Section 7: Windows Kernel Initialization

The Big Picture: The Kernel Wakes Up

The loader has jumped to the kernel and handed over its package of information. From this moment, ntoskrnl.exe is in charge. The kernel is the core of Windows: it decides who uses the CPU, who gets which memory, and how programs reach the hardware.

At this point the kernel is like a new city hall opening on day one. It has a map (the Loader Parameter Block) and a few staff (the boot drivers). It must create every department: the land office (memory), the registry office (process list), the post office (I/O), the records room (registry), and so on. Only when all of them work can ordinary citizens (programs) move in.

Windows splits the kernel's work into pieces called the Executive (the managers) and the kernel proper (the lowest layer that handles CPU scheduling and interrupts). The Executive contains the managers that this section talks about.

┌──────────────────────────────────────────────────────────────┐
│ EXECUTIVE (managers inside ntoskrnl.exe)                     │
│                                                              │
│ Memory manager     Process manager     Object manager        │
│ I/O manager        PnP manager         Power manager         │
│ Security monitor   Configuration mgr   Cache manager         │
├──────────────────────────────────────────────────────────────┤
│ KERNEL (scheduling, interrupts, exceptions)                  │
├──────────────────────────────────────────────────────────────┤
│ HAL (hides motherboard and chipset differences)              │
└──────────────────────────────────────────────────────────────┘

Kernel start-up has two big phases. In Phase 0, only one CPU runs and interrupts are off. Just the basics are built. In Phase 1, the remaining managers start, other CPU cores are woken up, and drivers load. You do not have to remember the phase names. Remember the idea: basics first, then everything else.

7.1 Kernel Execution Begins

What it is: The first lines of kernel code run. They are in a function called KiSystemStartup. At this point, there are no processes, no threads and no drivers running, except the boot drivers that were only loaded.

The kernel's first tasks:

1. Set up the CPU properly. It builds the tables the CPU uses to handle interrupts (signals from hardware, Chapter 4 Section 3) and exceptions (errors in running code, like dividing by zero).
2. Start the first thread. It creates a "thread" (a line of running work) that carries on the start-up.
3. Initialize the HAL, so it can use timers and the interrupt controller.
4. Hand over to the Executive. The kernel calls each manager's start-up function, one after another.

Soon after, the kernel creates two special processes you can see in Task Manager:

(PID is the process ID, a number that names each running program.)

See it: Open Task Manager (Ctrl + Shift + Esc) → Details tab. Find System Idle Process (PID 0) and System (PID 4). Every Windows PC has both.

7.2 Memory Manager Initialization

What it is: The memory manager controls all of RAM. It is one of the first managers to start, because every other manager needs memory to work.

What it sets up:

• A list of every page of RAM. RAM is cut into pages (usually 4 KB each). The manager keeps a database of every page: is it free, in use, or waiting to be written to disk?
• Kernel memory pools. A pool is a stock of memory that the kernel and drivers borrow from. There are two kinds:

• Virtual memory. It builds the page tables that give each program the feeling of owning a huge private memory space (Chapter 3). The kernel keeps its own part; each new process gets a new private part.
• The system cache and the page file. Later, it connects the paging file (pagefile.sys) where the memory manager can store pages that do not fit in RAM. (The session manager creates it in Section 8.1.)
• Protection rules. It marks memory as read-only, no-execute or writable. This stops a program from running data as code, a favourite trick of attackers.

Check yours: In Task Manager → Performance → Memory, you see "Paged pool" and "Non-paged pool" sizes at the bottom, and the Committed number. These are the memory manager's own figures.

7.3 Process Manager Initialization

What it is: A process is a running program with its own private memory and settings. A thread is one line of work inside a process. The process manager creates and tracks both.

At start-up, it:

1. Prepares the process and thread structures, the records that describe each one.
2. Builds the scheduler (in the lower kernel layer): the part that decides which thread runs on which CPU core next, many times a second.
3. Creates the first real processes. The System process (Section 7.1) is first.
4. Wakes the other CPU cores. Until now, only the boot core (the BSP, Section 2.3) ran. Now the other cores begin to take part.
5. Starts the first user-mode program: smss.exe, the Session Manager (Section 8.1).

