惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

博客园_首页
博客园 - 【当耐特】
博客园 - 叶小钗
阮一峰的网络日志
阮一峰的网络日志
WordPress大学
WordPress大学
D
Docker
T
The Blog of Author Tim Ferriss
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
Microsoft Azure Blog
Microsoft Azure Blog
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
月光博客
月光博客
M
MIT News - Artificial intelligence
H
Hackread – Cybersecurity News, Data Breaches, AI and More
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
云风的 BLOG
云风的 BLOG
F
Fortinet All Blogs
罗磊的独立博客
小众软件
小众软件
A
About on SuperTechFans
MyScale Blog
MyScale Blog
D
DataBreaches.Net
The GitHub Blog
The GitHub Blog
C
Check Point Blog
L
LangChain Blog

The Old New Thing

std::call_once vs. std::async - The Old New Thing Magic statics vs. std::call_once - The Old New Thing Why do Microsoft job levels start in the high 50's instead of starting at a sane number like 1? - The Old New Thing Why didn't Read­Directory­ChangesW provide a way to correlate the two sides of a rename operation? - The Old New Thing How can I remove the Close button from my window caption? - The Old New Thing Why is the x86 undefined instruction called ud2? Why 2? - The Old New Thing What algorithm did Windows XP use to choose your initial user picture? - The Old New Thing A sample use of the winstart.bat file in Windows 95 - The Old New Thing Why don't we allow stacks to be sparse, instead of forcing them to be contiguous? - The Old New Thing What happens if you change a window class's GCL_CB­WND­EXTRA? - The Old New Thing The case of the progress callback that never got called when progress happened - The Old New Thing The perils of binding to value types in XAML - The Old New Thing Microspeak: Funded / unfunded - The Old New Thing AWE does not require PAE, though PAE makes it much more useful - The Old New Thing On forcing all derived classes to implement a specific non-virtual method, part 2 - The Old New Thing On forcing all derived classes to implement a specific non-virtual method, part 1 - The Old New Thing In the product end game, every change carries significant risk, episode 2 - The Old New Thing Why didn't the Windows Entertainment Pack just run the MS-DOS version inside an emulator? - The Old New Thing Comparing the two holograms on the Windows 95 box - The Old New Thing Reducing C++ template bloat by factoring out the type-dependent portions of the function, practical exam - The Old New Thing Reducing C++ template bloat by factoring out the type-dependent portions of the function - The Old New Thing On wrapping a callable in a lambda that just calls it with the same parameters - The Old New Thing Why did the Microsoft Entertainment Pack for Windows have a special sticker announcing that it also had Tetris? - The Old New Thing How do functions like alloca allocate memory from the stack? - The Old New Thing How do functions like alloca allocate memory from the stack? - The Old New Thing Forcing an ARM64X executable to run as a specific architecture - The Old New Thing A little helper class for managing LPPROC_THREAD_ATTRIBUTE_LISTs - The Old New Thing The comments that go into code versus those that go into the pull request description - The Old New Thing How can I perform a Copy­File&shy in unbuffered mode? - The Old New Thing Creating a fake agile wrapper that is technically agile but is not useful outside its home apartment, part 5 - The Old New Thing
The little-known winstart.bat batch file - The Old New Thing
Raymond Chen · 2026-08-11 · via The Old New Thing

Reader Otul Osan wants to know what the use case for C:\WINDOWS\WINSTART.BAT was, compared to C:\AUTOEXEC.BAT and when exactly during system startup it launches.

In Windows 95, you could create a winstart.bat file in your Windows directory. During startup, the virtual machine manager initializes and creates the so-called “System virtual machine” (the “System VM”), which is the virtual machine that all Windows programs run in. But before running the user-mode kernel in that virtual machine, the virtual machine manager runs the winstart.bat batch file if it exists.

In pictures: First, we boot up MS-DOS and the command prompt. (Note: All diagrams omit lots of details not relevant to the discussion and are not to scale.)

The box labeled “Stuff” is a catch-all for random things that go at low addresses, like the interrupt vector table and the BIOS data area.

