="switches"/>
  • Template:Mono Template:En dash Specifies the maximum amount of RAM, in megabytes, that Windows can use.<ref name="switches"/> However, the Template:Mono switch does not account for memory holes. Therefore, it is recommended to use the Template:Mono switch instead.<ref>{{#invoke:citation/CS1|citation

|CitationClass=web }}</ref>

|CitationClass=web }}</ref>

  • Template:Mono Template:En dash Disables the graphical boot screen and uses the NT4 style text-boot, listing the Windows build number, version number, etc. In Windows 2000 and XP, the text is rendered inside the CHKDSK bitmap (and with a progress bar in 2000).
  • Template:Mono Template:En dash Specifies that Windows uses the Power Management Timer (PM_TIMER) timer settings instead of the Time Stamp Counter (TSC) timer settings if the processor supports the PM_TIMER settings.<ref name="switches"/> By default, Windows Server 2003 Service Pack 2 (SP2) uses the PM timer for all multiprocessor APIC or ACPI HALs. If you are not running Windows Server 2003 SP2, you must force the computer to use the PM timer by using the Template:Mono switch.<ref>{{#invoke:citation/CS1|citation

|CitationClass=web }}</ref>

See alsoEdit

ReferencesEdit

Template:Reflist

External linksEdit

Template:Windows Components

Retrieved from "https://zalansite.site/mediawiki/index.php?title=NTLDR&oldid=186739"