1.1.18 release

Plugson: cap Boot Conf Replace at 2 entries per mode (#3727 )
Ventoy only supports replacing up to 2 config files per mode, but Plugson's Boot Conf Replace page let users add unlimited entries with no indication that anything past the 2nd is silently ignored. Block the add action once 2 entries exist for the current tab and show a warning instead. Fixes #3593 Co-authored-by: Raj <raj@Rajs-MacBook-Pro.local>
2026-10-21 05:31:56 +00:00 · 2026-10-09 12:03:06 +08:00 · 2026-10-09 11:33:26 +08:00 · 2026-10-09 11:31:50 +08:00 · 2026-10-09 11:29:24 +08:00 · 2026-10-09 10:05:18 +08:00
178 changed files with 8362 additions and 2619 deletions
@@ -46,131 +46,132 @@
        <tr> <td>./IMG/cpio_x86/ventoy/tool/zstdcat</td> <td>build</td>  <td>Same with ./ZSTD/zstdcat<br/>Check the file hash to confirm</td>    </tr>
        <tr> <td>./IMG/cpio_x86/ventoy/tool/zstdcat64</td> <td>build</td>  <td>Same with ./ZSTD/zstdcat64<br/>Check the file hash to confirm</td>    </tr>
        <tr> <td>./INSTALL/EFI/BOOT/BOOTAA64.EFI</td> <td rowspan=4>build</td>  <td rowspan=4>Build Instructions:<br/> ./DOC/BuildVentoyFromSource.txt 4.1-Build grub2</td>                                     </tr>        
-        <tr> <td>./INSTALL/EFI/BOOT/BOOTMIPS.EFI</td>     
-        <tr> <td>./INSTALL/EFI/BOOT/grubia32_real.efi</td>
-        <tr> <td>./INSTALL/EFI/BOOT/grubx64_real.efi</td>
-        <tr> <td>./INSTALL/EFI/BOOT/grub.efi</td> <td rowspan=6>upstream</td>    <td rowspan=6>https://github.com/ValdikSS/Super-UEFIinSecureBoot-Disk </td>      </tr>        
-        <tr> <td>./INSTALL/EFI/BOOT/BOOTIA32.EFI</td> 
-        <tr> <td>./INSTALL/EFI/BOOT/BOOTX64.EFI</td> 
-        <tr> <td>./INSTALL/EFI/BOOT/grubia32.efi</td>
-        <tr> <td>./INSTALL/EFI/BOOT/mmia32.efi</td>
-        <tr> <td>./INSTALL/EFI/BOOT/MokManager.efi</td>
+        <tr> <td>./INSTALL/EFI/BOOT/BOOTMIPS.EFI</td>     </tr>
+        <tr> <td>./INSTALL/EFI/BOOT/grubia32_real.efi</td></tr>
+        <tr> <td>./INSTALL/EFI/BOOT/grubx64_real.efi</td></tr>
+        <tr> <td>./INSTALL/EFI/BOOT/BOOTIA32.EFI</td> <td rowspan=3>upstream</td>    <td rowspan=3>https://github.com/ValdikSS/Super-UEFIinSecureBoot-Disk </td>      </tr>        
+        <tr> <td>./INSTALL/EFI/BOOT/grubia32.efi</td></tr>
+        <tr> <td>./INSTALL/EFI/BOOT/mmia32.efi</td></tr>        
+        <tr> <td>./INSTALL/EFI/BOOT/BOOTX64.EFI</td> <td rowspan=2>upstream</td>    <td rowspan=2>From Rocky Linux 9.8 x86_64 ISO file<br/>Check the file hash to confirm </td>      </tr>        
+        <tr> <td>./INSTALL/EFI/BOOT/mmx64.efi</td></tr>        
        <tr> <td>./INSTALL/tool/aarch64/ash</td> <td rowspan=12>build</td>    <td rowspan=12>Build Instructions:<br/>./DOC/BUSYBOX/build.txt</td>    </tr>
-        <tr> <td>./INSTALL/tool/aarch64/hexdump</td>
-        <tr> <td>./INSTALL/tool/aarch64/xzcat</td>
-        <tr> <td>./INSTALL/tool/i386/ash</td>
-        <tr> <td>./INSTALL/tool/i386/hexdump</td>
-        <tr> <td>./INSTALL/tool/i386/xzcat</td>
-        <tr> <td>./INSTALL/tool/mips64el/ash</td>
-        <tr> <td>./INSTALL/tool/mips64el/hexdump</td>
-        <tr> <td>./INSTALL/tool/mips64el/xzcat</td>
-        <tr> <td>./INSTALL/tool/x86_64/ash</td>
-        <tr> <td>./INSTALL/tool/x86_64/hexdump</td>
-        <tr> <td>./INSTALL/tool/x86_64/xzcat</td>
+        <tr> <td>./INSTALL/tool/aarch64/hexdump</td></tr>
+        <tr> <td>./INSTALL/tool/aarch64/xzcat</td></tr>
+        <tr> <td>./INSTALL/tool/i386/ash</td></tr>
+        <tr> <td>./INSTALL/tool/i386/hexdump</td></tr>
+        <tr> <td>./INSTALL/tool/i386/xzcat</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/ash</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/hexdump</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/xzcat</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/ash</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/hexdump</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/xzcat</td></tr>
