Zusammenfassung der Ressource
Boot Process
- Bios -> Post
- Bios -> Loads the MBR
- MBR -> Locates the active partition and loads the boot sector
- Boot Sector -> loads ntldr
- Ntldr ->switches from real to protected mode
- Ntldr -> Loads/Reads boot.ini
- Ntldr -> loads/executes ntdetect.com
- Ntldr ->loads ntoskrnl.exe & hal.dll
- Ntldr -> loads HKLM\system & loads drivers w/ start value of 0
- ntoskrnl.exe -> loads drivers w/start value of 1
- ntoskrnl.exe -> creates HKLM\hardware
- ntoskrnl.exe -> starts session manager (smss.exe)
- Session mgr -> starts subsystem, setup pagefile for VMM, and winlogon.exe
- winlogon.exe -> starts LSA and SCM
- SCM -> starts services w/start value of 2
- Process Branching Down:
- Ntoskrnl.exe
- Smss.exe
- csrss.exe
- winlogon.exe
- lsass.exe
- services.exe
- explorer.exe