Next, command.com runs autoexec.bat, which might install some TSRs.

Stuff TSR1 (unused) MS-DOS

And then Windows starts up and initializes the virtual machine manager. The system is now running in protected mode with a virtual machine running in v86 mode, and that virtual machine is initialized with whatever was running in real mode at the time the virtual machine manager took over.¹

v86 mode Stuff TSR1 (unused) MS-DOS
ring 0: virtual machine manager

I crossed out MS-DOS because the virtual machine manager took over responsibility for the file system and shut off the real-mode file system in MS-DOS.

At this point, the virtual machine manager runs winstart.bat inside the virtual machine, and maybe it installs another TSR.

v86 mode Stuff TSR1 TSR2 (unused) MS-DOS
ring 0: virtual machine manager

And then we start the user-mode kernel that is in charge of Windows applications. That user-mode kernel switches the virtual machine into protected mode and starts running what most people think of as Windows.

v86 mode Stuff TSR1 TSR2   MS-DOS
 
prot mode
(ring 3)
GUI stuff
ring 0: virtual machine manager

And then from the Windows GUI, you decide to open a command prompt, which means creating a second virtual machine.

v86 mode Stuff TSR1 TSR2   MS-DOS
 
prot mode
(ring 3)
GUI stuff
ring 0: virtual machine manager
 
v86 mode Stuff TSR1 COMMAND.COM MS-DOS

Notice that the virtual machine running command.com is a copy of the system when Windows started.² So it has TSR1 (from autoexec.bat) but not TSR2 (from winstart.bat).

If you install a TSR in the command prompt virtual machine, you get

v86 mode Stuff TSR1 TSR2   MS-DOS
 
prot mode
(ring 3)
GUI stuff
ring 0: virtual machine manager
 
v86 mode Stuff TSR1 TSR3 COMMAND.COM MS-DOS

Okay, now that we see how the pieces fit together, we can reverse-engineer the purpose of winstart.bat.

The intended purpose of winstart.bat is batch file is to allow you to install TSRs that will apply only to Windows programs. For example, you might install network drivers to support your Windows programs. You might choose this option instead of installing them globally because you don’t care about networking for your MS-DOS programs and want to free up conventional memory for them. Or because those drivers don’t support running in multiple virtual machines, so you’ll take them in the System VM and forego them for your MS-DOS programs.

What I find interesting is that most people who discover this say that it’s a feature of Windows 95. But really, it’s a feature of Windows 3.1 (and possibly even Windows 3.0). You can find it documented in the Windows 3.1 Resource Kit on page 263. That page even has a nice table showing three ways of launching TSRs and how they are visible in the different virtual machines. (In this table, “TSR visible in virtual machines” really means “TSR visible in non-Windows virtual machines”, but the documentation takes the convention that the term “virtual machine” refers only to non-Windows virtual machines and not to the virtual machine running Windows itself, which it simply calls “Windows”.)

Where TSR is loaded TSR visible in Windows? TSR visible in virtual machines?
From MS-DOS Yes Yes, all virtual machines
From WINSTART.BAT Yes No
In a single virtual machine No Only that virtual machine

¹ Think about that: We booted an operating system and then booted another operating system around it, so that the original operating system was now running inside a virtual machine controlled by the second operating system. It’s like leaving your house, walking down the street, and halfway down the block, realizing that you’re now walking inside a movie studio set.

² It isn’t actually a copy of the system at the time Windows started. Rather, it is a copy of the system VM, but only the parts that existed at the time Windows started. How this worked is too complex to try to explain in a footnote. Maybe I’ll discuss it some other time.

Category

Topics

Author

Raymond Chen

Raymond has been involved in the evolution of Windows for more than 30 years. In 2003, he began a Web site known as The Old New Thing which has grown in popularity far beyond his wildest imagination, a development which still gives him the heebie-jeebies. The Web site spawned a book, coincidentally also titled The Old New Thing (Addison Wesley 2007). He occasionally appears on the Windows Dev Docs Twitter account to tell stories which convey no useful information.