1.1.15 release

- Add missing option (VTOY_WIN_UEFI_RES_LOCK)
 - Add new option (VTOY_SECURE_BOOT_POLICY)
 - Remove deprecated option (VTOY_LINUX_REMOUNT)

BLOB_List.md

@@ -46,131 +46,132 @@
         <tr> <td>./IMG/cpio_x86/ventoy/tool/zstdcat</td> <td>build</td>  <td>Same with ./ZSTD/zstdcat<br/>Check the file hash to confirm</td>    </tr>
         <tr> <td>./IMG/cpio_x86/ventoy/tool/zstdcat64</td> <td>build</td>  <td>Same with ./ZSTD/zstdcat64<br/>Check the file hash to confirm</td>    </tr>
         <tr> <td>./INSTALL/EFI/BOOT/BOOTAA64.EFI</td> <td rowspan=4>build</td>  <td rowspan=4>Build Instructions:<br/> ./DOC/BuildVentoyFromSource.txt 4.1-Build grub2</td>                                     </tr>        
-        <tr> <td>./INSTALL/EFI/BOOT/BOOTMIPS.EFI</td>     
+        <tr> <td>./INSTALL/EFI/BOOT/BOOTMIPS.EFI</td>     </tr>
-        <tr> <td>./INSTALL/EFI/BOOT/grubia32_real.efi</td>
+        <tr> <td>./INSTALL/EFI/BOOT/grubia32_real.efi</td></tr>
-        <tr> <td>./INSTALL/EFI/BOOT/grubx64_real.efi</td>
+        <tr> <td>./INSTALL/EFI/BOOT/grubx64_real.efi</td></tr>
-        <tr> <td>./INSTALL/EFI/BOOT/grub.efi</td> <td rowspan=6>upstream</td>    <td rowspan=6>https://github.com/ValdikSS/Super-UEFIinSecureBoot-Disk </td>      </tr>        
+        <tr> <td>./INSTALL/EFI/BOOT/BOOTIA32.EFI</td> <td rowspan=3>upstream</td>    <td rowspan=3>https://github.com/ValdikSS/Super-UEFIinSecureBoot-Disk </td>      </tr>        
-        <tr> <td>./INSTALL/EFI/BOOT/BOOTIA32.EFI</td> 
+        <tr> <td>./INSTALL/EFI/BOOT/grubia32.efi</td></tr>
-        <tr> <td>./INSTALL/EFI/BOOT/BOOTX64.EFI</td> 
+        <tr> <td>./INSTALL/EFI/BOOT/mmia32.efi</td></tr>        
-        <tr> <td>./INSTALL/EFI/BOOT/grubia32.efi</td>
+        <tr> <td>./INSTALL/EFI/BOOT/BOOTX64.EFI</td> <td rowspan=2>upstream</td>    <td rowspan=2>From Rocky Linux 9.8 x86_64 ISO file<br/>Check the file hash to confirm </td>      </tr>        
-        <tr> <td>./INSTALL/EFI/BOOT/mmia32.efi</td>
+        <tr> <td>./INSTALL/EFI/BOOT/mmx64.efi</td></tr>        
-        <tr> <td>./INSTALL/EFI/BOOT/MokManager.efi</td>
         <tr> <td>./INSTALL/tool/aarch64/ash</td> <td rowspan=12>build</td>    <td rowspan=12>Build Instructions:<br/>./DOC/BUSYBOX/build.txt</td>    </tr>
-        <tr> <td>./INSTALL/tool/aarch64/hexdump</td>
+        <tr> <td>./INSTALL/tool/aarch64/hexdump</td></tr>
-        <tr> <td>./INSTALL/tool/aarch64/xzcat</td>
+        <tr> <td>./INSTALL/tool/aarch64/xzcat</td></tr>
-        <tr> <td>./INSTALL/tool/i386/ash</td>
+        <tr> <td>./INSTALL/tool/i386/ash</td></tr>
-        <tr> <td>./INSTALL/tool/i386/hexdump</td>
+        <tr> <td>./INSTALL/tool/i386/hexdump</td></tr>
-        <tr> <td>./INSTALL/tool/i386/xzcat</td>
+        <tr> <td>./INSTALL/tool/i386/xzcat</td></tr>
-        <tr> <td>./INSTALL/tool/mips64el/ash</td>
+        <tr> <td>./INSTALL/tool/mips64el/ash</td></tr>
-        <tr> <td>./INSTALL/tool/mips64el/hexdump</td>
+        <tr> <td>./INSTALL/tool/mips64el/hexdump</td></tr>
-        <tr> <td>./INSTALL/tool/mips64el/xzcat</td>
+        <tr> <td>./INSTALL/tool/mips64el/xzcat</td></tr>
-        <tr> <td>./INSTALL/tool/x86_64/ash</td>
+        <tr> <td>./INSTALL/tool/x86_64/ash</td></tr>
-        <tr> <td>./INSTALL/tool/x86_64/hexdump</td>
+        <tr> <td>./INSTALL/tool/x86_64/hexdump</td></tr>
-        <tr> <td>./INSTALL/tool/x86_64/xzcat</td>
+        <tr> <td>./INSTALL/tool/x86_64/xzcat</td></tr>
         <tr> <td>./INSTALL/tool/aarch64/Ventoy2Disk.gtk3</td> <td rowspan=6>build</td>    <td rowspan=6>Build Instructions:<br/>./LinuxGUI/build_gtk.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.gtk3</td>
+        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.gtk3</td></tr>
-        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.gtk2</td>
+        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.gtk2</td></tr>
-        <tr> <td>./INSTALL/tool/mips64el/Ventoy2Disk.gtk3</td>
+        <tr> <td>./INSTALL/tool/mips64el/Ventoy2Disk.gtk3</td></tr>
-        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.gtk3</td>
+        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.gtk3</td></tr>
-        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.gtk2</td>
+        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.gtk2</td></tr>
         <tr> <td>./INSTALL/tool/aarch64/Ventoy2Disk.qt5</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./LinuxGUI/build_qt.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.qt5</td>
+        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.qt5</td></tr>
-        <tr> <td>./INSTALL/tool/mips64el/Ventoy2Disk.qt5</td>
+        <tr> <td>./INSTALL/tool/mips64el/Ventoy2Disk.qt5</td></tr>
-        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.qt5</td>
+        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.qt5</td></tr>
         <tr> <td>./INSTALL/tool/aarch64/Plugson</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./Plugson/build.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/Plugson</td>
+        <tr> <td>./INSTALL/tool/i386/Plugson</td></tr>
-        <tr> <td>./INSTALL/tool/mips64el/Plugson</td>
+        <tr> <td>./INSTALL/tool/mips64el/Plugson</td></tr>
-        <tr> <td>./INSTALL/tool/x86_64/Plugson</td>
+        <tr> <td>./INSTALL/tool/x86_64/Plugson</td></tr>
         <tr> <td>./INSTALL/tool/aarch64/V2DServer</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./LinuxGUI/build.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/V2DServer</td>
+        <tr> <td>./INSTALL/tool/i386/V2DServer</td></tr>
-        <tr> <td>./INSTALL/tool/mips64el/V2DServer</td>
+        <tr> <td>./INSTALL/tool/mips64el/V2DServer</td></tr>
-        <tr> <td>./INSTALL/tool/x86_64/V2DServer</td>
+        <tr> <td>./INSTALL/tool/x86_64/V2DServer</td></tr>
-        <tr> <td>./INSTALL/tool/aarch64/mkexfatfs</td> <td rowspan=8>build</td>    <td rowspan=8>Build Instructions:<br/>./DOC/BuildVentoyFromSource.txt 4.9<br/>./ExFAT/buidexfat.sh<br/>./ExFAT/buidexfat_aarch64.sh<br/>./ExFAT/buidlibfuse.sh<br/>./ExFAT/buidlibfuse_aarch64.sh<br/></td>    </tr>
+        <tr> <td>./INSTALL/tool/aarch64/mkexfatfs</td> <td rowspan=9>build</td>    <td rowspan=8>Build Instructions:<br/>./DOC/BuildVentoyFromSource.txt 4.9<br/>./ExFAT/buidexfat.sh<br/>./ExFAT/buidexfat_aarch64.sh<br/>./ExFAT/buidlibfuse.sh<br/>./ExFAT/buidlibfuse_aarch64.sh<br/></td>    </tr>
-        <tr> <td>./INSTALL/tool/aarch64/mount.exfat-fuse</td>
+        <tr> <td>./INSTALL/tool/aarch64/mount.exfat-fuse</td></tr>
-        <tr> <td>./INSTALL/tool/i386/mkexfatfs</td>
+        <tr> <td>./INSTALL/tool/i386/mkexfatfs</td></tr>
-        <tr> <td>./INSTALL/tool/i386/mount.exfat-fuse</td>
+        <tr> <td>./INSTALL/tool/i386/mount.exfat-fuse</td></tr>
-        <tr> <td>./INSTALL/tool/mips64el/mkexfatfs</td>
+        <tr> <td>./INSTALL/tool/mips64el/mkexfatfs</td></tr>
-        <tr> <td>./INSTALL/tool/mips64el/mount.exfat-fuse</td>
+        <tr> <td>./INSTALL/tool/mips64el/mount.exfat-fuse</td></tr>
-        <tr> <td>./INSTALL/tool/x86_64/mkexfatfs</td>
+        <tr> <td>./INSTALL/tool/x86_64/mkexfatfs</td></tr>
-        <tr> <td>./INSTALL/tool/x86_64/mount.exfat-fuse</td>    
+        <tr> <td>./INSTALL/tool/x86_64/mkexfatfs_static</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/mount.exfat-fuse</td>   </tr> 
         <tr> <td>./INSTALL/tool/aarch64/vlnk</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./Vlnk/build.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/vlnk</td>
+        <tr> <td>./INSTALL/tool/i386/vlnk</td></tr>
-        <tr> <td>./INSTALL/tool/mips64el/vlnk</td>
+        <tr> <td>./INSTALL/tool/mips64el/vlnk</td></tr>
-        <tr> <td>./INSTALL/tool/x86_64/vlnk</td>
+        <tr> <td>./INSTALL/tool/x86_64/vlnk</td></tr>
         <tr> <td>./INSTALL/tool/aarch64/vtoycli</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./vtoycli/build.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/vtoycli</td>
+        <tr> <td>./INSTALL/tool/i386/vtoycli</td></tr>
-        <tr> <td>./INSTALL/tool/mips64el/vtoycli</td>
+        <tr> <td>./INSTALL/tool/mips64el/vtoycli</td></tr>
-        <tr> <td>./INSTALL/tool/x86_64/vtoycli</td>
+        <tr> <td>./INSTALL/tool/x86_64/vtoycli</td></tr>
         <tr> <td>./INSTALL/ventoy/imdisk/32/imdisk.cpl</td>  <td rowspan=6>upstream</td>  <td rowspan=6>Download from imdisk project.<br/>URL & File Hash documented in<br/> ./DOC/BuildVentoyFromSource.txt 5.8</td>      </tr>
-        <tr> <td>./INSTALL/ventoy/imdisk/32/imdisk.exe</td>
+        <tr> <td>./INSTALL/ventoy/imdisk/32/imdisk.exe</td></tr>
-        <tr> <td>./INSTALL/ventoy/imdisk/32/imdisk.sys</td>
+        <tr> <td>./INSTALL/ventoy/imdisk/32/imdisk.sys</td></tr>
-        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.cpl</td>
+        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.cpl</td></tr>
-        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.exe</td>
+        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.exe</td></tr>
-        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.sys</td>
+        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.sys</td></tr>
         <tr> <td>./INSTALL/ventoy/iso9660_aa64.efi</td> <td rowspan=6>build</td>    <td rowspan=6>Build Instructions:<br/>./DOC/BuildVentoyFromSource.txt 4.17</td>    </tr>
-        <tr> <td>./INSTALL/ventoy/udf_aa64.efi</td>
+        <tr> <td>./INSTALL/ventoy/udf_aa64.efi</td></tr>
-        <tr> <td>./INSTALL/ventoy/iso9660_ia32.efi</td>
+        <tr> <td>./INSTALL/ventoy/iso9660_ia32.efi</td></tr>
-        <tr> <td>./INSTALL/ventoy/udf_ia32.efi</td>
+        <tr> <td>./INSTALL/ventoy/udf_ia32.efi</td></tr>
-        <tr> <td>./INSTALL/ventoy/iso9660_x64.efi</td>
+        <tr> <td>./INSTALL/ventoy/iso9660_x64.efi</td></tr>
-        <tr> <td>./INSTALL/ventoy/udf_x64.efi</td>
+        <tr> <td>./INSTALL/ventoy/udf_x64.efi</td></tr>
         <tr> <td>./INSTALL/VentoyGUI.aarch64</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./LinuxGUI/build_gtk.sh</td>    </tr>
-        <tr> <td>./INSTALL/VentoyGUI.i386</td>
+        <tr> <td>./INSTALL/VentoyGUI.i386</td></tr>
-        <tr> <td>./INSTALL/VentoyGUI.mips64el</td>
+        <tr> <td>./INSTALL/VentoyGUI.mips64el</td></tr>
-        <tr> <td>./INSTALL/VentoyGUI.x86_64</td>
+        <tr> <td>./INSTALL/VentoyGUI.x86_64</td></tr>
         <tr> <td>./INSTALL/Ventoy2Disk.exe</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./Ventoy2Disk/Ventoy2Disk.sln</td>    </tr>
-        <tr> <td>./INSTALL/Ventoy2Disk_ARM.exe</td>
+        <tr> <td>./INSTALL/Ventoy2Disk_ARM.exe</td></tr>
-        <tr> <td>./INSTALL/Ventoy2Disk_ARM64.exe</td>
+        <tr> <td>./INSTALL/Ventoy2Disk_ARM64.exe</td></tr>
-        <tr> <td>./INSTALL/Ventoy2Disk_X64.exe</td>
+        <tr> <td>./INSTALL/Ventoy2Disk_X64.exe</td></tr>
         <tr> <td>./INSTALL/ventoy/vtoyjump32.exe</td> <td rowspan=2>build</td>    <td rowspan=2>Build Instructions:<br/>./vtoyjump/vtoyjump.sln</td>    </tr>
-        <tr> <td>./INSTALL/ventoy/vtoyjump64.exe</td>
+        <tr> <td>./INSTALL/ventoy/vtoyjump64.exe</td></tr>
-        <tr> <td>./INSTALL/ventoy/ventoy_aa64.efi</td>  <td rowspan=6>build</td>  <td rowspan=6>Build Instructions:<br/>./EDK2/buildedk.sh</td>    </tr>
+        <tr> <td>./INSTALL/ventoy/ventoy_aa64.efi</td>  <td rowspan=7>build</td>  <td rowspan=7>Build Instructions:<br/>./EDK2/buildedk.sh</td>    </tr>
-        <tr> <td>./INSTALL/ventoy/ventoy_ia32.efi</td>
+        <tr> <td>./INSTALL/ventoy/ventoy_ia32.efi</td></tr>
-        <tr> <td>./INSTALL/ventoy/ventoy_x64.efi</td>
+        <tr> <td>./INSTALL/ventoy/ventoy_x64.efi</td></tr>
-        <tr> <td>./INSTALL/ventoy/vtoyutil_aa64.efi</td>
+        <tr> <td>./INSTALL/ventoy/vtoyutil_aa64.efi</td></tr>
-        <tr> <td>./INSTALL/ventoy/vtoyutil_ia32.efi</td>
+        <tr> <td>./INSTALL/ventoy/vtoyutil_ia32.efi</td></tr>
-        <tr> <td>./INSTALL/ventoy/vtoyutil_x64.efi</td>
+        <tr> <td>./INSTALL/ventoy/vtoyutil_x64.efi</td></tr>
+        <tr> <td>./INSTALL/EFI/BOOT/fbx64.efi</td></tr>
         <tr> <td>./INSTALL/ventoy/ipxe.krn</td> <td>build</td>  <td>Build Instructions:<br/>./IPXE/buildipxe.sh</td>    </tr>
         <tr> <td>./INSTALL/ventoy/memdisk</td> <td>upstream</td>  <td>Download from syslinux project.<br/>URL & File Hash documented in<br/> ./DOC/BuildVentoyFromSource.txt 5.9</td>      </tr>        
         <tr> <td>./LiveCD/ISO/EFI/boot/vmlinuz64</td> <td>upstream</td>  <td>Download from TinyLinux website.<br/>URL & File Hash documented in<br/> ./DOC/BuildVentoyFromSource.txt 5.14</td>      </tr>
         <tr> <td>./LiveCDGUI/EXT/busybox-x86_64</td> <td>build</td>  <td>Same with ./IMG/cpio_x86/ventoy/busybox/busybox64<br/>Check the file hash to confirm</td>    </tr>
         <tr> <td>./LiveCDGUI/GRUB/bootx64.efi</td> <td rowspan=2>build</td>  <td rowspan=2>./DOC/BuildVentoyFromSource.txt 4.1-Build grub2</td>    </tr>
-        <tr> <td>./LiveCD/GRUB/bootx64.efi</td>
+        <tr> <td>./LiveCD/GRUB/bootx64.efi</td></tr>
         <tr> <td>./LZIP/lunzip32</td> <td rowspan=3>build</td>  <td rowspan=3>Build Instructions:<br/>./DOC/BuildVentoyFromSource.txt 4.19</td>    </tr>
-        <tr> <td>./LZIP/lunzip64</td>
+        <tr> <td>./LZIP/lunzip64</td></tr>
-        <tr> <td>./LZIP/lunzipaa64</td>
+        <tr> <td>./LZIP/lunzipaa64</td></tr>
         <tr> <td>./LZIP/lz4cat64</td> <td rowspan=3>build</td>  <td rowspan=3>Build Instructions:<br/>./LZIP/buildlz4.txt</td>    </tr>
-        <tr> <td>./LZIP/lz4cataa64</td>
+        <tr> <td>./LZIP/lz4cataa64</td></tr>
-        <tr> <td>./LZIP/lz4catm64e</td>
+        <tr> <td>./LZIP/lz4catm64e</td></tr>
         <tr> <td>./Plugson/vs/VentoyPlugson/Release/VentoyPlugson.exe</td> <td rowspan=2>build</td>    <td rowspan=2>Build Instructions:<br/>./Plugson/vs/VentoyPlugson/VentoyPlugson.sln</td>    </tr>
-        <tr> <td>./Plugson/vs/VentoyPlugson/x64/Release/VentoyPlugson_X64.exe</td>
+        <tr> <td>./Plugson/vs/VentoyPlugson/x64/Release/VentoyPlugson_X64.exe</td></tr>
         <tr> <td>./SQUASHFS/unsquashfs_32</td> <td rowspan=3>build</td>    <td rowspan=3>Build Instructions:<br/>./SQUASHFS/build.sh</td>    </tr>
-        <tr> <td>./SQUASHFS/unsquashfs_64</td>
+        <tr> <td>./SQUASHFS/unsquashfs_64</td></tr>
-        <tr> <td>./SQUASHFS/unsquashfs_aa64</td>
+        <tr> <td>./SQUASHFS/unsquashfs_aa64</td></tr>
         <tr> <td>./Unix/ventoy_unix/DragonFly/sbin/dmsetup</td> <td>upstream</td>   <td>Get from DragonFly ISO.<br/>URL & File Hash documented in<br/> ./DOC/BuildVentoyFromSource.txt 5.13</td>      </tr>
         <tr> <td>./Unix/ventoy_unix/DragonFly/sbin/init</td> <td>build</td>    <td>Build Instructions:<br/>./Unix/ventoy_unix_src/DragonFly/build.sh</td>    </tr>
         <tr> <td>./VBLADE/vblade-master/vblade_32</td> <td rowspan=3>build</td>    <td rowspan=3>Build Instructions:<br/>./VBLADE/vblade-master/build.sh</td>    </tr>
-        <tr> <td>./VBLADE/vblade-master/vblade_64</td>
+        <tr> <td>./VBLADE/vblade-master/vblade_64</td></tr>
-        <tr> <td>./VBLADE/vblade-master/vblade_aa64</td>
+        <tr> <td>./VBLADE/vblade-master/vblade_aa64</td></tr>
         <tr> <td>./Vlnk/vs/VentoyVlnk/Release/VentoyVlnk.exe</td> <td>build</td>     <td>Build Instructions:<br/>./Vlnk/vs/VentoyVlnk/VentoyVlnk.sln</td>    </tr>
         <tr> <td>./VtoyTool/vtoytool/00/vtoytool_32</td> <td rowspan=6>build</td>    <td rowspan=6>Build Instructions:<br/>./VtoyTool/build.sh</td>    </tr>
-        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_64</td>
+        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_64</td></tr>
-        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_aa64</td>
+        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_aa64</td></tr>
-        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_m64e</td>
+        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_m64e</td></tr>
-        <tr> <td>./VtoyTool/vtoytool/01/vtoytool_64</td>
+        <tr> <td>./VtoyTool/vtoytool/01/vtoytool_64</td></tr>
-        <tr> <td>./VtoyTool/vtoytool/02/vtoytool_64</td>
+        <tr> <td>./VtoyTool/vtoytool/02/vtoytool_64</td></tr>
         <tr> <td>./ZSTD/zstdcat</td> <td rowspan=3>build</td>    <td rowspan=3>Build Instructions:<br/>./ZSTD/build.txt</td>    </tr>
-        <tr> <td>./ZSTD/zstdcat64</td>
+        <tr> <td>./ZSTD/zstdcat64</td></tr>
-        <tr> <td>./ZSTD/zstdcataa64</td>
+        <tr> <td>./ZSTD/zstdcataa64</td></tr>
         <tr> <td>./IMG/cpio_x86/ventoy/busybox/busybox32</td> <td rowspan=6>build</td>    <td rowspan=6>Build Instructions:<br/>./BUSYBOX/build.txt full busybox</td>    </tr>
-        <tr> <td>./IMG/cpio_x86/ventoy/busybox/busybox64</td>
+        <tr> <td>./IMG/cpio_x86/ventoy/busybox/busybox64</td></tr>
-        <tr> <td>./IMG/cpio_x86/ventoy/busybox/xzcat32_musl</td>
+        <tr> <td>./IMG/cpio_x86/ventoy/busybox/xzcat32_musl</td></tr>
-        <tr> <td>./IMG/cpio_x86/ventoy/busybox/xzcat64_musl</td>
+        <tr> <td>./IMG/cpio_x86/ventoy/busybox/xzcat64_musl</td></tr>
-        <tr> <td>./IMG/cpio_arm64/ventoy/busybox/busyboxaa64</td>
+        <tr> <td>./IMG/cpio_arm64/ventoy/busybox/busyboxaa64</td></tr>
-        <tr> <td>./IMG/cpio_mips64/ventoy/busybox/busyboxm64e</td>          
+        <tr> <td>./IMG/cpio_mips64/ventoy/busybox/busyboxm64e</td> </tr>         
         <tr> <td>ISNTALL/ventoy/7z/64/7za.exe</td>  <td rowspan=2>upstream</td>  <td>Download from 7z project.<br/>URL & File Hash documented in<br/> ./DOC/BuildVentoyFromSource.txt 5.12</td>      </tr>
-        <tr> <td>ISNTALL/ventoy/7z/32/7za.exe</td>  
+        <tr> <td>ISNTALL/ventoy/7z/32/7za.exe</td></tr>  
         <tr> <td>./INSTALL/ventoy/wimboot.i386.efi</td> <td rowspan=2>build</td>    <td rowspan=2>Build Instructions:<br/>./wimboot/build.sh</td>    </tr>
-        <tr> <td>./INSTALL/ventoy/wimboot.x86_64</td>        
+        <tr> <td>./INSTALL/ventoy/wimboot.x86_64</td></tr>        
         <tr> <td> ./Unix/ventoy_unix/ClonOS/geom_ventoy_ko/13.x/64/geom_ventoy.ko</td> <td rowspan=18>build</td>    <td rowspan=18>Build Instructions:<br/>./Unix/BuildUnixKmod.txt</td>    </tr>
         <tr> <td> ./Unix/ventoy_unix/FreeBSD/geom_ventoy_ko/10.x/32/geom_ventoy.ko</td></tr>
         <tr> <td> ./Unix/ventoy_unix/FreeBSD/geom_ventoy_ko/10.x/64/geom_ventoy.ko</td></tr>

DMPATCH/Makefile

@@ -1,7 +0,0 @@
-
-obj-m += dm_patch.o
-
-EXTRA_CFLAGS := -Wall
-
-dm_patch-objs := dmpatch.o
-

DMPATCH/Makefile_IBT

@@ -1,7 +0,0 @@
-
-obj-m += dm_patch_ibt.o
-
-EXTRA_CFLAGS := -Wall -DVTOY_IBT -fcf-protection=branch -mindirect-branch-register
-
-dm_patch_ibt-objs := dmpatch.o
-

