Windows® Internals, Sixth Edition, Part 2

When you direct the system to boot into safe mode, Winload hands the string specified by the bootlog option to the Windows kernel as a parameter, together with the parameter that requests safe mode. When the kernel initializes, it checks for the presence of the bootlog parameter whether or not any safe-mode parameter is present. If the kernel detects a boot log string, the kernel records the action the kernel takes on every device driver it considers for loading. For example, if IopSafebootDriverLoad tells the I/O manager not to load a driver, the I/O manager calls IopBootLog to record that the driver wasn’t loaded. Likewise, after IopLoadDriver successfully loads a driver that is part of the safe-mode configuration, IopLoadDriver calls IopBootLog to record that the driver loaded. You can examine boot logs to see which device drivers are part of a boot configuration.

Because the kernel wants to avoid modifying the disk until Chkdsk executes, late in the boot process, IopBootLog can’t simply dump messages into a log file. Instead, IopBootLog records messages in the HKLM\SYSTEM\CurrentControlSet\BootLog registry value. As the first user-mode component to load during a boot, the Session Manager (%SystemRoot%\System32\Smss.exe) executes Chkdsk to ensure the system drives’ consistency and then completes registry initialization by executing the NtInitializeRegistry system call. The kernel takes this action as a cue that it can safely open a log file on the disk, which it does, invoking the function IopCopyBootLogRegistryToFile. This function creates the file Ntbtlog.txt in the Windows system directory (%SystemRoot%) and copies the contents of the BootLog registry value to the file. IopCopyBootLogRegistryToFile also sets a flag for IopBootLog that lets IopBootLog know that writing directly to the log file, rather than recording messages in the registry, is now OK. The following output shows the partial contents of a sample boot log:Microsoft (R) Windows (R) Version 6.1 (Build 7601) 10 4 2012 09:04:53.375 Loaded driver \SystemRoot\system32\ntkrnlpa.exe Loaded driver \SystemRoot\system32\hal.dll Loaded driver \SystemRoot\system32\kdcom.dll Loaded driver \SystemRoot\system32\mcupdate_GenuineIntel.dll Loaded driver \SystemRoot\system32\PSHED.dll Loaded driver \SystemRoot\system32\BOOTVID.dll Loaded driver \SystemRoot\system32\CLFS.SYS Loaded driver \SystemRoot\system32\CI.dll Loaded driver \SystemRoot\system32\drivers\Wdf01000.sys Loaded driver \SystemRoot\system32\drivers\WDFLDR.SYS Loaded driver \SystemRoot\system32\drivers\acpi.sys Loaded driver \SystemRoot\system32\drivers\WMILIB.SYS Loaded driver \SystemRoot\system32\drivers\msisadrv.sys Loaded driver \SystemRoot\system32\drivers\pci.sys Loaded driver \SystemRoot\system32\drivers\volmgr.sys Loaded driver \SystemRoot\system32\DRIVERS\compbatt.sys Loaded driver \SystemRoot\system32\DRIVERS\BATTC.SYS Loaded driver \SystemRoot\System32\drivers\mountmgr.sys Loaded driver \SystemRoot\system32\drivers\intelide.sys Loaded driver \SystemRoot\system32\drivers\PCIIDEX.SYS Loaded driver \SystemRoot\system32\DRIVERS\pciide.sys Loaded driver \SystemRoot\System32\drivers\volmgrx.sys Loaded driver \SystemRoot\system32\drivers\atapi.sys Loaded driver \SystemRoot\system32\drivers\ataport.SYS Loaded driver \SystemRoot\system32\drivers\fltmgr.sys Loaded driver \SystemRoot\system32\drivers\fileinfo.sys ... Did not load driver @battery.inf,%acpi\acpi0003.devicedesc%;Microsoft AC Adapter Did not load driver @battery.inf,%acpi\pnp0c0a.devicedesc%;Microsoft ACPI-Compliant Control Method Battery Did not load driver @oem46.inf,%nvidia_g71.dev_0297.1%;NVIDIA GeForce Go 7950 GTX Did not load driver @oem5.inf,%nic_mpciex%;Intel(R) PRO/Wireless 3945ABG Network Connectio n Did not load driver @netb57vx.inf,%bcm5750a1clnahkd%;Broadcom NetXtreme 57xx Gigabit Contr oller Did not load driver @sdbus.inf,%pci\cc_080501.devicedesc%;SDA Standard Compliant SD Host Controller ...

Windows Recovery Environment (WinRE)