network boot and BootFlags - how does windows know?

NTDEV
1

In the service registry key there is a value called BootFlags (described here https://msdn.microsoft.com/en-us/library/windows/hardware/ff546326(v=vs.85).aspx) which (among other things) tells windows that this service should be promoted to “Boot Start” when it detects that the system has been booted from the network. How does Windows tell it is being booted from the network for this purpose?

In my scenario, as far as Windows is concerned it is booting from the harddisk, but I have a filter driver that intercepts read and write SRB’s, and when one comes along and the data being requested hasn’t been restored to disk yet, it retrieves it from the network and writes it to disk before passing down the original SRB.

I have a PXE NBP that does this at the BIOS level too, so the BIOS boot is via PXE (I “encrypt” the partition table so that the BIOS can’t accidentally boot off the disk).

To make this work, I am booting into WinPE and setting the required services to Boot Start manually, but if Windows already has the ability to promote services to the required start level it would be good to make use of that.

Thanks

James

2

At the moment, the flag is set iff IBFT is present. BootFlags is not really meant to be extensible, i.e., we don’t have a facility for you to plug in your own notion of “network boot” that is not iSCSI.

3

I have found that CCS\Control contains a value called BootDriverFlags which is described here https://msdn.microsoft.com/en-US/library/ff793561(v=winembedded.60).aspx and appears to be user serviceable.

Setting bit 1 loads all the drivers I need for my boot scenario (and additionally loads iscsi which is of no consequence), which is all I need. And then when my restore is finished I can set it back to what it was.

Thanks

James

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-602152-
xxxxx@lists.osr.com] On Behalf Of Jeffrey Tippet
Sent: Friday, 12 February 2016 5:55 AM
To: Windows System Software Devs Interest List
> Subject: RE:[ntdev] network boot and BootFlags - how does windows know?
>
> At the moment, the flag is set iff IBFT is present. BootFlags is not really
> meant to be extensible, i.e., we don’t have a facility for you to plug in your
> own notion of “network boot” that is not iSCSI.
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at:
> http:
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at
> http:</http:></http:></http:>