DMPATCH/dmpatch.c

@@ -1,632 +0,0 @@
-/******************************************************************************
- * dmpatch.c  ---- patch for device-mapper
- *
- * Copyright (c) 2021, longpanda <admin@ventoy.net>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 3 of the
- * License, or (at your option) any later version.
- * 
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- * 
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/kallsyms.h>
-#include <linux/mutex.h>
-#include <linux/mempool.h>
-#include <linux/delay.h>
-#include <linux/wait.h>
-#include <linux/slab.h>
-
-#define MAX_PATCH   4
-
-#define magic_sig 0xB0, 0xB1, 0xB2, 0xB3, 0xB4, 0xB5, 0xB6, 0xB7, 0xB8, 0xB9, 0xBA, 0xBB, 0xBC, 0xBD, 0xBE, 0xBF
-
-typedef int (*kprobe_reg_pf)(void *);
-typedef void (*kprobe_unreg_pf)(void *);
-typedef int (*printk_pf)(const char *fmt, ...);
-typedef int (*set_memory_attr_pf)(unsigned long addr, int numpages);
-
-#pragma pack(1)
-typedef struct ko_param
-{
-    unsigned char magic[16];
-    unsigned long struct_size;
-    unsigned long pgsize;
-    unsigned long printk_addr;
-    unsigned long ro_addr;
-    unsigned long rw_addr;
-    unsigned long reg_kprobe_addr;
-    unsigned long unreg_kprobe_addr;
-    unsigned long sym_get_addr;
-    unsigned long sym_get_size;
-    unsigned long sym_put_addr;
-    unsigned long sym_put_size;
-    unsigned long kv_major;
-    unsigned long ibt;
-    unsigned long kv_minor;
-    unsigned long blkdev_get_addr;
-    unsigned long blkdev_put_addr;
-    unsigned long bdev_open_addr;
-    unsigned long kv_subminor;
-    unsigned long bdev_file_open_addr;
-    unsigned long padding[1];
-}ko_param;
-
-#pragma pack()
-
-static printk_pf kprintf = NULL;
-static set_memory_attr_pf set_mem_ro = NULL;
-static set_memory_attr_pf set_mem_rw = NULL;
-static kprobe_reg_pf reg_kprobe = NULL;
-static kprobe_unreg_pf unreg_kprobe = NULL;
-
-static volatile ko_param g_ko_param = 
-{
-    { magic_sig },
-    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
-};
-
-#if defined(CONFIG_X86_64)
-#define PATCH_OP_POS1    3
-#define CODE_MATCH1(code, i) \
-    (code[i] == 0x40 && code[i + 1] == 0x80 && code[i + 2] == 0xce && code[i + 3] == 0x80)
-
-#define PATCH_OP_POS2    1
-#define CODE_MATCH2(code, i) \
-    (code[i] == 0x0C && code[i + 1] == 0x80 && code[i + 2] == 0x89 && code[i + 3] == 0xC6)
-    
-#define PATCH_OP_POS3    4
-#define CODE_MATCH3(code, i) \
-    (code[i] == 0x44 && code[i + 1] == 0x89 && code[i + 2] == 0xe8 && code[i + 3] == 0x0c && code[i + 4] == 0x80)
-
-
-
-
-
-#elif defined(CONFIG_X86_32)
-#define PATCH_OP_POS1    2
-#define CODE_MATCH1(code, i) \
-    (code[i] == 0x80 && code[i + 1] == 0xca && code[i + 2] == 0x80 && code[i + 3] == 0xe8)
-
-#define PATCH_OP_POS2    PATCH_OP_POS1
-#define CODE_MATCH2      CODE_MATCH1
-#define PATCH_OP_POS3    PATCH_OP_POS1
-#define CODE_MATCH3      CODE_MATCH1
-
-
-#else
-#error "unsupported arch"
-#endif
-
-#ifdef VTOY_IBT
-#ifdef CONFIG_X86_64
-/* Using 64-bit values saves one instruction clearing the high half of low */
-#define DECLARE_ARGS(val, low, high)	unsigned long low, high
-#define EAX_EDX_VAL(val, low, high)	((low) | (high) << 32)
-#define EAX_EDX_RET(val, low, high)	"=a" (low), "=d" (high)
-#else
-#define DECLARE_ARGS(val, low, high)	unsigned long long val
-#define EAX_EDX_VAL(val, low, high)	(val)
-#define EAX_EDX_RET(val, low, high)	"=A" (val)
-#endif
-
-#define	EX_TYPE_WRMSR			 8
-#define	EX_TYPE_RDMSR			 9
-#define MSR_IA32_S_CET			0x000006a2 /* kernel mode cet */
-#define CET_ENDBR_EN			(1ULL << 2)
-
-/* Exception table entry */
-#ifdef __ASSEMBLY__
-
-#define _ASM_EXTABLE_TYPE(from, to, type)			\
-	.pushsection "__ex_table","a" ;				\
-	.balign 4 ;						\
-	.long (from) - . ;					\
-	.long (to) - . ;					\
-	.long type ;						\
-	.popsection
-
-#else /* ! __ASSEMBLY__ */
-
-#define _ASM_EXTABLE_TYPE(from, to, type)			\
-	" .pushsection \"__ex_table\",\"a\"\n"			\
-	" .balign 4\n"						\
-	" .long (" #from ") - .\n"				\
-	" .long (" #to ") - .\n"				\
-	" .long " __stringify(type) " \n"			\
-	" .popsection\n"
-
-#endif /* __ASSEMBLY__ */
-#endif /* VTOY_IBT */
-
-
-
-
-
-
-#define vdebug(fmt, args...) if(kprintf) kprintf(KERN_ERR fmt, ##args)
-
-static unsigned int g_claim_ptr = 0;
-static unsigned char *g_get_patch[MAX_PATCH] = { NULL };
-static unsigned char *g_put_patch[MAX_PATCH] = { NULL };
-
-static int notrace dmpatch_kv_above(unsigned long Major, unsigned long Minor, unsigned long SubMinor)
-{
-    if (g_ko_param.kv_major != Major)
-    {
-        return (g_ko_param.kv_major > Major) ? 1 : 0;
-    }
-
-    if (g_ko_param.kv_minor != Minor)
-    {
-        return (g_ko_param.kv_minor > Minor) ? 1 : 0;
-    }
-
-    if (g_ko_param.kv_subminor != SubMinor)
-    {
-        return (g_ko_param.kv_subminor > SubMinor) ? 1 : 0;
-    }
-
-    return 1;
-}
-
-static void notrace dmpatch_restore_code(int bytes, unsigned char *opCode, unsigned int code)
-{
-    unsigned long align;
-
-    if (opCode)
-    {
-        align = (unsigned long)opCode / g_ko_param.pgsize * g_ko_param.pgsize;
-        set_mem_rw(align, 1);
-        if (bytes == 1)
-        {
-            *opCode = (unsigned char)code;            
-        }
-        else
-        {
-            *(unsigned int *)opCode = code;
-        }
-        set_mem_ro(align, 1);        
-    }
-}
-
-static int notrace dmpatch_replace_code
-(
-    int style,
-    unsigned long addr, 
-    unsigned long size, 
-    int expect, 
-    const char *desc, 
-    unsigned char **patch
-)
-{
-    int i = 0;
-    int cnt = 0;
-    unsigned long align;
-    unsigned char *opCode = (unsigned char *)addr;
-
-    vdebug("patch for %s style[%d] 0x%lx %d\n", desc, style, addr, (int)size);
-
-    for (i = 0; i < (int)size - 8; i++)
-    {
-        if (style == 1)
-        {
-            if (CODE_MATCH1(opCode, i) && cnt < MAX_PATCH)
-            {
-                patch[cnt] = opCode + i + PATCH_OP_POS1;
-                cnt++;
-            }
-        }
-        else if (style == 2)
-        {
-            if (CODE_MATCH2(opCode, i) && cnt < MAX_PATCH)
-            {
-                patch[cnt] = opCode + i + PATCH_OP_POS2;
-                cnt++;
-            }
-        }
-        else if (style == 3)
-        {
-            if (CODE_MATCH3(opCode, i) && cnt < MAX_PATCH)
-            {
-                patch[cnt] = opCode + i + PATCH_OP_POS3;
-                cnt++;
-            }
-        }
-    }
-
-
-
-
-
-    if (cnt != expect || cnt >= MAX_PATCH)
-    {
-        vdebug("patch error: cnt=%d expect=%d\n", cnt, expect);
-        return 1;
-    }
-
-
-    for (i = 0; i < cnt; i++)
-    {
-        opCode = patch[i];
-        align = (unsigned long)opCode / g_ko_param.pgsize * g_ko_param.pgsize;
-
-        set_mem_rw(align, 1);
-        *opCode = 0;
-        set_mem_ro(align, 1);
-    }
-
-    return 0;
-}
-
-static unsigned long notrace dmpatch_find_call_offset(unsigned long addr, unsigned long size, unsigned long func)
-{
-    unsigned long i = 0;
-    unsigned long dest;
-    unsigned char *opCode = NULL;
-    unsigned char aucOffset[8] = { 0, 0, 0, 0, 0xFF, 0xFF, 0xFF, 0xFF };
-
-    opCode = (unsigned char *)addr;
-    
-    for (i = 0; i + 4 < size; i++)
-    {
-        if (opCode[i] == 0xE8)
-        {
-            aucOffset[0] = opCode[i + 1];
-            aucOffset[1] = opCode[i + 2];
-            aucOffset[2] = opCode[i + 3];
-            aucOffset[3] = opCode[i + 4];
-
-            dest = addr + i + 5 + *(unsigned long *)aucOffset;
-            if (dest == func)
-            {
-                return i;
-            }
-        }
-    }
-
-    return 0;
-}
-
-static unsigned int notrace dmpatch_patch_claim_ptr(void)
-{
-    unsigned long i = 0;
-    unsigned long t = 0;
-    unsigned long offset1 = 0;
-    unsigned long offset2 = 0;
-    unsigned long align = 0;
-    unsigned char *opCode = NULL;
-
-    opCode = (unsigned char *)g_ko_param.sym_get_addr;
-    for (i = 0; i < 4; i++)
-    {
-        vdebug("%02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X\n",
-            opCode[i + 0], opCode[i + 1], opCode[i + 2], opCode[i + 3],
-            opCode[i + 4], opCode[i + 5], opCode[i + 6], opCode[i + 7],
-            opCode[i + 8], opCode[i + 9], opCode[i + 10], opCode[i + 11],
-            opCode[i + 12], opCode[i + 13], opCode[i + 14], opCode[i + 15]);
-    }
-
-    if (dmpatch_kv_above(6, 7, 0)) /* >= 6.7 kernel */
-    {
-        vdebug("Get addr: 0x%lx %lu open 0x%lx\n", g_ko_param.sym_get_addr, g_ko_param.sym_get_size, g_ko_param.bdev_open_addr);
-        offset1 = dmpatch_find_call_offset(g_ko_param.sym_get_addr, g_ko_param.sym_get_size, g_ko_param.bdev_open_addr);
-        if (offset1 == 0)
-        {
-            vdebug("call bdev_open_addr Not found\n");
-
-            vdebug("Get addr: 0x%lx %lu file_open 0x%lx\n", g_ko_param.sym_get_addr, g_ko_param.sym_get_size, g_ko_param.bdev_file_open_addr);
-            offset1 = dmpatch_find_call_offset(g_ko_param.sym_get_addr, g_ko_param.sym_get_size, g_ko_param.bdev_file_open_addr);
-            if (offset1 == 0)
-            {            
-                vdebug("call bdev_file_open_addr Not found\n");
-                return 1;
-            }
-        }
-    }
-    else
-    {
-        vdebug("Get addr: 0x%lx %lu 0x%lx\n", g_ko_param.sym_get_addr, g_ko_param.sym_get_size, g_ko_param.blkdev_get_addr);
-        vdebug("Put addr: 0x%lx %lu 0x%lx\n", g_ko_param.sym_put_addr, g_ko_param.sym_put_size, g_ko_param.blkdev_put_addr);        
-
-        offset1 = dmpatch_find_call_offset(g_ko_param.sym_get_addr, g_ko_param.sym_get_size, g_ko_param.blkdev_get_addr);
-        offset2 = dmpatch_find_call_offset(g_ko_param.sym_put_addr, g_ko_param.sym_put_size, g_ko_param.blkdev_put_addr);
-        if (offset1 == 0 || offset2 == 0)
-        {
-            vdebug("call blkdev_get or blkdev_put Not found, %lu %lu\n", offset1, offset2);
-            return 1;
-        }
-    }
-
-    
-    vdebug("call addr1:0x%lx  call addr2:0x%lx\n", 
-        g_ko_param.sym_get_addr + offset1, 
-        g_ko_param.sym_put_addr + offset2);
-    
-    opCode = (unsigned char *)g_ko_param.sym_get_addr;
-    for (i = offset1 - 1, t = 0; (i > 0) && (t < 24); i--, t++)
-    {
-        /* rdx */
-        if (opCode[i] == 0x48 && opCode[i + 1] == 0xc7 && opCode[i + 2] == 0xc2)
-        {
-            g_claim_ptr = *(unsigned int *)(opCode + i + 3);
-            g_get_patch[0] = opCode + i + 3;
-            vdebug("claim_ptr(%08X) found at get addr 0x%lx\n", g_claim_ptr, g_ko_param.sym_get_addr + i + 3);
-            break;
-        }
-    }
-
-    if (g_claim_ptr == 0)
-    {
-        vdebug("Claim_ptr not found in get\n");
-        return 1;
-    }
-
-    
-    align = (unsigned long)g_get_patch[0] / g_ko_param.pgsize * g_ko_param.pgsize;
-    set_mem_rw(align, 1);
-    *(unsigned int *)(g_get_patch[0]) = 0;
-    set_mem_ro(align, 1);  
-
-
-    if (offset2 > 0)
-    {        
-        opCode = (unsigned char *)g_ko_param.sym_put_addr;
-        for (i = offset2 - 1, t = 0; (i > 0) && (t < 24); i--, t++)
-        {
-            /* rsi */
-            if (opCode[i] == 0x48 && opCode[i + 1] == 0xc7 && opCode[i + 2] == 0xc6)
-            {
-                if (*(unsigned int *)(opCode + i + 3) == g_claim_ptr)
-                {
-                    vdebug("claim_ptr found at put addr 0x%lx\n", g_ko_param.sym_put_addr + i + 3);
-                    g_put_patch[0] = opCode + i + 3;
-                    break;                
-                }
-            }
-        }    
-
-        if (g_put_patch[0] == 0)
-        {
-            vdebug("Claim_ptr not found in put\n");
-            return 1;
-        }
-        
-        align = (unsigned long)g_put_patch[0] / g_ko_param.pgsize * g_ko_param.pgsize;
-        set_mem_rw(align, 1);
-        *(unsigned int *)(g_put_patch[0]) = 0;
-        set_mem_ro(align, 1);   
-    }
-
-    return 0;
-}
-
-#ifdef VTOY_IBT
-static __always_inline unsigned long long dmpatch_rdmsr(unsigned int msr)
-{
-	DECLARE_ARGS(val, low, high);
-
-	asm volatile("1: rdmsr\n"
-		     "2:\n"
-		     _ASM_EXTABLE_TYPE(1b, 2b, EX_TYPE_RDMSR)
-		     : EAX_EDX_RET(val, low, high) : "c" (msr));
-
-	return EAX_EDX_VAL(val, low, high);
-}
-
-static __always_inline void dmpatch_wrmsr(unsigned int msr, u32 low, u32 high)
-{
-	asm volatile("1: wrmsr\n"
-		     "2:\n"
-		     _ASM_EXTABLE_TYPE(1b, 2b, EX_TYPE_WRMSR)
-		     : : "c" (msr), "a"(low), "d" (high) : "memory");
-}
-
-static u64 notrace dmpatch_ibt_save(void)
-{
-    u64 msr = 0;
-    u64 val = 0;
-
-    msr = dmpatch_rdmsr(MSR_IA32_S_CET);
-    val = msr & ~CET_ENDBR_EN;
-    dmpatch_wrmsr(MSR_IA32_S_CET, (u32)(val & 0xffffffffULL), (u32)(val >> 32));
-
-    return msr;
-}
-
-static void notrace dmpatch_ibt_restore(u64 save)
-{
-	u64 msr;
-
-    msr = dmpatch_rdmsr(MSR_IA32_S_CET);
-
-	msr &= ~CET_ENDBR_EN;
-	msr |= (save & CET_ENDBR_EN);
-
-    dmpatch_wrmsr(MSR_IA32_S_CET, (u32)(msr & 0xffffffffULL), (u32)(msr >> 32));
-}
-#else
-static u64 notrace dmpatch_ibt_save(void) { return 0; }
-static void notrace dmpatch_ibt_restore(u64 save) { (void)save; }
-#endif
-
-static int notrace dmpatch_process(unsigned long a, unsigned long b, unsigned long c)
-{
-    int r = 0;
-    int rc = 0;
-    unsigned long kv_major = 0;
-    unsigned long kv_minor = 0;
-    unsigned long kv_subminor = 0;
-
-    vdebug("dmpatch_process as KV %d.%d.%d ...\n", (int)a, (int)b, (int)c);
-
-    kv_major = g_ko_param.kv_major;
-    kv_minor = g_ko_param.kv_minor;
-    kv_subminor = g_ko_param.kv_subminor;
-
-    g_ko_param.kv_major = a;
-    g_ko_param.kv_minor = b;
-    g_ko_param.kv_subminor = c;
-    
-    if (dmpatch_kv_above(6, 5, 0)) /* >= kernel 6.5 */
-    {
-        vdebug("new interface patch dm_get_table_device...\n");
-        r = dmpatch_patch_claim_ptr();
-    }
-    else
-    {
-        r = dmpatch_replace_code(1, g_ko_param.sym_get_addr, g_ko_param.sym_get_size, 2, "dm_get_table_device", g_get_patch);
-        if (r && g_ko_param.kv_major >= 5)
-        {
-            vdebug("new2 patch dm_get_table_device...\n");
-            r = dmpatch_replace_code(2, g_ko_param.sym_get_addr, g_ko_param.sym_get_size, 1, "dm_get_table_device", g_get_patch);
-        }
-
-        if (r && g_ko_param.kv_major >= 5)
-        {
-            vdebug("new3 patch dm_get_table_device...\n");
-            r = dmpatch_replace_code(3, g_ko_param.sym_get_addr, g_ko_param.sym_get_size, 1, "dm_get_table_device", g_get_patch);
-        }
-    }
-
-    if (r)
-    {
-        rc = -EFAULT;
-        goto out;
-    }
-    vdebug("patch dm_get_table_device success\n");
-
-    if (dmpatch_kv_above(6, 5, 0))
-    {
-        r = 0;
-    }
-    else
-    {
-        r = dmpatch_replace_code(1, g_ko_param.sym_put_addr, g_ko_param.sym_put_size, 1, "dm_put_table_device", g_put_patch);        
-        if (r)
-        {
-            rc = -EFAULT;
-            goto out;
-        }
-        vdebug("patch dm_put_table_device success\n");
-    }
-
-    vdebug("#####################################\n");
-    vdebug("######## dm patch success ###########\n");
-    vdebug("#####################################\n");
-
-out:
-
-    g_ko_param.kv_major = kv_major;
-    g_ko_param.kv_minor = kv_minor;
-    g_ko_param.kv_subminor = kv_subminor;
-
-	return rc;
-}
-
-static int notrace dmpatch_init(void)
-{
-    int rc = 0;
-    u64 msr = 0;
-    
-    if (g_ko_param.ibt == 0x8888)
-    {
-        msr = dmpatch_ibt_save();
-    }
-    
-    kprintf = (printk_pf)(g_ko_param.printk_addr); 
-
-    vdebug("dmpatch_init start pagesize=%lu kernel=%lu.%lu.%lu ...\n", 
-        g_ko_param.pgsize, g_ko_param.kv_major, g_ko_param.kv_minor, g_ko_param.kv_subminor);
-    
-    if (g_ko_param.struct_size != sizeof(ko_param))
-    {
-        vdebug("Invalid struct size %d %d\n", (int)g_ko_param.struct_size, (int)sizeof(ko_param));
-        return -EINVAL;
-    }
-    
-    if (g_ko_param.sym_get_addr == 0 || g_ko_param.sym_put_addr == 0 || 
-        g_ko_param.ro_addr == 0 || g_ko_param.rw_addr == 0)
-    {
-        return -EINVAL;
-    }
-
-    set_mem_ro = (set_memory_attr_pf)(g_ko_param.ro_addr);
-    set_mem_rw = (set_memory_attr_pf)(g_ko_param.rw_addr);
-    reg_kprobe = (kprobe_reg_pf)g_ko_param.reg_kprobe_addr;
-    unreg_kprobe = (kprobe_unreg_pf)g_ko_param.unreg_kprobe_addr;
-
-    rc = dmpatch_process(g_ko_param.kv_major, g_ko_param.kv_minor, g_ko_param.kv_subminor);
-    if (rc)
-    {
-        if (g_ko_param.kv_major >= 5)
-        {
-            rc = dmpatch_process(6, 5, 0);
-            if (rc)
-            {
-                rc = dmpatch_process(6, 7, 0);
-            }
-        }
-    }
-
-    if (g_ko_param.ibt == 0x8888)
-    {
-        dmpatch_ibt_restore(msr);
-    }
-
-    return rc;
-}
-
-static void notrace dmpatch_exit(void)
-{
-    int i = 0;
-    u64 msr;
-
-    if (g_ko_param.ibt == 0x8888)
-    {
-        msr = dmpatch_ibt_save();
-    }
-
-    if (g_claim_ptr)
-    {
-        dmpatch_restore_code(4, g_get_patch[0], g_claim_ptr);
-        if (g_put_patch[0])
-        {
-            dmpatch_restore_code(4, g_put_patch[0], g_claim_ptr);
-        }
-    }
-    else
-    {        
-        for (i = 0; i < MAX_PATCH; i++)
-        {
-            dmpatch_restore_code(1, g_get_patch[i], 0x80);
-            dmpatch_restore_code(1, g_put_patch[i], 0x80);
-        }
-    }
-
-    vdebug("dmpatch_exit success\n");
-
-    if (g_ko_param.ibt == 0x8888)
-    {
-        dmpatch_ibt_restore(msr);
-    }
-}
-
-module_init(dmpatch_init);
-module_exit(dmpatch_exit);
-
-
-MODULE_DESCRIPTION("dmpatch driver");
-MODULE_AUTHOR("longpanda <admin@ventoy.net>");
-MODULE_LICENSE("GPL");
-

DMPATCH/readme.txt

@@ -1,38 +0,0 @@
-1. install ubuntu 22.04  5.15.0-25
-2. apt-get install build-essential flex libncurses-dev linux-headers-generic linux-source libssl-dev bison yacc vim libelf-dev  ...... and so on
-3. cp /lib/modules/5.15.0-25-generic/build/Module.symvers ./
-4. /boot/config-5.15.0-25-generic as .config   make oldconfig
-5. make menuconfig 
-    1. close CONFIG_STACKPROTECTOR
-    2. close CONFIG_RETPOLINE
-    3. close CONFIG_UBSAN_BOUNDS
-    4. close CONFIG_UBSAN_ENUM
-
-6. modify ./scripts/mod/modpost.c
-    1. skip add_srcversion (just return)
-    2. force add_retpoline (#ifdef --> #ifndef)
-    3. force add_intree_flag
-
-7. make modules_prepare LOCALVERSION=-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-
-8. Append padding at the end of struct module <include/linux/module.h>
-struct module {
-    enum module_state state;
-
-	/* Member of list of modules */
-	struct list_head list;
-
-	/* Unique handle for this module */
-	char name[MODULE_NAME_LEN];
-    
-    ....
-    
-    char padding[1024];
-};
-
-This is because struct module size is different in different kernel versions or with different CONFIG item.
-
-
-9. make modules M=/home/dmpatch
-10. strip --strip-debug /home/dmpatch/dm_patch.ko
-

DMPATCH/ubuntu_build.sh

@@ -1,65 +0,0 @@
-#!/bin/bash
-
-FTPIP=192.168.44.1
-FTPUSR='a:a'
-
-rm -f dmpatch.c Makefile Makefile_IBT
-
-for f in dmpatch.c Makefile Makefile_IBT; do
-	curl -s -u $FTPUSR ftp://$FTPIP/$f -o $f
-	if [ -f $f ]; then
-		echo "download $f OK ..."
-	else
-		echo "download $f FAILED ..."
-		exit 1
-	fi
-done
-
-
-
-rm -f *.ko
-
-
-echo "build dm_patch.ko ..."
-rm -rf ./aa
-mkdir ./aa
-
-cp -a *.c aa/
-cp -a Makefile aa/
-
-cd /home/panda/linux-source-5.15.0
-make modules M=/home/panda/build/aa/
-strip --strip-debug /home/panda/build/aa/dm_patch.ko
-cd -
-
-cp -a aa/dm_patch.ko  ./
-
-
-
-echo "build dm_patch_ibt.ko ..."
-rm -rf ./aa
-mkdir ./aa
-
-cp -a *.c aa/
-cp -a Makefile_IBT aa/Makefile
-
-cd /home/panda/linux-source-5.15.0
-make modules M=/home/panda/build/aa/
-strip --strip-debug /home/panda/build/aa/dm_patch_ibt.ko
-cd -
-
-cp -a aa/dm_patch_ibt.ko ./
-
-rm -rf ./aa
-
-
-curl -s -T dm_patch.ko -u $FTPUSR ftp://$FTPIP/dm_patch_64.ko || exit 1
-curl -s -T dm_patch_ibt.ko -u $FTPUSR ftp://$FTPIP/dm_patch_ibt_64.ko || exit 1
-
-
-if [ -f ./dm_patch.ko -a -f ./dm_patch_ibt.ko ]; then
-	echo -e "\n\n=============== SUCCESS =============\n\n"
-else
-	echo -e "\n\n=============== FAILED ==============\n\n"
-fi
-

DOC/BuildVentoyFromSource.txt

@@ -232,7 +232,7 @@
   SHA-256: cde08b6a2cf5ad914f05203e18e3f7c2ed6060a63604e3d75536f19b55e8e0af  
 
 5.8 imdisk
-  download http://www.ltr-data.se/files/imdiskinst.exe and extract it by 7zip.
+  download http://static.ltr-data.se/files/imdiskinst_2.0.10.exe and extract it by 7zip.
   
