Brief Overview of Windows PE Boot Process

Windows PE Boot Process Overview

Microsoft’s original Windows PE (Preinstallation Environment) is a streamlined version of Windows designed for system deployment, repair, and recovery. Its boot process is significantly lighter and faster than that of a full Windows system. Below is a step-by-step explanation of the PE boot process.

---

1. Hardware Initialization Phase (BIOS/UEFI)

• BIOS (Basic Input/Output System) or UEFI (Unified Extensible Firmware Interface) first performs hardware initialization. This phase is responsible for self-testing and initializing system hardware, including the CPU, memory, hard drives, USB interfaces, etc.
• BIOS/UEFI checks bootable devices from the user-configured boot order (NVRAM), such as hard drives, USB drives, and optical discs. After selecting the appropriate boot device, BIOS/UEFI hands over boot control to that device’s boot loader.

Details:

• UEFI mode is typically the default boot method for modern computers. Unlike BIOS, it supports GPT partition tables, larger disks, and faster boot speeds.
• In BIOS mode, boot devices are identified via the MBR (Master Boot Record).

---

2. Boot Loader (Bootmgr/Bootmgfw.efi) Startup

• The boot loader for Windows PE is Bootmgr (Windows Boot Manager) / Bootmgfw.efi.
• Bootmgr is responsible for loading the Windows PE boot configuration. It reads and executes the boot configuration data (BCD, Boot Configuration Data) file from the boot device.
• The BCD defines which core components need to be loaded during system startup, as well as boot process parameters such as the kernel file, boot options, driver loading, etc.

Details:

• Bootmgr does not directly start the operating system kernel. Instead, it locates and parses the BCD file, then loads the kernel-related files. The BCD file contains boot information configuration, such as boot path, device identifier, system root directory, etc.
• If the device supports Secure Boot, a security check is performed at this stage to ensure the boot files have not been tampered with.

---

3. Loading Windows PE Core Components

• After loading the boot configuration file, Bootmgr/Bootmgfw.efi begins loading the core files of the PE system. This process primarily involves loading the boot.wim file.
• boot.wim is the core system image file for Windows PE, typically located in the \sources directory of the boot media. The WIM file is a compressed archive format containing the essential operating system files required for the PE system to run.

Details:

• The boot.wim file is significantly smaller than a full Windows image file, usually under 500MB, whereas a complete Windows 10 system WIM file can be as large as 4.72GB.
• WIM Decompression: After boot.wim is loaded into memory, the system decompresses the necessary files.
• Windows PE loads these files directly into memory (i.e., Ramdisk boot mode, as detailed in my 25th article: “25: Introduction to Ramdisk Boot Mode”) rather than onto a hard drive, allowing it to run without persistent storage.

---

4. Starting the WinPE Kernel

• Bootmgr / Bootmgfw.efi starts the core components of the PE system from the decompressed files. These components include:
  • WinPE Kernel: The PE system uses a streamlined version of the Windows NT kernel (e.g., the Windows graphical desktop interface is removed).
  • HAL: Loads the Hardware Abstraction Layer matching the current hardware architecture.
  • Drivers: Such as storage drivers, USB drivers, network drivers, etc., to interact with the hardware.

Details:

• During kernel loading, Windows PE initializes the basic file system, allowing users to access storage devices. PE uses the NTFS file system and can access mounted system partitions after booting.
• Driver loading is handled through built-in drivers. The PE system includes a limited set of drivers, which may not support all hardware, potentially causing boot failures.

5. WinPE Shell Startup

• winpeshl.exe is a critical component that runs after the Windows PE system boots. It is responsible for starting the PE system’s command-line interface. After loading the kernel and drivers, the system executes winpeshl.exe.
  • winpeshl.exe is the shell program for the PE system. It typically launches a command-line interface (cmd) as the default user interaction method. However, in third-party PE systems, it can launch different graphical interface tools or other applications.
  • PE system services, such as file management, disk partitioning, networking, etc., are loaded and initialized at this stage.

Details:

• If the PE system has a custom purpose, such as automated installation, winpeshl.exe can also launch specific scripts to perform these tasks.
• For automated deployment from a Windows ISO, after PE boots, winpeshl.exe typically calls setup.exe to start the Windows installation process.

---

---

Summary

The official Microsoft Windows PE boot process:

1. Hardware Initialization: BIOS/UEFI initializes and selects the boot device; the user presses Enter to enter the PE system.
2. Run Bootmgr/Bootmgfw.efi: Loads the BCD file and reads boot configuration.
3. Load boot.wim: Decompresses and loads the core Windows PE files.
4. Kernel Loading: Starts the streamlined Windows NT kernel and initializes necessary drivers.
5. winpeshl.exe Startup: Enters the PE system environment and launches the command-line interface.
6. Boot Complete: Users can enter commands to operate.

The above is a semi-professional analysis of the PE system boot process. Please forgive any shortcomings.