NTLDR Role in Windows XP Boot Sequence

In Windows XP, the NT Loader (NTLDR) served as the primary boot loader responsible for bridging the gap between firmware initialization and operating system startup. This article outlines the specific duties NTLDR carried out during the early boot sequence, detailing how it transitioned the CPU mode, accessed the file system, collected hardware information, and loaded the core operating system components before passing execution control to the Windows kernel.

1. Initial Execution and Processor Mode Switching

The boot process began when the BIOS finished the Power-On Self-Test (POST) and loaded the Master Boot Record (MBR), which subsequently executed the Volume Boot Record (VBR) of the active partition. The VBR loaded NTLDR into memory.

Upon execution, NTLDR performed a fundamental architectural shift:

  • Real Mode to Protected Mode: The processor started in 16-bit real mode for backward compatibility. NTLDR switched the CPU into 32-bit flat memory mode (protected mode) and enabled paging, allowing access to the full 4 GB physical memory address space.

2. File System Support and Configuration Parsing

Unlike the BIOS, which relied on low-level disk sectors, NTLDR contained built-in, read-only file system drivers for FAT16, FAT32, and NTFS.

With file system access established, NTLDR:

  • Checked for Hibernation: It inspected the root directory for hiberfil.sys. If a valid hibernation state existed, NTLDR read the file into memory and restored the system state directly, bypassing the standard boot path.
  • Parsed boot.ini: If no hibernation state was found, NTLDR read the configuration file boot.ini.
  • Displayed the Boot Menu: If multiple operating systems or boot options were listed in boot.ini, NTLDR rendered the boot selection screen and waited for user input or the timeout countdown to expire.

3. Hardware Detection

Once the user selected Windows XP (or the default entry timed out), NTLDR invoked NTDETECT.COM.

This component was responsible for scanning the system to identify essential hardware components, including:

  • Bus and adapter architectures (such as PCI and ISA).
  • Communication ports (COM and LPT).
  • Display adapters.
  • Keyboard and mouse controllers.

NTDETECT.COM compiled this hardware profile and returned the collected data back to NTLDR to populate the hardware registry tree later in the boot cycle.

4. Loading the Kernel and Critical Dependencies

After receiving the hardware information, NTLDR loaded the core components required to run Windows XP into memory:

  • Kernel and HAL: It loaded ntoskrnl.exe (the Windows kernel) and hal.dll (the Hardware Abstraction Layer) from the System32 directory.
  • Registry Hive: It loaded the SYSTEM registry hive located in System32\Config\System.
  • Boot-Critical Drivers: NTLDR parsed the SYSTEM hive to locate the "Select" subkey and identified the active Control Set. It then scanned for all device drivers flagged with a Start value of 0 (SERVICE_BOOT_START)—typically storage controllers and fundamental system devices—and loaded them into memory.

5. Control Transfer

With the kernel, HAL, registry hive, and boot drivers loaded into memory, NTLDR completed its responsibilities. It structured the loaded data into a parameter block and executed a function call that transferred CPU execution control directly to ntoskrnl.exe. From this point forward, the Windows kernel assumed full control of the operating system initialization.