Hack 94 Hack the Windows NT/2000/XP Boot Loader

Customize what and how you boot using the BOOT.INI file.

The BOOT.INI file was introduced with Windows NT and lives on through Windows 2000, XP, and 2003 as a means to provide preboot reference to where the operating system is located and control over which operating system will be used. It allows users to select the DOS environment or the Windows NT environment (which does not support many of the applications and direct hardware access that DOS does). BOOT.INI can also be modified to support the addition of another drive that has an operating system installed (perhaps unknown to the operating system on the first/original disk drive), giving you multiboot support to a non-Microsoft OS.

BOOT.INI is a plain-text file (equivalent to DOS's IO.SYS and MSDOS.SYS) that resides in the root directory of your boot disk and is read by the NTLDR program when the system is starting up. It is saved with Read-only, System, and Hidden attributes, requiring you to remove these attributes before reading or modifying the file.

9.11.1 BOOT.INI Contents

The contents of a typical BOOT.INI file are shown below. The parameters in the file are few—essentially specifying the time that the boot loader waits for user input before processing the default selection, the default operating system to boot if there is no user selection, and a list of possible operating systems and the disk parameters indicating where the operating systems are stored.

[boot loader]

timeout=3

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows 

XP Professional" 

/fastdetect

In this example, only one operating system is presented, Windows XP, and the computer will wait for three seconds after the menu appears before loading the default operating system. Windows XP is installed in partition 1 on the first physical disk, rdisk(0), on an ATA or SCSI device that is recognized by the system BIOS (the multi(0) parameter).

The following sample shows the [operating systems] section of a BOOT.INI file on a computer with two operating systems, Microsoft Windows XP and Microsoft Windows 2000. It has two boot entries, one for each operating system.

[operating systems]

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows 

XP Professional" 

/fastdetect

multi(0)disk(0)rdisk(0)partition(2)\WINNT="Microsoft Windows 2000 

Professional" 

/fastdetect

These entries reveal that Windows XP and 2000 are installed on two different partitions of the same physical disk drive. The operating system location information uses the Advanced Risk Computing (ARC) naming convention for the physical and logical information about the disk and partition where the operating system resides. ARC paths use the formats described in the following sections.

9.11.2 Editing BOOT.INI with a Text Editor

BOOT.INI starts out with System, Read-only, and Hidden file attributes. To find the file in Explorer or at a command prompt, you need to remove at least the Hidden attribute. To edit the file, you need to remove the Read-only attribute. You can remove all of the attributes at a command prompt with the following steps:

With the attributes removed, you can use EDIT, Notepad, or a similar text editor to view and make changes to the file. NTLDR can use the BOOT.INI file with any attributes set, but to protect the file when done editing, restore the attributes at a command prompt with the following steps:

X:\Foo>C:

C:\Bar>cd \

C:\>attrib +s +h +r boot.ini

9.11.3 ARC Disk and Partition Syntax for BIOS Drives

The BOOT.INI syntax discussed is used for all controllers that provide BIOS INT-13 support for ATA and SCSI disks. Table 9-2 provides details about these parameters.

Table 9-2. BOOT.INI syntax for IDE devices

Parameter	Description
multi(0)	The drive controller number, typically 0.
disk(0)	Always 0; not used with IDE drives
rdisk(0)	The physical hard disk attached to drive controller. For ATA controllers, this number is typically between 0 and 3. For SCSI controllers, this number is typically between 0 and 7, or 0 and 15, depending on the adapter type.
partition(0)	The partition number.

9.11.4 ARC Disk and Partition Syntax for Non-BIOS Drives

The following syntax tells Windows that the startup device is attached to a SCSI host controller that does not support BIOS INT-13 disk access and that bootup requires the NTBOOTDD.SYS device driver. SCSI host adapters built into servers, many of which support a variety of RAID and disaster recovery functions, avoid using the BIOS for disk access and must use either a custom disk access driver or the boot driver of Windows to support all of the features available in the special hardware. Table 9-3 describes the syntax used in BOOT.INI for SCSI devices.

Table 9-3. BOOT.INI syntax for SCSI devices

Parameter	Description
scsi(0)	The drive controller, typically 0.
disk(0)	The SCSI disk drive device number, between 0 and 7, or 0 and 15, depending on the host adapter.
rdisk(0)	The SCSI logical unit, typically 0.
partition(0)	The partition number the operating system resides on.

