-
Notifications
You must be signed in to change notification settings - Fork 118
WoeUSB boot process explained
This page explains the overall boot process of WoeUSB-prepared medium on a legacy/modern PC(BIOS/UEFI).
This article is made in the hope of letting the WoeUSB users understand the underlying "magic" that makes WoeUSB useful without dig deep into the implementation, and maybe help them to troubleshoot problems easier. It is not error-free nor extensive in details and does not attempt to describe the entire boot processes that are out of WoeUSB's scope.
After the system received the power-on signal, the hardware initialization phase began. The mainboard firmware(code programmed into the mainboard hardware to support its functionalities) starts to initialize various parts of the hardware(RAM, CPU, various peripherals). It may do some checks to make sure the hardware functions properly(POST) in this phase.
After hardware initialization, the motherboard firmware will detect which medium(hard disk drives, optical disk drives, USB storage devices, and even an Ethernet interface) contains a valid bootstrapping code to continue the boot process. It has a preset/customizable priority list that determines which medium to check first, if one medium does not contain valid bootstrapping code the motherboard firmware checks the next one in the list.
If it is supported by the firmware, the selection process may be overridden by a specific keystroke/hardware switch during the hardware initialization phase. In this case, the firmware may present a menu of boot medium candidates for the user to choose from, and continue the boot process with the selected medium.
This section describes the process where the control is passed from the mainboard firmware to the specific bootloaders and is split into different models based on the implementation of the mainboard firmware architectures.
In this model, the firmware loads the first 512 bytes of the boot medium, namely the Master Boot Record(MBR).
The first 446 bytes of the Master Boot Record contains the GNU GRUB bootloader's stage 1 bootstrapping code(boot.img) to chain-load its stage 2 bootstrapping code(core.img) which locates in the gap between the Master Boot Record and the first disk partition. The rest of the 64 bytes of MBR contains 4 partition definition entries(16 bytes each) which define the starting and the ending sectors of the physical partitions in MBR, determining the size and the location of the partitions on the disk.
The stage 2 bootstrapping code then locates a hardcoded address of the stage 3 bootloader, which is contained in a partition that contains the GNU GRUB installation prefix directory(which is /boot/grub(2) of regular GNU+Linux operating systems, and grub subdirectory in the WoeUSB created "target filesystem" in device prepare mode or user-specified partition's filesystem in the partition prepare mode), and loads the rest of the GNU GRUB bootloader.
The rest of the GNU GRUB bootloader again, do some initialization and loads the embedded boot script which chain-loads the Microsoft Windows bootloader(/bootmgr), giving the control to the rest of the Windows operating system:
# Extracted from https://github.com/WoeUSB/WoeUSB/blob/2057555/sbin/woeusb#L1600-L1602
ntldr /bootmgr
boot
Note that in this section the following elements are not even mentioned, as they are really NOT the essential elements in the boot process(some mainboard implementations, however, may (unnecessary) referring them due to historical reasons):
- The boot/bootable flag/bit of an MBR partition entry(some mainboard firmware may assume the medium is not bootable if none of the partitions has the boot flag set, specify the
--workaround-bios-boot-flagcommand-line option to work around it) - The Volume Boot Record bootstrapping code of some of the file system volumes in the partition
The firmware detects whether the medium contains a supported file system(the UEFI standard requires FAT file system support, while some vendors may support other file systems such as NTFS/exFAT) that contains a /EFI/BOOT/BOOT{uefi_architechture_code}.EFI file then loads it.
{uefi_architecture_code} |
corresponding CPU architecture |
|---|---|
| IA32 | x86(i386/Intel 32) |
| X64 | AMD64(Intel 64) |
Note that the UEFI mainboard firmware treats internal-connected and portable bootable mediums differently and has separate boot paths. For internal-connected bootable medium, the path of the to-be-launched UEFI bootloader installed in the EFI System Partition(ESP)(a partition with a specific partition code(0xef for the Master Boot Record(MBR)(Yes, contrary to most beliefs UEFI firmware can boot mediums with an MBR partition table) and C12A7328-F81F-11D2-BA4B-00A0C93EC93B for the GUID partition table(GPT)) is written in the mainboard's non-volatile RAM(NVRAM). For portable bootable medium the firmware search for a supported file system containing the aforementioned BOOT{uefi_architechture_code}.EFI file, there's no EFI System Partition(ESP) in this boot path.
If the aforementioned supported filesystem is FAT filesystem, the /EFI/BOOT/BOOT{uefi_architechture_code}.EFI file loaded is the stage 1 Microsoft Windows bootloader, which loads the rest of the Microsoft bootloader(/EFI/Microsoft/bootmgfw.efi), and giving control to the rest of the Windows operating system.
To support using the NTFS filesystem as the target filesystem without requiring the mainboard firmware to have an NTFS filesystem driver, WoeUSB incorporates Pete Batard(the infamous Rufus utility's author)'s UEFI:NTFS product and installs it as the bootable medium's second FAT filesystem partition at the end of the target device, which, includes a /EFI/BOOT/BOOT{uefi_architechture_code}.EFI file that loads an embedded NTFS filesystem driver then chain-loads the first NTFS filesystem partition's /EFI/BOOT/BOOT{uefi_architechture_code}.EFI file, giving the control to the rest of the Windows operating system.
A medium that contains bootstrapping code to load an operating system or a standalone application. It can be a USB Mass Storage device(pen drives, external hard drives) or memory cards, etc.
The mainboard of the computer, also known as the motherboard.
The user-specified Windows installation medium that contains the Windows installation data, can be an ISO image or a physical optical disk drive.
A WoeUSB term referring the device that is prepared as a Windows installation device.
A WoeUSB term referring the filesystem containing the Windows installation data from the source-media
A WoeUSB term referring the user-specified partition for Windows installation device preparation without (to an extent) destroying its original content, for the partition prepare mode.
A WoeUSB operating mode that destroys the entire content of the target device, re-creates partition(s) that spans the entire target device, copies the Windows installation data from the source media into the target filesystem, and applies magics that make the target device bootable by the computer.
A WoeUSB operating mode that copies the Windows installation data from the source media to the target filesystem of the user-specified target partition, and applies magics that makes the target device bootable by the computer.
Copyright © WoeUSB Contributors
Unless otherwise specified, the content of this Wiki is licensed under the Creative Commons Attribution-ShareAlike 4.0 International license (and any recent version of your preference).
Participating in the contribution of this Wiki indicates that you are agreeing to license your contribution under the same terms.