   INSTALL/ventoy/imdisk/64/imdisk.sys --> sys/amd64/imdisk.sys  SHA-256: 6702202220268787e361f5a82dae53362c8e6c6dcd240bb01b44dd77ae0788da
   INSTALL/ventoy/imdisk/64/imdisk.exe --> cli/amd64/imdisk.exe  SHA-256: 9759175380af836869443e5f21ce2e33022125d154bc6b3d1c04dc36b190de04
@@ -274,3 +274,4 @@
 5.14 ./LiveCD/ISO/EFI/boot/vmlinuz64
  download from http://www.tinycorelinux.net/11.x/x86_64/archive/11.0/distribution_files/vmlinuz64    
  vmlinuz64  SHA-256: 641077fc1f9914af244c248453005f56536ba9e7f54ba3e52402f26709ddb8a5
+

EDK2/build_shim.sh

@@ -0,0 +1,55 @@
+#!/bin/sh
+
+if [ -z "$1" ]; then
+    EDKARCH=X64
+    postfix=x64
+elif [ "$1" = "ia32" ]; then
+    EDKARCH=IA32
+    postfix=ia32
+    shift
+elif [ "$1" = "aa64" ]; then
+    EDKARCH=AARCH64
+    postfix=aa64
+    shift
+fi
+
+cd edk2-edk2-stable201911
+
+rm -rf ./Conf/.cache
+rm -f ./Conf/.AutoGenIdFile.txt
+
+VTEFI_PATH=Build/MdeModule/RELEASE_GCC48/$EDKARCH/MdeModulePkg/Application/VtoyShim/VtoyShim/OUTPUT/VtoyShim.efi
+DST_PATH=../../INSTALL/EFI/BOOT/fb${postfix}.efi
+
+
+rm -f $VTEFI_PATH
+rm -f $DST_PATH
+
+unset WORKSPACE
+source ./edksetup.sh
+
+if [ "$EDKARCH" = "AARCH64" ]; then    
+    PATH=$PATH:/opt/gcc-linaro-7.4.1-2019.02-x86_64_aarch64-linux-gnu/bin \
+    GCC48_AARCH64_PREFIX=aarch64-linux-gnu- \
+    build -p MdeModulePkg/MdeModulePkg.dsc -a $EDKARCH -b RELEASE -t GCC48  -m MdeModulePkg/Application/VtoyShim/VtoyShim.inf
+else
+    build -p MdeModulePkg/MdeModulePkg.dsc -a $EDKARCH -b RELEASE -t GCC48  -m MdeModulePkg/Application/VtoyShim/VtoyShim.inf
+fi
+
+if [ -e $VTEFI_PATH ]; then
+    objcopy \
+        --add-section .sbat="MdeModulePkg/Application/VtoyShim/sbat.csv" \
+        --set-section-flags .sbat=alloc,load,readonly,data \
+        "$VTEFI_PATH" "$DST_PATH"
+        
+    objcopy --adjust-section-vma .sbat=0x1000 "$DST_PATH"
+
+    echo -e '\n\n====================== SUCCESS ========================\n\n'    
+
+    cd ..
+else
+    echo -e '\n\n====================== FAILED ========================\n\n'
+    cd ..
+    exit 1
+fi
+

EDK2/buildedk.sh

@@ -19,3 +19,7 @@ sh ./build.sh aa64 || exit 1
 echo '======== build EDK2 for x86_64-efi ==============='
 sh ./build.sh      || exit 1
 
+
+echo '======== build EDK2 for x86_64-efi ==============='
+sh ./build_shim.sh      || exit 1
+

EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/Ventoy/Ventoy.c

@@ -1231,6 +1231,32 @@ EFI_STATUS EFIAPI ventoy_boot(IN EFI_HANDLE ImageHandle)
     return EFI_SUCCESS;
 }
 
+#if defined (MDE_CPU_X64)
+STATIC BOOLEAN EFIAPI CheckVtoyShim(VOID)
+{
+    UINT8 SecureBoot = 0;
+	UINTN DataSize;
+	EFI_STATUS Status;
+    EFI_GUID Guid = VTOY_SHIM_POLICY_GUID;
+    VOID *Prot = NULL;
+
+	DataSize = sizeof(SecureBoot);
+	Status = gST->RuntimeServices->GetVariable(L"SecureBoot", &gEfiGlobalVariableGuid, NULL,
+				     &DataSize, &SecureBoot);
+	if (!EFI_ERROR(Status) && SecureBoot)
+    {
+        Status = gBS->LocateProtocol(&Guid, NULL, (VOID**)&Prot);
+        if (EFI_ERROR(Status))
+        {
+            VtoyDebug("Failed to locate Vtoy Shim Protocol %lx\r\n", Status);
+            return FALSE;
+        }
+    }
+
+    return TRUE;
+}
+#endif
+
 EFI_STATUS EFIAPI VentoyEfiMain
 (
     IN EFI_HANDLE         ImageHandle,
@@ -1240,6 +1266,15 @@ EFI_STATUS EFIAPI VentoyEfiMain
     EFI_STATUS Status = EFI_SUCCESS;
     EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL *Protocol;
 
+#if defined (MDE_CPU_X64)
+    /* check that Ventoy Shim must exist */
+    if (!CheckVtoyShim())
+    {
+        sleep(5);
+        return EFI_NOT_FOUND;
+    }
+#endif
+
     g_sector_flag_num = 512; /* initial value */
 
     g_sector_flag = AllocatePool(g_sector_flag_num * sizeof(ventoy_sector_flag));
@@ -1263,6 +1298,11 @@ EFI_STATUS EFIAPI VentoyEfiMain
         return Status;
     }
 
+    if (g_os_param_reserved[11])
+    {
+        ventoy_lock_res(g_os_param_reserved[11]);
+    }
+
     ventoy_disable_ex_filesystem();
 
     if (gMemdiskMode)
@@ -1341,6 +1381,11 @@ EFI_STATUS EFIAPI VentoyEfiMain
 
     ventoy_enable_ex_filesystem();
 
+    if (g_os_param_reserved[11])
+    {
+        ventoy_unlock_res();
+    }
+
     return EFI_SUCCESS;
 }
 

EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/Ventoy/Ventoy.h

@@ -23,6 +23,8 @@
 
 #define COMPILE_ASSERT(expr)  extern char __compile_assert[(expr) ? 1 : -1]
 
+#define VTOY_SHIM_POLICY_GUID    {0x90a29d14, 0x3968, 0x48fe, { 0x85, 0x81, 0x6b, 0x7f, 0x7d, 0xc4, 0x70, 0x55 }};
+
 #define VENTOY_GUID { 0x77772020, 0x2e77, 0x6576, { 0x6e, 0x74, 0x6f, 0x79, 0x2e, 0x6e, 0x65, 0x74 }}
 
 typedef enum ventoy_chain_type
@@ -428,6 +430,8 @@ EFI_STATUS ventoy_hook_1st_cdrom_start(VOID);
 EFI_STATUS ventoy_hook_1st_cdrom_stop(VOID);
 EFI_STATUS ventoy_disable_ex_filesystem(VOID);
 EFI_STATUS ventoy_enable_ex_filesystem(VOID);
+EFI_STATUS ventoy_lock_res(UINT8 LockType);
+EFI_STATUS ventoy_unlock_res(VOID);
 
 #endif
 

EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/Ventoy/Ventoy.inf

@@ -25,6 +25,10 @@
   ENTRY_POINT                    = VentoyEfiMain
 
   
+[BuildOptions]
+  # Force standard GNU ld to pack and align ELF segments to 4KB page boundaries
+  GCC:*_*_*_DLINK_FLAGS = -Wl,-z,common-page-size=0x1000 -Wl,-z,max-page-size=0x1000
+
 [Sources]
   Ventoy.h
   Ventoy.c

EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/Ventoy/VentoyProtocol.c

@@ -1797,3 +1797,176 @@ EFI_STATUS ventoy_hook_1st_cdrom_stop(VOID)
     return EFI_SUCCESS;
 }
 
+
+
+#if 0
+/* For force highest resolution for Windows/WinPE */
+#endif
+
+
+STATIC UINT32 g_org_mode_num = 0;
+STATIC EFI_GRAPHICS_OUTPUT_PROTOCOL_SET_MODE  g_org_set_mode = NULL;
+
+STATIC EFI_STATUS EFIAPI ventoy_set_mode
+(
+  IN  EFI_GRAPHICS_OUTPUT_PROTOCOL *This,
+  IN  UINT32                       ModeNumber
+)
+{
+    (void)This;
+    (void)ModeNumber;
+
+    /* Force highest resolution */
+    return EFI_SUCCESS;
+}
+
+STATIC EFI_STATUS EFIAPI ventoy_set_mode2
+(
+  IN  EFI_GRAPHICS_OUTPUT_PROTOCOL *This,
+  IN  UINT32                       ModeNumber
+)
+{
+    UINTN Size;
+    EFI_STATUS rc;
+    EFI_GRAPHICS_OUTPUT_MODE_INFORMATION *info = NULL;
+
+    /* Force >= 1024x768 */
+    rc = This->QueryMode(This, ModeNumber, &Size, &info);
+    if (rc == EFI_SUCCESS)
+    {
+        if (info->HorizontalResolution < 1024 || info->VerticalResolution < 768)
+        {
+            return EFI_SUCCESS;
+        }
+    }
+
+    return g_org_set_mode(This, ModeNumber);
+}
+
+EFI_STATUS ventoy_lock_res(UINT8 LockType)
+{
+	UINT32 i = 0;
+	UINT32 x = 0;
+    UINT32 y = 0;
+    UINT32 SelMode = 0;
+    UINT32 CurMode = 0;
+    UINT32 Highest = 0;
+    UINT32 M1024_768 = MAX_UINT32;
+	UINTN  Size;
+	EFI_STATUS rc;
+    EFI_GRAPHICS_OUTPUT_PROTOCOL *gop = NULL;
+	EFI_GRAPHICS_OUTPUT_MODE_INFORMATION *info = NULL;
+
+    /* already hook */
+    if (g_org_set_mode)
+    {
+        return EFI_SUCCESS;
+    }
+
+    /* 1: Highest   2: 1024x768 3: >= 1024x768 */
+    if (LockType == 0 || LockType > 3)
+    {
+        return EFI_SUCCESS;
+    }
+
+    rc = gBS->LocateProtocol(&gEfiGraphicsOutputProtocolGuid, NULL, (void **)&gop);
+    if (rc != EFI_SUCCESS)
+    {
+        debug("Failed to locate GOP protocol");
+        return EFI_SUCCESS;
+    }
+
+
+    if (LockType == 3)
+    {
+        g_org_mode_num = MAX_UINT32;
+        g_org_set_mode = gop->SetMode;
+        gop->SetMode = ventoy_set_mode2;
+        return EFI_SUCCESS;
+    }
+
+
+    CurMode = gop->Mode->Mode;
+
+    for (i = 0 ; i < gop->Mode->MaxMode ; i++)
+    {
+		/* Get mode information */
+		if (gop->QueryMode(gop, i, &Size, &info) == EFI_SUCCESS)
+        {
+            if (info->HorizontalResolution == 1024 && info->VerticalResolution == 768)
+            {
+                M1024_768 = i;
+            }
+
+            if (x < info->HorizontalResolution ||
+               (x == info->HorizontalResolution && y < info->VerticalResolution))
+            {
+                Highest = i;
+                x = info->HorizontalResolution;
+                y = info->VerticalResolution;
+            }
+		}
+    }
+
+
+    if (LockType == 1)
+    {
+        SelMode = Highest;
+    }
+    else
+    {
+        if (M1024_768 == MAX_UINT32)
+        {
+            SelMode = Highest;
+        }
+        else
+        {
+            SelMode = M1024_768;
+            x = 1024;
+            y = 768;
+        }
+    }
+
+    if (SelMode != CurMode)
+    {
+        gop->SetMode(gop, SelMode);
+    }
+    debug("Lock resolution to Mode:%d  %d x %d", SelMode, x, y);
+
+
+    g_org_mode_num = CurMode;
+    g_org_set_mode = gop->SetMode;
+    gop->SetMode = ventoy_set_mode;
+
+    return EFI_SUCCESS;
+}
+
+EFI_STATUS ventoy_unlock_res(VOID)
+{
+	EFI_STATUS rc;
+    EFI_GRAPHICS_OUTPUT_PROTOCOL *gop = NULL;
+
+    /* not hooked yet */
+    if (!g_org_set_mode)
+    {
+        return EFI_SUCCESS;
+    }
+
+    rc = gBS->LocateProtocol(&gEfiGraphicsOutputProtocolGuid, NULL, (void **)&gop);
+    if (rc != EFI_SUCCESS)
+    {
+        debug("Failed to locate GOP protocol");
+        return EFI_SUCCESS;
+    }
+
+    if (g_org_mode_num != MAX_UINT32)
+    {
+        g_org_set_mode(gop, g_org_mode_num);
+    }
+
+    gop->SetMode = g_org_set_mode;
+    g_org_set_mode = NULL;
+    return EFI_SUCCESS;
+}
+
+

EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyShim/VtoyShim.c

@@ -0,0 +1,718 @@
+/******************************************************************************
+ * VtoyShim.c
+ *
+ * Copyright (c) 2017 - 2018, Intel Corporation. All rights reserved.<BR>
+ * SPDX-License-Identifier: BSD-2-Clause-Patent
+ *
+ */
+
+#include <Uefi.h>
+
+#include <Library/DebugLib.h>
+#include <Library/PrintLib.h>
+#include <Library/UefiLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DevicePathLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/UefiBootServicesTableLib.h>
+#include <Library/UefiRuntimeServicesTableLib.h>
+#include <Library/UefiApplicationEntryPoint.h>
+#include <Library/PeCoffLib.h>
+#include <Protocol/LoadedImage.h>
+#include <Guid/FileInfo.h>
+#include <Guid/FileSystemInfo.h>
+#include <Protocol/BlockIo.h>
+#include <Protocol/RamDisk.h>
+#include <Protocol/SimpleFileSystem.h>
+#include <Protocol/DevicePathToText.h>
+#include <Protocol/DevicePathFromText.h>
+#include <Protocol/LoadedImage.h>
+#include <Protocol/Security.h>
+#include <Protocol/Security2.h>
+#include <IndustryStandard/PeImage.h>
+#include <VtoyShim.h>
+
+#define CUR_SBAT_VER    1
+
+STATIC EFI_GUID gVtoySbatGUID = { 0xf755068a, 0xe04f, 0x452b, { 0x9d, 0x6d, 0x7c, 0x55, 0x96, 0xb3, 0xc0, 0x7d }};
+STATIC EFI_DEVICE_PATH_TO_TEXT_PROTOCOL *gDpToText = NULL;
+STATIC EFI_DEVICE_PATH_FROM_TEXT_PROTOCOL *gTextToDp = NULL;
+STATIC EFI_SECURITY_FILE_AUTHENTICATION_STATE gSysSecFileAuth = NULL;
+STATIC EFI_SECURITY2_FILE_AUTHENTICATION gSysSec2FileAuth = NULL;
+STATIC BOOLEAN gVtoyByPassSB = FALSE; /* must be FALSE by default for revoke */
+STATIC VTOY_SHIM gVtoyShimProtocol;
+STATIC EFI_HANDLE gVtoyShimProtHandle;
+STATIC SHIM_LOCK *gShimLock = NULL;
+
+STATIC VOID EFIAPI VtoyLog(CONST CHAR16 *Format, ...)
+{
+    VA_LIST         Marker;
+    CHAR16          Buffer[512];
+    UINTN           BufLen = 0;
+
+    Buffer[0] = 0;
+    VA_START(Marker, Format);
+    BufLen = UnicodeVSPrint(Buffer, sizeof(Buffer), Format, Marker);
+    VA_END(Marker);
+
+    if (gST->ConOut && gST->ConOut->OutputString)
+    {
+        gST->ConOut->OutputString(gST->ConOut, Buffer);
+    }
+}
+
+
+STATIC VOID EFIAPI DumpDevicePath(const EFI_DEVICE_PATH_PROTOCOL *DevicePath)
+{
+    CHAR16 *DPStr = NULL;
+
+    DPStr = gDpToText->ConvertDevicePathToText(DevicePath, TRUE, TRUE);
+    if (DPStr)
+    {
+        vLog(L"%s", DPStr);
+        gBS->FreePool(DPStr);
+    }
+    else
+    {
+        vLog(L"NULL");
+    }
+}
+
+STATIC VOID EFIAPI ShowSBWarning(BOOLEAN Reboot, const EFI_DEVICE_PATH_PROTOCOL *DevicePath)
+{
+    UINTN Index = 0;
+
+    vLog(L"\r\n=======================================================");
+    vLog(L"=======================================================\r\n");
+
+    DumpDevicePath(DevicePath);
+
+    vLog(L"\r\n####### Security Boot Violation ##########\r\n");
+
+    vLog(L"=======================================================");
+    vLog(L"=======================================================");
+
+    if (Reboot)
+    {
+        vLog(L"\r\n###### Press Enter to reboot... ######");
+        gST->ConIn->Reset(gST->ConIn, FALSE);
+        gBS->WaitForEvent(1, &gST->ConIn->WaitForKey, &Index);
+        gRT->ResetSystem(EfiResetWarm, EFI_SECURITY_VIOLATION, 0, NULL);
+    }
+    else
+    {
+        VtoySleep(5);
+    }
+}
+
+
+STATIC VOID * EFIAPI FindShimFuncAddr(UINT64 FuncOffset)
+{
+    EFI_STATUS Status;
+    SHIM_IMAGE_LOADER *ImgLoader = NULL;
+    EFI_GUID ShimImgLoaderGuid = SHIM_IMAGE_LOADER_GUID;
+
+    Status = gBS->LocateProtocol(&ShimImgLoaderGuid, NULL, (VOID **)&ImgLoader);
+    if (EFI_ERROR(Status) || !ImgLoader || !ImgLoader->LoadImage)
+    {
+        vLog(L"Failed to locate shim image loader protocol %lx %p", Status, ImgLoader);
+        return NULL;
+    }
+
+    if (NM_SHIM_LOAD_IMAGE_OFFSET > FuncOffset)
+    {
+        return (UINT8 *)ImgLoader->LoadImage - (NM_SHIM_LOAD_IMAGE_OFFSET - FuncOffset);
+    }
+    else
+    {
+        return (UINT8 *)ImgLoader->LoadImage + (FuncOffset - NM_SHIM_LOAD_IMAGE_OFFSET);
+    }
+}
+
+
+EFI_STATUS EFIAPI LaunchRealGrub(EFI_HANDLE ImageHandle, CONST CHAR16 *FileName)
+{
+    EFI_STATUS Status;
+    UINTN BufferSize = 0;
+    CHAR16 *DevDpStr = NULL;
+    CHAR16 *NewDpStr = NULL;
+    EFI_HANDLE ChildHandle = NULL;
+    EFI_LOADED_IMAGE_PROTOCOL *Li = NULL;
+    EFI_DEVICE_PATH_PROTOCOL *DeviceDP = NULL;
+    EFI_DEVICE_PATH_PROTOCOL *TargetDp = NULL;
+
+    Status = gBS->HandleProtocol(ImageHandle, &gEfiLoadedImageProtocolGuid, (VOID**)&Li);
+    if (EFI_ERROR(Status))
+    {
+        vLog(L"Failed to locate loaded image protocol %lx", Status);
+        return Status;
+    }
+
+    DeviceDP = DevicePathFromHandle(Li->DeviceHandle);
+    if (!DeviceDP || !IsDevicePathValid(DeviceDP, 0))
+    {
+        vLog(L"Failed to get device path of device handle %p", Li->DeviceHandle);
+        Status = EFI_NOT_FOUND;
+        goto END;
+    }
+
+    DevDpStr = gDpToText->ConvertDevicePathToText(DeviceDP, FALSE, TRUE);
+    if (!DevDpStr)
+    {
+        vLog(L"Failed to convert device path to text");
+        Status = EFI_OUT_OF_RESOURCES;
+        goto END;
+    }
+
+    BufferSize = (StrLen(DevDpStr) + 64) * sizeof(CHAR16);
+    NewDpStr = (CHAR16 *)AllocatePool(BufferSize);
+    if (!NewDpStr)
+    {
+        vLog(L"Failed to alloc new device path string buffer size:%lu", BufferSize);
+        Status = EFI_OUT_OF_RESOURCES;
+        goto END;
+    }
+
+    UnicodeSPrint(NewDpStr, BufferSize, L"%s/EFI/BOOT/%s", DevDpStr, FileName);
+
+    TargetDp = gTextToDp->ConvertTextToDevicePath(NewDpStr);
+    if (!TargetDp)
+    {
+        vLog(L"Failed to convert new text <%s> to device path", NewDpStr);
+        Status = EFI_NOT_FOUND;
+        goto END;
+    }
+
+    Status = gBS->LoadImage(FALSE, ImageHandle, TargetDp, NULL, 0, &ChildHandle);
+    if (EFI_ERROR(Status))
+    {
+        vLog(L"Failed to LoadImage %lx", Status);
+        goto END;
+    }
+
+    Status = gBS->StartImage(ChildHandle, NULL, NULL);
+    if (EFI_ERROR(Status))
+    {
+        vLog(L"Failed to StartImage %lx", Status);
+        gBS->UnloadImage(ChildHandle);
+        goto END;
+    }
+
+END:
+
+    CheckBSFreePool(DevDpStr);
+    CheckFreePool(NewDpStr);
+    CheckBSFreePool(TargetDp);
+
+    return Status;
+}
+
+
+
+STATIC EFI_STATUS EFIAPI ReadAuthFile
+(
+    const EFI_DEVICE_PATH_PROTOCOL *DevicePathConst,
+    VOID **Buffer,
+    UINT32 *Size
+)
+{
+    EFI_STATUS Status;
+    UINTN TmpSize = 0;
+    CHAR16 *DpStr = NULL;
+	EFI_HANDLE Handle = NULL;
+    EFI_DEVICE_PATH *DevPath = NULL;
+    EFI_DEVICE_PATH *TmpPath = NULL;
+	EFI_FILE_IO_INTERFACE *FileIO = NULL;
+	EFI_FILE *File = NULL;
+	EFI_FILE *Root = NULL;
+    UINT8 *FileData = NULL;
+    EFI_FILE_INFO *FInfo = NULL;
+    UINT8 Buf[1024];
+
+	DevPath	= TmpPath = DuplicateDevicePath(DevicePathConst);
+    if (!DevPath)
+    {
+        Status = EFI_OUT_OF_RESOURCES;
+        goto END;
+    }
+
+	Status = gBS->LocateDevicePath(&gEfiSimpleFileSystemProtocolGuid, &DevPath, &Handle);
+    if (EFI_ERROR(Status))
+    {
+        vLog(L"Failed to locate simple file protocol %lx", Status);
+        goto END;
+    }
+
+    DpStr = gDpToText->ConvertDevicePathToText(DevPath, FALSE, TRUE);
+    if (!DpStr)
+    {
+        Status = EFI_OUT_OF_RESOURCES;
+        goto END;
+    }
+
+    Status = gBS->HandleProtocol(Handle, &gEfiSimpleFileSystemProtocolGuid, (VOID **)&FileIO);
+    if (EFI_ERROR(Status))
+    {
+        vLog(L"Failed to handle simple file protocol %lx", Status);
+        goto END;
+    }
+
+    Status = FileIO->OpenVolume(Handle, &Root);
+	if (EFI_ERROR(Status))
+    {
+		vLog(L"Failed to open drive volume (%lx)\n", Status);
+		goto END;
+	}
+
+    Status = Root->Open(Root, &File, DpStr, EFI_FILE_MODE_READ, 0);
+    if (EFI_ERROR(Status))
+    {
+		vLog(L"Failed to open file (%s) (%lx)\n", DpStr, Status);
+		goto END;
+	}
+
+    FInfo = (EFI_FILE_INFO *)Buf;
+    TmpSize = sizeof(Buf);
+    ZeroMem(FInfo, sizeof(EFI_FILE_INFO));
+
+    Status = File->GetInfo(File, &gEfiFileInfoGuid, &TmpSize, FInfo);
+    if (EFI_ERROR(Status) || FInfo->FileSize == 0 || FInfo->FileSize >= 0xFFFFFFFFUL)
+    {
+		vLog(L"Failed to open file (%s) (%lx) Size(%ld)\n", DpStr, Status, (UINTN)FInfo->FileSize);
+		goto END;
+	}
+
+    FileData = AllocatePool(FInfo->FileSize);
+    if (!FileData)
+    {
+        Status = EFI_OUT_OF_RESOURCES;
+        goto END;
+    }
+
+    TmpSize = FInfo->FileSize;
+    Status = File->Read(File, &TmpSize, FileData);
+    if (EFI_ERROR(Status) || TmpSize != (UINTN)FInfo->FileSize)
+    {
+		vLog(L"Failed to read file (%lx) Read:%ld Size:%ld\n", Status, TmpSize, (UINTN)FInfo->FileSize);
+		goto END;
+	}
+
+
+END:
+
+    if (File)
+    {
+        File->Close(File);
+    }
+
+    if (Root)
+    {
+        Root->Close(Root);
+    }
+
+    CheckFreePool(TmpPath);
+    CheckBSFreePool(DpStr);
+
+    if (EFI_ERROR(Status))
+    {
+        CheckFreePool(FileData);
+    }
+    else
+    {
+        *Buffer = FileData;
+        *Size = (UINT32)FInfo->FileSize;
+    }
+
+    return Status;
+}
+
+
+STATIC BOOLEAN VtoyCheckRevoke(VOID *Buffer, UINTN Size)
+{
+    UINT32 uiVer = 0;
+    EFI_IMAGE_DOS_HEADER *DosHead = (EFI_IMAGE_DOS_HEADER *)Buffer;
+
+    if (Size > sizeof(EFI_IMAGE_DOS_HEADER))
+    {
+        if (CompareMem(DosHead->e_res2, &gVtoySbatGUID, 16) == 0)
+        {
+            CopyMem(&uiVer, DosHead->e_res2 + 8, 4);
+            if (uiVer < CUR_SBAT_VER)
+            {
+                vLog(L"Ventoy EFI file revoke (%u < %u)", uiVer, CUR_SBAT_VER);
+                return FALSE;
+            }
+        }
+    }
+
+    return TRUE;
+}
+
+STATIC EFI_STATUS EFIAPI SecurityPolicyAuth
+(
+	const EFI_SECURITY_ARCH_PROTOCOL *This,
+	UINT32 AuthenticationStatus,
+	const EFI_DEVICE_PATH_PROTOCOL *DevicePathConst
+)
+{
+    EFI_STATUS Status;
+    BOOLEAN bRevokeChkOK = TRUE;
+    UINT32 Size = 0;
+    VOID *Buffer = NULL;
+
+    /* Just return OK if the user choose to bypass SB */
+    if (gVtoyByPassSB)
+    {
+        return EFI_SUCCESS;
+    }
+
+    /*
+     * Step 1:
+     * Use original UEFI firmware auth API.
+     * If it's OK, it may be signed with Microsoft UEFI CA. (e.g. bootmgr/shim/...)
+     */
+    if (gSysSecFileAuth)
+    {
+        Status = gSysSecFileAuth(This, AuthenticationStatus, DevicePathConst);
+        if (!EFI_ERROR(Status))
+        {
+            return EFI_SUCCESS;
+        }
+    }
+
+
+    /*
+     * Step 2:
+     * Use shim verify API.
+     * If it's OK, it may be signed with a MOK key. (e.g. Ventoy EFI files)
+     */
+    if (gShimLock && gShimLock->Verify)
+    {
+        Status = ReadAuthFile(DevicePathConst, &Buffer, &Size);
+        if (!EFI_ERROR(Status))
+        {
+            Status = gShimLock->Verify(Buffer, Size);
+            if (!EFI_ERROR(Status))
+            {
+                bRevokeChkOK = VtoyCheckRevoke(Buffer, Size);
+                if (bRevokeChkOK)
+                {
+                    FreePool(Buffer);
+                    return EFI_SUCCESS;
+                }
+            }
+            FreePool(Buffer);
+        }
+    }
+
+    ShowSBWarning(!bRevokeChkOK, DevicePathConst);
+
+    return EFI_SECURITY_VIOLATION;
+}
+
+STATIC EFI_STATUS EFIAPI Security2PolicyAuth
+(
+	const EFI_SECURITY2_ARCH_PROTOCOL *This,
+	const EFI_DEVICE_PATH_PROTOCOL *DevicePath,
+	VOID *FileBuffer,
+	UINTN FileSize,
+	BOOLEAN	BootPolicy
+)
+{
+    EFI_STATUS Status;
+    BOOLEAN bRevokeChkOK = TRUE;
+
+    /* Just return OK if the user choose to bypass SB */
+    if (gVtoyByPassSB)
+    {
+        return EFI_SUCCESS;
+    }
+
+    /*
+     * Step 1:
+     * Use original UEFI firmware auth API.
+     * If it's OK, it may be signed with Microsoft UEFI CA. (e.g. bootmgr/shim/...)
+     */
+    if (gSysSec2FileAuth)
+    {
+        Status = gSysSec2FileAuth(This, DevicePath, FileBuffer, FileSize, BootPolicy);
+        if (!EFI_ERROR(Status))
+        {
+            return EFI_SUCCESS;
+        }
+    }
+
+
+    /*
+     * Step 2:
+     * Use shim verify API.
+     * If it's OK, it may be signed with a MOK key. (e.g. Ventoy EFI files)
+     */
+    if (gShimLock && gShimLock->Verify)
+    {
+        if (FileBuffer && FileSize > 0 && FileSize < 0xFFFFFFFFUL)
+        {
+            Status = gShimLock->Verify(FileBuffer, (UINT32)FileSize);
+            if (!EFI_ERROR(Status))
+            {
+                bRevokeChkOK = VtoyCheckRevoke(FileBuffer, FileSize);
+                if (bRevokeChkOK)
+                {
+                    return EFI_SUCCESS;
+                }
+            }
+        }
+    }
+
+    ShowSBWarning(!bRevokeChkOK, DevicePath);
+
+    return EFI_SECURITY_VIOLATION;
+}
+
+
+STATIC EFI_STATUS EFIAPI HookSecurityPolicy(VOID)
+{
+	EFI_STATUS Status;
+	EFI_STATUS Status2;
+	EFI_SECURITY_ARCH_PROTOCOL *Security = NULL;
+	EFI_SECURITY2_ARCH_PROTOCOL *Security2 = NULL;
+
+	Status = gBS->LocateProtocol(&gEfiSecurityArchProtocolGuid, NULL, (VOID **)&Security);
+	Status2 = gBS->LocateProtocol(&gEfiSecurity2ArchProtocolGuid, NULL, (VOID **)&Security2);
+    if (EFI_ERROR(Status) && EFI_ERROR(Status2))
+    {
+        vLog(L"Failed to locate security or security2 protocol. %lx %lx %p %p",
+             Status, Status2, Security, Security2);
+        return EFI_NOT_FOUND;
+    }
+
+    if (Security2)
+    {
+        gSysSec2FileAuth = Security2->FileAuthentication;
+        Security2->FileAuthentication = Security2PolicyAuth;
+    }
+
+    if (Security)
+    {
+        gSysSecFileAuth = Security->FileAuthenticationState;
+        Security->FileAuthenticationState = SecurityPolicyAuth;
+    }
+
+	return EFI_SUCCESS;
+}
+
+STATIC VOID EFIAPI UnHookSecurityPolicy(VOID)
+{
+	EFI_STATUS Status;
+	EFI_STATUS Status2;
+	EFI_SECURITY_ARCH_PROTOCOL *Security = NULL;
+	EFI_SECURITY2_ARCH_PROTOCOL *Security2 = NULL;
+
+    if (!gSysSec2FileAuth && !gSysSecFileAuth)
+    {
+        return;
+    }
+
+	Status = gBS->LocateProtocol(&gEfiSecurityArchProtocolGuid, NULL, (VOID **)&Security);
+	Status2 = gBS->LocateProtocol(&gEfiSecurity2ArchProtocolGuid, NULL, (VOID **)&Security2);
+    if (EFI_ERROR(Status) && EFI_ERROR(Status2))
+    {
+        vLog(L"Failed to locate security or security2 protocol. %lx %lx %p %p",
+             Status, Status2, Security, Security2);
+        return;
+    }
+
+    if (Security2 && gSysSec2FileAuth)
+    {
+        Security2->FileAuthentication = gSysSec2FileAuth;
+        gSysSec2FileAuth = NULL;
+    }
+
+    if (Security && gSysSecFileAuth)
+    {
+        Security->FileAuthenticationState = gSysSecFileAuth;
+        gSysSecFileAuth = NULL;
+    }
+}
+
+STATIC VOID EFIAPI VtoyByPassSB(VOID)
+{
+    gVtoyByPassSB = TRUE;
+}
+
+STATIC VOID EFIAPI VtoyCheckSB(VOID)
+{
+    gVtoyByPassSB = FALSE;
+}
+
+STATIC VOID EFIAPI UnInstallVtoyShimProtocol(VOID)
+{
+    EFI_GUID Guid = VTOY_SHIM_POLICY_GUID;
+
+    if (gVtoyShimProtHandle)
+    {
+        gBS->UninstallProtocolInterface(gVtoyShimProtHandle, &Guid, &gVtoyShimProtocol);
+        gVtoyShimProtHandle = NULL;
+    }
+}
+
+STATIC EFI_STATUS EFIAPI InstallVtoyShimProtocol(VOID)
+{
+	EFI_STATUS Status;
+    EFI_GUID Guid = VTOY_SHIM_POLICY_GUID;
+    VTOY_SHIM *Prot = NULL;
+
+    gVtoyShimProtocol.ByPassSB = VtoyByPassSB;
+    gVtoyShimProtocol.CheckSB = VtoyCheckSB;
+
+    Status = gBS->LocateProtocol(&Guid, NULL, (VOID**)&Prot);
+    if (!EFI_ERROR(Status))
+    {
+        vLog(L"Ventoy shim already loaded, cannot be nested.");
+        return EFI_ALREADY_STARTED;
+    }
+
+    Status = gBS->InstallProtocolInterface(&gVtoyShimProtHandle, &Guid,
+                    EFI_NATIVE_INTERFACE, &gVtoyShimProtocol);
+    if (EFI_ERROR(Status))
+    {
+        vLog(L"Failed to install protocol %lx", Status);
+    }
+
+    return Status;
+}
+
+STATIC BOOLEAN EFIAPI IsSecureBootEnabled(VOID)
+{
+    UINT8 SecureBoot = 0;
+	UINTN DataSize;
+	EFI_STATUS Status;
+
+	DataSize = sizeof(SecureBoot);
+	Status = gST->RuntimeServices->GetVariable(L"SecureBoot", &gEfiGlobalVariableGuid, NULL,
+				     &DataSize, &SecureBoot);
+	if (EFI_ERROR(Status))
+    {
+        return FALSE;
+    }
+
+	return SecureBoot ? TRUE : FALSE;
+}
+
+STATIC EFI_STATUS EFIAPI EnvInit(VOID)
+{
+    EFI_STATUS Status;
+
+    Status = gBS->LocateProtocol(&gEfiDevicePathToTextProtocolGuid, NULL, (VOID**)&gDpToText);
+	if (EFI_ERROR(Status) || !gDpToText || !gDpToText->ConvertDevicePathToText)
+    {
+        vLog(L"Failed to locate PathToText Protocol %lx", Status);
+        return Status;
+    }
+
+    Status = gBS->LocateProtocol(&gEfiDevicePathFromTextProtocolGuid, NULL, (VOID**)&gTextToDp);
+	if (EFI_ERROR(Status) || !gTextToDp || !gTextToDp->ConvertTextToDevicePath)
+    {
+        vLog(L"Failed to locate PathFromText Protocol %lx", Status);
+        return Status;
+    }
+
+    return EFI_SUCCESS;
+}
+
+
+EFI_STATUS EFIAPI VtoyShimEfiMain
+(
+    IN EFI_HANDLE         ImageHandle,
+    IN EFI_SYSTEM_TABLE  *SystemTable
+)
+{
+    EFI_STATUS Status;
+    EFI_GUID Guid = SHIM_LOCK_GUID;
+    unhook_system_services_pf Func = NULL;
+
+    Status = EnvInit();
+    if (EFI_ERROR(Status))
+    {
+        vErr(L"Failed to prepare env");
+        return Status;
+    }
+
+    /* If secure boot is not enabled, nothing needed, just launch Ventoy grub */
+    if (!IsSecureBootEnabled())
+    {
+        Status = LaunchRealGrub(ImageHandle, REAL_GRUB_FILE);
+        if (EFI_ERROR(Status))
+        {
+            vErr(L"Failed to launch %s", REAL_GRUB_FILE);
+        }
+        return Status;
+    }
+
+    Status = gBS->LocateProtocol(&Guid, NULL, (VOID**)&gShimLock);
+    if (EFI_ERROR(Status) || !gShimLock)
+    {
+        vErr(L"Failed to locate SHIM LOCK Protocol %lx", Status);
+        return Status;
+    }
+
+
+    Status = InstallVtoyShimProtocol();
+    if (EFI_ERROR(Status))
+    {
+        vErr(L"Failed to install ventoy shim protocol");
+        return Status;
+    }
+
+
+    /*
+     * IMPORTANT: All recent shim implementations hook the UEFI Boot Services
+     * (e.g. LoadImage, StartImage) to enforce signature verification.
+     *
+     * We must restore the original system service pointers here. If we fail to do this,
+     * we will be unable to launch Ventoy-signed EFI binaries or any other unsigned
+     * EFI applications later, even when the user has explicitly opted to disable
+     * all Secure Boot validation checks.
+     *
+     * To the best of my knowledge, there is no official way to remove these hooks.
+     * This is a tricky hack that relies on shim's internal implementation details.
+     * It may break in future versions of shim, and a better approach may exist.
+     *
+     */
+    Func = FindShimFuncAddr(NM_UNHOOK_SYSTEM_SERVICES_OFFSET);
+    if (!Func)
+    {
+        vErr(L"Can not find shim unhook_system_services");
+        Status = EFI_NOT_FOUND;
+        goto END;
+    }
+
+    Func(); /* call shim unhook_system_services() */
+
+
+    /* Hook the system security policy */
+    Status = HookSecurityPolicy();
+    if (EFI_ERROR(Status))
+    {
+        vErr(L"Failed to hook system security policy");
+        goto END;
+    }
+
+    /* Finally launch Ventoy grub */
+    Status = LaunchRealGrub(ImageHandle, REAL_GRUB_FILE);
+    if (EFI_ERROR(Status))
+    {
+        vErr(L"Failed to finally launch real grub %s", REAL_GRUB_FILE);
+        goto END;
+    }
+
+END:
+
+    /* UnHook system security policy */
+    UnHookSecurityPolicy();
+
+    UnInstallVtoyShimProtocol();
+
+    return Status;
+}
+

EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyShim/VtoyShim.h

@@ -0,0 +1,121 @@
+/******************************************************************************
+ * VtoyShim.h
+ *
+ * Copyright (c) 2017 - 2018, Intel Corporation. All rights reserved.<BR>
+ * SPDX-License-Identifier: BSD-2-Clause-Patent
+ *
+ */
+
+#ifndef __VTOYSHIM_H__
+#define __VTOYSHIM_H__
+
+#if defined (MDE_CPU_IA32)
+#define REAL_GRUB_FILE    L"grubia32_real.efi"
+#elif defined (MDE_CPU_X64)
+#define REAL_GRUB_FILE    L"grubx64_real.efi"
+#elif defined (MDE_CPU_AARCH64)
+#define REAL_GRUB_FILE    L"grubaa64_real.efi"
+#else
+#error "Not supported now"
+#endif
+
+
+/* The following definations are copied from shim source code */
+
+#define SHIM_LOCK_GUID  {0x605dab50, 0xe046, 0x4300, {0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23 } };
+
+typedef
+EFI_STATUS
+(*EFI_SHIM_LOCK_VERIFY) (
+	IN VOID *buffer,
+	IN UINT32 size
+	);
+
+typedef
+EFI_STATUS
+(*EFI_SHIM_LOCK_HASH) (
+	IN char *data,
+	IN int datasize,
+	PE_COFF_LOADER_IMAGE_CONTEXT *context,
+	UINT8 *sha256hash,
+	UINT8 *sha1hash
+	);
+
+typedef
+EFI_STATUS
+(*EFI_SHIM_LOCK_CONTEXT) (
+	IN VOID *data,
+	IN unsigned int datasize,
+	PE_COFF_LOADER_IMAGE_CONTEXT *context
+	);
+
+typedef struct _SHIM_LOCK {
+	EFI_SHIM_LOCK_VERIFY Verify;
+	EFI_SHIM_LOCK_HASH Hash;
+	EFI_SHIM_LOCK_CONTEXT Context;
+} SHIM_LOCK;
+
+
+
+#define SHIM_IMAGE_LOADER_GUID {0x1f492041, 0xfadb, 0x4e59, {0x9e, 0x57, 0x7c, 0xaf, 0xe7, 0x3a, 0x55, 0xab } }
+
+typedef struct _SHIM_IMAGE_LOADER {
+	EFI_IMAGE_LOAD LoadImage;
+	EFI_IMAGE_START StartImage;
+	EFI_EXIT Exit;
+	EFI_IMAGE_UNLOAD UnloadImage;
+} SHIM_IMAGE_LOADER;
+
+typedef VOID (*unhook_system_services_pf)(VOID);
+
+
+/*
+ * The two offset here are extract from the shim file which used in Ventoy.
+ * nm BOOTX64.EFI | grep shim_load_image
+ * nm BOOTX64.EFI | grep unhook_system_services
+ *
+ * It means that they must be updated every time Ventoy update the shim file.
+ *
+ */
+#define NM_SHIM_LOAD_IMAGE_OFFSET             0x2dc12
+#define NM_UNHOOK_SYSTEM_SERVICES_OFFSET      0x2e278
+
+
+
+
+#define VtoySleep(sec)      gBS->Stall(1000000 * (sec))
+#define vLog(fmt, ...)      VtoyLog(fmt "\r\n", ##__VA_ARGS__)
+#define vErr(fmt, ...)      VtoyLog(fmt "\r\n", ##__VA_ARGS__); VtoySleep(5)
+
+#define CheckFreePool(p) \
+do { \
+    if (p) { \
+        FreePool(p); \
+        (p) = NULL; \
+    }\
+} while (0)
+
+#define CheckBSFreePool(p) \
+do { \
+    if (p) { \
+        gBS->FreePool(p); \
+        (p) = NULL; \
+    }\
+} while (0)
+
+
+
+#define VTOY_SHIM_POLICY_GUID    {0x90a29d14, 0x3968, 0x48fe, { 0x85, 0x81, 0x6b, 0x7f, 0x7d, 0xc4, 0x70, 0x55 }};
+
+
+typedef VOID (EFIAPI *VTOY_BYPASS_SB)(VOID);
+typedef VOID (EFIAPI *VTOY_CHECK_SB)(VOID);
+typedef struct _VTOY_SHIM{
+	VTOY_BYPASS_SB ByPassSB;
+	VTOY_BYPASS_SB CheckSB;
+} VTOY_SHIM;
+
+CONST UINT8 * ventoy_get_der_data(UINT32 *Len);
+
+#endif
+

EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyShim/VtoyShim.inf

@@ -0,0 +1,83 @@
+#************************************************************************************
+# Copyright (c) 2026, longpanda <admin@ventoy.net>
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, see <http://www.gnu.org/licenses/>.
+#
+#************************************************************************************
+
+[Defines]
+  INF_VERSION                    = 0x00010005
+  BASE_NAME                      = VtoyShim
+  FILE_GUID                      = 6d7c7406-b32c-461f-8454-ddaa5243d93d
+  MODULE_TYPE                    = UEFI_APPLICATION
+  VERSION_STRING                 = 1.0
+  ENTRY_POINT                    = VtoyShimEfiMain
+  
+[BuildOptions]
+  # Force standard GNU ld to pack and align ELF segments to 4KB page boundaries
+  GCC:*_*_*_DLINK_FLAGS = -Wl,-z,common-page-size=0x1000 -Wl,-z,max-page-size=0x1000
+
+[Sources]
+  VtoyShim.h
+  VtoyShim.c
+  
+[Packages]
+  MdePkg/MdePkg.dec
+  MdeModulePkg/MdeModulePkg.dec
+  ShellPkg/ShellPkg.dec
+
+[LibraryClasses]
+  UefiApplicationEntryPoint
+  UefiLib
+  DevicePathLib
+  DebugLib
+
+[Guids]
+  gEfiGlobalVariableGuid
+  gShellVariableGuid
+  gEfiVirtualCdGuid
+  gEfiFileInfoGuid
+
+[Protocols]
+  gEfiSecurityArchProtocolGuid
+  gEfiSecurity2ArchProtocolGuid
+  gEfiLoadedImageProtocolGuid
+  gEfiBlockIoProtocolGuid
+  gEfiDevicePathProtocolGuid
+  gEfiDevicePathToTextProtocolGuid
+  gEfiDevicePathFromTextProtocolGuid
+  gEfiSimpleFileSystemProtocolGuid
+  gEfiRamDiskProtocolGuid
+  gEfiAbsolutePointerProtocolGuid
+  gEfiAcpiTableProtocolGuid
+  gEfiBlockIo2ProtocolGuid
+  gEfiBusSpecificDriverOverrideProtocolGuid
+  gEfiComponentNameProtocolGuid
+  gEfiComponentName2ProtocolGuid
+  gEfiDriverBindingProtocolGuid
+  gEfiDiskIoProtocolGuid
+  gEfiDiskIo2ProtocolGuid
+  gEfiGraphicsOutputProtocolGuid
+  gEfiHiiConfigAccessProtocolGuid
+  gEfiHiiFontProtocolGuid
+  gEfiLoadFileProtocolGuid
+  gEfiLoadFile2ProtocolGuid
+  gEfiLoadedImageProtocolGuid
+  gEfiLoadedImageDevicePathProtocolGuid
+  gEfiPciIoProtocolGuid
+  gEfiSerialIoProtocolGuid
+  gEfiSimpleTextInProtocolGuid
+  gEfiSimpleTextInputExProtocolGuid
+  gEfiSimpleTextOutProtocolGuid
+

EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyShim/sbat.csv

@@ -0,0 +1,2 @@
+sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
+ventoy-shim,1,Ventoy,ventoy-shim,1.0,https://www.ventoy.net/

EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyUtil/VtoyUtil.c

@@ -145,6 +145,32 @@ STATIC EFI_STATUS ParseCmdline(IN EFI_HANDLE ImageHandle)
     return EFI_SUCCESS;
 }
 
+#if defined (MDE_CPU_X64)
+STATIC BOOLEAN EFIAPI CheckVtoyShim(VOID)
+{
+    UINT8 SecureBoot = 0;
+	UINTN DataSize;
+	EFI_STATUS Status;
+    EFI_GUID Guid = VTOY_SHIM_POLICY_GUID;
+    VOID *Prot = NULL;
+
+	DataSize = sizeof(SecureBoot);
+	Status = gST->RuntimeServices->GetVariable(L"SecureBoot", &gEfiGlobalVariableGuid, NULL,
+				     &DataSize, &SecureBoot);
+	if (!EFI_ERROR(Status) && SecureBoot)
+    {
+        Status = gBS->LocateProtocol(&Guid, NULL, (VOID**)&Prot);
+        if (EFI_ERROR(Status))
+        {
+            gST->ConOut->OutputString(gST->ConOut, L"Can not locate Vtoy Shim\r\n");
+            return FALSE;
+        }
+    }
+
+    return TRUE;
+}
+#endif
+
 EFI_STATUS EFIAPI VtoyUtilEfiMain
 (
     IN EFI_HANDLE         ImageHandle,
@@ -154,6 +180,15 @@ EFI_STATUS EFIAPI VtoyUtilEfiMain
     UINTN i;
     UINTN Len;
 
+#if defined (MDE_CPU_X64)
+    /* check that Ventoy Shim must exist */
+    if (!CheckVtoyShim())
+    {
+        gBS->Stall(5 * 1000000);
+        return EFI_NOT_FOUND;
+    }
+#endif
+
     ParseCmdline(ImageHandle);
 
     for (i = 0; gCurFeature && i < ARRAY_SIZE(gFeatureList); i++)

EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyUtil/VtoyUtil.h

@@ -21,6 +21,8 @@
 #ifndef __VTOYUTIL_H__
 #define __VTOYUTIL_H__
 
+#define VTOY_SHIM_POLICY_GUID    {0x90a29d14, 0x3968, 0x48fe, { 0x85, 0x81, 0x6b, 0x7f, 0x7d, 0xc4, 0x70, 0x55 }};
+
 #pragma pack(1)
 
 typedef EFI_STATUS (*VTOY_UTIL_PROC_PF)(IN EFI_HANDLE ImageHandle, IN CONST CHAR16 *CmdLine);

EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyUtil/VtoyUtil.inf

@@ -24,6 +24,9 @@
   VERSION_STRING                 = 1.0
   ENTRY_POINT                    = VtoyUtilEfiMain
  
+[BuildOptions]
+  # Force standard GNU ld to pack and align ELF segments to 4KB page boundaries
+  GCC:*_*_*_DLINK_FLAGS = -Wl,-z,common-page-size=0x1000 -Wl,-z,max-page-size=0x1000
 
 [Sources]
   VtoyUtil.h

EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/MdeModulePkg.dsc

@@ -205,6 +205,7 @@
 [Components]
   MdeModulePkg/Application/Ventoy/Ventoy.inf
   MdeModulePkg/Application/VtoyUtil/VtoyUtil.inf
+  MdeModulePkg/Application/VtoyShim/VtoyShim.inf
   MdeModulePkg/Application/VDiskChain/VDiskChain.inf
   MdeModulePkg/Application/HelloWorld/HelloWorld.inf
   MdeModulePkg/Application/DumpDynPcd/DumpDynPcd.inf

GRUB2/MOD_SRC/grub-2.04/grub-core/kern/corecmd.c

@@ -0,0 +1,195 @@
+/* corecmd.c - critical commands which are registered in kernel */
+/*
+ *  GRUB  --  GRand Unified Bootloader
+ *  Copyright (C) 2009  Free Software Foundation, Inc.
+ *
+ *  GRUB is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  GRUB is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <grub/mm.h>
+#include <grub/dl.h>
+#include <grub/err.h>
+#include <grub/env.h>
+#include <grub/misc.h>
+#include <grub/term.h>
+#include <grub/file.h>
+#include <grub/device.h>
+#include <grub/command.h>
+#include <grub/i18n.h>
+
+/* set ENVVAR=VALUE */
+static grub_err_t
+grub_core_cmd_set (struct grub_command *cmd __attribute__ ((unused)),
+		   int argc, char *argv[])
+{
+  char *var;
+  char *val;
+
+  if (argc < 1)
+    {
+      struct grub_env_var *env;
+      FOR_SORTED_ENV (env)
+	grub_printf ("%s=%s\n", env->name, grub_env_get (env->name));
+      return 0;
+    }
+
+  var = argv[0];
+  val = grub_strchr (var, '=');
+  if (! val)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, "not an assignment");
+
+  val[0] = 0;
+  grub_env_set (var, val + 1);
+  val[0] = '=';
+
+  return 0;
+}
+
+static grub_err_t
+grub_core_cmd_unset (struct grub_command *cmd __attribute__ ((unused)),
+		     int argc, char *argv[])
+{
+  if (argc < 1)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT,
+		       N_("one argument expected"));
+
+  grub_env_unset (argv[0]);
+  return 0;
+}
+
+/* insmod MODULE */
+static grub_err_t
+grub_core_cmd_insmod (struct grub_command *cmd __attribute__ ((unused)),
+		      int argc, char *argv[])
+{
+  grub_dl_t mod;
+
+  if (argc == 0)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("one argument expected"));
+
+  /* For simple, just disable insmod when SecureBoot is enabled. */
+  if (g_sys_sb && g_sb_policy == VTOY_SB_POLICY_CHECK)
+  {
+      return grub_error (GRUB_ERR_BAD_SIGNATURE, "Cannot insmod when SecureBoot is enabled and Policy is check.");
+  }
+
+  if (argv[0][0] == '/' || argv[0][0] == '(' || argv[0][0] == '+')
+    mod = grub_dl_load_file (argv[0]);
+  else
+    mod = grub_dl_load (argv[0]);
+
+  if (mod)
+    grub_dl_ref (mod);
+
+  return 0;
+}
+
+static int
+grub_mini_print_devices (const char *name, void *data __attribute__ ((unused)))
+{
+  grub_printf ("(%s) ", name);
+
+  return 0;
+}
+
+static int
+grub_mini_print_files (const char *filename,
+		       const struct grub_dirhook_info *info,
+		       void *data __attribute__ ((unused)))
+{
+  grub_printf ("%s%s ", filename, info->dir ? "/" : "");
+
+  return 0;
+}
+
+/* ls [ARG] */
+static grub_err_t
+grub_core_cmd_ls (struct grub_command *cmd __attribute__ ((unused)),
+		  int argc, char *argv[])
+{
+  if (argc < 1)
+    {
+      grub_device_iterate (grub_mini_print_devices, NULL);
+      grub_xputs ("\n");
+      grub_refresh ();
+    }
+  else
+    {
+      char *device_name;
+      grub_device_t dev = 0;
+      grub_fs_t fs;
+      char *path;
+
+      device_name = grub_file_get_device_name (argv[0]);
+      if (grub_errno)
+	goto fail;
+      dev = grub_device_open (device_name);
+      if (! dev)
+	goto fail;
+
+      fs = grub_fs_probe (dev);
+      path = grub_strchr (argv[0], ')');
+      if (! path)
+	path = argv[0];
+      else
+	path++;
+
+      if (! *path && ! device_name)
+	{
+	  grub_error (GRUB_ERR_BAD_ARGUMENT, "invalid argument");
+	  goto fail;
+	}
+
+      if (! *path)
+	{
+	  if (grub_errno == GRUB_ERR_UNKNOWN_FS)
+	    grub_errno = GRUB_ERR_NONE;
+
+	  grub_printf ("(%s): Filesystem is %s.\n",
+		       device_name, fs ? fs->name : "unknown");
+	}
+      else if (fs)
+	{
+	  (fs->fs_dir) (dev, path, grub_mini_print_files, NULL);
+	  grub_xputs ("\n");
+	  grub_refresh ();
+	}
+
+    fail:
+      if (dev)
+	grub_device_close (dev);
+
+      grub_free (device_name);
+    }
+
+  return grub_errno;
+}
+
+void
+grub_register_core_commands (void)
+{
+  grub_command_t cmd;
+  cmd = grub_register_command ("set", grub_core_cmd_set,
+			       N_("[ENVVAR=VALUE]"),
+			       N_("Set an environment variable."));
+  if (cmd)
+    cmd->flags |= GRUB_COMMAND_FLAG_EXTRACTOR;
+  grub_register_command ("unset", grub_core_cmd_unset,
+			 N_("ENVVAR"),
+			 N_("Remove an environment variable."));
+  grub_register_command ("ls", grub_core_cmd_ls,
+			 N_("[ARG]"), N_("List devices or files."));
+  grub_register_command ("insmod", grub_core_cmd_insmod,
+			 N_("MODULE"), N_("Insert a module."));
+}

GRUB2/MOD_SRC/grub-2.04/grub-core/kern/disk.c

@@ -466,6 +466,37 @@ grub_err_t grub_disk_blocklist_read(void *chunklist, grub_uint64_t sector,
     return 0;
 }
 
+grub_err_t grub_disk_blocklist_read2(grub_disk_t disk, grub_uint64_t sector, 
+    grub_uint64_t size, char *buf)
+{
+    ventoy_img_chunk_list *chunk_list = (ventoy_img_chunk_list *)(disk->read_hook_data);
+
+    if (buf < chunk_list->buf || buf >= chunk_list->buf + VTOY_CHUNK_BUF_SIZE)
+    {
+        return 2;
+    }
+
+    if ((chunk_list->buf + chunk_list->last_off) != buf)
+    {
+        chunk_list->err_code = VTOY_CHUNK_ERR_NOT_FLAT;
+        return 0;
+    }
+
+    if (chunk_list->last_off + size > VTOY_CHUNK_BUF_SIZE)
+    {
+        chunk_list->err_code = VTOY_CHUNK_ERR_OVER_FLOW;
+        return 0;
+    }
+
+    chunk_list->last_off += (grub_uint32_t)size;
+    if (chunk_list->last_off == VTOY_CHUNK_BUF_SIZE)
+    {
+        chunk_list->last_off = 0;
+    }
+
+    return grub_disk_blocklist_read(chunk_list, sector, size, disk->log_sector_size);
+}
+
 /* Read data from the disk.  */
 grub_err_t
 grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector,
@@ -475,6 +506,14 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector,
     {
         return grub_disk_blocklist_read((ventoy_img_chunk_list *)disk->read_hook_data, sector, size, disk->log_sector_size);
     }
+    else if (disk->read_hook == (grub_disk_read_hook_t)(void *)grub_disk_blocklist_read2)
+    {
+        grub_err_t rv = grub_disk_blocklist_read2(disk, sector, size, (char *)buf);
+        if (rv != 2)
+        {
+            return rv;
+        }
+    }
 
