BootFlags in the LOADER_PARAMETER_EXTENSION

Windows 8 introduced a set of BootFlags to the LOADER_PARAMETER_EXTENSION. The immediate purpose was that the kernel would record them and then make them available as a new member of the SYSTEM_BOOT_ENVIRONMENT_INFORMATION structure that the ZwQuerySystemInformation and NtQuerySystemInformation functions produce as output when given the information class SystemBootEnvironmentInformation (0x5A).

Interpretation in bits was not at first explicit. The BootFlags member was just a ULONGLONG. Presumably, the masks for the meaningful bits had (and still have) macro definitions. For the 1607 release of Windows 10, Microsoft formalised the interpretation by defining BootFlags in union with a set of ULONGLONG bit fields:

ULONGLONG DbgMenuOsSelection : 1;

ULONGLONG DbgHiberBoot : 1;

ULONGLONG DbgSoftRestart : 1;

ULONGLONG DbgMeasuredLaunch : 1;

When each of the BootFlags bits were introduced merely as macro definitions may never be known with certainty: they can have been defined but not yet used, and (less likely) can have been used without a symbol being yet defined.

The bit that is later represented by DbgMenuOsSelection certainly dates from version 6.2. It gets set to report a particular combination of Boot Configuration Data (BCD) settings:

• bootmenupolicy is non-zero (0 is the default and 1 is documented as meaning Standard);
• safeboot is not present;
• custom:16000071 is non-zero.

The first and third were new for version 6.2. The third has no friendly name for use with the BCDEDIT tool but does have a symbolic definition in the BCDSRV.DLL type library as BcdLibraryBoolean_MultiBootSystem.