The DOS-Windows boot process

You've come to this page because you've asked a question similar to the following:

What is the DOS-Windows (i.e. DOS-Windows 3.1, DOS-Windows 95, DOS-Windows 98, or DOS-Windows ME) boot process ?

This is the Frequently Given Answer to such questions. (It is not the Windows NT 6.x boot process.)

DOS-Windows bootstraps itself by first bootstrapping DOS, on top of which is loaded a DPMI DOS extender and then the Windows kernel.

Booting DOS.

Either the system firmware or a boot manager program loads and transfers control to the Volume Boot Record (VBR) of the boot volume, which in turn loads the DOS kernel image from either one file or two files.

Out of the box, the DOS that is booted will be Microsoft's MS-DOS, whose kernel image is contained in files named io.sys and msdos.sys (more on this later) in the root directory of the boot volume. Other DOS operating systems have their kernel images in different files. DR-DOS (a.k.a. OpenDOS) and IBM's PC-DOS hold their DOS kernel images in files named ibmbio.com and ibmdos.com in the root directory of the boot volume. FreeDOS holds its DOS kernel image in a file named kernel.exe in the root directory of the boot volume, which is loaded by a boot loader contained in the file named ipl.sys.

The DOS kernel loads and runs as its first DOS process the DOS program from the image file specified by the shell directive in the config.sys configuration file. Normally, this is command.com, the command interpreter, or an equivalent (such as JP Software's 4DOS).

The command interpreter recognises, either by dint of being executed with the /P option or (in the case of 4DOS) by recognising the fact that it has no parent process that spawned it, that it is the first process, and as a consequence automatically runs the command script contained in the autoexec.bat file in the root directory, if such a file exists.

The final command in the autoexec.bat script is an invocation of win.com, a DOS program that is the loader for the DPMI DOS extender and the Windows kernel.

Changes to the DOS boot process in MS-DOS version 7.

In the version of MS-DOS first shipped as DOS-Windows 95, the following changes to the above DOS boot process were made:

  1. The DOS kernel image became a single file, io.sys, containing what was previously split across io.sys and msdos.sys. This allowed the name msdos.sys to be re-used. That file became a text file containing various configuration directives that the DOS kernel obeyed. Ironically, one of the options in the configuration file is to turn off the new behaviour in change 2 :

  2. The DOS kernel was changed to directly invoke win.com, skipping the loading and running of the command interpreter entirely, if an autoexec.bat file in the root directory did not exist. If an autoexec.bat file in the root directory did exist, the DOS kernel would invoke the command interpreter as before. However, the system was also changed so that the command interpreter would invoke win.com after it had processed the autoexec.bat script.

Booting Windows.

(This description applies to DOS-Windows 3.1 only when it is bootstrapped into "386 Enhanced Mode".)

The Windows kernel is bootstrapped by running a DOS program named win.com. This DOS program loads a DPMI server and DOS extender from the image file named win386.exe, which was in DOS-Windows 95 renamed to vmm32.sys. This file is an executable image file in the "W3" format, which contains multiple "normal" executable images within it, including the executable images of all of those "internal" VxDs that can be seen listed in system.ini. Other, "external", VxDs are loaded from image files whose named are listed in system.ini.

In concert, the Virtual Machine Manager and the VxDs provide multiple parallel DOS boxes, capable of running DPMI programs and supplied with various DPMI and VxD services. Essentially, they take a snapshot of DOS as it is at the point at which the VMM is brought up, and clone it whenever a new DOS box is started. There are complications to do with memory that is shared across all of the DOS boxes, and interactions with DOS itself so that only one DOS box can be executing certain portions of the DOS code at any given time, but those details are too long and too complex to go into here.

win.com then loads the Windows "KERNEL" module into the first of those DOS boxes, which is the so-called "system virtual machine". The name of the kernel module image file is usually krnl386.exe. However, a directive in system.ini can be used to change this. The "KERNEL" module is an extended DOS program that uses the DPMI server to switch into protected mode. The only reason that it cannot be run directly from the DOS prompt is that it performs a secret handshake with win.com, and exits if it finds that it has not been invoked by win.com.

The remaining modules that comprise the Windows kernel — USER, GDI, SYSTEM, NETWORK, DISPLAY, and KEYBOARD — are then loaded. Normally, the image files for these modules are named user.exe, gdi.exe, system.drv, network.drv, display.drv, and keyboard.drv; but again, the names of the files may be affected by directives in system.ini. (Indeed, this is the mechanism that Adobe Type Manager uses to replace system.drv with its own atmsys.drv.)

The 32-bit Windows API on DOS-Windows 95/98/ME is built on top of the 16-bit Windows kernel. Much of the functionality of the 32-bit API DLLs (kernel32.dll, user32.dll, gdi32.dll, advapi32.dll, and so forth) is provided by thunking from 32-bit to 16-bit and calling into the 16-bit Windows kernel, grabbing a global mutual exclusion semaphore known as "Win16Mutex" (that prevents multiple threads from executing in the 16-bit Windows kernel concurrently) for the duration.

Finally, the Windows kernel loads and runs its primary shell. On DOS-Windows 3.1 this is progman.exe. On DOS-Windows 95 and later, this is explorer.exe.


© Copyright 1996–2002 Jonathan de Boyne Pollard. "Moral" rights asserted.
Permission is hereby granted to copy and to distribute this web page in its original, unmodified form as long as its last modification datestamp is preserved.