Writing an OS Kernel from Scratch | Windows GPT+UEFI Boot: ESP Partition, NVRAM Boot Entries, and Secure Boot — Complete Analysis
The previous chapter covered the Windows boot chain in MBR+BIOS mode. The System Reserved partition was the core anchor of the entire chain — BOOTMGR and BCD both resided in that 100MB FAT32 partition, and BIOS found it via the MBR’s active partition flag.
But if you bought a brand-name PC manufactured after 2014 (ThinkPad, Dell, HP desktops), chances are it’s no longer in MBR mode — it uses GPT+UEFI. The System Reserved partition is gone, replaced by an ESP (EFI System Partition), and boot entries are no longer managed by an “active partition flag” but by entries in NVRAM (non-volatile memory).
These two modes are not just “different partition table formats” — they represent completely different boot philosophies:
| MBR+BIOS | GPT+UEFI | |
|---|---|---|
| Partition Table Location | LBA 0 (512 bytes mixed together) | LBA 1 (GPT Header) + LBA 2-33 (Partition Table) |
| Boot Flag | MBR partition table 0x80 active bit | NVRAM BootOrder (flash memory, not on disk) |
| Boot Manager Location | System Reserved (FAT32, 100MB) | ESP (FAT32, ≥100MB) |
| Boot File Format | BOOTMGR (16-bit real mode) | bootmgfw.efi (64-bit PE/COFF) |
| Secure Boot | None (BIOS mode has no signature verification) | Secure Boot (signature chain verification) |
| Multi-OS Coexistence | GRUB writes MBR + chain loading | GRUB writes ESP + NVRAM entries |
| Disk Capacity Limit | 2TB (32-bit LBA) | 8ZB (64-bit LBA, no upper limit) |
In this chapter, we’ll completely dissect the Windows GPT+UEFI boot chain — what’s in the ESP partition, how NVRAM BootOrder works, how the Secure Boot signature chain works, and how to use all the related tools.
Boot Chain: Complete 10-Step Process
In GPT+UEFI mode, Windows’ boot chain is longer than MBR+BIOS, but each step is clearer:
① Power button pressed
→ CPU starts executing from initial microcode burned into silicon
→ Initialize UART (for GDB debugging), initialize memory controller
② UEFI firmware initialization (SEC → PEI → DXE → BDS)
→ SEC (Security): Initialize CPU microcode, memory detection (earliest no-DRAM phase)
→ PEI (Pre-EFI Initialization): Memory initialization, find boot device
→ DXE (Driver Execution Environment): Load device drivers (USB/SATA/NVMe)
→ BDS (Boot Device Selection): Look up boot entries in boot order
③ Read BootOrder from NVRAM
→ NVRAM contains BootOrder (boot priority list)
→ The first available boot entry is selected
→ For example: Boot0001 = EFIMicrosoftBootootmgfw.efi
④ Load bootmgfw.efi
→ Path: ESP/EFI/Microsoft/Boot/bootmgfw.efi
→ Format: 64-bit PE/COFF executable (not COM/MZ format)
→ UEFI firmware verifies file signature (in Secure Boot mode)
⑤ bootmgfw.efi reads BCD
→ Location: ESP/Boot/BCD (or ESP/EFI/Microsoft/Boot/BCD)
→ Format: Registry hive (exactly the same as MBR mode)
→ Shows boot menu (or directly loads the default entry)
⑥ Locate Windows partition based on osdevice in BCD
→ MBR mode relies on "active partition flag"; UEFI mode relies on GPT partition GUID
→ Every partition in GPT has a unique GUID, no confusion
⑦ Load winload.efi
→ Path: C:WindowsSystem32winload.efi
→ Different from MBR mode's winload.exe... [truncated]
Comments