Modifications to Microsoft Boot Components: Update



Modifications to Microsoft Boot Components: Update

Published April 18, 2007   Reviewed: July 8, 2008

Abstract

This paper provides a brief technical advisory and appropriate guidelines for modification to Microsoft boot components.

This information applies for the following operating systems:

Windows Server® 2008

Windows Vista® 

The current version of this paper is maintained on the Web at:



Contents

Introduction to Windows Operating System Boot Process 2

Modification to Windows Boot Components 2

Supported MBR Modifications 3

Supported Identification of Windows RE Partition 3

Detection Algorithm for Windows RE Installations 3

Disclaimer: The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication.

This White Paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT.

Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, email address, logo, person, place or event is intended or should be inferred.

© 2007 Microsoft Corporation. All rights reserved.

Microsoft, Windows, Windows Server, and Windows Vista are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.

Document History

|Date |Change | | | |

|July 8, 2008 |Reviewed |

|April 18, 2007 |First publication |

Introduction to Windows Operating System Boot Process

On BIOS-based PC systems, the startup process has been managed traditionally by clear handoff across a few components that facilitate operating system execution. The operating system requires that the system be initialized and prepared before control is transferred to it. This process is called the operating system bootstrap and includes initializing all critical devices and preparing the system resources—such as memory, hard drive, and display—as required by the operating system to start execution.

The Microsoft® Windows® operating system bootstrap starts with the power-on self-test (POST). After the BIOS has completed initialization of various devices—including processor, memory, disks, and other I/O units—then the BIOS executes the initial program load (IPL) from the boot device.

When the boot device is a hard disk, the IPL data usually comes from the master boot record (MBR) on the first sector of the disk. The MBR contains partition information and instructions to load Windows bootstrap code from the beginning of the system partition. This code is file-system specific and loads Windows Boot Manager (Bootmgr.exe) from the root directory of the volume and transfers execution to it.

Windows Boot Manager displays the boot menu if more than one Windows operating system is installed on the system and then selects the default operating system to load after the specified time-out. Then Windows Boot Manager transfers control to Windows Boot Loader (Winload.exe), which prepares the execution environment by loading the operating system kernel and required device drivers.

The Windows operating system bootstrap process relies on strictly managed components, which are critical for the proper execution of the operating system and countless other utilities. Under normal circumstances, the Windows Setup process ensures that all of the components that are required for Windows operating system bootstrap are properly installed on the system. Similarly, Windows repair utilities must also ensure that these components are installed correctly.

Modification to Windows Boot Components

Caution: Modifications to Windows boot components have never been supported by Microsoft. Windows boot components include modifications to the MBR, NTFS boot code (the first 8K of the partition), Bootmgr.exe, and Winload.exe. With the partial exception of the MBR, modifications to these components impair the reliability and functionality of Windows.

Many features in Windows Vista now have even greater reliance on boot components and require greater assurance that they have not been modified. In addition, many Microsoft-provided and third-party tools, backup utilities, and disaster recovery solutions are designed specifically for the standard boot components. These utilities often do not function properly on systems with altered boot components. Further, most recovery procedures restore the standard Microsoft boot environment.

If system manufacturers or software vendors must alter the boot sequence, Microsoft has architected a way to help ensure that OEM/ISV solutions remain functional after Windows system recovery and that such modifications do not create application compatibility issues with other software.

Supported MBR Modifications

The only Microsoft-supported way to enable custom boot mechanisms is described in “Custom Bootstrap Actions in Windows Vista” at .

Supported Identification of Windows RE Partition

The only way for software to identify the Windows Recovery Environment (Windows RE) partition in a manner supported by Microsoft is described in “Detection Algorithm for Windows RE Installations” later in this paper.

IMPORTANT:

If any backup or recovery tool is required to identify the Windows RE partition, the tool must not depend on any method that involves changing any aspect of the Windows RE partition. For example, Microsoft does not support solutions that include writing flags to the volume boot code or customizing the MBR. Such solutions may result in fragile implementations that will not function if the system is repaired or updated.

To ensure application compatibility and avoid problems if modified components are serviced or replaced, Windows RE detection must be performed only by observing existing partition characteristics.

Detection Algorithm for Windows RE Installations

1. Check the Windows Vista boot configuration data (BCD) object for the following settings:

a. recoverysequence GUID of Windows RE BCD object.

b. recoveryenabled Indicates whether automatic failover is turned on/off.

2. Confirm that both settings exist:

a. If both exist, then locate the Windows RE BCD object specified by the GUID in Step 1a.

b. If one or both are missing, then no valid Windows RE installation can be found.

3. Confirm that the Windows RE BCD object contains the setting “custom:46000010” with value “yes”:

a. If this setting exists, then locate the “device” setting in the Windows RE BCD object.

b. If this setting does not exist, then no valid Windows RE installation can be found.

4. Examine the “device” setting in the Windows RE BCD object:

a. If the “device” setting does not exist, then no valid Windows RE installation can be found.

b. If the value of the “device” setting starts with “ramdisk=”, it will be followed by the path to the Windows RE image file.

This image file is a valid Windows RE installation if all of the following are true:

0. The file is named Winre.wim.

0. The Winre.wim file exists in the location specified in “ramdisk=”.

0. Boot.sdi exists in the same folder as Winre.wim

c. If the “device” setting exists but does not start with “ramdisk=”, this means that Windows RE is installed as an expanded image on the partition specified in the “device” value.

A valid Windows RE installation can be confirmed if both of the following files exist under the \sources\recovery\ path:

0. Recenv.exe

0. Startrep.exe

................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download