        <tr> <td>./INSTALL/tool/aarch64/Ventoy2Disk.gtk3</td> <td rowspan=6>build</td>    <td rowspan=6>Build Instructions:<br/>./LinuxGUI/build_gtk.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.gtk3</td>
-        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.gtk2</td>
-        <tr> <td>./INSTALL/tool/mips64el/Ventoy2Disk.gtk3</td>
-        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.gtk3</td>
-        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.gtk2</td>
+        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.gtk3</td></tr>
+        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.gtk2</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/Ventoy2Disk.gtk3</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.gtk3</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.gtk2</td></tr>
        <tr> <td>./INSTALL/tool/aarch64/Ventoy2Disk.qt5</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./LinuxGUI/build_qt.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.qt5</td>
-        <tr> <td>./INSTALL/tool/mips64el/Ventoy2Disk.qt5</td>
-        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.qt5</td>
+        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.qt5</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/Ventoy2Disk.qt5</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.qt5</td></tr>
        <tr> <td>./INSTALL/tool/aarch64/Plugson</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./Plugson/build.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/Plugson</td>
-        <tr> <td>./INSTALL/tool/mips64el/Plugson</td>
-        <tr> <td>./INSTALL/tool/x86_64/Plugson</td>
+        <tr> <td>./INSTALL/tool/i386/Plugson</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/Plugson</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/Plugson</td></tr>
        <tr> <td>./INSTALL/tool/aarch64/V2DServer</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./LinuxGUI/build.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/V2DServer</td>
-        <tr> <td>./INSTALL/tool/mips64el/V2DServer</td>
-        <tr> <td>./INSTALL/tool/x86_64/V2DServer</td>
-        <tr> <td>./INSTALL/tool/aarch64/mkexfatfs</td> <td rowspan=8>build</td>    <td rowspan=8>Build Instructions:<br/>./DOC/BuildVentoyFromSource.txt 4.9<br/>./ExFAT/buidexfat.sh<br/>./ExFAT/buidexfat_aarch64.sh<br/>./ExFAT/buidlibfuse.sh<br/>./ExFAT/buidlibfuse_aarch64.sh<br/></td>    </tr>
-        <tr> <td>./INSTALL/tool/aarch64/mount.exfat-fuse</td>
-        <tr> <td>./INSTALL/tool/i386/mkexfatfs</td>
-        <tr> <td>./INSTALL/tool/i386/mount.exfat-fuse</td>
-        <tr> <td>./INSTALL/tool/mips64el/mkexfatfs</td>
-        <tr> <td>./INSTALL/tool/mips64el/mount.exfat-fuse</td>
-        <tr> <td>./INSTALL/tool/x86_64/mkexfatfs</td>
-        <tr> <td>./INSTALL/tool/x86_64/mount.exfat-fuse</td>    
+        <tr> <td>./INSTALL/tool/i386/V2DServer</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/V2DServer</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/V2DServer</td></tr>
+        <tr> <td>./INSTALL/tool/aarch64/mkexfatfs</td> <td rowspan=9>build</td>    <td rowspan=8>Build Instructions:<br/>./DOC/BuildVentoyFromSource.txt 4.9<br/>./ExFAT/buidexfat.sh<br/>./ExFAT/buidexfat_aarch64.sh<br/>./ExFAT/buidlibfuse.sh<br/>./ExFAT/buidlibfuse_aarch64.sh<br/></td>    </tr>
+        <tr> <td>./INSTALL/tool/aarch64/mount.exfat-fuse</td></tr>
+        <tr> <td>./INSTALL/tool/i386/mkexfatfs</td></tr>
