Order of Operations in Windows PE

[SmokinXP]

Some time ago I saw a post with a link to a page by gosh on how Longhorn PE loads (or at least how he thought it did). Unfortunately by the time I checked out the link it was pretty well gone. So I figured I'd post some details about how WinPE boots. Hope this help people configure their own PE's.

P.S. None of this is my own work, I just compiled and formatted it. SmokinXP..

Order of Operations in Windows PE

The boot process of Windows PE is as follows:

1. The boot sector on the particular media is loaded. Control is passed to Setupldr.

2. Setupldr runs Ntdetect.com, which extracts basic system configuration information and stores it in HKLM\HARDWARE\DESCRIPTION.

3. Setupldr then loads the appropriate HAL, loads the System registry hive, and loads necessary boot drivers using Winpeoem.sif. After it finishes loading, it prepares the environment to execute the kernel, Ntoskrnl.exe.

Note

o If you start Windows PE from read-only media such as a CD, Windows PE stores the registry hives in memory so that applications can write to the registry. Any changes made to the registry by the applications do not persist across different Windows PE sessions.

4. Ntoskrnl.exe is executed and finishes the environment setup. Control is passed to the Session Manager (SMSS).

5. SMSS loads the rest of the registry, configures the environment to run the Win32 subsystem (Win32k.sys) and its various processes. SMSS then loads the Winlogon process to create the user session and starts the services and the rest of the non-essential device drivers and the security subsystem (LSASS).

6. Windows PE loads the Command Prompt (Cmd.exe) process and executes Startnet.cmd.

7. When Startnet.cmd finishes, the command prompt is displayed. Windows PE boot is complete.

Interactive Shell Components

The Startnet.cmd batch file launches the networking processes and any custom routines that you might include. The commands in the default Startnet.cmd file are:

regsvr32 /s netcfgx.dll

factory -minint

netcfg -v -winpe

net start dhcp

net start nla

a:\floppy.cmd

Command descriptions:

• Regsvr32 /s netcfgx.dll: Registers the necessary helper function DLL to allow the networking components to be installed. Without this command, Factory mode will be unable to install the network card and Netcfg will fail to load the networking components.

• Factory -minint: Starts factory.exe in -minint mode. Factory.exe locates the Winbom.ini file, creates a computername for the Windows PE session if the name is not specified in the Winbom.ini, use Plug and Play to detect and install the network card drivers, and processes the Winbom.ini file.

• Netcfg -v -winpe: Installs Tcpip, Netbios and the Msclient for the Windows PE session.

• Net start dhcp: Starts the DHCP client.

• Net start nla: Starts the Network Location Awareness service.

• a:\floppy.cmd: Floppy.cmd is an optional sample file which you can remove from Startnet.cmd. It can contain any commands normally run at a command prompt, such as starting applications or opening additional command windows that run scripts.

For more information on the specific functionality of these commands, see below:

• The syntax of the Factory tool is:

factory {-minint | -winpe}

-minint Uses Plug and Play to install the network interface card (NIC).

-winpe Locates a Winbom.ini file and processes these sections in this order:

[WinPE.Net]

[DiskConfig]

[OEMRunOnce]

[OEMRun]

[WinPE], except for the Restart entry

[updateSystem]

Restart entry in [WinPE]

• The Netcfg Command-Line Options:

netcfg [-v] [-winpe] [-l path_to_component_inf] [-c {c | p | s}] [-i component_id]

-v Specifies verbose mode.

-winpe Installs TCP/IP, NetBIOS, and the Client for Microsoft Networks (MSClient) when running in the Windows Preinstallation Environment (Windows PE).

-l path_to_component_inf Specifies the complete path of the .inf file.

-c Specifies the class of the component to install. Valid options are c, p, and s.

c Client

p Protocol

s Service

component_id Specifies the component ID of the networking component to install from the .inf file.

The syntax of additional Netcfg options:

netcfg [-s {a | n}] [{-b | -q | -u} component_id]

-s Specifies the type of the component to display; valid options are a and n.

a Displays network adapters.

n Displays network components.

-b Displays the binding paths that contain the specified component_id.

-q Queries if a particular component, specified by component_id, is installed.

-u Uninstalls a particular component, specified by component_id.

component_id Specifies the component ID of the relevant component.

When you start a computer using Windows PE, you run the command factory -winpe, which processes these sections in Winbom.ini in this order:

• [WinPE.Net] contains entries for controlling the settings that WinPE uses to connect to a network.

Eg:

[WinPE.Net]

Gateway = 123.45.6.789 [ip address or blank]

IPConfig = DHCP [ip address or DHCP]

StartNet = Yes [Yes or No]

SubnetMask = 255.255.255.0 [ignored unless ipconfig is set]

• [DiskConfig] contains entries for configuring and partitioning one or more physical hard disks when the Factory tool runs in WinPE.

• [OEMRunOnce] contains entries for controlling external applications and command shell scripts when the Sysprep -factory command runs.

• [OEMRun] enables you to control how and when external applications and command shell scripts run when auditing the computer in the factory environment, using the Sysprep -factory command.

• [WinPE], except for the Restart entry

contains entries for identifying the configuration set and Windows operating system that you install. Unless you run the factory -winpe command, Setup ignores all entries in this section.

• [updateSystem] contains entries, called directives, for performing registry or file system updates.

• Restart entry in [WinPE] Specifies the behaviour after the factory -winpe command finishes.

The settings in Winbom.ini provide a wide range of preinstallation tasks. To perform tasks beyond the scope of Winbom.ini, create batch files either to replace or supplement Winbom.ini.

With Windows PE running, you can use Winbom.ini or your own batch files in order to:

• Copy a test harness to the destination computer and run hardware diagnostics.

• Run programs, such as a utility to partition and format the drives.

• Establish network connectivity with the NET USE command, and change directories to the location of the preinstalled images.

• Start the unattended Setup from a network source.

[likuidkewl]

This is a nice post. Good job. Will be very helpful to people who are into the PE scene.