Technical background

This document provides a technical overview on VBoot. After reading this document, you should be able to get some ideas on how VBoot works internally. VBoot consists of three components, the virtual disk format, and VBoot Loader and the VBoot kernel drivers.  

Virtual Storage

VBoot stores operating systems inside some kind of virtual storage, usually disk image files. VBoot supports all popular standard formats, and you can use tools from other vendors to manipulate them, in addition to those provided by VBoot.

Disk image files (VHD, VMDK, VDI, Raw)

Disk image files reside on the host system and are seen by the operating systems as hard disks of a certain geometry. When an operating system reads from or writes to a hard disk, VBoot redirects the request to the image file.

When you create an image file, its capacity needs to be specified, which represents a fixed geometry of the virtual disk. It is therefore not possible to change the size of the virtual hard disk later.

VBoot supports four variants of disk image files, which are the most popular formats:
  • VBoot fully supports the VHD format used by Microsoft.
  • VBoot fully supports the popular and open VMDK container format that is used by many other virtualization products, in particular, by VMware.
  • VBoot fully supports Oracle VirtualBox container format for hard disks – Virtual Disk Image (VDI) files.
  • VBoot fully supports the raw disk format.

Irrespective of the disk format, there are two options of how to create a disk image: fixed-size or dynamically expanding.

  • If you create a fixed-size image of e.g. 10 GB, an image file of roughly the same size will be created on your host system. Note that the creation of a fixed-size image can take a long time depending on the size of the image and the write performance of your hard disk.
  • For more flexible storage management, use a dynamically expanding image. This will initially be very small and not occupy any space for unused virtual disk sectors, but the image file will grow every time a disk sector is written to for the first time. While this format takes less space initially, the fact that VBoot needs to constantly expand the image file consumes additional computing resources, so until the disk has fully expanded, write operations are slower than with fixed size disks. However, after a dynamic disk has fully expanded, the performance penalty for read and write operations is negligible.

Note that the plain raw disk format must be allocated as ixed size.

Differencing images

Sometimes, you may want to save disk changes to separate image files, this kind of disk images are called differencing images. VBoot fully supports this feature.

A differencing image is a special disk image that only holds the differences to another image. A differencing image by itself is useless, it must always refer to another image. The differencing image is then typically referred to as a “child”, which holds the differences to its “parent”.

When a differencing image is active, it receives and process all write operations from the operating system instead of its parent. The differencing image only contains the sectors of the virtual hard disk that have changed since the differencing image was created. When the machine reads a sector from such a virtual hard disk, it looks into the differencing image first. If the sector is present, it is returned from there; if not, VBoot looks into the parent. In other words, the parent becomes “read-only”; it is never written to again, but it is read from if a sector has not changed.

Differencing images can be chained. If another differencing image is created for a virtual disk that already has a differencing image, then it becomes a “grandchild” of the original parent. The first differencing image then becomes read-only as well, and write operations only go to the second-level differencing image. When reading from the virtual disk, VBoot needs to look into the second differencing image first, then into the first if the sector was not found, and then into the original image.

There can be an unlimited number of differencing images, and each image can have more than one child. As a result, the differencing images can form a complex tree with parents, “siblings” and children, depending on how complex your machine configuration is. Write operations always go to the one “active” differencing image that is attached to the machine, and for read operations, VBoot may need to look up all the parents in the chain until the sector in question is found.

In all of these situations, from the point of view of the physical machine, the virtual hard disk behaves like any other disk. While the machine is running, there is a slight run-time I/O overhead because VBoot might need to look up sectors several times. This is not noticeable however since the tables with sector information are always kept in memory and can be looked up quickly.

Differencing images are used in the following situations:

1. Snapshots. When you create a snapshot, VBoot “freezes” the image attached to the current running machine and creates a differencing image to the image. From the point of view of the machine, the virtual disks continue to operate as before, but all write operations go into the differencing image. Each time you create another snapshot, another differencing image is created and attached, forming a chain or tree.

When you restore a snapshot – that is, if you want to go back to the exact disk state that was stored in the snapshot, the differencing image holding all the write operations since the current snapshot was taken is thrown away, and the original parent image is made active again. (If you restored the “root” snapshot, then this will be the root disk image; otherwise, some other differencing image descended from it.) This effectively restores the old disk state.

If you later delete a snapshot in order to free disk space, one of the differencing images becomes obsolete. In this case, the differencing image of the disk cannot simply be deleted. Instead, VBoot needs to look at each sector of the differencing image and needs to copy it back into its parent; this is called “merging” images and can be a potentially lengthy process, depending on how large the differencing image is. It can also temporarily need a considerable amount of extra disk space, before the differencing image obsoleted by the merge operation is deleted.

2. Immutable images. When an image is booted as “immutable” mode, a differencing image is created as well. As with snapshots, the parent image then becomes read-only, and the differencing image receives all the write operations. Every time the machine is started, the immutable image has its differencing image thrown away, effectively resetting the virtual disk with every restart.

To boot a virtual harddisk as immutable, you can simply append the keyword "immutable" to the vboot line inside grub.cfg file, for example:

 vboot harddisk=(hd0,1)/xp.vmdk immutable

indicates xp.vmdk will be immutable, and all system changes, including files and registry entries will be thrown away after reboot. This way, you can browse to any websites without fear, any computer virus or spyware installed during the session will be automatically deleted after your machine is rebooted.