Together with the process manager, the object manager works. In Windows, nearly everything is an object: files, processes, threads, keys, events. The object manager gives them names and handles (a handle is a ticket a program holds that points to an object). The security reference monitor is the guard: each time a program wants an object, it asks whether that is allowed.

Kernel start ──► Executive managers start ──► System process ──► smss.exe (first user program)

7.4 Device Driver Loading (All Drivers)

What it is: The loader brought in only the boot-start drivers (Start = 0, Section 6.2). Now the kernel loads the rest of the drivers needed for the hardware actually present.

This is done by the Plug and Play (PnP) manager. It builds the device tree: a family tree of every device in the PC. The root is the motherboard, then buses, then devices on those buses.

How it works:

1. The PnP manager asks each bus driver: "What is plugged into you?" (This is enumeration; the firmware did a first round of it in Section 3.2.)
2. For each device found, it takes the device's hardware ID and looks for a matching driver.
3. It loads the driver from disk and starts it (system-start drivers, Start = 1, then others).
4. The driver sets up its device: reads and writes to its registers, hooks the interrupt, and creates the device object that programs will use later.

The tree you see in Device Manager (View → Devices by connection) is exactly the device tree built here.

Root (motherboard)
 ├─ PCI Express bus
 │   ├─ Graphics card ──► graphics driver
 │   ├─ NVMe SSD ──────► storage driver
 │   └─ Network card ──► network driver
 ├─ USB controller
 │   └─ keyboard, mouse ──► USB and input drivers
 └─ ACPI devices (fans, buttons, battery)

Some devices (like your printer) show up later. Windows loads Automatic start drivers (Start = 2) while services are starting (Section 8), and Manual ones only when needed.

Windows tip: If a driver cannot start, Device Manager shows a yellow warning triangle on the device, and the System log in Event Viewer records why (Section 11.5).

7.5 I/O Subsystem Initialization

What it is: I/O means input and output: all the traffic between programs and hardware. The I/O manager is the part of the kernel that organizes this. It is the "post office": programs hand it a request (read this file), and it sends the request through the right stack of drivers to the device and brings the answer back.

What it prepares:

• The driver model. Every driver follows the same rules and receives work as I/O Request Packets (IRPs), small envelopes that describe each request.
• Driver stacks. A request may pass through several drivers in a row (for a file read: file system driver → volume manager → disk driver). The I/O manager builds these stacks.
• Mounting the boot volume. The file system driver (ntfs.sys) takes over from the loader's simple disk reading. Now Windows reads its own files properly, with caching and security.
• The cache manager. It keeps recently used file data in RAM, so repeated reads are much faster than going to the disk again.
• The power manager. It sets up power states (sleep, hibernate, device power) in line with the ACPI rules from Chapter 4.

Program: "read this file"
        │
        ▼
 I/O manager ──► File system driver (ntfs.sys)
                        │
                        ▼
                 Volume / storage driver stack
                        │
                        ▼
                  Disk driver (stornvme.sys) ──► the SSD

When this is working, the kernel can read and write files normally. That is the key step that lets the next programs start.

7.6 Registry Full Loading

What it is: In Section 6.3, the loader had loaded only the SYSTEM hive. The kernel's configuration manager is the part that owns the registry. It takes the SYSTEM hive, builds the live registry tree in memory, and gets ready to add the other hives.

What happens:

1. The configuration manager starts. It mounts the SYSTEM hive as HKEY_LOCAL_MACHINE\SYSTEM, and it creates the CurrentControlSet shortcut (Section 6.3).
2. The other machine hives are attached as start-up goes on: SOFTWARE, SAM, SECURITY and DEFAULT. After this, HKEY_LOCAL_MACHINE is complete. (The session manager takes part in this early in user mode, Section 8.1.)
3. The user part comes last. No user is signed in yet, so there is no HKEY_CURRENT_USER. It is created when your profile loads (Section 9.5).

The registry is the "settings brain" of Windows. Drivers, services and programs read it all the time during boot to know how to behave.

Windows tip: The registry is also backed up. If it is damaged, Windows can sometimes recover through Startup Repair, or you can restore from a system restore point. Section 11 shows these.

Summary