Windows XP Boot Process: Ntoskrnl.exe Functions

This article provides a technical overview of how the Windows XP kernel image, ntoskrnl.exe, initializes the operating system during the core boot phase. It details the primary entry function executed upon taking control from the bootloader, the execution of Phase 0 and Phase 1 executive initialization routines, and the subsequent launch of the user-mode environment.

Handoff from NTLDR to the Kernel Entry Point

During the Windows XP boot sequence, the NT OS Loader (NTLDR) loads ntoskrnl.exe, the Hardware Abstraction Layer (hal.dll), and the boot-start drivers into memory. Once these components are loaded and system page tables are configured, NTLDR transfers CPU control directly to the kernel's entry point function: KiSystemStartup.

The Primary Function: KiSystemStartup

KiSystemStartup is the architecture-specific routine executed first by ntoskrnl.exe. Operating at the lowest software level, its primary responsibilities include:

  1. CPU State Configuration: Initializing the processor's basic structures, such as the Interrupt Descriptor Table (IDT), Global Descriptor Table (GDT), and Task State Segment (TSS).
  2. HAL Integration: Calling HalInitializeProcessor to configure system timers, interrupt controllers, and hardware-specific synchronization.
  3. Control Transfer: Handing execution over to the Executive subsystem by calling ExpInitializeExecutive.

Phase 0 Initialization

ExpInitializeExecutive oversees the setup of core kernel services. This process is divided into two distinct phases. During Phase 0, interrupts remain disabled, and the function executes internal initialization calls for essential kernel subsystems:

  • HalInitSystem (Phase 0): Prepares interrupt controllers and system clocks.
  • MmInitSystem (Phase 0): Configures the Memory Manager, creating system page tables, non-paged pools, and paged pools.
  • ObInitSystem (Phase 0): Initializes the Object Manager and defines the core object types.
  • SeInitSystem (Phase 0): Sets up the Security Reference Monitor and access token infrastructure.
  • PsInitSystem (Phase 0): Initializes the Process Manager, creates the initial "System" process structure, and sets up the primary thread.

Phase 1 Initialization

At the conclusion of Phase 0, ExpInitializeExecutive creates a system thread assigned to run the Phase1Initialization function. At this stage, interrupts are enabled, and the remaining subsystems transition into fully operational states:

  1. Hardware and Subsystem Completion: The HAL, Object Manager, and Memory Manager are called again (Phase 1) to enable advanced runtime capabilities and allocate working buffers.
  2. I/O and Driver Initialization: The I/O Manager initializes through IoInitSystem, which initializes loaded boot drivers and starts system-start device drivers in dependency order.
  3. Power and PnP Setup: The Power Manager (PoInitSystem) and Plug and Play Manager (PnpInitSystem) detect attached hardware and initialize bus drivers.
  4. Handoff to User Mode: As its final boot action, Phase1Initialization locates and launches the Session Manager Subsystem executable, smss.exe, transitioning the operating system from the core kernel boot phase into the user-mode startup sequence.