1. System component
Component | Processor Execution | Responsibilities |
---|---|---|
Master Boot Record (MBR) code | 16-bit real mode | Reads and loads partition boot sectors. |
Boot sector | 16-bit real mode | Reads the root directory to load Ntldr. |
Ntldr | 16-bit real mode and 32-bit or 64-bit protected mode; turns on paging | Reads Boot.ini, presents boot menu, and loads Ntoskrnl.exe, Bootvid.dll, Hal.dll, and boot-start device drivers. If a 32-bit installation is booted, switches to 32-bit protected mode; if a 64-bit installation is booted, switches to 64-bit long mode. |
Ntdetect.com | 16-bit real mode | Performs hardware detection for Ntldr. |
Ntbootdd.sys | Protected mode | Device driver used for disk I/O on SCSI and Advanced Technology Attachment (ATA) systems where the BIOS is not used. |
Ntoskrnl.exe | Protected mode with paging | Initializes executive subsystems and boot and system-start device drivers, prepares the system for running native applications, and runs Smss.exe. |
Hal.dll | Protected mode with paging | Kernel-mode DLL that interfaces Ntoksnrl and drivers to the hardware. |
Smss | Native application | Loads Windows subsystem, including Win32k.sys and Csrss.exe, and starts Winlogon process. |
Winlogon | Native application | Starts the service control manager (SCM), starts the Local Security Subsystem (LSASS), and presents interactive logon dialog box. |
Service control manager (SCM) | Native application | Loads and initializes auto-start device drivers and Windows services |
2. Paged Pool & Nonpaged Pool
-
Nonpaged pool Consists of ranges of system virtual addresses that are guaranteed to reside in physical memory at all times and thus can be accessed at any time (from any IRQL level and from any process context) without incurring a page fault. One of the reasons nonpaged pool is required is because of the rule described in Chapter 2: page faults can't be satisfied at DPC/dispatch level or above.
-
Paged pool A region of virtual memory in system space that can be paged in and out of the system. Device drivers that don't need to access the memory from DPC/dispatch level or above can use paged pool. It is accessible from any process context.