+        <tr> <td>./INSTALL/tool/i386/mount.exfat-fuse</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/mkexfatfs</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/mount.exfat-fuse</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/mkexfatfs</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/mkexfatfs_static</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/mount.exfat-fuse</td>   </tr> 
        <tr> <td>./INSTALL/tool/aarch64/vlnk</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./Vlnk/build.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/vlnk</td>
-        <tr> <td>./INSTALL/tool/mips64el/vlnk</td>
-        <tr> <td>./INSTALL/tool/x86_64/vlnk</td>
+        <tr> <td>./INSTALL/tool/i386/vlnk</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/vlnk</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/vlnk</td></tr>
        <tr> <td>./INSTALL/tool/aarch64/vtoycli</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./vtoycli/build.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/vtoycli</td>
-        <tr> <td>./INSTALL/tool/mips64el/vtoycli</td>
-        <tr> <td>./INSTALL/tool/x86_64/vtoycli</td>
+        <tr> <td>./INSTALL/tool/i386/vtoycli</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/vtoycli</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/vtoycli</td></tr>
        <tr> <td>./INSTALL/ventoy/imdisk/32/imdisk.cpl</td>  <td rowspan=6>upstream</td>  <td rowspan=6>Download from imdisk project.<br/>URL & File Hash documented in<br/> ./DOC/BuildVentoyFromSource.txt 5.8</td>      </tr>
-        <tr> <td>./INSTALL/ventoy/imdisk/32/imdisk.exe</td>
-        <tr> <td>./INSTALL/ventoy/imdisk/32/imdisk.sys</td>
-        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.cpl</td>
-        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.exe</td>
-        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.sys</td>
+        <tr> <td>./INSTALL/ventoy/imdisk/32/imdisk.exe</td></tr>
+        <tr> <td>./INSTALL/ventoy/imdisk/32/imdisk.sys</td></tr>
+        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.cpl</td></tr>
+        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.exe</td></tr>
+        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.sys</td></tr>
        <tr> <td>./INSTALL/ventoy/iso9660_aa64.efi</td> <td rowspan=6>build</td>    <td rowspan=6>Build Instructions:<br/>./DOC/BuildVentoyFromSource.txt 4.17</td>    </tr>
-        <tr> <td>./INSTALL/ventoy/udf_aa64.efi</td>
-        <tr> <td>./INSTALL/ventoy/iso9660_ia32.efi</td>
-        <tr> <td>./INSTALL/ventoy/udf_ia32.efi</td>
-        <tr> <td>./INSTALL/ventoy/iso9660_x64.efi</td>
-        <tr> <td>./INSTALL/ventoy/udf_x64.efi</td>
+        <tr> <td>./INSTALL/ventoy/udf_aa64.efi</td></tr>
+        <tr> <td>./INSTALL/ventoy/iso9660_ia32.efi</td></tr>
+        <tr> <td>./INSTALL/ventoy/udf_ia32.efi</td></tr>
+        <tr> <td>./INSTALL/ventoy/iso9660_x64.efi</td></tr>
+        <tr> <td>./INSTALL/ventoy/udf_x64.efi</td></tr>
        <tr> <td>./INSTALL/VentoyGUI.aarch64</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./LinuxGUI/build_gtk.sh</td>    </tr>
-        <tr> <td>./INSTALL/VentoyGUI.i386</td>
-        <tr> <td>./INSTALL/VentoyGUI.mips64el</td>
-        <tr> <td>./INSTALL/VentoyGUI.x86_64</td>
+        <tr> <td>./INSTALL/VentoyGUI.i386</td></tr>
+        <tr> <td>./INSTALL/VentoyGUI.mips64el</td></tr>
+        <tr> <td>./INSTALL/VentoyGUI.x86_64</td></tr>
        <tr> <td>./INSTALL/Ventoy2Disk.exe</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./Ventoy2Disk/Ventoy2Disk.sln</td>    </tr>
-        <tr> <td>./INSTALL/Ventoy2Disk_ARM.exe</td>
-        <tr> <td>./INSTALL/Ventoy2Disk_ARM64.exe</td>
-        <tr> <td>./INSTALL/Ventoy2Disk_X64.exe</td>
+        <tr> <td>./INSTALL/Ventoy2Disk_ARM.exe</td></tr>
+        <tr> <td>./INSTALL/Ventoy2Disk_ARM64.exe</td></tr>
+        <tr> <td>./INSTALL/Ventoy2Disk_X64.exe</td></tr>