You can use this syntax to specify which SCSI disk to boot from by following these steps:

The unmodified BOOT.INI on both drives may initially read as follows:

[boot loader]

timeout=3

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP 

Professional"

After installing the second drive, the BOOT.INI file on the first drive should be modified to look like:

[boot loader]

timeout=3

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP on 1st Drive" 

multi(0)disk(0)rdisk(1)partition(1)\WINNT="Microsoft Windows 2000 on 2nd Drive"

Add the second operating system choice, "Microsoft Windows 2000 on 2nd Drive" and indicate that it resides on the first partition, partition(1), of the second disk, rdisk(1).

Then modify the BOOT.INI file on the second drive to look like:

[boot loader]

timeout=0

default=multi(0)disk(0)rdisk(1)partition(1)\WINNT

[operating systems]

multi(0)disk(0)rdisk(1)partition(1)\WINNT="Microsoft Windows 2000 on 2nd Drive"

This provides the operating system location reference for the operating system on the second drive.

Remember to make backups of these files before you change them so you can restore them if you make a mistake. You can copy the original file back into the text-based Recovery Console, which you can access by running Windows setup and choosing to recover an existing installation.

9.11.5 Booting Linux

You can boot Linux from BOOT.INI with a little trickery. The first step is to install a Linux bootloader, such as GRUB or LILO, onto your Linux partition. So, supposing your Linux root partition is /dev/hda6, you'd set up the GRUB bootloader with these commands:

# grub

   

GNU GRUB  version 0.95  (640K lower / 3072K upper memory)

   

 [ Minimal BASH-like line editing is supported.  For the first word, TAB

   lists possible command completions.  Anywhere else TAB lists the possible

   completions of a device/filename. ]

   

grub> root (hd0,  <TAB>

 Possible partitions are:

   Partition num: 0,  Filesystem type unknown, partition type 0x7

   Partition num: 2,  Filesystem type is fat, partition type 0xc

   Partition num: 4,  Filesystem type unknown, partition type 0x82

   Partition num: 5,  Filesystem type is ext2fs, partition type 0x83

   

grub> root (hd0,5)

 Filesystem type is ext2fs, partition type 0x83

   

grub> setup (hd0,5)

 Checking if "/boot/grub/stage1" exists... yes

 Checking if "/boot/grub/stage2" exists... yes

 Checking if "/boot/grub/e2fs_stage1_5" exists... yes

 Running "embed /boot/grub/e2fs_stage1_5 (hd0,5)"... failed (this is not fatal)

 Running "embed /boot/grub/e2fs_stage1_5 (hd0,5)"... failed (this is not fatal)

 Running "install /boot/grub/stage1 (hd0,5) /boot/grub/stage2 p /boot/grub/menu

.lst "... succeeded

Done.

   

grub> quit

Note that GRUB uses a different numbering scheme than the rest of Linux. Linux numbers partitions starting at 1, but GRUB starts at 0. So /dev/hda6 is (hd0,5) in GRUB.

After you set up the bootloader, you need to grab it and save it into a file with the dd command:

# dd if=/dev/hda6 of=grub.bin bs=512 count=1

Now you need to copy grub.bin over to the root of your boot partition, typically the Windows C: drive. If your Windows C: drive is formatted as NTFS, you probably won't be able to write grub.bin to it from Linux, so you'll need to use a FAT-32 partition, a floppy disk, a directory on another computer, or some other means to transfer it over.

Boot back into Windows, edit your BOOT.INI as directed earlier in this hack, and add the following line to the [operating systems] section:

c:\grub.bin="Linux"

If you reinstall your Linux boot loader, you'll need to use dd to extract the boot loader and copy it to your C: drive again. The advantage of using GRUB instead of LILO is that GRUB does not need to be reinstalled each time you install a new kernel (simply edit the GRUB configuration file, usually /boot/grub/menu.lst).

9.11.6 Booting DOS or Windows 9x-Me

Configuring the BOOT.INI file to allow you to boot to DOS or Windows 95-Me is done automatically by the setup program if, when you install Windows NT-2003 including XP, you choose to leave your current filesystem intact (it must be a FAT-16 or FAT-32 partition) and install the new operating system in a different directory or on a different disk drive (which could be NTFS).

If you want to add DOS/95/98/Me to an existing NT-2003 installation, it is easier to do so by adding a second hard drive setup with a FAT-16 or FAT-32 filesystem and modifying the BOOT.INI file to provide the option to boot to the second drive. The steps in a nutshell are:

The line containing d:\="Windows 98" provides the boot-time option and operating system location reference for the operating system on the second drive.