Analysis of Windows Computer Boot Process 1
Analysis of the Windows Computer Boot Process 1
To truly understand why certain options in WinNTSetup need to be configured the way they are, you need to understand the Windows computer boot process.
Booting the Motherboard UEFI Firmware
When you press the power button, the first step is to boot the motherboard’s UEFI firmware. The UEFI firmware has nothing to do with the Windows system itself; its full name is the Unified Extensible Firmware Interface.
UEFI has replaced the traditional BIOS firmware and is now standard on all newly manufactured computers. Generally speaking, computers manufactured after 2015 boot in UEFI mode.
Before Windows can start, the computer must first boot the UEFI firmware. Through UEFI, the computer can gradually guide the Windows system to start.
Only Windows 8 and later versions of Windows support UEFI firmware. Windows 7 and earlier operating systems only support BIOS firmware.
The UEFI firmware boot menu interface produced by Intel is the blue screen you see when selecting “Enter Firmware on Boot” in a VM. This is the UEFI boot selection menu interface. Different manufacturers produce different UEFI interfaces, but the functionality is similar.
For us, the primary role of UEFI is to boot the operating system.
So, how does UEFI accomplish this?
This is closely related to the System Boot Partition (ESP partition).
The ESP Partition
The ESP partition, also known as the EFI partition, is a disk partition that stores operating system boot files. The EFI partition is typically very small, around 200-300 MB.
It’s important to note that the EFI partition’s file system is almost always FAT32 or FAT16!
This is because most UEFI firmware can only recognize and read FAT32 and FAT16 file system types.
File Directory of the EFI Partition
The EFI partition has a fixed file directory structure, designed to meet the requirements of the UEFI motherboard.
So, how can you open the EFI partition and see the files inside?
The EFI partition is actually a hidden partition of the operating system with a high level of security. You cannot assign a new drive letter through Disk Management; instead, you need to use third-party software to assign one.
DiskGenius Disk Management Tool
DiskGenius (DG for short) is an excellent, long-established disk management software developed by a Chinese developer. With DG, you can perform almost any disk operation imaginable.
In this step, we’ll use DG to assign a drive letter to the EFI partition. (I provided a DG download link in a previous article.)
Operation Steps:
1. Open DG and locate the ESP partition on the left side.
2. Right-click the ESP partition and select "Assign new drive letter (path)."
3. Confirm.
Now, with a drive letter assigned, the EFI partition will appear in File Explorer.
However, the operating system is quite cautious :)
Access Denied.
The operating system means well, as the files inside are extremely important—messing them up could render the computer unbootable.
But in a virtual machine, what’s the worst that can happen? :)
The method mentioned above works in a PE environment, where you can bypass all permissions and manipulate any partition freely.
You can directly use DG software to view the files inside the EFI partition.
Double-click the ESP partition in DG, or click “Browse Files” in the right panel to view them. You can even right-click a file or folder and copy it to your desktop.
The directory structure of the EFI partition is as follows: (No need to memorize)
EFI
├─Boot
└─Microsoft
├─Boot
│ ├─bg-BG
│ ├─cs-CZ
│ ├─da-DK
│ ├─de-DE
│ ├─el-GR
│ ├─en-GB
│ ├─en-US
│ ├─es-ES
│ ├─es-MX
│ ├─et-EE
│ ├─fi-FI
│ ├─Fonts
│ ├─fr-CA
│ ├─fr-FR
│ ├─hr-HR
│ ├─hu-HU
│ ├─it-IT
│ ├─ja-JP
│ ├─ko-KR
│ ├─lt-LT
│ ├─lv-LV
│ ├─nb-NO
│ ├─nl-NL
│ ├─pl-PL
│ ├─pt-BR
│ ├─pt-PT
│ ├─qps-ploc
│ ├─Resources
│ │ ├─en-US
│ │ └─zh-CN
│ ├─ro-RO
│ ├─ru-RU
│ ├─sk-SK
│ ├─sl-SI
│ ├─sr-Latn-RS
│ ├─sv-SE
│ ├─tr-TR
│ ├─uk-UA
│ ├─zh-CN
│ └─zh-TW
└─Recovery
Why can’t the directory structure of the EFI partition be changed?
This brings us to a new file type: the .efi file.
*.efi Files
An .efi file can be thought of as software within the UEFI system (similar to an .exe). It is a type of program.
The role of an efi program is to boot the operating system. A key task of the UEFI firmware during the boot process is to locate efi programs and list them in the system boot menu.
Efi programs are stored in the EFI boot partition. Since the EFI partition uses a FAT32 or FAT16 file system, the UEFI firmware can recognize and access the files within it.
Common efi programs include:
1. bootmgfw.efi
2. bootmgr.efi
3. memtest.efi
4. bootx64.efi
1. bootmgfw.efi: I believe this stands for “boot manager for Windows.” This efi program is specifically designed to boot the Windows system.
2. bootmgr.efi: Likely short for “boot manager,” this serves as a backup program when bootmgfw.efi is missing or corrupted.
3. bootx64.efi: The most versatile efi boot program, capable of booting operating systems other than Windows, such as Linux.
4. memtest.efi: A computer memory diagnostic tool.
As mentioned earlier, the UEFI firmware lists efi programs in the system boot menu. So, how does UEFI find these efi programs?
The reason the EFI partition’s directory structure cannot be changed lies here. The UEFI firmware “remembers” the directory structure of the EFI partition. All manufacturers must follow this structure when placing their EFI partition files.
In other words, the process by which the UEFI firmware locates the bootmgfw.efi program is as follows:
1. Scan for the EFI partition (a partition with a FAT32 or FAT16 file system).
2. Enter the EFI partition and follow the path EFI -> Microsoft -> Boot -> bootmgfw.efi to find the efi program.
3. Once found, list the information contained in bootmgfw.efi on the UEFI boot menu (labeled as "Windows Boot Manager").
In the next section, we will dive into the specific workings of bootmgfw.