        <tr> <td>./INSTALL/ventoy/vtoyjump32.exe</td> <td rowspan=2>build</td>    <td rowspan=2>Build Instructions:<br/>./vtoyjump/vtoyjump.sln</td>    </tr>
-        <tr> <td>./INSTALL/ventoy/vtoyjump64.exe</td>
-        <tr> <td>./INSTALL/ventoy/ventoy_aa64.efi</td>  <td rowspan=6>build</td>  <td rowspan=6>Build Instructions:<br/>./EDK2/buildedk.sh</td>    </tr>
-        <tr> <td>./INSTALL/ventoy/ventoy_ia32.efi</td>
-        <tr> <td>./INSTALL/ventoy/ventoy_x64.efi</td>
-        <tr> <td>./INSTALL/ventoy/vtoyutil_aa64.efi</td>
-        <tr> <td>./INSTALL/ventoy/vtoyutil_ia32.efi</td>
-        <tr> <td>./INSTALL/ventoy/vtoyutil_x64.efi</td>
+        <tr> <td>./INSTALL/ventoy/vtoyjump64.exe</td></tr>
+        <tr> <td>./INSTALL/ventoy/ventoy_aa64.efi</td>  <td rowspan=7>build</td>  <td rowspan=7>Build Instructions:<br/>./EDK2/buildedk.sh</td>    </tr>
+        <tr> <td>./INSTALL/ventoy/ventoy_ia32.efi</td></tr>
+        <tr> <td>./INSTALL/ventoy/ventoy_x64.efi</td></tr>
+        <tr> <td>./INSTALL/ventoy/vtoyutil_aa64.efi</td></tr>
+        <tr> <td>./INSTALL/ventoy/vtoyutil_ia32.efi</td></tr>
+        <tr> <td>./INSTALL/ventoy/vtoyutil_x64.efi</td></tr>
+        <tr> <td>./INSTALL/EFI/BOOT/fbx64.efi</td></tr>
        <tr> <td>./INSTALL/ventoy/ipxe.krn</td> <td>build</td>  <td>Build Instructions:<br/>./IPXE/buildipxe.sh</td>    </tr>
        <tr> <td>./INSTALL/ventoy/memdisk</td> <td>upstream</td>  <td>Download from syslinux project.<br/>URL & File Hash documented in<br/> ./DOC/BuildVentoyFromSource.txt 5.9</td>      </tr>        
        <tr> <td>./LiveCD/ISO/EFI/boot/vmlinuz64</td> <td>upstream</td>  <td>Download from TinyLinux website.<br/>URL & File Hash documented in<br/> ./DOC/BuildVentoyFromSource.txt 5.14</td>      </tr>
        <tr> <td>./LiveCDGUI/EXT/busybox-x86_64</td> <td>build</td>  <td>Same with ./IMG/cpio_x86/ventoy/busybox/busybox64<br/>Check the file hash to confirm</td>    </tr>
        <tr> <td>./LiveCDGUI/GRUB/bootx64.efi</td> <td rowspan=2>build</td>  <td rowspan=2>./DOC/BuildVentoyFromSource.txt 4.1-Build grub2</td>    </tr>
-        <tr> <td>./LiveCD/GRUB/bootx64.efi</td>
+        <tr> <td>./LiveCD/GRUB/bootx64.efi</td></tr>
        <tr> <td>./LZIP/lunzip32</td> <td rowspan=3>build</td>  <td rowspan=3>Build Instructions:<br/>./DOC/BuildVentoyFromSource.txt 4.19</td>    </tr>
-        <tr> <td>./LZIP/lunzip64</td>
-        <tr> <td>./LZIP/lunzipaa64</td>
+        <tr> <td>./LZIP/lunzip64</td></tr>
+        <tr> <td>./LZIP/lunzipaa64</td></tr>
        <tr> <td>./LZIP/lz4cat64</td> <td rowspan=3>build</td>  <td rowspan=3>Build Instructions:<br/>./LZIP/buildlz4.txt</td>    </tr>
-        <tr> <td>./LZIP/lz4cataa64</td>
-        <tr> <td>./LZIP/lz4catm64e</td>
+        <tr> <td>./LZIP/lz4cataa64</td></tr>
+        <tr> <td>./LZIP/lz4catm64e</td></tr>
        <tr> <td>./Plugson/vs/VentoyPlugson/Release/VentoyPlugson.exe</td> <td rowspan=2>build</td>    <td rowspan=2>Build Instructions:<br/>./Plugson/vs/VentoyPlugson/VentoyPlugson.sln</td>    </tr>
-        <tr> <td>./Plugson/vs/VentoyPlugson/x64/Release/VentoyPlugson_X64.exe</td>
+        <tr> <td>./Plugson/vs/VentoyPlugson/x64/Release/VentoyPlugson_X64.exe</td></tr>
        <tr> <td>./SQUASHFS/unsquashfs_32</td> <td rowspan=3>build</td>    <td rowspan=3>Build Instructions:<br/>./SQUASHFS/build.sh</td>    </tr>
-        <tr> <td>./SQUASHFS/unsquashfs_64</td>
-        <tr> <td>./SQUASHFS/unsquashfs_aa64</td>
+        <tr> <td>./SQUASHFS/unsquashfs_64</td></tr>
+        <tr> <td>./SQUASHFS/unsquashfs_aa64</td></tr>
        <tr> <td>./Unix/ventoy_unix/DragonFly/sbin/dmsetup</td> <td>upstream</td>   <td>Get from DragonFly ISO.<br/>URL & File Hash documented in<br/> ./DOC/BuildVentoyFromSource.txt 5.13</td>      </tr>
        <tr> <td>./Unix/ventoy_unix/DragonFly/sbin/init</td> <td>build</td>    <td>Build Instructions:<br/>./Unix/ventoy_unix_src/DragonFly/build.sh</td>    </tr>
