// HACKER NEWS — CYBERSECURITY
The little-known winstart.bat batch file
Reader Otul Osan wants to know what the use case for C:\WINDOWS\WINSTART.BAT was, compared to C:\AUTOEXEC.BAT and when exactly during system startup it launches.
In Windows 95, you could create a winstart.bat file in your Windows directory. During startup, the virtual machine manager initializes and creates the so-called “System virtual machine” (the “System VM”), which is the virtual machine that all Windows programs run in. But before running the user-mode kernel in that virtual machine, the virtual machine manager runs the winstart.bat batch file if it exists.
In pictures: First, we boot up MS-DOS and the command prompt. (Note: All diagrams omit lots of details not relevant to the discussion and are not to scale.)
The box labeled “Stuff” is a catch-all for random things that go at low addresses, like the interrupt vector table and the BIOS data area.
Next, command.com runs autoexec.bat, which might install some TSRs.
And then Windows starts up and initializes the virtual machine manager. The system is now running in protected mode with a virtual machine running in v86 mode, and that virtual machine is initialized with whatever was running in real mode at the time the virtual machine manager took over.¹
I crossed out MS-DOS because the virtual machine manager took over responsibility for the file system and shut off the real-mode file system in MS-DOS.
At this point, the virtual machine manager runs winstart.bat inside the virtual machine, and maybe it installs another TSR.
And then we start the user-mode kernel that is in charge of Windows applications. That user-mode kernel switches the virtual machine into protected mode and starts running what most people think of as Windows.
And then from the Windows GUI, you decide to open a command prompt, which means creating a second virtual machine.