Clarification on what is the bootloader of Windows?

[Tripredacus]

I was doing some reading about bootloaders in modern versions of Windows and keep coming upon conflicting information. I suspect it is just a terminology confusion but wanted to know if there was any official answers available about these terms.

In NT days, the bootloader was NTLDR. In Vista and newer OSes, we have Bootmgr which reads from the BCD to determine where the OS (winload.exe) is, or to display a menu to allow different boot choices. Of course the following links are from Wikipedia which certainly doesn't help.

Here it says that bootmgr.exe is a Second Stage Bootloader:

http://en.wikipedia.org/wiki/Booting#Second-stage_boot_loader

But on Bootmgr's page it says that winload.exe is the bootloader:

http://en.wikipedia.org/wiki/BOOTMGR#winload.exe

The history of NTLDR says that now bootmgr.exe is a "boot manager" and winload.exe is a system loader.

http://en.wikipedia.org/wiki/NTLDR#History

Of course, none of these peices of information are cited (I thought that was what Wikipedia was for) so I haven't drilled into it.

So what is the bootloader now? Is it *both* bootmgr.exe and winload.exe? But since we already know you can use bootmgr.exe to boot anything (if configured properly) you can have it on a system and not have winload.exe present.

[submix8c]

Wikipedia is wrong. It should be changed.

http://thestarman.pcministry.com/asm/mbr/W7VBR.htm

Same goes for a Vista one.

As for "second stage", I guess they're talking about the MBR code being the first stage? The last link is most accurate. See Starman link.

Someone should clean up that "disinformation".

edit - DOH! Also see jaclaz' post below.

Edited March 26, 2014 by submix8c

[jaclaz]

And what happens on EFI?

http://www.911cd.net/forums//index.php?s=&showtopic=25596&view=findpost&p=175061

And it is NOT bootmgr.exe (on BIOS), only BOOTMGR.

The "old" NTLDR was both a bootmanager (rather poor) and a Systemloader (but needed, to boot NT systems, the "side app" NTDETECT.COM).

The "new" BOOTMGR is essentially (also rather poor) bootmanager and a system initiator (i.e. it also replaces NTDETECT.COM), but the actual Systemloader is winload.exe.

BTW (and just for the record) BOOTMGR also parses the BOOT.INI files and adds any non-Arcpath entries in it):

http://www.msfn.org/board/topic/169320-dual-booting-dos-and-win7/?p=1059437

The differences (still on BIOS only) are graphically presented here:

http://www.multibooters.co.uk/multiboot.html

Loosely, on DOS the actual VBR code was the first (and only) stage systemloader and bootloader (i.e. it directly chainloaded IO:SYS).

On NT systems the VBR code chainloads the NTLDR, which then becomes the second stage systemloader and bootloader (the NTLDR, after having used NTDETECT.COM as auxiliary tool, chainloads the actual kernel).

Since Vista , BOOTMGR becomes the second stage bootloader, and winload.exe is either the third stage bootloader or the systemloader.

jaclaz

Edited March 26, 2014 by jaclaz

[Tripredacus]

Well there is a bootmgr.exe.mui at least... so is BOOTMGR just an .exe without a file extension or is there a separate bootmgr.exe as well?

[jaclaz]

Well there is a bootmgr.exe.mui at least... so is BOOTMGR just an .exe without a file extension or is there a separate bootmgr.exe as well?

Well, just like there was a SETUPLDR.BIN and a SETUPLDR.EXE, and a NTLDR and a NTLDR.EXE (or OSLOADER.EXE):

http://reboot.pro/topic/5900-make-your-own-nt-os-loader-ntldrsetupldr/

http://reboot.pro/topic/9474-busting-the-myth-about-ramdisksys-xp2003/page-2#entry82899

it is possible .

But besides the stripping of the extension, the 16 bit stub is added to it

(just open bootmgr in a hex editor and search for the PE header "MZ" ).

JFYI:

http://reboot.pro/topic/16824-how-to-modify-bootmgr-of-windows-8/

http://www.sevenforums.com/customization/106861-how-change-boot-animation-windows-7-a.html

http://reboot.pro/files/file/188-bootmgr-recompiler/

jaclaz