［原创］PE2.0启动过程及VISTA DVD 中PE2.0与元旦版PE2.0的融合 - 无忧启动论坛

How Windows PE Works
Windows PE version 2.0 is a minimal Win32 subsystem with limited services, based on the Windows Vista kernel running in protected mode.

Windows PE Optimal Environment
An optimal environment for running Windows PE has the following characteristics:
• Sufficient RAM for RAM disk boot.
• If you choose to use a USB Flash Drive (UFD) device, it must meet all the requirements for booting Windows PE.
• The appropriate network adapter and mass storage drivers available, either on the Windows PE CD or available to place on a customized Windows PE image.
• Physical access to the computer, or, if using Emergency Management Services (EMS) to use Windows PE in the configuration of a remotely administered server, the computer properly supports EMS.
• If you choose to use Windows DS, the server must run Windows Server 2003 RIS server, and the destination computers must have a network adapter that enables PXE or one that is supported by the Windows DS start disk.
Order of Operations in Windows PE
The boot process of Windows PE is as follows.
1. The boot sector on the particular media is loaded. Control is passed to Bootmgr. Bootmgr extracts basic boot information from the Boot Configuration Data (BCD) and passes control to winload.exe that is contained in Boot.wim. Winload.exe then loads the appropriate Hardware Abstraction Layer (HAL), and loads the System registry hive and necessary boot drivers. After it finishes loading, it prepares the environment to execute the kernel, Ntoskrnl.exe. Note:

If you start Windows PE from read-only media such as a CD, Windows PE stores the registry hives in memory so that applications can write to the registry. Any changes made to the registry by the applications do not persist across different Windows PE sessions.

2. Ntoskrnl.exe is executed and finishes the environment setup. Control is passed to the Session Manager (SMSS).
3. SMSS loads the rest of the registry, configures the environment to run the Win32 subsystem (Win32k.sys) and its various processes. SMSS loads the Winlogon process to create the user session, and then starts the services and the rest of the non-essential device drivers and the security subsystem (LSASS).
4. Winlogon.exe runs setup based on the registry value HKLM\SYSTEM\Setup\CmdLine. Winpeshl.exe will launch %SYSTEMDRIVE%\sources\setup.exe if it exists, otherwise it looks for an application specified in %SYSTEMROOT%\system32\winpeshl.ini. If no application is specified, Winpeshl.exe will execute cmd /k %SYSTEMROOT%\system32\startnet.cmd. By default, Windows PE contains a Startnet.cmd file which will launch Wpeinit.exe. Wpeinit.exe loads network resources and coordinates with networking components like DHCP.
5. When Wpeinit.exe completes, the Command Prompt window is displayed. The boot process of Windows PE is complete.

Winpeshl.ini Files
Winpeshl.ini controls whether a custom shell is loaded in Windows PE instead of the default Command Prompt window. To load a custom shell, create a file named Winpeshl.ini and place it in %SYSTEMROOT%\System32 of your custom Windows PE image. The .ini file must have the following section and entry.
[LaunchApp]
AppPath = %SYSTEMDRIVE%\myshell.exe
[LaunchApps]
%SYSTEMDRIVE%\mydir\application1.exe, -option1 -option2
application2.exe, -option1 -option2
Set the AppPath entry to the path to your shell application. The path can be either fully qualified, or you can use environment variables, such as %SYSTEMROOT%\System32\Myshell.exe. The AppPath entry does not support command-line options.
Use the [LaunchApps] section to run applications with command-line options. The applications run in the order listed; separate the name of the application from its options with a comma.
When you exit the Command Prompt window or your custom shell application, Windows PE restarts.
Important:

Do not edit the value of CmdLine in the HKEY_LOCAL_MACHINE\SYSTEM\Setup registry key of Setupreg.hiv to start your shell application. The value of CmdLine calls Winpeshl.exe, which performs a number of functions, including calling the default Command Prompt window in Windows PE or your custom shell application.