NTLDR

From Wikipedia, the free encyclopedia

You have new messages (last change).
An NTLDR boot menu.
An NTLDR boot menu.

NTLDR (abbreviation of NT Loader) is the boot loader for Windows NT, including some of its later versions (2000/XP/Server 2003). NTLDR does not appear in Windows Vista, which divides the functionality of NTLDR between two new components: winload.exe and the Windows Boot Manager. NTLDR can be run from either portable storage (such as a CD-ROM or USB flash drive), or the primary hard disk. NTLDR can also load a non NT-based operating system given the appropriate boot sector in a file.

NTLDR requires, at the minimum, the following two files to be on the system volume: NTLDR, which contains the main boot loader itself, and boot.ini, which contains configuration options for a boot menu. To load an NT-based OS, ntdetect.com must also be present. (Strictly speaking, only NTLDR is actually required. If boot.ini is missing, NTLDR will default to C:\Windows on the first partition of the first hard drive. Many desktops in the home are in this configuration and a missing boot.ini file will simply generate an error stating it is missing, then boot into Windows successfully.)

The Volume Boot Record written to disc by the Windows NT format command attempts to load and to run the NTLDR program.

Contents

[edit] Other names for the same program

boot floppy has several names. On installed IA-32 systems the boot loader is stored in a file named NTLDR in the system volume. On setup discs created for Windows 2000, the boot loader is stored in a file named SETUPLDR.BIN, which is loaded by the Volume Boot Record of the setup disc. On bootable CD-ROMs, the boot loader is stored in a file named I386/SETUPLDR.BIN. On ARC machines, the boot loader is stored in a file named OSLOADER.EXE. Windows XP and Windows Server 2003 on IA-64-based systems the boot loader is stored in a file named IA64ldr.efi on the EFI System Partition.

All of these files contain the same boot loader code, with minor variations:

  • Instead of reading the system registry hive (which will not be present when no system has been installed) to locate device driver files to load, SETUPLDR.BIN is hardwired to use TXTSETUP.SIF.[1] Other flavours of NTLDR read the system registry hive.
  • On IA-32 platforms, the loader proper, which is stored in the file in the Portable Executable format, is preceded by a small, real mode, stub loader program that switches the processor into 32-bit flat memory mode before invoking the loader proper. On ARC and Extensible Firmware Interface platforms (such as IA-64), where there is no need for a real-mode stub, there is no stub and the file comprises solely the loader proper, which is started directly by the system firmware.

[edit] Startup process

When booting, the loader proper portion of NTLDR does the following in order:

  1. Accesses the file system on the boot drive (either FAT or NTFS).
  2. If hiberfil.sys is found, and it finds a hibernation image, its contents are loaded into memory and the system resumes where it left off.
  3. Otherwise, reads boot.ini and prompts the user with the boot menu accordingly.
  4. If a non NT-based OS is selected, then NTLDR loads the associated file listed in boot.ini (bootsect.dos if no file is specified) and gives it control.
  5. If an NT-based OS is selected, then NTLDR runs ntdetect.com, which gathers information about the computer's hardware. (If ntdetect hangs during hardware detection there is a debug version called ntdetect.chk which can be found on Microsoft support[1].)
  6. Starts Ntoskrnl.exe, passing to it the information returned by ntdetect.com. [2]

[edit] boot.ini

NTLDR allows the user to choose which operating system to boot from at the menu; for NT and NT-based operating systems, it also allows the user to pass preconfigured options to the kernel. The menu options are stored in boot.ini, which itself is located in the root of the same disk as NTLDR.

For NT-based OSs, the location of the operating system is written as an Advanced RISC Computing (ARC) path.

boot.ini is protected from user configuration by having the following file attributes: system, hidden, read-only. To make it editable, you must first unlock it with the following command under a console attrib -s -h -r boot.ini. A more secure fashion to edit the file is to use the bootcfg command from a console. bootcfg will also relock the file (setting the file back to system, hidden and read-only).

[edit] Example

This boot.ini produces the boot menu in the screenshot above.

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect
C:\bootsect.dos="Microsoft Windows 98"

If the boot loader timeout option in boot.ini is set to 0, the NTLDR boot menu does not appear.

[edit] NT Kernel switches

NTLDR Bootloader's Advanced Option Menu
NTLDR Bootloader's Advanced Option Menu

A full explanation of all these is available from [2]

  • /3gb — Allocate 3 GB of virtual address space to programs and 1 GB to the kernel; used for some programs that require more than the standard 2gb allocation for user programs.
  • /basevideo — The computer starts up using the standard VGA video driver.
  • /baudrate=nnn — Sets the baud rate of the debug port that is used for kernel debugging.
  • /bootlog — Write a log file when Windows boots.
  • /burnmemory — Amount of memory Windows is not allowed to use.
  • /channel — Use with /debug and /debugport to have kernel debugging messages sent over an IEEE 1394 (firewire) port
  • /crashdebug — Causes the kernel debugger to load, but remain inactive until a crash is detected.
  • /debug — Causes the kernel debugger to load and activate.
  • /debugport=comx —
  • /fastdetect — Turn off mouse detection
  • /HAL=filename — Define Hardware Abstraction Layer to use.
  • /kernel=filename — Use an alternate kernel on boot.
  • /maxmem=nn — Set maximum memory Windows can use (use /burnmemory recommended instead).
  • /nodebug — Turn off debugging; can cause Stop Error if a program uses debugging.
  • /noexecute=optin (DEP)
  • /noguiboot — Don't use the bitmap progress bar when starting up. This also disables the text output used by CHKDSK and various partitioning tools, so you should use this switch with extreme caution. Those programs will actually run correctly; the only exception is when they need some text input to continue.
  • /nopae — Do Not Support Physical Address Extension.
  • /noserialmice:comx —
  • /numproc=CPUs — Set number of processors Windows is allowed to use; useful if some processors are failing or defective.
  • /onecpu — Equivalent to using /numproc=1; only lets Windows use one CPU.
  • /pae — Support Physical Address Extension.
  • /pcilock — Let the BIOS assign device addresses instead of Windows.
  • /redirect — Turn on Emergency Management Services on certain versions of Windows.
  • /safeboot — Enter Safe Mode.
    • /safeboot:dsrepair — Starts a domain controller in Directory Services Restore Mode.
    • /safeboot:minimal — Enter safe mode with minimal device drivers
    • /safeboot:minimal(alternateshell) — and an alternate shell
    • /safeboot:network — with network support
  • /usepmtimer —
  • /userva — Specify additional memory rules in combination with /3gb switch.
  • /sos — Display driver names while loading.
  • /w95 — Loads C:\BOOTSECT.W40 as a bootsector.
  • /w95dos — Loads C:\BOOTSECT.DOS as a bootsector.
  • /year — Tells Windows to ignore the system clock and use the year you specify. For example, /year=2001 was used when testing Windows 2000. [3]

[edit] References

  1. ^ William Boswell. Inside Windows 2000 Server. New Riders. ISBN 1-56205-929-7.
  2. ^ Microsoft (2000). Windows 2000 Professional Resource Kit, 1st, Redmond, WA: Microsoft Press. ISBN 1-57231-808-2.
  3. ^ Boot INI Options Reference

[edit] See also

[edit] External links

Retrieved from "http://en.wikipedia.org../../../n/t/l/NTLDR_9896.html"