        <tr> <td>./VBLADE/vblade-master/vblade_32</td> <td rowspan=3>build</td>    <td rowspan=3>Build Instructions:<br/>./VBLADE/vblade-master/build.sh</td>    </tr>
-        <tr> <td>./VBLADE/vblade-master/vblade_64</td>
-        <tr> <td>./VBLADE/vblade-master/vblade_aa64</td>
+        <tr> <td>./VBLADE/vblade-master/vblade_64</td></tr>
+        <tr> <td>./VBLADE/vblade-master/vblade_aa64</td></tr>
        <tr> <td>./Vlnk/vs/VentoyVlnk/Release/VentoyVlnk.exe</td> <td>build</td>     <td>Build Instructions:<br/>./Vlnk/vs/VentoyVlnk/VentoyVlnk.sln</td>    </tr>
        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_32</td> <td rowspan=6>build</td>    <td rowspan=6>Build Instructions:<br/>./VtoyTool/build.sh</td>    </tr>
-        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_64</td>
-        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_aa64</td>
-        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_m64e</td>
-        <tr> <td>./VtoyTool/vtoytool/01/vtoytool_64</td>
-        <tr> <td>./VtoyTool/vtoytool/02/vtoytool_64</td>
+        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_64</td></tr>
+        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_aa64</td></tr>
+        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_m64e</td></tr>
+        <tr> <td>./VtoyTool/vtoytool/01/vtoytool_64</td></tr>
+        <tr> <td>./VtoyTool/vtoytool/02/vtoytool_64</td></tr>
        <tr> <td>./ZSTD/zstdcat</td> <td rowspan=3>build</td>    <td rowspan=3>Build Instructions:<br/>./ZSTD/build.txt</td>    </tr>
-        <tr> <td>./ZSTD/zstdcat64</td>
-        <tr> <td>./ZSTD/zstdcataa64</td>
+        <tr> <td>./ZSTD/zstdcat64</td></tr>
+        <tr> <td>./ZSTD/zstdcataa64</td></tr>
        <tr> <td>./IMG/cpio_x86/ventoy/busybox/busybox32</td> <td rowspan=6>build</td>    <td rowspan=6>Build Instructions:<br/>./BUSYBOX/build.txt full busybox</td>    </tr>
-        <tr> <td>./IMG/cpio_x86/ventoy/busybox/busybox64</td>
-        <tr> <td>./IMG/cpio_x86/ventoy/busybox/xzcat32_musl</td>
-        <tr> <td>./IMG/cpio_x86/ventoy/busybox/xzcat64_musl</td>
-        <tr> <td>./IMG/cpio_arm64/ventoy/busybox/busyboxaa64</td>
-        <tr> <td>./IMG/cpio_mips64/ventoy/busybox/busyboxm64e</td>          
+        <tr> <td>./IMG/cpio_x86/ventoy/busybox/busybox64</td></tr>
+        <tr> <td>./IMG/cpio_x86/ventoy/busybox/xzcat32_musl</td></tr>
+        <tr> <td>./IMG/cpio_x86/ventoy/busybox/xzcat64_musl</td></tr>
+        <tr> <td>./IMG/cpio_arm64/ventoy/busybox/busyboxaa64</td></tr>
+        <tr> <td>./IMG/cpio_mips64/ventoy/busybox/busyboxm64e</td> </tr>         
        <tr> <td>ISNTALL/ventoy/7z/64/7za.exe</td>  <td rowspan=2>upstream</td>  <td>Download from 7z project.<br/>URL & File Hash documented in<br/> ./DOC/BuildVentoyFromSource.txt 5.12</td>      </tr>
-        <tr> <td>ISNTALL/ventoy/7z/32/7za.exe</td>  
+        <tr> <td>ISNTALL/ventoy/7z/32/7za.exe</td></tr>  
        <tr> <td>./INSTALL/ventoy/wimboot.i386.efi</td> <td rowspan=2>build</td>    <td rowspan=2>Build Instructions:<br/>./wimboot/build.sh</td>    </tr>
-        <tr> <td>./INSTALL/ventoy/wimboot.x86_64</td>        
+        <tr> <td>./INSTALL/ventoy/wimboot.x86_64</td></tr>        
        <tr> <td> ./Unix/ventoy_unix/ClonOS/geom_ventoy_ko/13.x/64/geom_ventoy.ko</td> <td rowspan=18>build</td>    <td rowspan=18>Build Instructions:<br/>./Unix/BuildUnixKmod.txt</td>    </tr>
        <tr> <td> ./Unix/ventoy_unix/FreeBSD/geom_ventoy_ko/10.x/32/geom_ventoy.ko</td></tr>
        <tr> <td> ./Unix/ventoy_unix/FreeBSD/geom_ventoy_ko/10.x/64/geom_ventoy.ko</td></tr>
@@ -25,22 +25,21 @@
    Next I assume that you have unzipped the code into the /home directory (check /home/Ventoy-master/README.md file for the directory layout).
