x86与x64系统引导过程

1、机器上电自检，完成设备的枚举与配置

2、加载主引导记录（MBR）并运行

3、读活动分区中的引导分区到内存中，并运行

4、加载系统目录下的Ntldr——也就是系统的加载程序

5、Ntldr初始化完成处理器模式切换和文件系统（FAT或NTFS）驱动加载，如果使用了SCSI设备，Ntldr将Ntbootdd.sys加载到内存中运行，然后读取系统目录下的Boot.ini选择加载系统

6、选择完加载系统，Ntldr开始硬件检查（Ntdetect.com）并调用系统的硬件配置文件

7、加载内核Ntoskrnl.exe和HAL.dll，选择控制集初始化计算机——加载低级设备驱动

8、内核初始化，内核从Ntldr处取得系统控制权，加载初始化设备驱动程序，调用SMSS.exe引导Window子系统，包括w32k.sys和Csrss.exe

9、启动Winlogon进程，启动LSASS（本地安全认证），执行SCM（服务控制器管理），出现登录窗口

10、完成系统的引导过程

下面是系统引导过程的一些部件详细资料（摘自Microsoft® Windows® Internals, Fourth Edition: Microsoft Windows Server™ 2003, Windows XP, and Windows 2000）供大家参考

Component	Processor Execution	Responsibilities
Master Boot Record (MBR) code	16-bit real mode	Reads and loads partition boot sectors.
Boot sector	16-bit real mode	Reads the root directory to load Ntldr.
Ntldr	16-bit real mode and 32-bit or 64-bit protected mode; turns on paging	Reads Boot.ini, presents boot menu, and loads Ntoskrnl.exe, Bootvid.dll, Hal.dll, and boot-start device drivers. If a 32-bit installation is booted, switches to 32-bit protected mode; if a 64-bit installation is booted, switches to 64-bit long mode.
Ntdetect.com	16-bit real mode	Performs hardware detection for Ntldr.
Ntbootdd.sys	Protected mode	Device driver used for disk I/O on SCSI and Advanced Technology Attachment (ATA) systems where the BIOS is not used.
Ntoskrnl.exe	Protected mode with paging	Initializes executive subsystems and boot and system-start device drivers, prepares the system for running native applications, and runs Smss.exe.
Hal.dll	Protected mode with paging	Kernel-mode DLL that interfaces Ntoksnrl and drivers to the hardware.
Smss	Native application	Loads Windows subsystem, including Win32k.sys and Csrss.exe, and starts Winlogon process.
Winlogon	Native application	Starts the service control manager (SCM), starts the Local Security Subsystem (LSASS), and presents interactive logon dialog box.
Service control manager (SCM)	Native application	Loads and initializes auto-start device drivers and Windows services.