Closed a1ive closed 4 years ago
11000001
wim/vhd/os device & file path ??
12000002
winload path
\Windows\system32\boot\winload.efi
12000004
title
Boot from WIM
12000005
lang
en-US
14000006
BcdLibraryObjectList_InheritedObjects (Windows Loader only) ??
{6efb52bf-1766-41db-a6b3-0ee5eff72bd7}
{7ea2e1ac-2e61-4728-aaa3-896d9d0a9f0e}
15000052
graphicsresolution
0 1024x768
1 800x600
2 1024x600
16000020
EMS
00 Disable
01 Enable
16000048
DisableIntegrityChecks (Windows Boot Manager only)
01 True
00 False
16000049
Test Mode (testsigning)
01 Enable
00 Disable
16000054
GraphicsForceHighestMode
01 True
00 False
21000001
wim/vhd/os device & file path ??
22000002
windows dir
\Windows
\hiberfil.sys
23000003
Windows Resume Application GUID (Windows Loader only)
{bbf30fe1-ffff-4cb5-9c43-8f5c1e15b3d9}
Default Menu GUID (Windows Boot Manager only)
{84203d36-a38d-4b90-8829-42b5372bbe83}
24000001
Display Order GUID (Windows Boot Manager only)
{06aa01ea-a7b6-4321-a270-b017823960b4}
{077a5dc3-1d58-4c3d-a5ce-b816c5bfce78}
{84203d36-a38d-4b90-8829-42b5372bbe83}
24000002
BootSequence GUID
25000004
Timeout (Windows Boot Manager only)
1e 00 00 00 00 00 00 00 timeout=30
25000020
Nx Policy
Enables, disables, and configures Data Execution Prevention (DEP),
a set of hardware and software technologies designed to prevent
harmful code from running in protected memory locations.
01 00 00 00 00 00 00 00 OptOut
00 00 00 00 00 00 00 00 OptIn
02 00 00 00 00 00 00 00 AlwaysOff
03 00 00 00 00 00 00 00 AlwaysOn
25000021
PAE Policy
00 00 00 00 00 00 00 00 Default
01 00 00 00 00 00 00 00 Enable
02 00 00 00 00 00 00 00 Disable
250000C2
Metro Menu (BootMenuPolicy)
01 00 00 00 00 00 00 00 Standard
00 00 00 00 00 00 00 00 Legacy
26000004
BcdOSLoaderBoolean_StampDisks
00
01
26000005
AttemptResume
01 True
00 False
26000006
BcdResumeBoolean_DebugOptionEnabled
01
00
26000010
Detect HAL and kernel
01 True
00 False
26000020
Display Boot Menu (Windows Boot Manager only)
01 Enable
00 Disable
26000022
Boot into WinPE
01 True
00 False
260000C4
Allow F10 Edit
01 True
00 False
31000003
boot.sdi device & file path ??
32000004
boot.sdi path
\boot\boot.sdi
35000001
RamdiskImageOffset
00 00 01 00 00 00 00 00
35000005
RamdiskImageLength
00 00 00 00 00 00 00 00
36000006
RamdiskExportAsCd
01 True
00 False
// gpt
00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
0x00 e0,34,55,ae,24,a9,6c,46, b8,36,75,85,39,a3,ee,3a,
0x10 00,00,00,00,01,00,00,00, 90,00,00,00,00,00,00,00,
0x20 03,00,00,00,00,00,00,00, 00,00,00,00,7c,00,00,00,
0x30 00,00,00,00,05,00,00,00, 01,00,00,00,68,00,00,00,
0x40 05,00,00,00,06,00,00,00, 00,00,00,00,48,00,00,00,
0x50 00,00,00,00,14,47,1f,bb, f2,4a,c8,47,96,eb,6f,16,
0x60 2b,1b,57,ad,00,00,00,00, 00,00,00,00,75,fa,fa,92,
0x70 8a,cc,6b,45,b0,82,16,c4, 99,ff,f0,c1,00,00,00,00,
0x80 00,00,00,00,00,00,00,00, 00,00,00,00,5c,00,66,00,
0x90 75,00,63,00,6b,00,2e,00, 77,00,69,00,6d,00,00,00
0x44 +0x04 dp type: QualifiedPartitionData (0x06)
0x4c == 0x48 (+0x08) ???