    
 2.2 Download third-party source code and tool
-    
-    https://www.fefe.de/dietlibc/dietlibc-0.34.tar.xz                    ===>  /home/Ventoy-master/DOC/dietlibc-0.34.tar.xz
-    https://musl.libc.org/releases/musl-1.2.1.tar.gz                     ===>  /home/Ventoy-master/DOC/musl-1.2.1.tar.gz
-    https://ftp.gnu.org/gnu/grub/grub-2.04.tar.xz                        ===>  /home/Ventoy-master/GRUB2/grub-2.04.tar.xz
-    https://codeload.github.com/tianocore/edk2/zip/edk2-stable201911     ===>  /home/Ventoy-master/EDK2/edk2-edk2-stable201911.zip
-    https://codeload.github.com/relan/exfat/zip/v1.3.0                   ===>  /home/Ventoy-master/ExFAT/exfat-1.3.0.zip
-    https://codeload.github.com/libfuse/libfuse/zip/fuse-2.9.9           ===>  /home/Ventoy-master/ExFAT/libfuse-fuse-2.9.9.zip
-    https://releases.linaro.org/components/toolchain/binaries/7.4-2019.02/aarch64-linux-gnu/gcc-linaro-7.4.1-2019.02-x86_64_aarch64-linux-gnu.tar.xz           ===>  /opt/gcc-linaro-7.4.1-2019.02-x86_64_aarch64-linux-gnu.tar.xz
-    https://toolchains.bootlin.com/downloads/releases/toolchains/aarch64/tarballs/aarch64--uclibc--stable-2020.08-1.tar.bz2 ===> /opt/aarch64--uclibc--stable-2020.08-1.tar.bz2
-    https://github.com/ventoy/vtoytoolchain/releases/download/1.0/mips-loongson-gcc7.3-2019.06-29-linux-gnu.tar.gz ===> /opt/mips-loongson-gcc7.3-2019.06-29-linux-gnu.tar.gz
-    https://github.com/ventoy/musl-cross-make/releases/download/latest/output.tar.bz2 ===> /opt/output.tar.bz2
+    wget https://github.com/ventoy/vtoytoolchain/releases/download/1.0/dietlibc-0.34.tar.xz -O /home/Ventoy-master/DOC/dietlibc-0.34.tar.xz
+    wget https://musl.libc.org/releases/musl-1.2.1.tar.gz -O /home/Ventoy-master/DOC/musl-1.2.1.tar.gz
+    wget https://ftp.gnu.org/gnu/grub/grub-2.04.tar.xz -O /home/Ventoy-master/GRUB2/grub-2.04.tar.xz
+    wget https://codeload.github.com/tianocore/edk2/zip/edk2-stable201911 -O /home/Ventoy-master/EDK2/edk2-edk2-stable201911.zip
+    wget https://codeload.github.com/relan/exfat/zip/v1.3.0 -O /home/Ventoy-master/ExFAT/exfat-1.3.0.zip
+    wget https://codeload.github.com/libfuse/libfuse/zip/fuse-2.9.9 -O /home/Ventoy-master/ExFAT/libfuse-fuse-2.9.9.zip
+    wget https://github.com/ventoy/vtoytoolchain/releases/download/1.0/gcc-linaro-7.4.1-2019.02-x86_64_aarch64-linux-gnu.tar.xz -O /opt/gcc-linaro-7.4.1-2019.02-x86_64_aarch64-linux-gnu.tar.xz
+    wget https://toolchains.bootlin.com/downloads/releases/toolchains/aarch64/tarballs/aarch64--uclibc--stable-2020.08-1.tar.bz2 -O /opt/aarch64--uclibc--stable-2020.08-1.tar.bz2
+    wget https://github.com/ventoy/vtoytoolchain/releases/download/1.0/mips-loongson-gcc7.3-2019.06-29-linux-gnu.tar.gz -O /opt/mips-loongson-gcc7.3-2019.06-29-linux-gnu.tar.gz
+    wget https://github.com/ventoy/musl-cross-make/releases/download/latest/output.tar.bz2 -O /opt/output.tar.bz2


-    http://www.tinycorelinux.net/11.x/x86_64/release/distribution_files/vmlinuz64 ===> /home/Ventoy-master/LiveCD/ISO/EFI/boot/vmlinuz64
-    http://www.tinycorelinux.net/11.x/x86_64/release/distribution_files/corepure64.gz ===> /home/Ventoy-master/LiveCD/ISO/EFI/boot/corepure64.gz
-    http://www.tinycorelinux.net/11.x/x86_64/release/distribution_files/modules64.gz ===> /home/Ventoy-master/LiveCD/ISO/EFI/boot/modules64.gz    
+    wget http://www.tinycorelinux.net/11.x/x86_64/release/distribution_files/vmlinuz64 -O /home/Ventoy-master/LiveCD/ISO/EFI/boot/vmlinuz64
+    wget http://www.tinycorelinux.net/11.x/x86_64/release/distribution_files/corepure64.gz -O /home/Ventoy-master/LiveCD/ISO/EFI/boot/corepure64.gz
+    wget http://www.tinycorelinux.net/11.x/x86_64/release/distribution_files/modules64.gz -O /home/Ventoy-master/LiveCD/ISO/EFI/boot/modules64.gz

 2.3 Prepare third-party tools
    cd /home/Ventoy-master/DOC/
@@ -232,7 +231,7 @@
  SHA-256: cde08b6a2cf5ad914f05203e18e3f7c2ed6060a63604e3d75536f19b55e8e0af  

 5.8 imdisk
-  download http://www.ltr-data.se/files/imdiskinst.exe and extract it by 7zip.
