Understanding the Boot Process

Introduction

Not so many years ago, sitting down at a computer meant waiting several minutes for it to start. By contrast, our phones are nearly always on, typically only needing to be restarted when the battery runs out or to install an occasional system update. The boot process, the process by which a digital device transforms from a cold piece of silicon into an interactive system ready to run applications, is a complex process that has seen innovation in recent years. In particular, the boot process is now fundamental to the security of our modern devices, so those rare occasions when a smartphone powers on are more important than ever.

In this post, we’ll review the basic steps of the boot process that a modern smartphone would use. In the next post, we’ll look at approaches to initializing a system securely with the boot process.

From zero to sixty

The term “booting” comes from “bootstrapping,” the paradoxical concept of lifting oneself up by one’s own bootstraps. More than simply turning an ignition to ready the engine, the boot process is responsible for initializing software far beyond the capabilities of the hardware and software components that are immediately available to the system.

One might think (incorrectly) that pressing the power button invokes only a simple checklist of hardware: first set up main memory (RAM), then start the video display, and so on until the computer is fully ready. In reality, the system first launches a very simple operating system, responsible only for initializing the minimal set of hardware necessary to load a slightly more complex operating system. Once that hardware is ready, the simple operating system launches the more complex operating system, then relinquishes control. This process of initializing hardware for increasingly complex operating systems can happen several times over, depending on the particular hardware/software platform.

The transition between each of these stages, known as “boot loaders,” is more of a replacement than a handoff. If the boot loader were an employee doing a task, the analogy would not be the process of giving that task to a colleague, but instead the process of letting that more capable colleague sit down at the same desk and take over the workspace. The previous employee is removed and cannot work further on the task just as the previous boot loader is discarded from memory once the subsequent boot loader is launched.

As explained below, each of these boot loaders in a way resembles an operating system from decades ago. Just as the developmental stages of an animal embryo were thought to resemble adult forms of its ancestors (the “ontogeny recapitulates phylogeny” theory), so too do the intermediate boot loaders resemble the final stage of a more primitive computer system. The earliest boot loaders in the boot process need to fit in tiny storage areas because only certain hardware is available at that early stage, limiting the amount of code they can contain just as old operating systems were limited by the storage capacities that were available at the time. Because of the limitation on the amount of code that can be present, the earliest boot loaders can only make incremental progress in initializing hardware and software before the next boot loader is launched. Source code at this stage is both primitive and simultaneously some of the most difficult to comprehend due to its necessarily compact nature, which is what can make it so enjoyable to analyze and explain to clients (or judges or juries).

Continue reading about securing the boot process from attackers in our next post.

Understanding the Boot Process

Daniel W. Steinbrook

Technology Strategy & Analysis

June 04, 2019