   /* First of all, check if the region is within the disk.  */
   if (grub_disk_adjust_range (disk, &sector, &offset, size) != GRUB_ERR_NONE)

GRUB2/MOD_SRC/grub-2.04/grub-core/kern/env.c

@@ -22,6 +22,9 @@
 #include <grub/misc.h>
 #include <grub/mm.h>
 
+grub_uint8_t g_sys_sb = 0;
+grub_uint8_t g_sb_policy = VTOY_SB_POLICY_BYPASS;
+
 /* The initial context.  */
 static struct grub_env_context initial_context;
 

GRUB2/MOD_SRC/grub-2.04/grub-core/loader/i386/linux.c

@@ -35,6 +35,8 @@
 #include <grub/i18n.h>
 #include <grub/lib/cmdline.h>
 #include <grub/linux.h>
+#include <grub/time.h>
+#include <grub/env.h>
 #include <grub/machine/kernel.h>
 
 GRUB_MOD_LICENSE ("GPLv3+");
@@ -750,6 +752,16 @@ grub_linux_boot (void)
   grub_size_t mmap_size;
   grub_size_t cl_offset;
 
+  /* To be simple, just deny to boot linux kernel when SecureBoot is enabled and Policy is check */
+  if (g_sys_sb && g_sb_policy == VTOY_SB_POLICY_CHECK)
+  {
+      grub_printf("\n\n ######### Can not do linux boot in SecureBoot Policy Check #######\n\n");
+      grub_refresh();
+      grub_sleep(5);
+      grub_errno = GRUB_ERR_BAD_SIGNATURE;
+      return 0;
+  }
+
   ventoy_preboot();
 
 #ifdef GRUB_MACHINE_IEEE1275

GRUB2/MOD_SRC/grub-2.04/grub-core/normal/menu.c

@@ -1134,6 +1134,7 @@ show_menu (grub_menu_t menu, int nested, int autobooted)
   while (1)
     {
       int ndown;
+      char *pos = NULL;
       int boot_entry;
       grub_menu_entry_t e;
       int auto_boot;
@@ -1176,14 +1177,27 @@ show_menu (grub_menu_t menu, int nested, int autobooted)
 
       if (2 == e->argc && e->args && e->args[1] && grub_strncmp(e->args[1], "VTOY_RUN_RET", 12) == 0)
         break;
-      else if (2 == e->argc && e->args && e->args[1] && grub_strncmp(e->args[1], "VTOY_RUN_SET", 12) == 0) {        
+      else if (2 == e->argc && e->args && e->args[1] && grub_strncmp(e->args[1], "VTOY_RUN_SET_", 13) == 0) {
-        ndown = (int)grub_strtol(e->args[1] + 12, NULL, 10);
+        pos = NULL;
+        ndown = (int)grub_strtol(e->args[1] + 13, &pos, 10);
         while (ndown > 0)
         {
             ventoy_menu_push_key(GRUB_TERM_KEY_DOWN);
             ndown--;
         }
+
         ventoy_menu_push_key('\n');
+
+        if (pos && *pos == '_')
+        {
+            ndown = (int)grub_strtol(pos + 1, NULL, 10);
+            while (ndown > 0)
+            {
+                ventoy_menu_push_key(GRUB_TERM_KEY_DOWN);
+                ndown--;
+            }
+        }
+
         break;
       }
     }

GRUB2/MOD_SRC/grub-2.04/grub-core/ventoy/ventoy.c

@@ -49,6 +49,10 @@ int g_ventoy_debug = 0;
 static int g_efi_os = 0xFF;
 grub_uint32_t g_ventoy_plat_data;
 
+#ifdef GRUB_MACHINE_EFI
+static VTOY_SHIM *g_vtoy_shim = NULL;
+#endif
+
 void ventoy_debug(const char *fmt, ...)
 {
     va_list args;
@@ -298,9 +302,119 @@ void ventoy_memfile_env_set(const char *prefix, const void *buf, unsigned long l
     return;
 }
 
+#ifdef GRUB_MACHINE_EFI
+static void ventoy_get_uefi_version(char *str, grub_size_t len)
+{
+    grub_efi_uint8_t uefi_minor_1, uefi_minor_2;
+
+    uefi_minor_1 = (grub_efi_system_table->hdr.revision & 0xffff) / 10;
+    uefi_minor_2 = (grub_efi_system_table->hdr.revision & 0xffff) % 10;
+    grub_snprintf(str, len, "%d.%d", (grub_efi_system_table->hdr.revision >> 16), uefi_minor_1);
+    if (uefi_minor_2)
+        grub_snprintf(str, len, "%s.%d", str, uefi_minor_2);
+}
+
+int ventoy_set_sb_policy(void)
+{
+    const char *env = NULL;
+    static int set_once = 0;
+
+    /* no need when SecureBoot is disabled */
+    if (g_sys_sb == 0)
+    {
+        return 0;
+    }
+
+    /* can only set once */
+    if (set_once > 0)
+    {
+        return 0;
+    }
+    set_once = 1;
+
+    /* VTOY_SECURE_BOOT_POLICY only take affect once during init */
+    env = grub_env_get("VTOY_SECURE_BOOT_POLICY");
+    if (env)
+    {
+        g_sb_policy = (grub_uint8_t)(env[0] - '0');
+    }
+
+    if (g_sb_policy == VTOY_SB_POLICY_BYPASS)
+    {
+        if (g_vtoy_shim && g_vtoy_shim->ByPassSB)
+        {
+            g_vtoy_shim->ByPassSB();
+        }
+    }
+    else if (g_sb_policy == VTOY_SB_POLICY_CHECK)
+    {
+        if (g_vtoy_shim && g_vtoy_shim->CheckSB)
+        {
+            g_vtoy_shim->CheckSB();
+        }
+    }
+
+    return 0;
+}
+
+static void ventoy_get_uefi_sb(void)
+{
+    grub_uint8_t *var = NULL;
+    grub_size_t size = 0;
+    grub_efi_guid_t global = GRUB_EFI_GLOBAL_VARIABLE_GUID;
+
+    var = grub_efi_get_variable("SecureBoot", &global, &size);
+    if (var && size == 1 && *var == 1)
+    {
+        g_sys_sb = 1;
+    }
+
+    grub_check_free(var);
+}
+
+static int ventoy_secure_boot_init(void)
+{
+    grub_efi_guid_t ProtGuid = VTOY_SHIM_POLICY_GUID;
+
+    ventoy_get_uefi_sb();
+
+    if (g_sys_sb == 0)
+    {
+        return 0;
+    }
+
+
+    /*
+     * When SecureBoot enabled, Ventoy grub must be launched by Ventoy Shim.
+     * Currently only x86_64 support this feature.
+     */
+    if (g_ventoy_plat_data == VTOY_PLAT_X86_64_UEFI)
+    {
+        g_vtoy_shim = grub_efi_locate_protocol(&ProtGuid, NULL);
+        if (g_vtoy_shim == NULL || g_vtoy_shim->ByPassSB == NULL || g_vtoy_shim->CheckSB == NULL)
+        {
+            grub_cls();
+            grub_printf(VTOY_WARNING"\n");
+            grub_printf(VTOY_WARNING"\n");
+            grub_printf(VTOY_WARNING"\n\n\n");
+
+            grub_printf("Ventoy grub is not launched by Ventoy shim.\n\n");
+            grub_refresh();
+
+            ventoy_prompt_end();
+        }
+    }
+
+    return 0;
+}
+
+
+#endif
+
 static int ventoy_arch_mode_init(void)
 {
     #ifdef GRUB_MACHINE_EFI
+
     if (grub_strcmp(GRUB_TARGET_CPU, "i386") == 0)
     {
         g_ventoy_plat_data = VTOY_PLAT_I386_UEFI;
@@ -329,19 +443,6 @@ static int ventoy_arch_mode_init(void)
     return 0;
 }
 
-#ifdef GRUB_MACHINE_EFI
-static void ventoy_get_uefi_version(char *str, grub_size_t len)
-{
-    grub_efi_uint8_t uefi_minor_1, uefi_minor_2;
-
-    uefi_minor_1 = (grub_efi_system_table->hdr.revision & 0xffff) / 10;
-    uefi_minor_2 = (grub_efi_system_table->hdr.revision & 0xffff) % 10;
-    grub_snprintf(str, len, "%d.%d", (grub_efi_system_table->hdr.revision >> 16), uefi_minor_1);
-    if (uefi_minor_2)
-        grub_snprintf(str, len, "%s.%d", str, uefi_minor_2);
-}
-#endif
-
 static int ventoy_calc_totalmem(grub_uint64_t addr, grub_uint64_t size, grub_memory_type_t type, void *data)
 {
     grub_uint64_t *total_mem = (grub_uint64_t *)data;
@@ -431,11 +532,12 @@ int ventoy_global_var_init(void)
 
 static ctrl_var_cfg g_ctrl_vars[] =
 {
-    { "VTOY_WIN11_BYPASS_CHECK",  1 },
+    { "VTOY_WIN11_BYPASS_CHECK",  "1" },
-    { "VTOY_WIN11_BYPASS_NRO",    1 },
+    { "VTOY_WIN11_BYPASS_NRO",    "1" },
-    { "VTOY_LINUX_REMOUNT",       0 },
+    { "VTOY_LINUX_REMOUNT",       "0" },
-    { "VTOY_SECONDARY_BOOT_MENU", 1 },
+    { "VTOY_SECONDARY_BOOT_MENU", "1" },
-    { NULL, 0 }
+    { "VTOY_WIN_UEFI_RES_LOCK",   "3" },
+    { NULL, "" }
 };
 
 static const char * ventoy_ctrl_var_read_hook(struct grub_env_var *var, const char *val)
@@ -446,7 +548,7 @@ static const char * ventoy_ctrl_var_read_hook(struct grub_env_var *var, const ch
     {
         if (grub_strcmp(g_ctrl_vars[i].name, var->name) == 0)
         {
-            return g_ctrl_vars[i].value ? "1" : "0";
+            return g_ctrl_vars[i].szval;
         }
     }
 
@@ -461,14 +563,14 @@ static char * ventoy_ctrl_var_write_hook(struct grub_env_var *var, const char *v
     {
         if (grub_strcmp(g_ctrl_vars[i].name, var->name) == 0)
         {
-            if (val && val[0] == '1' && val[1] == 0)
+            if (val && grub_isdigit(val[0]) && val[1] == 0)
             {
-                g_ctrl_vars[i].value = 1;
+                g_ctrl_vars[i].szval[0] = val[0];
-                return grub_strdup("1");
+                return grub_strdup(val);
             }
             else
             {
-                g_ctrl_vars[i].value = 0;
+                g_ctrl_vars[i].szval[0] = '0';
                 return grub_strdup("0");
             }
         }
@@ -479,12 +581,13 @@ static char * ventoy_ctrl_var_write_hook(struct grub_env_var *var, const char *v
 
 int ventoy_ctrl_var_init(void)
 {
-    int i;
+    ctrl_var_cfg *cfg = g_ctrl_vars;
 
-    for (i = 0; g_ctrl_vars[i].name; i++)
+    while (cfg->name)
     {
-        ventoy_env_export(g_ctrl_vars[i].name, g_ctrl_vars[i].value ? "1" : "0");
+        ventoy_env_export(cfg->name, cfg->szval);
-        grub_register_variable_hook(g_ctrl_vars[i].name, ventoy_ctrl_var_read_hook, ventoy_ctrl_var_write_hook);
+        grub_register_variable_hook(cfg->name, ventoy_ctrl_var_read_hook, ventoy_ctrl_var_write_hook);
+        cfg++;
     }
 
     return 0;
@@ -495,6 +598,11 @@ GRUB_MOD_INIT(ventoy)
     ventoy_hwinfo_init();
     ventoy_env_init();
     ventoy_arch_mode_init();
+
+#ifdef GRUB_MACHINE_EFI
+    ventoy_secure_boot_init();
+#endif
+
     ventoy_register_all_cmd();
 }
 

GRUB2/MOD_SRC/grub-2.04/grub-core/ventoy/ventoy_cmd.c

@@ -202,6 +202,10 @@ int ventoy_get_fs_type(const char *fs)
     {
         return ventoy_fs_fat;
     }
+    else if (grub_strncmp(fs, "btrfs", 5) == 0)
+    {
+        return ventoy_fs_btrfs;
+    }
 
     return ventoy_fs_max;
 }
@@ -1696,7 +1700,7 @@ static int ventoy_vlnk_probe_fs(ventoy_vlnk_part *cur)
 {
     const char *fs[ventoy_fs_max + 1] =
     {
-        "exfat", "ntfs", "ext2", "xfs", "udf", "fat", NULL
+        "exfat", "ntfs", "ext2", "xfs", "udf", "fat", "btrfs", NULL
     };
 
     if (!cur->dev)
@@ -3241,6 +3245,25 @@ void ventoy_fill_os_param(grub_file_t file, ventoy_os_param *param)
     param->vtoy_reserved[6] = file->vlnk;
     grub_memcpy(param->vtoy_reserved + 7, g_ventoy_part_info->MBR.BootCode + 0x1b8, 4);
 
+
+    /* Windows UEFI force resolution lock */
+    if (g_ventoy_chain_type == 1) /* Windows */
+    {
+        val = ventoy_get_env("VTOY_WIN_UEFI_RES_LOCK");
+        if (val && val[1] == 0)
+        {
+            if (val[0] == '1')
+            {
+                param->vtoy_reserved[11] = 1;
+            }
+            else if (val[0] == '2')
+            {
+                param->vtoy_reserved[11] = 2;
+            }
+        }
+    }
+
+
     /* calculate checksum */
     for (i = 0; i < sizeof(ventoy_os_param); i++)
     {
@@ -3251,13 +3274,49 @@ void ventoy_fill_os_param(grub_file_t file, ventoy_os_param *param)
     return;
 }
 
-int ventoy_check_block_list(grub_file_t file, ventoy_img_chunk_list *chunklist, grub_disk_addr_t start)
+static const char* g_chunk_err_msg[VTOY_CHUNK_ERR_MAX] =
+{
+    "success",
+    "File system use more than 1 disks! (maybe RAID)",
+    "File system enable RAID feature, this is NOT supported!",
+    "File is compressed in disk, this is not supported!",
+    "File not flat in disk! (maybe compressed)",
+    "Read buffer overflow!",
+};
+
+static const char * ventoy_get_chunk_err_msg(grub_uint32_t err)
+{
+    if (err < VTOY_CHUNK_ERR_MAX)
+    {
+        return g_chunk_err_msg[err];
+    }
+
+    return "XXXX";
+}
+
+int ventoy_check_block_list(grub_file_t file, ventoy_img_chunk_list *chunklist,
+grub_disk_addr_t start, char *err, grub_uint32_t len)
 {
     grub_uint32_t i = 0;
     grub_uint64_t total = 0;
     grub_uint64_t fileblk = 0;
     ventoy_img_chunk *chunk = NULL;
 
+    if (chunklist->err_code)
+    {
+        if (err)
+        {
+            grub_snprintf(err, len, "%s", ventoy_get_chunk_err_msg(chunklist->err_code));
+        }
+
+        return 1;
+    }
+
+    if (err)
+    {
+        grub_snprintf(err, len, "Unsupported chunk list.");
+    }
+
     for (i = 0; i < chunklist->cur_chunk; i++)
     {
         chunk = chunklist->chunk + i;
@@ -3307,6 +3366,10 @@ int ventoy_get_block_list(grub_file_t file, ventoy_img_chunk_list *chunklist, gr
     {
         grub_ext_get_file_chunk(start, file, chunklist);
     }
+    else if (fs_type == ventoy_fs_btrfs)
+    {
+        grub_btrfs_get_file_chunk(start, file, chunklist);
+    }
     else
     {
         file->read_hook = (grub_disk_read_hook_t)(void *)grub_disk_blocklist_read;
@@ -3366,8 +3429,10 @@ int ventoy_get_block_list(grub_file_t file, ventoy_img_chunk_list *chunklist, gr
 static grub_err_t ventoy_cmd_img_sector(grub_extcmd_context_t ctxt, int argc, char **args)
 {
     int rc;
+    int fs_type;
     grub_file_t file;
     grub_disk_addr_t start;
+    char errmsg[128];
 
     (void)ctxt;
     (void)argc;
@@ -3387,7 +3452,8 @@ static grub_err_t ventoy_cmd_img_sector(grub_extcmd_context_t ctxt, int argc, ch
         grub_free(g_img_chunk_list.chunk);
     }
 
-    if (ventoy_get_fs_type(file->fs->name) >= ventoy_fs_max)
+    fs_type = ventoy_get_fs_type(file->fs->name);
+    if (fs_type >= ventoy_fs_max)
     {
         grub_file_close(file);
         return grub_error(GRUB_ERR_BAD_ARGUMENT, "Unsupported filesystem %s\n", file->fs->name);
@@ -3408,12 +3474,17 @@ static grub_err_t ventoy_cmd_img_sector(grub_extcmd_context_t ctxt, int argc, ch
 
     ventoy_get_block_list(file, &g_img_chunk_list, start);
 
-    rc = ventoy_check_block_list(file, &g_img_chunk_list, start);
+    rc = ventoy_check_block_list(file, &g_img_chunk_list, start, errmsg, sizeof(errmsg));
     grub_file_close(file);
 
     if (rc)
     {
-        return grub_error(GRUB_ERR_NOT_IMPLEMENTED_YET, "Unsupported chunk list.\n");
+        if (fs_type == ventoy_fs_btrfs)
+        {
+            vtoy_tip(10, "%s\n\nWill exit in 10 seconds...\n", errmsg);
+            grub_exit();
+        }
+        return grub_error(GRUB_ERR_NOT_IMPLEMENTED_YET, "%s\n", errmsg);
     }
 
     grub_memset(&g_grub_param->file_replace, 0, sizeof(g_grub_param->file_replace));
@@ -3950,6 +4021,7 @@ static grub_err_t ventoy_cmd_test_block_list(grub_extcmd_context_t ctxt, int arg
     grub_uint32_t i;
     grub_file_t file;
     ventoy_img_chunk_list chunklist;
+    char errmsg[128];
 
     (void)ctxt;
     (void)argc;
@@ -3973,8 +4045,9 @@ static grub_err_t ventoy_cmd_test_block_list(grub_extcmd_context_t ctxt, int arg
 
     ventoy_get_block_list(file, &chunklist, 0);
 
-    if (0 != ventoy_check_block_list(file, &chunklist, 0))
+    if (0 != ventoy_check_block_list(file, &chunklist, 0, errmsg, sizeof(errmsg)))
     {
+        grub_printf("%s\n", errmsg);
         grub_printf("########## UNSUPPORTED ###############\n");
     }
 
@@ -4650,7 +4723,7 @@ static grub_err_t ventoy_cmd_img_unhook_root(grub_extcmd_context_t ctxt, int arg
 static grub_err_t ventoy_cmd_check_secureboot_var(grub_extcmd_context_t ctxt, int argc, char **args)
 {
     int ret = 1;
-    grub_uint8_t *var;
+    grub_uint8_t *var = NULL;
     grub_size_t size;
     grub_efi_guid_t global = GRUB_EFI_GLOBAL_VARIABLE_GUID;
 
@@ -4661,6 +4734,7 @@ static grub_err_t ventoy_cmd_check_secureboot_var(grub_extcmd_context_t ctxt, in
     var = grub_efi_get_variable("SecureBoot", &global, &size);
     if (var && *var == 1)
     {
+        grub_free(var);
         return 0;
     }
 
@@ -5045,7 +5119,7 @@ int ventoy_load_part_table(const char *diskname)
     return 0;
 }
 
-static void ventoy_prompt_end(void)
+void ventoy_prompt_end(void)
 {
     int op = 0;
     char c;
@@ -6339,6 +6413,52 @@ static grub_err_t ventoy_cmd_load_menu_lang(grub_extcmd_context_t ctxt, int argc
     VENTOY_CMD_RETURN(0);
 }
 
+static grub_err_t ventoy_cmd_update_sb_policy(grub_extcmd_context_t ctxt, int argc, char **args)
+{
+    (void)ctxt;
+    (void)argc;
+    (void)args;
+
+#ifdef GRUB_MACHINE_EFI
+    ventoy_set_sb_policy();
+#endif
+
+    VENTOY_CMD_RETURN(0);
+}
+
+static grub_err_t ventoy_cmd_sb_info(grub_extcmd_context_t ctxt, int argc, char **args)
+{
+    (void)ctxt;
+    (void)argc;
+    (void)args;
+
+#ifdef GRUB_MACHINE_EFI
+    const char *policy = NULL;
+
+    if (g_sb_policy == VTOY_SB_POLICY_BYPASS)
+    {
+        policy = "ByPass";
+    }
+    else if (g_sb_policy == VTOY_SB_POLICY_CHECK)
+    {
+        policy = "Check";
+    }
+    else
+    {
+        policy = "XXX";
+    }
+
+    grub_printf("UEFI Firmware Secure Boot: %s\n", g_sys_sb ? "Enable" : "Disable");
+    grub_printf("Ventoy Secure Boot Policy: %s\n", policy);
+#else
+    grub_printf("Non EFI mode!\n");
+#endif
+
+    grub_refresh();
+
+    VENTOY_CMD_RETURN(0);
+}
+
 static int ventoy_chksum_pathcmp(int chktype, char *rlpath, char *rdpath)
 {
     char *pos1 = NULL;
@@ -6985,6 +7105,10 @@ static cmd_para ventoy_cmds[] =
     { "vt_cmp_checksum", ventoy_cmd_cmp_checksum, 0, NULL, "", "", NULL },
     { "vt_push_menu_lang", ventoy_cmd_push_menulang, 0, NULL, "", "", NULL },
     { "vt_pop_menu_lang", ventoy_cmd_pop_menulang, 0, NULL, "", "", NULL },
+    { "vt_linux_initrd", ventoy_cmd_linux_initrd, 0, NULL, "", "", NULL },
+
+    { "vt_sbinfo", ventoy_cmd_sb_info, 0, NULL, "", "", NULL },
+    { "vt_update_sb_policy", ventoy_cmd_update_sb_policy, 0, NULL, "", "", NULL },
 
 };
 

GRUB2/MOD_SRC/grub-2.04/grub-core/ventoy/ventoy_def.h

@@ -37,6 +37,7 @@
 #define VTOY_SIZE_4MB     (4 * 1024 * 1024)
 #define VTOY_SIZE_512KB   (512 * 1024)
 #define VTOY_SIZE_1KB     1024
+#define VTOY_SIZE_4KB     4096
 #define VTOY_SIZE_32KB    (32 * 1024)
 #define VTOY_SIZE_128KB   (128 * 1024)
 
@@ -95,6 +96,12 @@
     return (err);\
 }
 
+#define vtoy_tip(wait_seconds, fmt, ...) \
+    grub_printf(fmt, __VA_ARGS__); \
+    grub_refresh(); \
+    grub_sleep(wait_seconds)
+
+
 #define VTOY_APPEND_NEWBUF(buf) \
 {\
     char *__c = buf;\
@@ -188,6 +195,16 @@ typedef struct cpio_newc_header
 #define check_free(p, func) if (p) { func(p); p = NULL; }
 #define grub_check_free(p) if (p) { grub_free(p); p = NULL; }
 
+#define VTOY_SHIM_POLICY_GUID    {0x90a29d14, 0x3968, 0x48fe, { 0x85, 0x81, 0x6b, 0x7f, 0x7d, 0xc4, 0x70, 0x55 }};
+
+typedef void (*VTOY_BYPASS_SB)(void);
+typedef void (*VTOY_CHECK_SB)(void);
+typedef struct _VTOY_SHIM{
+	VTOY_BYPASS_SB ByPassSB;
+	VTOY_CHECK_SB CheckSB;
+} VTOY_SHIM;
+
+
 typedef int (*grub_char_check_func)(int c);
 #define ventoy_is_decimal(str)  ventoy_string_check(str, grub_isdigit)
 
@@ -656,6 +673,7 @@ grub_uint32_t ventoy_get_iso_boot_catlog(grub_file_t file);
 int ventoy_has_efi_eltorito(grub_file_t file, grub_uint32_t sector);
 grub_err_t ventoy_cmd_linux_chain_data(grub_extcmd_context_t ctxt, int argc, char **args);
 grub_err_t ventoy_cmd_linux_systemd_menu(grub_extcmd_context_t ctxt, int argc, char **args);
+grub_err_t ventoy_cmd_linux_initrd(grub_extcmd_context_t ctxt, int argc, char **args);
 grub_err_t ventoy_cmd_linux_limine_menu(grub_extcmd_context_t ctxt, int argc, char **args);
 grub_err_t ventoy_cmd_linux_locate_initrd(grub_extcmd_context_t ctxt, int argc, char **args);
 grub_err_t ventoy_cmd_initrd_count(grub_extcmd_context_t ctxt, int argc, char **args);
@@ -1150,7 +1168,7 @@ int ventoy_plugin_find_conf_replace(const char *iso, conf_replace *nodes[VTOY_MA
 dud * ventoy_plugin_find_dud(const char *iso);
 int ventoy_plugin_load_dud(dud *node, const char *isopart);
 int ventoy_get_block_list(grub_file_t file, ventoy_img_chunk_list *chunklist, grub_disk_addr_t start);
-int ventoy_check_block_list(grub_file_t file, ventoy_img_chunk_list *chunklist, grub_disk_addr_t start);
+int ventoy_check_block_list(grub_file_t file, ventoy_img_chunk_list *chunklist, grub_disk_addr_t start, char *err, grub_uint32_t len);
 void ventoy_plugin_dump_persistence(void);
 grub_err_t ventoy_cmd_set_theme(grub_extcmd_context_t ctxt, int argc, char **args);
 grub_err_t ventoy_cmd_set_theme_path(grub_extcmd_context_t ctxt, int argc, char **args);
@@ -1273,6 +1291,7 @@ typedef struct systemd_menu_ctx
 {
     char *dev;
     char *buf;
+    const char *initrd_cmd;
     int pos;
     int len;
 }systemd_menu_ctx;
@@ -1287,7 +1306,7 @@ typedef struct global_var_cfg
 typedef struct ctrl_var_cfg
 {
     const char *name;
-    int value;
+    char szval[2];
 }ctrl_var_cfg;
 
 #define vtoy_check_goto_out(p)  if (!p) goto out
@@ -1317,6 +1336,8 @@ int ventoy_ctrl_var_init(void);
 int ventoy_global_var_init(void);
 grub_err_t ventoy_cmd_push_menulang(grub_extcmd_context_t ctxt, int argc, char **args);
 grub_err_t ventoy_cmd_pop_menulang(grub_extcmd_context_t ctxt, int argc, char **args);
+void ventoy_prompt_end(void);
+int ventoy_set_sb_policy(void);
 