+  download http://static.ltr-data.se/files/imdiskinst_2.0.10.exe and extract it by 7zip.
  
  INSTALL/ventoy/imdisk/64/imdisk.sys --> sys/amd64/imdisk.sys  SHA-256: 6702202220268787e361f5a82dae53362c8e6c6dcd240bb01b44dd77ae0788da
  INSTALL/ventoy/imdisk/64/imdisk.exe --> cli/amd64/imdisk.exe  SHA-256: 9759175380af836869443e5f21ce2e33022125d154bc6b3d1c04dc36b190de04
@@ -274,3 +273,4 @@
 5.14 ./LiveCD/ISO/EFI/boot/vmlinuz64
 download from http://www.tinycorelinux.net/11.x/x86_64/archive/11.0/distribution_files/vmlinuz64    
 vmlinuz64  SHA-256: 641077fc1f9914af244c248453005f56536ba9e7f54ba3e52402f26709ddb8a5
+
@@ -0,0 +1,113 @@
+#!/bin/sh
+
+if [ -z "$1" ]; then
+    EDKARCH=X64
+    postfix=x64
+elif [ "$1" = "ia32" ]; then
+    EDKARCH=IA32
+    postfix=ia32
+    shift
+elif [ "$1" = "aa64" ]; then
+    EDKARCH=AARCH64
+    postfix=aa64
+    shift
+fi
+
+cd edk2-edk2-stable201911
+
+rm -rf ./Conf/.cache
+rm -f ./Conf/.AutoGenIdFile.txt
+
+VTEFI_PATH=Build/MdeModule/RELEASE_GCC48/$EDKARCH/MdeModulePkg/Application/VtoyShim/VtoyShim/OUTPUT/VtoyShim.efi
+DST_PATH=../../INSTALL/EFI/BOOT/fb${postfix}.efi
+
+
+rm -f $VTEFI_PATH
+rm -f $DST_PATH
+
+unset WORKSPACE
+source ./edksetup.sh
+
+if [ "$EDKARCH" = "AARCH64" ]; then    
+    PATH=$PATH:/opt/gcc-linaro-7.4.1-2019.02-x86_64_aarch64-linux-gnu/bin \
+    GCC48_AARCH64_PREFIX=aarch64-linux-gnu- \
+    build -p MdeModulePkg/MdeModulePkg.dsc -a $EDKARCH -b RELEASE -t GCC48  -m MdeModulePkg/Application/VtoyShim/VtoyShim.inf
+else
+    build -p MdeModulePkg/MdeModulePkg.dsc -a $EDKARCH -b RELEASE -t GCC48  -m MdeModulePkg/Application/VtoyShim/VtoyShim.inf
+fi
+
+if [ -e $VTEFI_PATH ]; then
+
+    objdump -h "$VTEFI_PATH"
+    echo ""
+
+    objcopy \
+        --add-section .sbat="MdeModulePkg/Application/VtoyShim/sbat.csv" \
+        --set-section-flags .sbat=alloc,load,readonly,data \
+        "$VTEFI_PATH" "$DST_PATH"
+
+    #find the right sbat section VMA
+    tmpfile=$(mktemp)
+    
+    cnt1=$(objdump -h "$DST_PATH" | grep -P '^\s*[0-9][0-9]* \.' | wc -l)
+    cnt2=$(objdump -h "$DST_PATH" | grep -P 'ALLOC' | wc -l)
+    
+    if [ $cnt1 -ne $cnt2 ]; then
+        echo "Section count mismatch $cnt1 $cnt2"
+        objdump -h "$DST_PATH"
+        exit 1
+    fi
+
+    objdump -h "$DST_PATH" | grep -P '^\s*[0-9][0-9]* \.' > $tmpfile    
+    sbat_size=$(stat -c '%s' MdeModulePkg/Application/VtoyShim/sbat.csv)    
+    sbat_size_hex=$(printf '0x%08x' $sbat_size)
+    
+    lmax='0000000000000000'
+    lsize='0000000000000000'
+    while read line; do
+        echo $line        
+        lbase=$(echo $line | awk '{print $4}')        
+        if expr "$lmax" \< "$lbase" > /dev/null; then
+            lmax=$lbase
+            lsize=$(echo $line | awk '{print $3}')
+        fi
+        echo "max=$lmax size=$lsize"
+    done < $tmpfile