0x54 +0x10 part guid
0x68 +0x04 partmap: gpt 0x00
0x6c +0x10 disk guid
// mbr
00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
0x00 e0,34,55,ae,24,a9,6c,46, b8,36,75,85,39,a3,ee,3a,
0x10 00,00,00,00,01,00,00,00, 90,00,00,00,00,00,00,00,
0x20 03,00,00,00,00,00,00,00, 00,00,00,00,7c,00,00,00,
0x30 00,00,00,00,05,00,00,00, 01,00,00,00,68,00,00,00,
0x40 05,00,00,00,06,00,00,00, 00,00,00,00,48,00,00,00,
0x50 00,00,00,00,00,00,10,00, 08,00,00,00,00,00,00,00,
0x60 00,00,00,00,00,00,00,00, 01,00,00,00,f4,d4,7d,1e,
0x70 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x80 00,00,00,00,00,00,00,00, 00,00,00,00,5c,00,66,00,
0x90 75,00,63,00,6b,00,2e,00, 77,00,69,00,6d,00,00,00
// ntboot
00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
0x00 df,e1,94,a2,7c,8a,de,11, 94,2c,f2,4e,6a,36,7b,43,
0x10 00,00,00,00,01,00,00,00, 86,02,00,00,00,00,00,00,
0x20 03,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x30 00,00,00,00,00,00,00,00, 01,00,00,00,5e,02,00,00,
0x40 05,00,00,00,06,00,00,00, 00,00,00,00,48,00,00,00,
0x50 00,00,00,00,00,7e,00,00, 00,00,00,00,00,00,00,00,
0x60 00,00,00,00,00,00,00,00, 01,00,00,00,53,b7,53,b7,
0x70 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x80 00,00,00,00,00,00,00,00, 00,00,00,00,5c,57,49,4d,
0x90 5f,46,49,4c,45,5f,50,41, 54,48,20,20,30,00,30,00
0x44 +0x04 dp type: QualifiedPartitionData (0x06)
0x54 +0x04 part start (+0x10)
0x68 +0x04 partmap: mbr 0x01 (+0x24)
0x6c +0x04 disk signature (+0x28)
0x8c +.... path (+0x48)
// mbr vhd
00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
0x00 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x10 08,00,00,00,00,00,00,00, c2,00,00,00,00,00,00,00,
0x20 00,00,00,00,02,00,00,12, 1e,00,00,00,00,00,00,00,
0x30 00,00,00,00,00,00,a4,00, 00,00,00,00,00,00,06,00,
0x40 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x50 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,7c,00,
0x60 00,00,00,00,00,00,05,00, 00,00,01,00,00,00,68,00,
0x70 00,00,05,00,00,00,06,00, 00,00,00,00,00,00,48,00,
0x80 00,00,00,00,00,00,14,47, 1f,bb,f2,4a,c8,47,96,eb,
0x90 6f,16,2b,1b,57,ad,00,00, 00,00,00,00,00,00,75,fa,
0xa0 fa,92,8a,cc,6b,45,b0,82, 16,c4,99,ff,f0,c1,00,00,
0xb0 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,5c,00,
0xc0 66,00,75,00,63,00,6b,00, 2e,00,76,00,68,00,64,00,
0xd0 00,00
0x76 +0x04 dp type: QualifiedPartitionData (0x06)
0x86 +0x10 part guid (+0x10)
0x9e +0x10 disk guid (+0x28)
0xbe +.... path (+0x48)
//ntboot vhd
00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
0x00 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x10 08,00,00,00,00,00,00,00, b8,02,00,00,00,00,00,00,
0x20 00,00,00,00,02,00,00,12, 1e,00,00,00,00,00,00,00,
0x30 00,00,00,00,00,00,9a,02, 00,00,00,00,00,00,06,00,
0x40 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x50 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,72,02,
0x60 00,00,00,00,00,00,05,00, 00,00,01,00,00,00,5e,02,
0x70 00,00,05,00,00,00,06,00, 00,00,00,00,00,00,48,00,
0x80 00,00,00,00,00,00,00,7e, 00,00,00,00,00,00,00,00,
0x90 00,00,00,00,00,00,00,00, 00,00,01,00,00,00,53,b7,
0xa0 53,b7,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0xb0 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,5c,56,
0xc0 48,44,5f,46,49,4c,45,5f, 50,41,54,48,20,20,30,00
0x76 +0x04 dp type: QualifiedPartitionData (0x06)
//boot.sdi
00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
0x00 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x10 05,00,00,00,00,00,00,00, 48,00,00,00,00,00,00,00,
0x20 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x30 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x40 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x50 00,00,00,00,00,00,00,00
//Windows OS Loader
00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
0x00 00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,
0x10 06,00,00,00,00,00,00,00, 48,00,00,00,00,00,00,00,
0x20 14,47,1f,bb,f2,4a,c8,47, 96,eb,6f,16,2b,1b,57,ad,
0x30 00,00,00,00,00,00,00,00, 75,fa,fa,92,8a,cc,6b,45,
0x40 b0,82,16,c4,99,ff,f0,c1, 00,00,00,00,00,00,00,00,
0x50 00,00,00,00,00,00,00,00
0x10 +0x04 dp type: QualifiedPartitionData (0x06)
0x20 +0x10 part guid (+0x10)
0x38 +0x10 disk guid (+0x28)
https://github.com/a1ive/grub/blob/68596aea36cea22012f6d372fc3012b72a6a23d9/grub-core/lib/libreg/reg.h#L67
#define CM_KEY_LEAF 0x666c // "lf"
https://github.com/a1ive/grub/blob/68596aea36cea22012f6d372fc3012b72a6a23d9/grub-core/lib/libreg/reg.h#L136-L140
typedef struct
{
uint32_t Cell;
char Name[4];
} GRUB_PACKED CM_INDEX;
https://docs.microsoft.com/en-us/previous-versions/windows/desktop/bcd/boot-configuration-data-portal