 #endif /* __VENTOY_DEF_H__ */
 

GRUB2/MOD_SRC/grub-2.04/grub-core/ventoy/ventoy_linux.c

@@ -1867,7 +1867,7 @@ static int ventoy_systemd_conf_hook(const char *filename, const struct grub_dirh
         ctx->pos = oldpos;
         goto out;
     }
-    vtoy_len_ssprintf(ctx->buf, ctx->pos, ctx->len, "  echo \"Downloading kernel ...\"\n  linux %s ", tag);
+    vtoy_len_ssprintf(ctx->buf, ctx->pos, ctx->len, "  echo \"Loading kernel ...\"\n  linux %s ", tag);
 
     /* kernel options */
     grub_memcpy(filebuf, bkbuf, file->size);
@@ -1876,7 +1876,7 @@ static int ventoy_systemd_conf_hook(const char *filename, const struct grub_dirh
 
     
     /* initrd xxx xxx xxx */
-    vtoy_len_ssprintf(ctx->buf, ctx->pos, ctx->len, "  echo \"Downloading initrd ...\"\n  initrd ");
+    vtoy_len_ssprintf(ctx->buf, ctx->pos, ctx->len, "  echo \"Loading initrd ...\"\n  %s ", ctx->initrd_cmd);
     grub_memcpy(filebuf, bkbuf, file->size);
     tag = ventoy_systemd_conf_tag(filebuf, "initrd", 1);
     while (tag)
@@ -1893,6 +1893,34 @@ out:
     return 0;
 }
 
+grub_err_t ventoy_cmd_linux_initrd(grub_extcmd_context_t ctxt, int argc, char **args)
+{
+    int i;    
+    int pos = 0;
+    char *buf = NULL;
+
+    (void)ctxt;
+
+    buf = (char *)grub_malloc(VTOY_SIZE_4KB);
+    if (!buf)
+    {
+        return 1;
+    }
+
+    pos += grub_snprintf(buf + pos, VTOY_SIZE_4KB - pos, "initrd mem:%s:size:%s",
+        grub_env_get("ventoy_cpio_addr"), grub_env_get("ventoy_cpio_size"));
+    
+    for (i = 0; i < argc; i++)
+    {
+        pos += grub_snprintf(buf + pos, VTOY_SIZE_4KB - pos, " newc:initrd%03d:%s", i + 1, args[i]);
+    }
+
+    grub_script_execute_sourcecode(buf);
+    grub_free(buf);
+
+    return 0;
+}
+
 grub_err_t ventoy_cmd_linux_systemd_menu(grub_extcmd_context_t ctxt, int argc, char **args)
 {
     static char *buf = NULL;
@@ -1936,6 +1964,7 @@ grub_err_t ventoy_cmd_linux_systemd_menu(grub_extcmd_context_t ctxt, int argc, c
 
     ctx.dev = args[0];
     ctx.buf = buf;
+    ctx.initrd_cmd = args[2] ? args[2] : "initrd";
     ctx.pos = 0;
     ctx.len = VTOY_LINUX_SYSTEMD_MENU_MAX_BUF;
     fs->fs_dir(dev, "/loader/entries", ventoy_systemd_conf_hook, &ctx);

GRUB2/MOD_SRC/grub-2.04/grub-core/ventoy/ventoy_plugin.c

@@ -2765,7 +2765,7 @@ int ventoy_plugin_get_persistent_chunklist(const char *isopath, int index, vento
     start = file->device->disk->partition->start;
     ventoy_get_block_list(file, chunk_list, start);
 
-    if (0 != ventoy_check_block_list(file, chunk_list, start))
+    if (0 != ventoy_check_block_list(file, chunk_list, start, NULL, 0))
     {
         grub_free(chunk_list->chunk);
         chunk_list->chunk = NULL;

GRUB2/MOD_SRC/grub-2.04/include/grub/disk.h

@@ -197,6 +197,8 @@ grub_disk_t EXPORT_FUNC(grub_disk_open) (const char *name);
 void EXPORT_FUNC(grub_disk_close) (grub_disk_t disk);
 grub_err_t EXPORT_FUNC(grub_disk_blocklist_read)(void *chunklist, grub_uint64_t sector, 
     grub_uint64_t size, grub_uint32_t log_sector_size);
+grub_err_t EXPORT_FUNC(grub_disk_blocklist_read2)(grub_disk_t disk, grub_uint64_t sector, 
+    grub_uint64_t size, char *buf);
 
 grub_err_t EXPORT_FUNC(grub_disk_read) (grub_disk_t disk,
 					grub_disk_addr_t sector,

GRUB2/MOD_SRC/grub-2.04/include/grub/env.h

@@ -24,6 +24,11 @@
 #include <grub/types.h>
 #include <grub/menu.h>
 
+#define VTOY_SB_POLICY_BYPASS   0
+#define VTOY_SB_POLICY_CHECK    1
+extern grub_uint8_t EXPORT_VAR(g_sys_sb);
+extern grub_uint8_t EXPORT_VAR(g_sb_policy);
+
 struct grub_env_var;
 
 typedef const char *(*grub_env_read_hook_t) (struct grub_env_var *var,

GRUB2/MOD_SRC/grub-2.04/include/grub/ventoy.h

@@ -36,6 +36,7 @@ typedef enum ventoy_fs_type
     ventoy_fs_xfs,       /* 3: XFS */
     ventoy_fs_udf,       /* 4: UDF */
     ventoy_fs_fat,       /* 5: FAT */
+    ventoy_fs_btrfs,     /* 6: BTRFS */
 
     ventoy_fs_max
 }ventoy_fs_type;
@@ -124,6 +125,7 @@ typedef struct ventoy_os_param
      * vtoy_reserved[5]: vtoy_linux_remount
      * vtoy_reserved[6]: vtoy_vlnk
      * vtoy_reserved[7~10]: vtoy_disk_sig[4] used for vlnk
+     * vtoy_reserved[11]: vtoy_win_uefi_max_res
      *
      */
     grub_uint8_t   vtoy_reserved[32];    // Internal use by ventoy
@@ -252,12 +254,15 @@ typedef struct ventoy_virt_chunk
 #define DEFAULT_CHUNK_NUM   1024
 typedef struct ventoy_img_chunk_list
 {
+    char *buf;
+    grub_uint32_t last_off;
+    grub_uint32_t err_code;
+
     grub_uint32_t max_chunk;
     grub_uint32_t cur_chunk;
     ventoy_img_chunk *chunk;
 }ventoy_img_chunk_list;
 
-
 #pragma pack()
 
 #define ventoy_filt_register grub_file_filter_register
@@ -291,7 +296,21 @@ typedef struct ventoy_grub_param
 
 #pragma pack()
 
+#define VTOY_CHUNK_BUF_SIZE          (4 * 1024 * 1024)
+
+typedef enum vtoy_chunk_err
+{
+    VTOY_CHUNK_ERR_NONE = 0,
+    VTOY_CHUNK_ERR_MULTI_DEV,
+    VTOY_CHUNK_ERR_RAID,
+    VTOY_CHUNK_ERR_COMPRESS,
+    VTOY_CHUNK_ERR_NOT_FLAT,
+    VTOY_CHUNK_ERR_OVER_FLOW,
+    VTOY_CHUNK_ERR_MAX
+}vtoy_chunk_err;
+
 int grub_ext_get_file_chunk(grub_uint64_t part_start, grub_file_t file, ventoy_img_chunk_list *chunk_list);
+int grub_btrfs_get_file_chunk(grub_uint64_t part_start, grub_file_t file, ventoy_img_chunk_list *chunk_list);
 int grub_fat_get_file_chunk(grub_uint64_t part_start, grub_file_t file, ventoy_img_chunk_list *chunk_list);
 void grub_iso9660_set_nojoliet(int nojoliet);
 int grub_iso9660_is_joliet(void);

IMG/cpio/ventoy/hook/arch/ventoy-hook.sh

@@ -67,4 +67,5 @@ fi
 
 if [ -f $VTOY_PATH/ventoy_persistent_map ]; then
     $SED "1 aexport cow_label=vtoycow" -i /init 
+    $SED "/parse.*cmdline/aecho cow_label=vtoycow>>/tmp/cmdline" -i /init 
 fi

IMG/cpio/ventoy/hook/debian/porteus-hook.sh

@@ -33,11 +33,13 @@ echo "_vtRet1=$_vtRet1  _vtRet2=$_vtRet2 ..." >> $VTLOG
 
 if [ $_vtRet1 -ne 0 -a $_vtRet2 -eq 0 ]; then
     vtFindFlag=0
-    $GREP '`value from`' /usr/* -r | $AWK -F: '{print $1}' | while read vtline; do
+    $GREP '`value from`' /usr/* -r | $AWK -F: '{print $1}' > $VTOY_PATH/.porteus
+    while read vtline; do
         echo "hooking $vtline ..." >> $VTLOG
         $SED "s#\`value from\`#$vtPath#g"  -i $vtline
         vtFindFlag=1
-    done
+    done < $VTOY_PATH/.porteus
+    rm -f $VTOY_PATH/.porteus
 
     if [ $vtFindFlag -eq 0 ]; then
         if $GREP -q '`value from`' /linuxrc; then

IMG/cpio/ventoy/hook/debian/ventoy-hook.sh

@@ -58,6 +58,9 @@ ventoy_get_debian_distro() {
         if $GREP -q 'Tails' /etc/os-release; then
             echo 'tails'; return
         fi
+        if $GREP -q 'NAME="Kylin"' /etc/os-release; then
+            echo 'kylin'; return
+        fi
     fi
 
     if $GREP -q 'slax/' /proc/cmdline; then

IMG/cpio/ventoy/hook/rhel6/udev_disk_hook.sh

@@ -72,6 +72,12 @@ ventoy_udev_disk_common_hook $* "noreplace"
 
 $BUSYBOX_PATH/mount $VTOY_DM_PATH /mnt/ventoy
 
+#fix Oracle Linux 6.9 install issue
+if $GREP -q -i 'Oracle Linux'  /mnt/ventoy/.discinfo; then
+    ln -s /mnt/ventoy  /mnt/source
+fi
+
+
 # 
 # We do a trick for rhel6 series here.
 # Use /dev/$vtCheatLoop and wapper it as a removable cdrom with bind mount.

IMG/cpio/ventoy/hook/t2/disk_hook.sh

@@ -25,7 +25,19 @@ fi
 
 VTPATH_OLD=$PATH; PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
 
-modprobe dm-mod
+vtlog "Loading dax and dm-mod module ..."
+$BUSYBOX_PATH/modprobe dax      > /dev/null 2>&1
+$BUSYBOX_PATH/modprobe dm-mod   > /dev/null 2>&1
+
+if $GREP -q 'device-mapper' /proc/devices; then
+    vtlog "dm-mod module check success ..."
+else
+    vtlog "Need to extract dax and dm-mod module ..."
+    $VTOY_PATH/tool/zstdcat /lib/modules/$(uname -r)/drivers/dax/dax.ko.zst > $VTOY_PATH/extract_dax.ko
+    $BUSYBOX_PATH/insmod $VTOY_PATH/extract_dax.ko
+    $VTOY_PATH/tool/zstdcat /lib/modules/$(uname -r)/drivers/md/dm-mod.ko.zst > $VTOY_PATH/extract_dm_mod.ko
+    $BUSYBOX_PATH/insmod $VTOY_PATH/extract_dm_mod.ko
+fi
 
 wait_for_usb_disk_ready
 

IMG/cpio/ventoy/hook/t2/ventoy-hook.sh

@@ -19,6 +19,8 @@
 
 . $VTOY_PATH/hook/ventoy-os-lib.sh
 
+$SED  "/Searching/i $BUSYBOX_PATH/sh $VTOY_PATH/hook/t2/disk_hook.sh"  -i /init
+$SED  "/disktype/i x=/dev/ventoy"  -i /init
 $SED  "/getdevice *devicefile/i $BUSYBOX_PATH/sh $VTOY_PATH/hook/t2/disk_hook.sh"  -i /init
 $SED  "/getdevice *devicefile/a devicefile=/dev/ventoy"  -i /init
 

IMG/cpio/ventoy/hook/ventoy-hook-lib.sh

@@ -67,8 +67,11 @@ set_ventoy_hook_finish() {
 
     if [ -f /ventoy/ventoy_iso_part_dm_cmd ]; then
         echo "### create iso part raw dm" >> $VTLOG
+        $CAT $VTOY_PATH/ventoy_raw_table >> $VTLOG
+        echo "### iso part dm cmd" >> $VTLOG
+        $CAT /ventoy/ventoy_iso_part_dm_cmd >> $VTLOG        
         $BUSYBOX_PATH/sh /ventoy/ventoy_iso_part_dm_cmd >>$VTLOG 2>&1        
-        $BUSYBOX_PATH/rm -f /ventoy/ventoy_iso_part_dm_cmd
+        #$BUSYBOX_PATH/rm -f /ventoy/ventoy_iso_part_dm_cmd
     fi
 }
 
@@ -160,10 +163,10 @@ ventoy_get_vblade_bin() {
 }
 
 ventoy_find_bin_path() {        
+    #must use built-in dmsetup, so first try ventoy path. Otherwise ubuntu installer unhappy. #3567
     if $BUSYBOX_PATH/which "$1" > /dev/null; then
         $BUSYBOX_PATH/which "$1"; return
     fi
-    
     for vt_path in '/bin' '/sbin' '/usr/bin' '/usr/sbin' '/usr/local/bin' '/usr/local/sbin' '/root/bin'; do
         if [ -e "$vt_path/$1" ]; then
             echo "$vt_path/$1"; return
@@ -267,6 +270,8 @@ create_ventoy_device_mapper() {
     
     RAWDISKNAME=$($HEAD -n1 $VTOY_PATH/ventoy_raw_table | $AWK '{print $4}')    
     echo "$VT_DM_BIN create  ${RAWDISKNAME#/dev/}  $VTOY_PATH/ventoy_raw_table"  > /ventoy/ventoy_iso_part_dm_cmd    
+    #echo "$VT_DM_BIN mknodes ${RAWDISKNAME#/dev/}"                              >> /ventoy/ventoy_iso_part_dm_cmd    
+    #echo "$VT_DM_BIN ls"                                                        >> /ventoy/ventoy_iso_part_dm_cmd    
 }
 
 create_persistent_device_mapper() {

IMG/cpio/ventoy/ventoy_chain.sh

@@ -169,7 +169,7 @@ ventoy_get_os_type() {
             echo 'debian'; return
         elif $GREP -q 'Solus' /etc/os-release; then
             echo 'rhel7'; return
-        elif $GREP -q 'openEuler' /etc/os-release; then
+        elif $GREP -q -i 'openEuler' /etc/os-release; then
             echo 'openEuler'; return
         elif $GREP -q 'fuyu' /etc/os-release; then
             echo 'openEuler'; return
@@ -177,6 +177,10 @@ ventoy_get_os_type() {
             echo 'deepin'; return
         elif $GREP -q 'chinauos' /etc/os-release; then
             echo 'deepin'; return
+        elif $GREP -qi 'aerynos' /etc/os-release; then
+            echo 'rhel7'; return
+        elif $GREP -qi 'ID_LIKE=debian' /etc/os-release; then
+            echo 'debian'; return
         fi
     fi
     
@@ -312,8 +316,8 @@ ventoy_get_os_type() {
     fi
     
     
-    if [ -e /init ]; then
+    if [ -e /etc/initrd-release ]; then
-        if $GREP -q -m1 'T2 SDE' /init; then
+        if $GREP -q -m1 't2sde' /etc/initrd-release; then
             echo 't2'; return
         fi
     fi
@@ -373,6 +377,13 @@ ventoy_get_os_type() {
             echo 'openEuler'; return
         fi
     fi
+    if [ -f /etc/kylin-release ]; then
+        if $GREP -i -q -m1 'Kylin.*Server.* V1[1-9] ' /etc/kylin-release; then
+            echo 'openEuler'; return
+        fi
+    fi
+
+
     
     if $GREP -q 'chimera' /proc/version; then
         echo 'chimera'; return

IMG/cpio/ventoy/ventoy_loop.sh

@@ -205,7 +205,7 @@ ventoy_get_os_type() {
             echo 'debian'; return
         elif $GREP -q 'Solus' /etc/os-release; then
             echo 'rhel7'; return
-        elif $GREP -q 'openEuler' /etc/os-release; then
+        elif $GREP -q -i 'openEuler' /etc/os-release; then
             echo 'openEuler'; return
         elif $GREP -q 'fuyu' /etc/os-release; then
             echo 'openEuler'; return
@@ -344,8 +344,8 @@ ventoy_get_os_type() {
     fi
     
     
-    if [ -e /init ]; then
+    if [ -e /etc/initrd-release ]; then
-        if $GREP -q -m1 'T2 SDE' /init; then
+        if $GREP -q -m1 't2sde' /etc/initrd-release; then
             echo 't2'; return
         fi
     fi

INSTALL/README

@@ -11,7 +11,8 @@ Ventoy2Disk.sh CMD [ OPTION ] /dev/sdX
     
   OPTION: (optional)
    -r SIZE_MB  preserve some space at the bottom of the disk (only for install)
-   -s          enable secure boot support (default is disabled)
+   -s          enable  secure boot support (default is enabled)
+   -S          disable secure boot support (default is enabled)
    -g          use GPT partition style, default is MBR style (only for install)
 
 Please refer https://www.ventoy.net/en/doc_start.html for details.   

INSTALL/Ventoy2Disk.sh

@@ -21,7 +21,7 @@ elif uname -m | grep -E -q 'mips64'; then
 else
     export TOOLDIR=i386
 fi
-export PATH="./tool/$TOOLDIR:$PATH"
+export PATH="$OLDDIR/tool/$TOOLDIR:$PATH"
 
 
 echo ''
@@ -61,6 +61,24 @@ if [ $? -eq 0 ]; then
     done
 fi
 
+#use static linked mkexfatfs for musl-libc environment
+if [ -f mkexfatfs_static ]; then
+    if ldd --version 2>&1 | grep -qi musl; then
+        mv mkexfatfs mkexfatfs_shared
+        mv mkexfatfs_static mkexfatfs
+    else
+        if ./mkexfatfs -V > /dev/null 2>&1; then
+            echo "mkexfatfs can not run, check static version" >> ./log.txt
+        else
+            if ./mkexfatfs_static -V > /dev/null 2>&1; then
+                echo "Use static version of mkexfatfs" >> ./log.txt
+                mv mkexfatfs mkexfatfs_shared
+                mv mkexfatfs_static mkexfatfs
+            fi
+        fi
+    fi
+fi
+
 cd ../../
 chmod +x -R ./tool/$TOOLDIR
 

INSTALL/grub/debug.cfg

@@ -4,7 +4,7 @@
 #
 submenu "$VTLANG_CTRL_TEMP_SET" --class=debug_temp_set --class=F5tool {
     menuentry "[ $VTOY_WIN11_BYPASS_CHECK ]  $VTLANG_WIN11_BYPASS_CHECK" --class=debug_temp_win11_bypass --class=debug_temp_set --class=F5tool \
-        VTOY_RUN_SET0 {
+        VTOY_RUN_SET_0_0 {
         if [ "$VTOY_WIN11_BYPASS_CHECK" = "0" ]; then
             set VTOY_WIN11_BYPASS_CHECK=1
         else
@@ -13,7 +13,7 @@ submenu "$VTLANG_CTRL_TEMP_SET" --class=debug_temp_set --class=F5tool {
     }
     
     menuentry "[ $VTOY_WIN11_BYPASS_NRO ]  $VTLANG_WIN11_BYPASS_NRO" --class=debug_temp_win11_nro --class=debug_temp_set --class=F5tool \
-        VTOY_RUN_SET1 {
+        VTOY_RUN_SET_1_0 {
         if [ "$VTOY_WIN11_BYPASS_NRO" = "0" ]; then
             set VTOY_WIN11_BYPASS_NRO=1
         else
@@ -22,7 +22,7 @@ submenu "$VTLANG_CTRL_TEMP_SET" --class=debug_temp_set --class=F5tool {
     }    
     
     menuentry "[ $VTOY_SECONDARY_BOOT_MENU ]  $VTLANG_SECONDARY_BOOT_MENU" --class=debug_temp_second_menu --class=debug_temp_set --class=F5tool \
-        VTOY_RUN_SET3 {
+        VTOY_RUN_SET_2_0 {
         if [ "$VTOY_SECONDARY_BOOT_MENU" = "0" ]; then
             set VTOY_SECONDARY_BOOT_MENU=1
         else
@@ -36,6 +36,42 @@ submenu "$VTLANG_CTRL_TEMP_SET" --class=debug_temp_set --class=F5tool {
 }
 
 
+if [ "$grub_platform" != "pc" ]; then
+    submenu "$VTLANG_WIN_UEFI_RES_LOCK" --class=debug_uefi_res_lock --class=F5tool {
+        set vtActive0="[ ]"
+        set vtActive1="[ ]"
+        set vtActive2="[ ]"
+        set vtActive3="[ ]"
+        if [ "$VTOY_WIN_UEFI_RES_LOCK" = "0" ]; then
+            set vtActive0="[*]"
+        elif [ "$VTOY_WIN_UEFI_RES_LOCK" = "1" ]; then
+            set vtActive1="[*]"
+        elif [ "$VTOY_WIN_UEFI_RES_LOCK" = "2" ]; then
+            set vtActive2="[*]"
+        elif [ "$VTOY_WIN_UEFI_RES_LOCK" = "3" ]; then
+            set vtActive3="[*]"
+        fi
+
+        menuentry "$vtActive0 $VTLANG_UEFI_RES_LOCK_NONE" --class=debug_uefi_res_lock0 --class=F5tool VTOY_RUN_SET_0_1 {
+            set VTOY_WIN_UEFI_RES_LOCK=0
+        }
+        menuentry "$vtActive1 $VTLANG_UEFI_RES_LOCK_MAX" --class=debug_uefi_res_lock1 --class=F5tool VTOY_RUN_SET_1_1 {
+            set VTOY_WIN_UEFI_RES_LOCK=1
+        }
+        menuentry "$vtActive2 $VTLANG_UEFI_RES_LOCK_1024_768" --class=debug_uefi_res_lock2 --class=F5tool VTOY_RUN_SET_2_1 {
+            set VTOY_WIN_UEFI_RES_LOCK=2
+        }
+        menuentry "$vtActive3 $VTLANG_UEFI_RES_LOCK_BE1024_768" --class=debug_uefi_res_lock3 --class=F5tool VTOY_RUN_SET_3_1 {
+            set VTOY_WIN_UEFI_RES_LOCK=3
+        }
+        
+        menuentry "$VTLANG_RETURN_PREVIOUS" --class=vtoyret VTOY_RET {
+            echo "Return ..."
+        }
+    }
+fi
+
+
 submenu "$VTLANG_MENU_LANG" --class=debug_menu_lang --class=F5tool {
     source $prefix/menulang.cfg
 }

INSTALL/grub/grub.cfg

@@ -70,6 +70,12 @@ function ventoy_acpi_param {
     fi
 }
 
+function vt_vcfg_pre_proc {
+    vt_img_sector "${vtoy_iso_part}${vt_chosen_path}"
+    vt_load_cpio  $vtoy_path  "${vt_chosen_path}" ${vtoy_iso_part} "busybox=$ventoy_busybox_ver"
+    vt_trailer_cpio $vtoy_iso_part "$vt_chosen_path"
+}
+
 function ventoy_vcfg_proc {
     if vt_check_custom_boot "${1}" vt_vcfg; then
         set vtoy_chosen_path="${1}"
@@ -422,6 +428,16 @@ function distro_specify_initrd_file_phase2 {
         vt_linux_specify_initrd_file /initramfs-linux.img
     elif [ -f (loop)/boot/isolinux/initrd.gz ]; then
         vt_linux_specify_initrd_file /boot/isolinux/initrd.gz        
+    elif vt_str_begin "$vt_volume_id" "AERYNOS"; then
+        vt_vcfg_pre_proc
+
+        loopback va "${vtoy_iso_part}${vt_chosen_path}"
+        loopback vb (va)/EFI/Boot/efiboot.img
+
+        set root=(vb)
+        vt_systemd_menu (vb) vt_sys_menu_mem vt_linux_initrd
+        configfile "mem:${vt_sys_menu_mem_addr}:size:${vt_sys_menu_mem_size}"
+
     fi
 }
 
@@ -487,19 +503,19 @@ function ventoy_freebsd_proc {
         ventoy_get_truenas_ver "$1" "${chosen_path}"
     elif vt_strstr "$vt_volume_id" "FURYBSD"; then
         ventoy_get_furybsd_ver "$1" "${chosen_path}"  
-    elif regexp --set 1:vtBsdVerNum "^(14|13|12|11|10|9)_[0-9]" "$vt_volume_id"; then
+    elif regexp --set 1:vtBsdVerNum "^(15|14|13|12|11|10|9)_[0-9]" "$vt_volume_id"; then
         set vt_freebsd_ver=${vtBsdVerNum}.x    
     elif [ -d (loop)/usr/midnightbsd-dist ]; then
         ventoy_get_midnightbsd_ver "$1" "${chosen_path}"
         set vtFreeBsdDistro=MidnightBSD
     elif [ -e (loop)/bin/freebsd-version ]; then
         vt_unix_parse_freebsd_ver (loop)/bin/freebsd-version vt_userland_ver        
-        if regexp --set 1:vtBsdVerNum "\"(14|13|12|11|10|9)\.[0-9]-" "$vt_userland_ver"; then
+        if regexp --set 1:vtBsdVerNum "\"(15|14|13|12|11|10|9)\.[0-9]-" "$vt_userland_ver"; then
             set vt_freebsd_ver=${vtBsdVerNum}.x
         fi        
     elif [ -e (loop)/README.TXT ]; then
         vt_1st_line (loop)/README.TXT vt_freebsd_line1
-        if regexp --set 1:vtBsdVerNum "FreeBSD (14|13|12|11|10|9)\.[0-9]-" "$vt_freebsd_line1"; then
+        if regexp --set 1:vtBsdVerNum "FreeBSD (15|14|13|12|11|10|9)\.[0-9]-" "$vt_freebsd_line1"; then
             set vt_freebsd_ver=${vtBsdVerNum}.x        
         fi
     elif vt_strstr "${chosen_path}" "MidnightBSD"; then
@@ -1428,7 +1444,7 @@ function ventoy_iso_busybox_ver {
     
         #special process for deepin-live iso
         if [ "$vt_chosen_size" = "403701760" ]; then
-            if vt_str_str "$vt_chosen_path" "/deepin-live"; then
+            if vt_strstr "$vt_chosen_path" "/deepin-live"; then
                 set ventoy_busybox_ver=64
             fi
         elif vt_str_begin "$vt_volume_id" "PHOTON_"; then
@@ -1439,6 +1455,8 @@ function ventoy_iso_busybox_ver {
             set ventoy_busybox_ver=64
         elif vt_str_begin "$vt_volume_id" "KAOS_"; then
             set ventoy_busybox_ver=64
+        elif vt_strstr "$vt_volume_id" "x86_64"; then
+            set ventoy_busybox_ver=64
 
         fi
     fi
@@ -2431,7 +2449,7 @@ function mimg_common_menuentry {
 #############################################################
 #############################################################
 
-set VENTOY_VERSION="1.1.07"
+set VENTOY_VERSION="1.1.15"
 
 #ACPI not compatible with Window7/8, so disable by default
 set VTOY_PARAM_NO_ACPI=1
@@ -2533,6 +2551,10 @@ else
     vt_check_json_path_case $vtoy_iso_part
 fi
 
+#Update Secure Boot Policy
+vt_update_sb_policy
+
+
 if [ -n "$VTOY_MENU_LANGUAGE" ]; then
     vt_init_menu_lang "$VTOY_MENU_LANGUAGE"
 else

INSTALL/grub/help/fa_IR.txt

@@ -0,0 +1,19 @@
+ L - انتخاب زبان
+F1 - نمایش راهنما
+F2 - مرور و بوت کردن فایل‌ها در دیسک محلی
+F3 - تغییر حالت منو بین درختی <-> لیستی
+F4 - بوت کردن ویندوز/لینوکس روی دیسک محلی
+F5 - ابزار های کمکی
+F6 - بارگیری منوی سفارشی Grub2
+F7 - تغییر حالت بین حالت GUI <-> حالت TEXT
+
+m/Ctrl+m - اعتبارسنجی فایل ایمیج (md5/sha1/sha256/sha512)
+d/Ctrl+d - حالت Memdisk (فقط برای ایمیج های کوچک WinPE/LiveCD ISO/IMG)
+w/Ctrl+w - حالت WIMBOOT (فقط برای فایل های ایزو Windows/WinPE)
+r/Ctrl+r - حالت Grub2 (فقط برای برخی از توزیع های لینوکس)
+i/Ctrl+i - حالت سازگار (فقط برای مشکل زدایی)
+u/Ctrl+u - بارگیری درایور ISO EFI (تنها برای مشکل زدایی، نمیتوان به صورت رسمی استفاده کرد)
+
+
+
+جهت بازگشت دکمه ESC را کلیک کنید ......

