In TrueCrypt 5 I have seen that the bootloader loads the TrueCrypt driver to memory just before windows starts. First it seams a modified version of grub is starting, then the control is hand over to ntldr.
This was kinda wondering me. How does this work? Before I thought any kernel will keep control about anything he can get from the hardware. But if *anyone* can load whatever he wants to before the kernel is starting...
(I do NOT mean virtual hardware such as VMware or Virtualbox!) Wouldn`t it be possible to boot up first a full linux distro (such as Ubuntu) and then boot Windows directly?
