BIOS: Boot Process & Functions

BIOS

• A computer program typically stored in EPROM and used by the CPU to perform start-up procedures when the computer is turned on
• Its two major procedures = determine what devices are available and loading the OS into main memory
• After start-up, the BIOS program manages data flow between the OS and the devices
• In the early 21st century, BIOS was replaced by United Extensible Firmware Interface (UEFI)

How Boot process begins

• The PC is turned on and the BIOS initializes the hardware
• The BIOS calls code stored in the MBR at the start of disk 0
• The MBR loads code from the boot sector of the active partition
• The boot sector loads and runs the bootloader from its file system

BIOS Functions

• Usually stored on EEPROM
• Electrically-erasable programmable ROM is abbreviated EEPROM
• Once PC is powered on, BIOS starts as part of POST(Power-On Self Test)
• It bridges the various parts of PC, interfaces, sets up video display (VGA), initializes memory banks, gives CPU access to hardware
• Scans IO buses for attached hardware, identifies, and maps access to hard disks

Master Boot Record (MBR)

• First 512 bytes loaded by the BIOS from the hard drive of the selected boot device
• Contains a partition table = an index of up to four partitions that exist on the same disk
• MBR Bootloader loads the OS bootloader to execute the OS

The Bootloader

• Computer program responsible for booting a computer
• Examples:
  • GNU GRUB (GNU GRand Unified Bootloader)
  • NTLDR (NT loader) for Windows NT OS
  • Windows Boot Manager (bootmgr) based on NTLDR
• Bootloader loads its configuration from files on the same partition
• Optionally presents a list of OS options to the user from the configuration file
• Locates and loads the kernel for the selected OS from the disk, and hands-off control of the PC to the OS.

Windows Bootloader Details

• NTLDR is the default bootloader for Windows NT, 2000, and XP
  • BOOT.INI on the active partition contains the list of OS and their locations
  • NTDETECT.COM detects hardware and identifies devices
• BOOTMGR is for newer Windows OS (Vista, 7, 8, and 10)
  • List of OS is read from the BCD file in the BOOT directory on the active partition
  • BOOTMGR is self-contained

GRUB(2)

• Most-popular bootloader for Linux, can boot many OSes
• Boot settings are in a file called grub.cfg (GRUB2) or menu.lst (GRUB)
• GRUB is modular and can load additional modules from disk

BIOS vs UEFI

• BIOS reads the first sector of the hard drive for the next device's address/code
  • Selects the boot device and operates in 16-bit mode
• UEFI stores initialization information in an .efi file on the EFI System Partition (ESP)
  • Is intended to replace BIOS, has many new features

Secured Boot

• Legacy boot = BIOS starts any OS Loader
  • Malware may start before Windows
• Modern boot = Native UEFI only starts signed OS loaders
  • OS loader enforces signature verification for Windows components
  • Malware is is unable to change boot and OS components

UEFI vs Legacy BIOS Comparisons

• BIOS uses Master Boot Record (MBR); UEFI uses GUID Partition Table (GPT) partitioning scheme
• Max partition size in MBR is ~2TB, and max partition size in UEFI is ~9 ZetaBytes
• MBR can have at max 4 primary partitions, while GPT can have 128 partitions
• MBR can store only one boot loader, but GPT uses a separate EFI System Partition (ESP)
• UEFI offers secure boot, uses GOP for Graphics output, and can boot faster

Disk Partition Styles

• Basic Disk
  • Uses a partition table
  • Supported by all Windows OS starting from MS-DOS, Windows 95/98 to Windows 8
  • Once created a partition capacity cannot be directly changed without third-party tools
  • Maximum capacity is limited to 2TB
  • Maximum for MBR partition = four partitions
  • Can only have primary or logical partitions
  • Basic disks can be converted to dynamic disks without any data loss
• Dynamic Disk
  • Uses a hidden logical disk manager (LDM) or virtual disk service (VDS)
  • Supported by Windows 2000, XP, 2003, 2008, 2011, 2012, Vista, Windows 7 and Windows 8 only
  • Can expand the capacity of partitions without restarting
  • Unlimited number of partitions
  • Allows simple, spanned, striped, mirrored, and RAID-5 volumes
  • Requires all volumes to be deleted if converting to basic

Basic vs Dynamic Disk

• Basic disk uses normal partition tables but a Dynamic disk uses a hidden LDM database to manage all volumes
• Basic disk has standard partitions while Dynamic uses dynamic volumes instead of partitions
• Limited to 4 primary or 3 primary + 1 extended partition while dynamic disks support simple, spanned, striped, mirrored, and RAID-5 configurations.
• Supports multi-boot configurations meaning you can easily switch between OS versus lacks this ability.
• Cannot have partition size changed vs. can have partition extended.

Basic and Logical Partitions

• Primary Partition is the hard disk partition where Windows OS and other data can be stored
  • Windows OS can be set to active if BIOS needs to locate it
• Logical Drive is the hard disk partition created in extended partition
  • A user cannot set this active
  • Used to install Windows, files, etc

Dynamic Disk Volume Types

• Simple volume: uses free space from a single disk and can be a single region or consist of multiple regions
  • A simple volume can be extended within the same disk or onto additional disks
• Spanned volume: is made from free disk space linked together from multiple disks linked together up to 32 disks total
  • A user cannot mirror a spanned volume and can extend it onto additional disks
• Mirrored volume: is a fault-tolerant volume with data duplicated on two physical disks
  • If one drive fails, the data can still be accessed from the remaining disk
  • A user cannot extend a mirrored volume
  • Also known as RAID-1
• Striped volume: has data interleaved across two or more physical disks
  • A striped volume cannot be mirrored or extended
  • Also known as RAID-0
• RAID-5 volume is a fault-tolerant volume striped across three or more disks

File System Hierarchy

• OS keeps track of data and places data (documents, pictures, etc.) into a file
• Disks are divided into tracks
• Tracks are divided into sectors
• Sectors are grouped into clusters
• The size of the hard drive and choice of the file allocation system determine the number of sectors in a cluster
  • File allocation options include FAT, FAT32, NTFS

Additional File System Info

• A cluster (also known as allocation unit) consists of sectors of storage
• Sector quantity depends on the disk type, OS and size of the disk (number is modifiable via NTFS)
• Every sector can store 512 bytes of data
• Filing system dictates quantity of clusters per disk (such as FAT 16,32 and NTFS)

File System Size Limits

Virtualization

• Check if virtualization is enabled/disabled on your PC
  • Open Task Manager by pressing Ctrl + Shift + Esc, and check the Performance tab
  • Run Systeminfo.exe
• Enabling Virtualization in your PC BIOS
  • Reboot your computer
  • Press Delete, Esc, F1, F2, or F4 when computer is starting

Boot Option Keys for Various Systems

• ASRock: F2 or DEL
• ASUS: F2
• Acer: F2 or DEL
• Dell: F2 or F12
• ECS: DEL
• Gigabyte / Aorus: F2 or DEL
• HP: ESC, F10
• Lenovo (Consumer Laptops): F2 or Fn + F2
• Lenovo (Desktops): F1
• Lenovo (ThinkPads): Enter then F1
• MSI: DEL
• Microsoft Surface Tablets: Press and hold volume up button
• Origin PC: F2
• Samsung: F2
• Toshiba: F2
• Zotac: DEL

BIOS Settings

• Enable virtualization
  • Some BIOS settings may be called VT-x, AMD-V, SVM, or Vanderpool
• Enable Intel VT-d or AMD IOMMU if the options are available

Tips

• In the Run command write:
  • MSINFO32
  • msconfig