INSTALL/grub/help/ko_KR.txt

@@ -7,10 +7,10 @@ F5 - 유틸리티
 F6 - 사용자 지정 Grub2 메뉴 불러오기
 F7 - 그래픽 모드 <-> 텍스트 모드 간에 전환
 
-m/Ctrl+m - 체크섬 이미지 파일 (md5/sha1/sha256/sha512)
+m/Ctrl+m - 이미지 파일 체크섬 (md5/sha1/sha256/sha512)
-d/Ctrl+d - Memdisk 모드 (작은 WinPE/LiveCD ISO/IMG 전용)
+d/Ctrl+d - Memdisk 모드 (작은 WinPE/LiveCD ISO/IMG에만 해당)
-w/Ctrl+w - WIMBOOT 모드 (표준 Windows/WinPE ISO 전용)
+w/Ctrl+w - WIMBOOT 모드 (표준 Windows/WinPE ISO에만 해당)
-r/Ctrl+r - Grub2 모드 (일부 Linux 배포판에만 해당)
+r/Ctrl+r - Grub2 모드 (일반 Linux 배포판에만 해당)
 i/Ctrl+i - 호환 모드 (디버그 전용, 공식적으로 사용할 수 없음)
 u/Ctrl+u - ISO EFI 드라이버 불러오기 (디버그 전용, 공식적으로 사용할 수 없음)
 

INSTALL/grub/help/lg_UG.txt

@@ -0,0 +1,19 @@
+L - Londako Olulimi
+F1 - Laga obuyambi 
+F2 - Nnoonya era kozesa Fayiro eziri ku Disk
+F3 - Kyusa endabika ya Menu wakati wa Masaasana (Treeview) ne y'olukalala (ListView)
+F4 - Ttandika Windows/Linux ku disk erimu 
+F5 - Ebikozesebwa ebirala
+F6 - Kozesa Grub2 menu gyewerobozza
+F7 - Okukyuusa okuva mu Bifaananyi (GUI Mode) <-> Bigambo (TEXT Mode)
+
+m/Ctrl+m - Okukebera Checksum image files (md5/sha1/sha256/sha512)
+d/Ctrl+d - Memdisk Mode (Ya WinPE/LiveCD ISO/IMG entono zokka)
+w/Ctrl+w - WIMBOOT Mode (Ya Windows/WinPE ISO zokka)
+r/Ctrl+r - Grub2 Mode (Ya nkola za Linux  ezimu)
+i/Ctrl+i - Compatible Mode (Ya kutereeza kwokka (debugging))
+u/Ctrl+u - Kozesa ISO EFI driver (Ya kutereeza kwokka (debugging), tesobola kukozesebwa mu butongole) 
+
+
+
+nyiga ESC to okudda emabega ......

INSTALL/grub/help/pt_BR.txt

@@ -1,18 +1,18 @@
- L - Sele<EFBFBD><EFBFBD>o de Idiomas
+ L - Seleção de Idiomas
-F1 - Exibir informa<EFBFBD><EFBFBD>es de ajuda
+F1 - Exibir informações de ajuda
 F2 - Explorar e inicializar os arquivos no disco local
-F3 - Trocar o modo do menu entre Visualiza<EFBFBD><EFBFBD>o em <EFBFBD>rvore <-> Visualiza<EFBFBD><EFBFBD>o em Lista
+F3 - Trocar o modo do menu entre Visualização em Árvore <-> Visualização em Lista
 F4 - Inicializar o Windows/Linux no disco local
-F5 - Utilit<EFBFBD>rios
+F5 - Utilitários
 F6 - Carregar o Menu Personalizado do Grub2
 F7 - Trocar entre o Modo GUI <-> Modo TEXTO
 
 m/Ctrl+m - Checksum dos arquivos de imagem (md5/sha1/sha256/sha512)
-d/Ctrl+d - Modo Memdisk (S<EFBFBD> pros pequenos WinPE/LiveCD ISO/IMG)
+d/Ctrl+d - Modo Memdisk (Só pros pequenos WinPE/LiveCD ISO/IMG)
-w/Ctrl+w - Modo WIMBOOT (S<EFBFBD> pra arquivos ISO do Windows/WinPE)
+w/Ctrl+w - Modo WIMBOOT (Só pra arquivos ISO do Windows/WinPE)
-r/Ctrl+r - Modo Grub2 (S<EFBFBD> pra algumas distros do Linux)
+r/Ctrl+r - Modo Grub2 (Só pra algumas distros do Linux)
-i/Ctrl+i - Modo Compat<EFBFBD>vel (S<EFBFBD> pra debugging)
+i/Ctrl+i - Modo Compatível (Só pra debugging)
-u/Ctrl+u - Carregar o driver EFI da ISO (S<EFBFBD> pra debugging, n<EFBFBD>o pode ser usado oficialmente)
+u/Ctrl+u - Carregar o driver EFI da ISO (Só pra debugging, não pode ser usado oficialmente)
 
 
 

INSTALL/grub/help/sl_SI.txt

@@ -0,0 +1,19 @@
+ L - Izbira jezika
+F1 - Prikaz informacij o pomoči
+F2 - Brskanje in zagon datotek na lokalnem disku
+F3 - Preklop med načinom menija Treeview <-> ListView
+F4 - Zagon Windows/Linux na lokalnem disku
+F5 - Pripomočki
+F6 - Naložitev prilagojenega menija Grub2
+F7 - Preklop med načinom GUI <-> načinom TEXT
+
+m/Ctrl+m - Preveri kontrolno vsoto slikovnih datotek (md5/sha1/sha256/sha512)
+d/Ctrl+d - Način Memdisk (samo za majhne WinPE/LiveCD ISO/IMG)
+w/Ctrl+w - Način WIMBOOT (samo za datoteke Windows/WinPE ISO)
+r/Ctrl+r – Način Grub2 (samo za nekatere distribucije Linux)
+i/Ctrl+i – Združljiv način (samo za odpravljanje napak)
+u/Ctrl+u – Naloži ISO EFI gonilnik (samo za odpravljanje napak, uradno se ne more uporabljati)
+
+
+
+Pritisnite ESC za vrnitev ......

INSTALL/grub/hwinfo.cfg

@@ -40,17 +40,17 @@ menuentry "$VTLANG_HWINFO" --class=debug_hwinfo --class=F5tool {
     echo "Physical RAM            $grub_total_ram MB"
                                   
     echo ""                       
-    echo "Manufacture             $system_vendor"
+    echo "Manufacturer            $system_vendor"
     echo "Product Name            $system_product"
     echo "Version                 $system_version"
                                   
     echo ""                       
-    echo "Board Manufacture       $board_vendor"
+    echo "Board Manufacturer      $board_vendor"
     echo "Board Name              $board_product"
     echo "Board Version           $board_version"
                                   
     echo ""                       
-    echo "BIOS Manufacture        $bios_vendor"
+    echo "BIOS Manufacturer       $bios_vendor"
     echo "BIOS Version            $bios_ver"
     echo "BIOS Date               $bios_date"
     echo "BIOS ROM Size           $bios_size"

INSTALL/grub/menu/ar_AR.json

@@ -88,6 +88,11 @@
     "VTLANG_WIN11_BYPASS_NRO": "تجاوز متطلبات الحساب عبر الإنترنت عند تثبيت Windows 11",
     "VTLANG_LINUX_REMOUNT": "ضم قسم Ventoy بعد إقلاع Linux",
     "VTLANG_SECONDARY_BOOT_MENU": "اظهر قائمة الإقلاع الثانوية",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/bn_BN.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Windows 11 ইনস্টল করার সময় অনলাইন অ্যাকাউন্টের প্রয়োজন বাইপাস করুন",
     "VTLANG_LINUX_REMOUNT": "লিনাক্স বুটের পরে ভেন্টয় পার্টিশনটি মাউন্ট করুন",
     "VTLANG_SECONDARY_BOOT_MENU": "গৌণ বুট মেনু দেখান",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/cs_CZ.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Obejít požadování online účtu při instalaci Windows 11",
     "VTLANG_LINUX_REMOUNT": "Připojit Ventoy oddíl po spuštění Linuxu",
     "VTLANG_SECONDARY_BOOT_MENU": "Zobrazit druhou spouštěcí nabídku",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
     
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/de_DE.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Umgehen Sie die Online-Kontoanforderung bei der Installation von Windows 11",
     "VTLANG_LINUX_REMOUNT": "Mounten Sie die Ventoy-Partition nach dem Booten von Linux",
     "VTLANG_SECONDARY_BOOT_MENU": "Sekundäres Bootmenü anzeigen",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/el_GR.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Παράκαμψη της απαίτησης online λογαριασμού κατά την εγκατάσταση των Windows 11",
     "VTLANG_LINUX_REMOUNT": "Προσάρτηση διαμερίσματος Ventoy μετά την εκκίνηση του Linux",
     "VTLANG_SECONDARY_BOOT_MENU": "Εμφάνιση δευτερεύοντος μενού εκκίνησης",
+     "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/en_US.json

@@ -88,6 +88,11 @@
     "VTLANG_WIN11_BYPASS_NRO": "Bypass online account requirement when install Windows 11",
     "VTLANG_LINUX_REMOUNT": "Mount Ventoy partition after boot Linux",
     "VTLANG_SECONDARY_BOOT_MENU": "Show secondary boot menu",    
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
     
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/es_ES.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Saltar requerimiento de cuenta en linea al instalar Windows 11",
     "VTLANG_LINUX_REMOUNT": "Montar partición de Ventoy después de arrancar Linux",
     "VTLANG_SECONDARY_BOOT_MENU": "Mostrar menú de arranque secundario",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/fa_IR.json

@@ -0,0 +1,99 @@
+{
+    "VTLANG_LANGUAGE_NAME": "Persian (فارسی)",
+    
+    "VTLANG_STR_HOTKEY_LIST": "L:زبان  F1:راهنما  F2:مرور  F3:نمای لیستی  F4:بوت محلی  F5:ابزار  F6:بازگشت",
+    "VTLANG_STR_HOTKEY_TREE": "L:زبان  F1:راهنما  F2:مرور  F3:نمای درختی  F4:بوت محلی  F5:ابزار  F6:بازگشت",
+    "VTLANG_RETURN_PREVIOUS": "بازگشت به منوی قبلی [Esc]",
+    "VTLANG_RETURN_PRV_NOESC": "بازگشت به منوی قبلی",
+    
+    "VTLANG_MENU_LANG": "منوی انتخاب زبان",
+    
+    "VTLANG_LB_SBOOT_WINDOWS": "جستجو و بوت ویندوز",
+    "VTLANG_LB_SBOOT_G4D": "جستجو و بوت Grub4dos",
+    "VTLANG_LB_SBOOT_HDD1": "بوت اولین دیسک محلی",
+    "VTLANG_LB_SBOOT_HDD2": "بوت دومین دیسک محلی",
+    "VTLANG_LB_SBOOT_HDD3": "بوت سومین دیسک محلی",
+    "VTLANG_LB_SBOOT_X64EFI": "جستجو و بوت BOOTX64.EFI",
+    "VTLANG_LB_SBOOT_IA32EFI": "جستجو و بوت BOOTIA32.EFI",
+    "VTLANG_LB_SBOOT_AA64EFI": "جستجو و بوت BOOTAA64.EFI",
+    "VTLANG_LB_SBOOT_XORBOOT": "جستجو و بوت xorboot",
+    
+    "VTLANG_FILE_CHKSUM": "اعتبارسنجی فایل",
+    "VTLANG_CHKSUM_MD5_CALC": "محاسبه md5sum",
+    "VTLANG_CHKSUM_SHA1_CALC": "محاسبه sha1sum",
+    "VTLANG_CHKSUM_SHA256_CALC": "محاسبه sha256sum",
+    "VTLANG_CHKSUM_SHA512_CALC": "محاسبه sha512sum",
+    "VTLANG_CHKSUM_MD5_CALC_CHK": "محاسبه و بررسی md5sum",
+    "VTLANG_CHKSUM_SHA1_CALC_CHK": "محاسبه و بررسی sha1sum",
+    "VTLANG_CHKSUM_SHA256_CALC_CHK": "محاسبه و بررسی sha256sum",
+    "VTLANG_CHKSUM_SHA512_CALC_CHK": "محاسبه و بررسی sha512sum",
+    
+    "VTLANG_POWER": "انرژی",
+    "VTLANG_POWER_REBOOT": "ریبوت",
+    "VTLANG_POWER_HALT": "توقف",
+    "VTLANG_POWER_BOOT_EFIFW": "ریبوت به تنظیمات EFI",
+    
+    "VTLANG_KEYBRD_LAYOUT": "نمایه صفحه کلید",
+    "VTLANG_HWINFO": "اطلاعات سخت افزار",
+    
+    "VTLANG_RESOLUTION_CFG": "پیکربندی رزولوشن",
+    "VTLANG_SCREEN_MODE": "حالت نمایش صفحه",
+    "VTLANG_SCREEN_TEXT_MODE": "حالت متنی اجباری",
+    "VTLANG_SCREEN_GUI_MODE": "حالت گرافیکی اجباری",
+    
+    "VTLANG_THEME_SELECT": "انتخاب تم",
+    
+    "VTLANG_UEFI_UTIL": "ابزار های کمکی Ventoy UEFI",
+    "VTLANG_UTIL_SHOW_EFI_DRV": "نمایش درایور های EFI",
+    "VTLANG_UTIL_FIX_BLINIT_FAIL": "رفع خطای Windows BlinitializeLibrary",
+    
+    "VTLANG_JSON_CHK_JSON": "بررسی پیکربندی json افزونه (ventoy.json)",
+    "VTLANG_JSON_CHK_CONTROL": "بررسی پیکربندی افزونه کنترل سراسری",
+    "VTLANG_JSON_CHK_THEME": "بررسی پیکربندی افزونه قالب",
+    "VTLANG_JSON_CHK_AUTOINS": "بررسی پیکربندی افزونه نصب خودکار",
+    "VTLANG_JSON_CHK_PERSIST": "بررسی پیکربندی افزونه‌ی تداوم",
+    "VTLANG_JSON_CHK_MENU_ALIAS": "بررسی پیکربندی افزونه نام مستعار منو",
+    "VTLANG_JSON_CHK_MENU_TIP": "بررسی پیکربندی افزونه نکته منو",
+    "VTLANG_JSON_CHK_MENU_CLASS": "بررسی پیکربندی افزونه کلاس منو",
+    "VTLANG_JSON_CHK_INJECTION": "بررسی پیکربندی افزونه تزریق",
+    "VTLANG_JSON_CHK_AUTO_MEMDISK": "بررسی پیکربندی افزونه memdisk خودکار",
+    "VTLANG_JSON_CHK_IMG_LIST": "بررسی پیکربندی افزونه لیست ایمیج ها",
+    "VTLANG_JSON_CHK_IMG_BLIST": "بررسی پیکربندی افزونه لیست سیاه ایمیج",
+    "VTLANG_JSON_CHK_CONF_REPLACE": "بررسی پیکربندی افزونه جایگزینی فایل پیکربندی بوت",
+    "VTLANG_JSON_CHK_DUD": "بررسی پیکربندی افزونه dud",
+    "VTLANG_JSON_CHK_PASSWORD": "بررسی پیکربندی افزونه کلمه عبور",
+    
+    "VTLANG_NORMAL_MODE": "بوت در حالت عادی",
+    "VTLANG_WIMBOOT_MODE": "بوت در حالت wimboot",
+    "VTLANG_GRUB2_MODE": "بوت در حالت grub2",
+    "VTLANG_MEMDISK_MODE": "بوت در حالت memdisk",
+    
+    "VTLANG_RET_TO_LISTVIEW": "بازگشت به نمای لیستی",
+    "VTLANG_RET_TO_TREEVIEW": "بازگشت به نمای درختی",
+    
+    "VTLANG_NO_AUTOINS_SCRIPT": "بوت بدون قالب نصب خودکار",
+    "VTLANG_AUTOINS_USE": "بوت با",
+    
+    "VTLANG_NO_PERSIST": "بوت بدون تداوم",
+    "VTLANG_PERSIST_USE": "بوت با",
+    
+    "VTLANG_BROWER_RETURN": "بازگشت",
+    
+    "VTLANG_ENTER_EXIT": "جهت خروج دکمه Enter را فشار دهید",
+    "VTLANG_ENTER_REBOOT": "جهت ریبوت دکمه Enter را فشار دهید",
+    "VTLANG_ENTER_CONTINUE": "جهت ادامه دکمه Enter را فشار دهید",
+    
+    "VTLANG_CTRL_TEMP_SET": "تنظیمات کنترل موقت",
+    "VTLANG_WIN11_BYPASS_CHECK": "دور زدن بررسی CPU/TPM/SecureBoot در هنگام نصب ویندوز 11",
+    "VTLANG_WIN11_BYPASS_NRO": "دور زدن نیاز به حساب کاربری آنلاین هنگام نصب ویندوز 11",
+    "VTLANG_LINUX_REMOUNT": "اتصال پارتیشن Ventoy بعد از بوت لینوکس",
+    "VTLANG_SECONDARY_BOOT_MENU": "نمایش منوی بوت ثانویه",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
+
+    "MENU_STR_XXX": ""
+}

INSTALL/grub/menu/fr_FR.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Contourner l'exigence de compte en ligne lors de l'installation de Windows 11",
     "VTLANG_LINUX_REMOUNT": "Monter la partition Ventoy après le démarrage de Linux",
     "VTLANG_SECONDARY_BOOT_MENU": "Afficher le menu de démarrage secondaire",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/hi_HI.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "विंडोज 11 स्थापित करते समय ऑनलाइन खाते की आवश्यकता बाईपास",
     "VTLANG_LINUX_REMOUNT": "लिनक्स बूट के बाद वेंटॉय विभाजन को माउंट करें",
     "VTLANG_SECONDARY_BOOT_MENU": "द्वितीयक बूट मेनू दिखाएं",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/hr_HR.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Bypass online account requirement when install Windows 11",
     "VTLANG_LINUX_REMOUNT": "Mount Ventoy partition after boot Linux",
     "VTLANG_SECONDARY_BOOT_MENU": "Show secondary boot menu",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/hu_HU.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Internetes fiók követelményének megkerülése Windows 11 telepítésekor",
     "VTLANG_LINUX_REMOUNT": "Ventoy partíció csatolása a Linux indítása után",
     "VTLANG_SECONDARY_BOOT_MENU": "Másodlagos indítási menü megjelenítése",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/id_ID.json

@@ -43,7 +43,7 @@
     
     "VTLANG_THEME_SELECT": "Pilih Tema",
     
-    "VTLANG_UEFI_UTIL": "Ventoy UEFI Utilities",
+    "VTLANG_UEFI_UTIL": "Utilitas UEFI Ventoy",
     "VTLANG_UTIL_SHOW_EFI_DRV": "Tampilkan Driver EFI",
     "VTLANG_UTIL_FIX_BLINIT_FAIL": "Memperbaiki Kegagalan Windows BlinitializeLibrary",
     
@@ -80,14 +80,20 @@
     "VTLANG_BROWER_RETURN": "Kembali",
     
     "VTLANG_ENTER_EXIT": "tekan tombol Enter untuk keluar",
-    "VTLANG_ENTER_REBOOT": "tekan tombol Enter untuk reboot",
+    "VTLANG_ENTER_REBOOT": "tekan tombol Enter untuk memulai ulang",
     "VTLANG_ENTER_CONTINUE": "tekan tombol Enter untuk melanjutkan",
     
-    "VTLANG_CTRL_TEMP_SET": "Temporary Control Settings",
+    "VTLANG_CTRL_TEMP_SET": "Pengaturan Kontrol Sementara",
-    "VTLANG_WIN11_BYPASS_CHECK": "Bypass CPU/TPM/SecureBoot check when install Windows 11",
+    "VTLANG_WIN11_BYPASS_CHECK": "Melewati pemeriksaaan CPU/TPM/SecureBoot ketika memasang Windows 11",
-    "VTLANG_WIN11_BYPASS_NRO": "Bypass online account requirement when install Windows 11",
+    "VTLANG_WIN11_BYPASS_NRO": "Melewati persyaratan akun online ketika memasang Windows 11",
-    "VTLANG_LINUX_REMOUNT": "Mount Ventoy partition after boot Linux",
+    "VTLANG_LINUX_REMOUNT": "Memuat partisi Ventoy setelah boot ke Linux",
-    "VTLANG_SECONDARY_BOOT_MENU": "Show secondary boot menu",
+    "VTLANG_SECONDARY_BOOT_MENU": "Tampilkan menu boot sekunder",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/it_IT.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Durante l'installazione di Windows 11 bypassa il requisito di un account online ",
     "VTLANG_LINUX_REMOUNT": "Dopo l'avvio di Linux monta la partizione Ventoy ",
     "VTLANG_SECONDARY_BOOT_MENU": "Visualizza menu di avvio secondario",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/ja_JP.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Bypass online account requirement when install Windows 11",
     "VTLANG_LINUX_REMOUNT": "Mount Ventoy partition after boot Linux",
     "VTLANG_SECONDARY_BOOT_MENU": "Show secondary boot menu",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/ka_GE.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Bypass online account requirement when install Windows 11",
     "VTLANG_LINUX_REMOUNT": "Mount Ventoy partition after boot Linux",
     "VTLANG_SECONDARY_BOOT_MENU": "Show secondary boot menu",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/ko_KR.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Windows 11 설치 시 온라인 계정 요구 사항 무시",
     "VTLANG_LINUX_REMOUNT": "Linux 부팅 후 Ventoy 파티션 마운트",
     "VTLANG_SECONDARY_BOOT_MENU": "보조 부팅 메뉴 표시",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/lg_UG.json