VBoot Loader

VBoot Loader is is the first software program that runs when your computer starts. It is responsible for loading and transferring control to the operating system kernel software.

 VBoot Loader is modified from the popular GRUB2 boot loader, in particular, VBoot Loader supports loading operating system from virtual disk files in various disk formats, including VHD, VMDK, VDI, ISO and raw images.


  • performs BIOS level INT 13 disk emulations for hard disk, cdrom and floppy.
  • supports loading virtual disk files, in VHD/VMDK/VDI/ISO/raw images.
  • supports differencing disk files for VHD/VMDK/VDI images.
  • supports read-only access to disks, no support for writeable access
  • supports most file systems, such as NTFS, Ext2/3/4, ReiserFS, FAT, etc.

Using Windows 7 Boot Manager

For windows 7, you can actually use Windows 7 boot manager to boot Windows 7 VHD. Note only Windows 7 virtual disk file in VHD format can be booted this way. In all other cases, you will have to use VBoot boot manager.

You can do the following to add Windows 7 vhd and boot via bootmgr:

bcdedit /copy {default} /d "Windows 7 VBoot VHD" 

this will print out a uuid, used as input for below:

bcdedit /set {guid} device vhd=[C:]\windows7.vhd
bcdedit /set {guid} osdevice vhd=[C:]\windows7.vhd 

then you should be able to boot the VBoot VHD.

VBoot command options

To use VBoot Loader, you need to insert a command into the grub.cfg configuration files. VBoot Loader passes these options to vboot virtual disk drivers inside the operating system. The VBoot virtual disk drivers utilize these options to perform the corresponding operations, such as mounting the disk files, taking a new snapshot, restoring to a snapshot and delete the child differencing disks, updating the grub.cfg file, etc.

The full syntax of vboot command is as follows:

vboot harddisk=disk_path cdrom=file_path floppy=file_path floppy_b=file_path boot=harddisk|cdrom|floppy parent_dir=folder_path take_snapshot=differencing_disk_path boot_entry=index config_file=grub_config_file new_menu_entry=title restore immutable recover_mbr pause



This option specifies a hard disk file, the path format is described here.


This option specifies a cdrom ISO file, the path format is described here.


This option specifies a floppy image file, which usually contains vboot driver, the path format is described here.


This option specifies a 2nd floppy image file, which usually contains a 3rd party SCSI driver, the path format is described here.


This option specifies which media to boot. The default boot is harddisk.


This option specifies a folder to search for base images, and should be only used for differencing hard disks.


This option is used to take a snapshot with the specified path as the differencing disk file.


This option is reserved for VBoot Loader to specify a boot entry. You should not use it explicitly.


This option is reserved for VBoot Loader to specify the full path of the grub.cfg file. You should not use it explicitly.


This option is used to restore to a snapshot. When a disk file contains child differencing disks, you can use this option to thrown away the child disks, and bring back to the same state before the snapshot was taken. Since the VBoot Loader does not support write access, it is the virtuald disk driver that performs the real task of deleting the snapshot and its child disks when the operating system kernel boots up. If the disk has another child disk after restoring, a new snapshot will be taken, with a new child differencing disk file created. If the disk has no child disks after restoring, then the disk will operate as a base image without taking a new snapshot. The grub.cfg file will be automatically updated to reflect the change.


When this option is used, the operating boots as immutable, meaning that all system changes will be discarded after reboot.  This is done by automatically saving all system changes to a differencing disk, and the delete the differencing disk after reboot. Note that you can still permanently save files to your real hard disks or external disks. Only those changes that are saved to the virtual disk, including system registry entries, will be thrown away.


This option is used to create a new menu entry inside the grub.cfg file. The virtual disk driver inserts an entry based the specified disk paths and the specified menu title. This option is typically used after you have entered some options manually using the VBoot Loader edit screen, i.e., you have pressed 'C' or 'E' . This way, you don't have to edit the grub.cfg file by hand after the operating system is booted up.


Immediately remove VBoot Loader code from MBR sectors and recover the original boot code.


Pause before booting, and the user needs to press a key to continue. This provide a chance to examine some messages.

 VBoot Kernel Drivers

The VBoot Loader lives outside of the virtual disk files, however in order to  boot a virtual disk file, a kernel driver corresponding to the installed operating system must be present inside the virtual disk file:

  • Windows 2000 (32-bit) uses \vboot\tools\x86\drivers\vbootdsk-w2k\vbootdsk.sys
  • Windows XP (32-bit) uses \vboot\tools\x86\drivers\vbootdsk\vbootdsk.sys
  • Windows 2003 (32-bit) uses \vboot\tools\x86\drivers\vbootsmp\vbootsmp.sys
  • Windows Vista, Windows 7 and Windows 2008 (32-bit) use \vboot\tools\x86\drivers\vbootstor\vbootstor.sys
  • Windows XP, Windows 2003 (64-bit) uses \vboot\tools\amd64\drivers\vbootsmp\vbootsmp.sys
  • Windows Vista, Windows 7 and Windows 2008 (64-bit) use \vboot\tools\amd64\drivers\vbootstor\vbootstor.sys
  • Linux uses vloop.mod