Writing an OS Kernel from Scratch | Windows MBR+BIOS Boot: What Happens Before BOOTMGR and How to Fix It

Have you noticed a phenomenon: You assemble a computer, install Windows 10, the System Reserved partition takes up 100MB, and the C: drive takes everything else. This 100MB partition is usually invisible in File Explorer. Only when you plug in a Windows installation USB drive and enter “Repair your computer” do you vaguely sense its existence — there are a few folders called Boot, Recovery, and some .mui files.

But if you look closely at Disk Management, you’ll find the System Reserved partition’s filesystem shows as “FAT32” rather than NTFS — this is intentional on Windows’ part, because in BIOS boot mode, BOOTMGR can only read data from FAT filesystems.

In this chapter, we’ll completely dissect the Windows MBR+BIOS boot chain — from the moment you press the power button to the appearance of the Windows login screen, explaining every file, every step, and every tool along the way.

Windows Boot Chain in BIOS + MBR Mode

Complete Phase Diagram

① Power button pressed
  → CPU CS:IP = 0xFFFF:0x0000
  → BIOS ROM executes (0xFFFF0)

② POST (Power-On Self Test)
  → CPU self-test, memory check, GPU initialization
  → Read boot order from CMOS

③ BIOS searches for "bootable devices" in boot order
  → Tries LBA 0 (MBR) of the first disk

④ The 512 bytes of MBR
  → First 446 bytes: BOOTMGR code (or GRUB Stage 1)
  → Middle 64 bytes: Partition table (4 entries × 16 bytes)
  → Last 2 bytes: 0x55AA (boot signature)

⑤ BIOS jumps CS:IP to 0x7C00 (where MBR was loaded)
  → BOOTMGR in the MBR starts executing

⑥ BOOTMGR (BootBOOTMGR, NTFS compressed)
  → Reads BootBCD (BCD registry configuration)
  → Shows boot menu (if multiple boot entries exist)
  → Finds {default} boot entry's osdevice

⑦ Load winload.exe
  → Path: C:WindowsSystem32winload.exe
  → Verifies boot signature (Secure Boot related, skipped in BIOS mode)
  → Reads SYSTEM registry (gets driver list)

⑧ winload.exe loads ntoskrnl.exe + drivers
  → Switches to higher privilege level
  → Starts the Windows kernel

Throughout this chain, the only Windows code placed in the MBR is part of BOOTMGR; everything else (winload.exe, ntoskrnl.exe, BCD on the C: drive) lives inside partitions. The MBR’s 446 bytes of bootloader code are just a “second-stage loader”; the real bulk is in the System Reserved partition.

System Reserved Partition: What’s Actually in 100MB

Normal Partition Structure

The System Reserved partition (also called the “system partition”) is forcibly created by Windows in MBR mode. It must be a FAT32 filesystem (not NTFS) because BOOTMGR in BIOS mode only recognizes FAT.

Viewing Windows' System Reserved partition (in Windows):
diskpart
list volume
# Volume 1   System Reserved   FAT32   100 MB   Boot
# Volume 2   C:               NTFS    233 GB   Active

System Reserved (FAT32) Content Structure:
D: (assuming System Reserved is D:)

├── Boot
│   ├── BCD                     ← Boot Configuration Data (registry format)
│   ├── BCD.LOG                ← BCD transaction log
│   ├── BCD.LOG1               ← Previous version log
│   ├── ... [truncated]