@@ -0,0 +1,99 @@
+{
+    "VTLANG_LANGUAGE_NAME": "English (English)",
+    
+    "VTLANG_STR_HOTKEY_LIST": "L:Language  F1:Help  F2:Browse  F3:ListView  F4:Localboot  F5:Tools  F6:ExMenu",
+    "VTLANG_STR_HOTKEY_TREE": "L:Language  F1:Help  F2:Browse  F3:TreeView  F4:Localboot  F5:Tools  F6:ExMenu",
+    "VTLANG_RETURN_PREVIOUS": "Return to previous menu [Esc]",
+    "VTLANG_RETURN_PRV_NOESC": "Return to previous menu",
+    
+    "VTLANG_MENU_LANG": "Menu Language Select",
+    
+    "VTLANG_LB_SBOOT_WINDOWS": "Search and boot Windows",
+    "VTLANG_LB_SBOOT_G4D": "Search and boot Grub4dos",
+    "VTLANG_LB_SBOOT_HDD1": "Boot the 1st local disk",
+    "VTLANG_LB_SBOOT_HDD2": "Boot the 2nd local disk",
+    "VTLANG_LB_SBOOT_HDD3": "Boot the 3rd local disk",
+    "VTLANG_LB_SBOOT_X64EFI": "Search and boot BOOTX64.EFI",
+    "VTLANG_LB_SBOOT_IA32EFI": "Search and boot BOOTIA32.EFI",
+    "VTLANG_LB_SBOOT_AA64EFI": "Search and boot BOOTAA64.EFI",
+    "VTLANG_LB_SBOOT_XORBOOT": "Search and boot xorboot",
+    
+    "VTLANG_FILE_CHKSUM": "File checksum",
+    "VTLANG_CHKSUM_MD5_CALC": "Calculate md5sum",
+    "VTLANG_CHKSUM_SHA1_CALC": "Calculate sha1sum",
+    "VTLANG_CHKSUM_SHA256_CALC": "Calculate sha256sum",
+    "VTLANG_CHKSUM_SHA512_CALC": "Calculate sha512sum",
+    "VTLANG_CHKSUM_MD5_CALC_CHK": "Calculate and check md5sum",
+    "VTLANG_CHKSUM_SHA1_CALC_CHK": "Calculate and check sha1sum",
+    "VTLANG_CHKSUM_SHA256_CALC_CHK": "Calculate and check sha256sum",
+    "VTLANG_CHKSUM_SHA512_CALC_CHK": "Calculate and check sha512sum",
+    
+    "VTLANG_POWER": "Power",
+    "VTLANG_POWER_REBOOT": "Reboot",
+    "VTLANG_POWER_HALT": "Halt",
+    "VTLANG_POWER_BOOT_EFIFW": "Reboot to EFI setup",
+    
+    "VTLANG_KEYBRD_LAYOUT": "Keyboard Layouts",
+    "VTLANG_HWINFO": "Hardware Information",
+    
+    "VTLANG_RESOLUTION_CFG": "Resolution Configuration",
+    "VTLANG_SCREEN_MODE": "Screen Display Mode",
+    "VTLANG_SCREEN_TEXT_MODE": "Force Text Mode",
+    "VTLANG_SCREEN_GUI_MODE": "Force Graphics Mode",
+    
+    "VTLANG_THEME_SELECT": "Theme Select",
+    
+    "VTLANG_UEFI_UTIL": "Ventoy UEFI Utilities",
+    "VTLANG_UTIL_SHOW_EFI_DRV": "Show EFI Drivers",
+    "VTLANG_UTIL_FIX_BLINIT_FAIL": "Fixup Windows BlinitializeLibrary Failure",
+    
+    "VTLANG_JSON_CHK_JSON": "Check plugin json configuration (ventoy.json)",
+    "VTLANG_JSON_CHK_CONTROL": "Check global control plugin configuration",
+    "VTLANG_JSON_CHK_THEME": "Check theme plugin configuration",
+    "VTLANG_JSON_CHK_AUTOINS": "Check auto install plugin configuration",
+    "VTLANG_JSON_CHK_PERSIST": "Check persistence plugin configuration",
+    "VTLANG_JSON_CHK_MENU_ALIAS": "Check menu alias plugin configuration",
+    "VTLANG_JSON_CHK_MENU_TIP": "Check menu tip plugin configuration",
+    "VTLANG_JSON_CHK_MENU_CLASS": "Check menu class plugin configuration",
+    "VTLANG_JSON_CHK_INJECTION": "Check injection plugin configuration",
+    "VTLANG_JSON_CHK_AUTO_MEMDISK": "Check auto memdisk plugin configuration",
+    "VTLANG_JSON_CHK_IMG_LIST": "Check image list plugin configuration",
+    "VTLANG_JSON_CHK_IMG_BLIST": "Check image blacklist plugin configuration",
+    "VTLANG_JSON_CHK_CONF_REPLACE": "Check boot conf replace plugin configuration",
+    "VTLANG_JSON_CHK_DUD": "Check dud plugin configuration",
+    "VTLANG_JSON_CHK_PASSWORD": "Check password plugin configuration",
+    
+    "VTLANG_NORMAL_MODE": "Boot in normal mode",
+    "VTLANG_WIMBOOT_MODE": "Boot in wimboot mode",
+    "VTLANG_GRUB2_MODE": "Boot in grub2 mode",
+    "VTLANG_MEMDISK_MODE": "Boot in memdisk mode",
+    
+    "VTLANG_RET_TO_LISTVIEW": "Return to ListView",
+    "VTLANG_RET_TO_TREEVIEW": "Return to TreeView",
+    
+    "VTLANG_NO_AUTOINS_SCRIPT": "Boot without auto installation template",
+    "VTLANG_AUTOINS_USE": "Boot with",
+    
+    "VTLANG_NO_PERSIST": "Boot without persistence",
+    "VTLANG_PERSIST_USE": "Boot with",
+    
+    "VTLANG_BROWER_RETURN": "Return",
+    
+    "VTLANG_ENTER_EXIT": "press Enter key to exit",
+    "VTLANG_ENTER_REBOOT": "press Enter key to reboot",
+    "VTLANG_ENTER_CONTINUE": "press Enter key to continue",
+    
+    "VTLANG_CTRL_TEMP_SET": "Temporary Control Settings",
+    "VTLANG_WIN11_BYPASS_CHECK": "Bypass CPU/TPM/SecureBoot check when install Windows 11",
+    "VTLANG_WIN11_BYPASS_NRO": "Bypass online account requirement when install Windows 11",
+    "VTLANG_LINUX_REMOUNT": "Mount Ventoy partition after boot Linux",
+    "VTLANG_SECONDARY_BOOT_MENU": "Show secondary boot menu",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
+
+    "MENU_STR_XXX": ""
+}

INSTALL/grub/menu/pl_PL.json

@@ -28,40 +28,40 @@
     "VTLANG_CHKSUM_SHA256_CALC_CHK": "Oblicz i sprawdź sumę sha256",
     "VTLANG_CHKSUM_SHA512_CALC_CHK": "Oblicz i sprawdź sumę sha512",
     
-    "VTLANG_POWER": "Zasilanie",
+    "VTLANG_POWER": "Opcje zasilania",
     "VTLANG_POWER_REBOOT": "Uruchom ponownie",
     "VTLANG_POWER_HALT": "Zakończ",
     "VTLANG_POWER_BOOT_EFIFW": "Uruchom ponownie i przejdź do konfiguracji EFI",
     
     "VTLANG_KEYBRD_LAYOUT": "Układy klawiatury",
-    "VTLANG_HWINFO": "Informacje o sprzęcie",
+    "VTLANG_HWINFO": "Informacje o konfiguracji sprzętowej",
     
     "VTLANG_RESOLUTION_CFG": "Konfiguracja rozdzielczości",
     "VTLANG_SCREEN_MODE": "Tryb wyświetlania ekranu",
     "VTLANG_SCREEN_TEXT_MODE": "Wymuś tryb tekstowy",
     "VTLANG_SCREEN_GUI_MODE": "Wymuś tryb graficzny",
     
-    "VTLANG_THEME_SELECT": "Wybór motywu",
+    "VTLANG_THEME_SELECT": "Wybierz motyw",
     
-    "VTLANG_UEFI_UTIL": "Narzędzia UEFI Ventoy",
+    "VTLANG_UEFI_UTIL": "Narzędzia Ventoy UEFI",
     "VTLANG_UTIL_SHOW_EFI_DRV": "Pokaż sterowniki EFI",
     "VTLANG_UTIL_FIX_BLINIT_FAIL": "Napraw błąd BlinitializeLibrary systemu Windows",
     
-    "VTLANG_JSON_CHK_JSON": "Sprawdź konfigurację wtyczki json (ventoy.json)",
+    "VTLANG_JSON_CHK_JSON": "Sprawdź konfigurację pluginu json (ventoy.json)",
-    "VTLANG_JSON_CHK_CONTROL": "Sprawdź konfigurację wtyczki globalnej kontroli",
+    "VTLANG_JSON_CHK_CONTROL": "Sprawdź konfigurację pluginu Global Control",
-    "VTLANG_JSON_CHK_THEME": "Sprawdź konfigurację wtyczki motywu",
+    "VTLANG_JSON_CHK_THEME": "Sprawdź konfigurację pluginu Theme",
-    "VTLANG_JSON_CHK_AUTOINS": "Sprawdź konfigurację wtyczki automatycznej instalacji",
+    "VTLANG_JSON_CHK_AUTOINS": "Sprawdź konfigurację pluginu Auto Installation",
-    "VTLANG_JSON_CHK_PERSIST": "Sprawdź konfigurację wtyczki trwałości",
+    "VTLANG_JSON_CHK_PERSIST": "Sprawdź konfigurację pluginu Persistence",
-    "VTLANG_JSON_CHK_MENU_ALIAS": "Sprawdź konfigurację wtyczek aliasów menu",
+    "VTLANG_JSON_CHK_MENU_ALIAS": "Sprawdź konfigurację pluginu Menu Alias",
-    "VTLANG_JSON_CHK_MENU_TIP": "Sprawdź konfigurację wtyczki podpowiedzi menu",
+    "VTLANG_JSON_CHK_MENU_TIP": "Sprawdź konfigurację pluginu Menu Tip",
-    "VTLANG_JSON_CHK_MENU_CLASS": "Sprawdź konfigurację wtyczki klasy menu",
+    "VTLANG_JSON_CHK_MENU_CLASS": "Sprawdź konfigurację pluginu Menu Class",
-    "VTLANG_JSON_CHK_INJECTION": "Sprawdź konfigurację wtyczki wstrzykiwania",
+    "VTLANG_JSON_CHK_INJECTION": "Sprawdź konfigurację pluginu Injection",
-    "VTLANG_JSON_CHK_AUTO_MEMDISK": "Sprawdź automatyczną konfigurację wtyczki memdisk",
+    "VTLANG_JSON_CHK_AUTO_MEMDISK": "Sprawdź konfigurację pluginu Auto Memdisk",
-    "VTLANG_JSON_CHK_IMG_LIST": "Sprawdź konfigurację wtyczki listy obrazów",
+    "VTLANG_JSON_CHK_IMG_LIST": "Sprawdź konfigurację pluginu Image List",
-    "VTLANG_JSON_CHK_IMG_BLIST": "Sprawdź konfigurację wtyczki czarnej listy obrazów",
+    "VTLANG_JSON_CHK_IMG_BLIST": "Sprawdź konfigurację pluginu Blacklist dla obrazów",
-    "VTLANG_JSON_CHK_CONF_REPLACE": "Sprawdź konfigurację wtyczki zastępującej konfigurację bootowania",
+    "VTLANG_JSON_CHK_CONF_REPLACE": "Sprawdź konfigurację pluginu Boot Conf Replace",
-    "VTLANG_JSON_CHK_DUD": "Sprawdź konfigurację wtyczki dud",
+    "VTLANG_JSON_CHK_DUD": "Sprawdź konfigurację pluginu DUD (Driver Update Disk)",
-    "VTLANG_JSON_CHK_PASSWORD": "Sprawdź konfigurację wtyczki hasła",
+    "VTLANG_JSON_CHK_PASSWORD": "Sprawdź konfigurację pluginu Password",
     
     "VTLANG_NORMAL_MODE": "Uruchom w trybie normalnym",
     "VTLANG_WIMBOOT_MODE": "Uruchom w trybie Wimboot",
@@ -74,7 +74,7 @@
     "VTLANG_NO_AUTOINS_SCRIPT": "Uruchom bez szablonu automatycznej instalacji",
     "VTLANG_AUTOINS_USE": "Uruchom z",
     
-    "VTLANG_NO_PERSIST": "Uruchom bez zachowania",
+    "VTLANG_NO_PERSIST": "Uruchom bez persistence (zapisywania ustawień)",
     "VTLANG_PERSIST_USE": "Uruchom z",
     
     "VTLANG_BROWER_RETURN": "Powrót",
@@ -84,10 +84,16 @@
     "VTLANG_ENTER_CONTINUE": "naciśnij klawisz Enter, aby kontynuować",
     
     "VTLANG_CTRL_TEMP_SET": "Tymczasowe ustawienia kontroli",
-    "VTLANG_WIN11_BYPASS_CHECK": "Pominięcie kontroli CPU/TPM/SecureBoot podczas instalacji Windows 11",
+    "VTLANG_WIN11_BYPASS_CHECK": "Pominięcie sprawdzania CPU/TPM/SecureBoot podczas instalacji Windows 11",
-    "VTLANG_WIN11_BYPASS_NRO": "Pominięcie wymogu posiadania konta online podczas instalacji systemu Windows 11",
+    "VTLANG_WIN11_BYPASS_NRO": "Pominięcie wymogu posiadania konta Microsoft podczas instalacji Windows 11",
-    "VTLANG_LINUX_REMOUNT": "Zamontuj partycję Ventoy po starcie Linuksa",
+    "VTLANG_LINUX_REMOUNT": "Zamontuj partycję Ventoy po uruchomieniu Linuksa",
-    "VTLANG_SECONDARY_BOOT_MENU": "Pokaż dodatkowe menu startowe",
+    "VTLANG_SECONDARY_BOOT_MENU": "Pokaż dodatkowe menu rozruchowe (boot menu)",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Zablokuj rozdzielczość podczas bootowania UEFI Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "Brak",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Najwyższa",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Stała 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "Co najmniej 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/pt_BR.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Ignorar o requerimento de conta online quanto instalar o Windows 11",
     "VTLANG_LINUX_REMOUNT": "Montar a partição do Ventoy após iniciar o Linux",
     "VTLANG_SECONDARY_BOOT_MENU": "Mostrar o menu secundário da inicialização",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/pt_PT.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Ignorar requerimento de conta online quanto instalando Windows 11",
     "VTLANG_LINUX_REMOUNT": "Montar partição Ventoy após boot do Linux",
     "VTLANG_SECONDARY_BOOT_MENU": "Mostar menu seundário de boot",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/ru_RU.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Обойти требование сетевой учётной записи при установке Windows 11",
     "VTLANG_LINUX_REMOUNT": "Смонтировать раздел Ventoy после загрузки Linux",
     "VTLANG_SECONDARY_BOOT_MENU": "Показать вторичное загрузочное меню",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/sl_si.json

@@ -88,6 +88,12 @@
   "VTLANG_WIN11_BYPASS_NRO": "Obid zahteve po spletnem računu pri namestitvi sistema Windows 11",
   "VTLANG_LINUX_REMOUNT": "Priklopi Ventoy particijo po zagonu Linuxa",
   "VTLANG_SECONDARY_BOOT_MENU": "Prikaz sekundarnega zagonskega menija",
+  "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+  "VTLANG_UEFI_RES_LOCK_NONE": "None",
+  "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+  "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
   "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/sr_RS.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Bypass online account requirement when install Windows 11",
     "VTLANG_LINUX_REMOUNT": "Mount Ventoy partition after boot Linux",
     "VTLANG_SECONDARY_BOOT_MENU": "Show secondary boot menu",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/ta_IN.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "விண்டோஸ் 11 ஐ நிறுவும் போது ஆன்லைன் கணக்கின் தேவையை புறக்கணிக்கவும்",
     "VTLANG_LINUX_REMOUNT": "லினக்ஸை துவக்கிய பிறகு Ventoy பகிர்வை ஏற்றவும்",
     "VTLANG_SECONDARY_BOOT_MENU": "இரண்டாம் நிலை துவக்க பட்டியலைக்  காட்டு",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/tr_TR.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Windows11'i yüklerken, çevrimiçi hesap gereksinimini(OOBE) atla",
     "VTLANG_LINUX_REMOUNT": "Linux sistemi önyükledikten sonra, Ventoy bölümünü bağla",
     "VTLANG_SECONDARY_BOOT_MENU": "İkincil önyükleme menüsünü göster",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/uk_UA.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Обійти вимогу онлайн-аккаунту під час інсталяції Windows 11",
     "VTLANG_LINUX_REMOUNT": "Монтувати розділ Ventoy після завантаження Linux",
     "VTLANG_SECONDARY_BOOT_MENU": "Показувати вторинне меню завантаження",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/vi_VN.json

@@ -88,6 +88,12 @@
     "VTLANG_WIN11_BYPASS_NRO": "Bỏ qua yêu cầu tài khoản trực tuyến khi cài đặt Windows 11",
     "VTLANG_LINUX_REMOUNT": "Gắn phân vùng Ventoy sau khi khởi động GNU/Linux",
     "VTLANG_SECONDARY_BOOT_MENU": "Hiện menu khởi động thứ cấp`",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
 
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/zh_CN.json

@@ -88,6 +88,11 @@
     "VTLANG_WIN11_BYPASS_NRO": "安装 Windows 11 时绕过在线账户的要求",
     "VTLANG_LINUX_REMOUNT": "启动 Linux 系统后挂载 Ventoy 分区",
     "VTLANG_SECONDARY_BOOT_MENU": "显示二级启动菜单",
+    "VTLANG_WIN_UEFI_RES_LOCK": "UEFI启动 Windows/WinPE 时锁定分辨率",
+    "VTLANG_UEFI_RES_LOCK_NONE": "不锁定",
+    "VTLANG_UEFI_RES_LOCK_MAX": "锁定最高分辨率",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "锁定 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "锁定 1024 x 768 及以上",
     
     "MENU_STR_XXX": ""
 }

INSTALL/grub/menu/zh_TW.json

@@ -88,6 +88,11 @@
     "VTLANG_WIN11_BYPASS_NRO": "安裝 Windows 11 時繞過登入帳戶的需求",
     "VTLANG_LINUX_REMOUNT": "啟動 Linux 系統後掛載 Ventoy 分區",
     "VTLANG_SECONDARY_BOOT_MENU": "顯示次要啟動選單",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
 
     "MENU_STR_XXX": ""
 }

INSTALL/sign_with_pass.exp

@@ -0,0 +1,19 @@
+#!/usr/bin/expect -f
+
+set password [lindex $argv 0]
+set key_file  [lindex $argv 1]
+set cert_file [lindex $argv 2]
+set input_file [lindex $argv 3]
+set output_file [lindex $argv 4]
+
+
+spawn bash -c "sbsign --key '$key_file' --cert '$cert_file' --output '$output_file' '$input_file' 2>&1"
+expect -nocase -re "Enter PEM pass phrase:"
+send "$password\r"
+
+
+expect eof
+
+
+set ret [wait]
+exit [lindex $ret 3]

INSTALL/tool/VentoyWorker.sh

@@ -12,7 +12,7 @@ print_usage() {
     echo '   -l  list Ventoy information in sdX'
     echo ''
     echo '  OPTION: (optional)'
-    echo '   -r SIZE_MB  preserve some space at the bottom of the disk (only for install)'
+    echo '   -r SIZE_MiB preserve some space (MiB) at the bottom of the disk (only for install)'
     echo '   -s/-S       enable/disable secure boot support (default is enabled)'
     echo '   -g          use GPT partition style, default is MBR (only for install)'
     echo '   -L          Label of the 1st exfat partition (default is Ventoy)'
@@ -93,7 +93,7 @@ fi
 
 if [ -n "$RESERVE_SPACE" -a "$MODE" = "install" ]; then
     if echo $RESERVE_SIZE_MB | grep -q '^[0-9][0-9]*$'; then
-        vtdebug "User will reserve $RESERVE_SIZE_MB MB disk space"
+        vtdebug "User will reserve $RESERVE_SIZE_MB MiB disk space"
     else
         vterr "$RESERVE_SIZE_MB is invalid for reserved space"
         exit 1
@@ -231,7 +231,7 @@ if [ "$MODE" = "install" -a -z "$NONDESTRUCTIVE" ]; then
         reserve_sector_num=$(expr $sum_size_mb \* 2048)
 
         if [ $disk_sector_num -le $reserve_sector_num ]; then
-            vterr "Can't reserve $RESERVE_SIZE_MB MB space from $DISK"
+            vterr "Can't reserve $RESERVE_SIZE_MB MiB space from $DISK"
             exit 1
         fi
     fi
@@ -239,7 +239,7 @@ if [ "$MODE" = "install" -a -z "$NONDESTRUCTIVE" ]; then
     #Print disk info
     echo "Disk : $DISK"
     parted -s $DISK p 2>&1 | grep Model
-    echo "Size : $disk_size_gb GB"
+    echo "Size : $disk_size_gb GiB"
     if [ -n "$VTGPT" ]; then
         echo "Style: GPT"
     else
@@ -248,7 +248,7 @@ if [ "$MODE" = "install" -a -z "$NONDESTRUCTIVE" ]; then
     echo ''
 
     if [ -n "$RESERVE_SPACE" ]; then
-        echo "You will reserve $RESERVE_SIZE_MB MB disk space "
+        echo "You will reserve $RESERVE_SIZE_MB MiB disk space "
     fi
     echo ''
 
@@ -395,7 +395,7 @@ elif [ "$MODE" = "install" -a -n "$NONDESTRUCTIVE" ]; then
     #Print disk info
     echo "Disk : $DISK"
     parted -s $DISK p 2>&1 | grep Model
-    echo "Size : $disk_size_gb GB" 
+    echo "Size : $disk_size_gb GiB" 
     echo "Style: $OldStyle"    
     echo ''
 
@@ -424,7 +424,7 @@ elif [ "$MODE" = "install" -a -n "$NONDESTRUCTIVE" ]; then
     PART1_MB=$(expr $PART1_4K / 256)
     PART1_NEW_MB=$(expr $PART1_MB - 32)
 
-    echo "$PART1 is ${PART1_MB}MB"
+    echo "$PART1 is ${PART1_MB}MiB"
 
     #check partition layout
     echo "check partition layout ..."

INSTALL/tool/create_ventoy_iso_part_dm.sh

@@ -0,0 +1,38 @@
+#!/bin/sh
+
+if [ "$(id -u)" -ne 0 ]; then    
+    echo "Please run with sudo ..."
+    exit 1
+fi
+
+oldpwd=$(pwd)
+VPART=""
+
+if dmsetup -h > /dev/null 2>&1; then
+    VPART_MAJOR_MINOR=$(dmsetup table ventoy | head -n 1 | awk '{print $4}')    
+    cd /sys/class/block/
+    for t in *; do
+        if grep -q "^${VPART_MAJOR_MINOR}$" $t/dev; then
+            VPART=$t
+            echo 0 $(cat /sys/class/block/$VPART/size) linear /dev/$VPART 0 | dmsetup create $VPART
+            dmsetup mknodes "$VPART" > /dev/null 2>&1
+            break
+        fi
+    done
+    cd $oldpwd
+    
+    if [ -z "$VPART" ]; then
+        echo "$VPART_MAJOR_MINOR not found"
+        dmsetup ls; dmsetup info ventoy; dmsetup table ventoy
+        exit 1
+    else                                 
+        if [ ! -b "/dev/mapper/$VPART" ]; then
+            udevadm trigger --type=devices --action=add  > /dev/null 2>&1
+            udevadm settle > /dev/null 2>&1
+        fi
+        echo "Create /dev/mapper/$VPART success"
+    fi    
+else
+    echo "dmsetup program not avaliable"
+    exit 1
+fi

INSTALL/tool/ventoy_lib.sh

@@ -341,6 +341,7 @@ EOF
    
     udevadm trigger --name-match=$DISK >/dev/null 2>&1
     partprobe >/dev/null 2>&1
+    partx -u $DISK >/dev/null 2>&1
     sleep 3
     echo "Done"
 
@@ -458,6 +459,7 @@ format_ventoy_disk_gpt() {
 
     udevadm trigger --name-match=$DISK >/dev/null 2>&1
     partprobe >/dev/null 2>&1
+    partx -u $DISK >/dev/null 2>&1
     sleep 3
     echo "Done"
 

INSTALL/ventoy_pack.sh

@@ -1,5 +1,64 @@
 #!/bin/sh
 
+if [ "$VENTOY_CERT_PASS" = "YES" ]; then
+    read -s -p "Enter cert key passphrase: " KEY_PASS   
+    echo
+
+    if openssl pkey -in "$VENTOY_CERT_KEY" -passin pass:"$KEY_PASS" -out /dev/null  > /dev/null 2>&1; then
+        echo "Password check OK"
+    else
+        echo "Incorrect password"
+        exit 1
+    fi
+fi
+
+SBAT_VER=1
+sign_efi() {
+    efi=$1
+    
+    if [ ! -f "$efi" ]; then
+        printf "### %-64s  non-exist\n" "$efi"
+        return
+    fi
+
+    #Don't sign if VENTOY_CERT_KEY is not defined.
+    if [ -z "$VENTOY_CERT_KEY" -o -z "$VENTOY_CERT_PEM" ]; then
+        printf "### %-64s  NO-CA\n" "$efi"
+        return
+    fi    
+
+    if echo $efi | grep -q '\.xz$'; then
+        xzcat $efi > ${efi}.unxz
+        mv ${efi}.unxz  ${efi}
+    fi
+
+    sbstr=$(printf "%08x" $SBAT_VER)
+    echo -en "\x8a\x06\x55\xf7\x4f\xe0\x2b\x45\x9d\x6d\x7c\x55\x96\xb3\xc0\x7d\x${sbstr:6:2}\x${sbstr:4:2}\x${sbstr:2:2}\x${sbstr:0:2}" | \
+        dd bs=1 count=20 of=${efi} seek=40 conv=notrunc status=none
+
+    rm -f "${efi}.signed"
+    if [ "$VENTOY_CERT_PASS" = "YES" ]; then
+        expect -f ./sign_with_pass.exp "$KEY_PASS" "$VENTOY_CERT_KEY" "$VENTOY_CERT_PEM" "${efi}" "${efi}.signed" >/dev/null 2>&1
+    else
+        sbsign --key "$VENTOY_CERT_KEY" --cert "$VENTOY_CERT_PEM" --output "${efi}.signed" "${efi}" >/dev/null 2>&1
+    fi
+
+    if [ -f "${efi}.signed" ]; then
+        if echo $efi | grep -q '\.xz$'; then
+            xz --check=crc32 "${efi}.signed"
+            mv "${efi}.signed.xz" "$efi"
+            rm -f "${efi}.signed"
+        else
+            mv "${efi}.signed" "$efi"
+        fi
+    else
+        echo "### %-64s  failed\n" "$efi"
+        exit 1
+    fi 
+
+    printf "### %-64s  success\n" "$efi"
+}
+
 if [ "$1" = "CI" ]; then
     OPT='-dR'
 else
@@ -126,11 +185,33 @@ mkdir -p $tmpmnt/tool
 dd status=none bs=1024 count=16  if=./tool/i386/vtoycli    of=$tmpmnt/tool/mount.exfat-fuse_i386
 dd status=none bs=1024 count=16  if=./tool/x86_64/vtoycli  of=$tmpmnt/tool/mount.exfat-fuse_x86_64
 dd status=none bs=1024 count=16  if=./tool/aarch64/vtoycli of=$tmpmnt/tool/mount.exfat-fuse_aarch64
+cp -a ./tool/create_ventoy_iso_part_dm.sh  $tmpmnt/tool/
 
 
 rm -f $tmpmnt/grub/i386-pc/*.img
 
 
+sign_efi $tmpmnt/EFI/BOOT/fbx64.efi
+sign_efi $tmpmnt/EFI/BOOT/fbia32.efi
+sign_efi $tmpmnt/EFI/BOOT/fbaa64.efi
+sign_efi $tmpmnt/EFI/BOOT/grubx64_real.efi
+sign_efi $tmpmnt/EFI/BOOT/grubia32_real.efi
+sign_efi $tmpmnt/ventoy/iso9660_x64.efi
+sign_efi $tmpmnt/ventoy/iso9660_ia32.efi
+sign_efi $tmpmnt/ventoy/iso9660_aa64.efi
+sign_efi $tmpmnt/ventoy/udf_x64.efi
+sign_efi $tmpmnt/ventoy/udf_ia32.efi
+sign_efi $tmpmnt/ventoy/udf_aa64.efi
+sign_efi $tmpmnt/ventoy/ventoy_x64.efi
+sign_efi $tmpmnt/ventoy/ventoy_ia32.efi
+sign_efi $tmpmnt/ventoy/ventoy_aa64.efi
+sign_efi $tmpmnt/ventoy/vtoyutil_x64.efi
+sign_efi $tmpmnt/ventoy/vtoyutil_ia32.efi
+sign_efi $tmpmnt/ventoy/vtoyutil_aa64.efi
+sign_efi $tmpmnt/ventoy/wimboot.i386.efi.xz
+sign_efi $tmpmnt/ventoy/wimboot.x86_64.xz
+
+
 umount $tmpmnt && rm -rf $tmpmnt
 
 
@@ -270,6 +351,13 @@ cd $CurDir
 mv ../LiveCDGUI/ventoy*.iso ./
 
 if [ -e ventoy-${curver}-windows.zip ] && [ -e ventoy-${curver}-linux.tar.gz ]; then
+
+    if [ -z "$VENTOY_CERT_KEY" -o -z "$VENTOY_CERT_PEM" ]; then
+        echo "[warning]: EFI files are not signed and can only boot when Secure Boot is disabled."
+        echo "[warning]: EFI files are not signed and can only boot when Secure Boot is disabled."
+        echo "[warning]: EFI files are not signed and can only boot when Secure Boot is disabled."
+    fi
+
     echo -e "\n ============= SUCCESS =================\n"
 else
     echo -e "\n ============= FAILED =================\n"