+    rm -f $tmpfile
+
+
+    lvma=$((0x${lsize}+0x${lmax}))
+    lvma_align=`printf '0x%08x' $(( (lvma + 4095) / 4096 * 4096 ))`
+    echo "sbat section lvma_align=$lvma_align"    
+    
+    objcopy --adjust-section-vma .sbat=$lvma_align "$DST_PATH"
+
+    img_base=$(objdump -p "$DST_PATH" | grep ImageBase | awk '{print $2}')
+    size_img=0x$(objdump -p "$DST_PATH" | grep SizeOfImage | awk '{print $2}')
+    sbat_end=`printf '0x%08x' $(($lvma_align+$sbat_size_hex))`
+
+    if [ "$img_base" != "0000000000000000" ]; then
+        echo "#### ImageBase is not 0 $img_base"
+        exit 1
+    fi
+    
+    echo "size_img=$size_img  sbat_size=$sbat_size_hex sbat_range $lvma_align - $sbat_end"    
+
+    if expr "$size_img" \< "$sbat_end" > /dev/null; then
+        echo "SizeOfImage $size_img less than sbat section addr $sbat_end"
+        exit 1
+    else
+        echo "SizeOfImage $size_img >= $sbat_end is OK"
+    fi
+
+    objdump -h "$DST_PATH"
+
+    echo -e '\n\n====================== SUCCESS ========================\n\n'    
+
+    cd ..
+else
+    echo -e '\n\n====================== FAILED ========================\n\n'
+    cd ..
+    exit 1
+fi
+
@@ -19,3 +19,7 @@ sh ./build.sh aa64 || exit 1
 echo '======== build EDK2 for x86_64-efi ==============='
 sh ./build.sh      || exit 1

+
+echo '======== build EDK2 for x86_64-efi ==============='
+sh ./build_shim.sh      || exit 1
+
@@ -7,12 +7,12 @@
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 3 of the
 * License, or (at your option) any later version.
- * 
+ *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
- * 
+ *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see <http://www.gnu.org/licenses/>.
 *
@@ -76,7 +76,7 @@ STATIC EFI_EXIT_BOOT_SERVICES g_org_exit_boot_service = NULL;

 /* Boot filename */
 UINTN gBootFileStartIndex = 1;
-CONST CHAR16 *gEfiBootFileName[] = 
+CONST CHAR16 *gEfiBootFileName[] =
 {
    L"@",
    EFI_REMOVABLE_MEDIA_FILE_NAME,
@@ -101,7 +101,7 @@ CONST CHAR16 *gEfiBootFileName[] =
    L"\\EFI\\BOOT\\bootaa64.efi",
    L"\\efi\\boot\\bootaa64.efi",
 #endif
-    
+
 };

 VOID EFIAPI VtoyDebug(IN CONST CHAR8  *Format, ...)
@@ -112,14 +112,14 @@ VOID EFIAPI VtoyDebug(IN CONST CHAR8  *Format, ...)
    VA_START (Marker, Format);
    UnicodeVSPrintAsciiFormat(Buffer, sizeof(Buffer), Format, Marker);
    VA_END (Marker);
-    
+
    gST->ConOut->OutputString(gST->ConOut, Buffer);
 }

 VOID EFIAPI ventoy_clear_input(VOID)
 {
    EFI_INPUT_KEY Key;
-    
+
    gST->ConIn->Reset(gST->ConIn, FALSE);
    while (EFI_SUCCESS == gST->ConIn->ReadKeyStroke(gST->ConIn, &Key))
    {
@@ -142,7 +142,7 @@ static void EFIAPI ventoy_dump_img_chunk(ventoy_chain_head *chain)
    for (i = 0; i < chain->img_chunk_num; i++)
    {
        debug("%2u: [ %u - %u ] <==> [ %llu - %llu ]",
-               i, chunk[i].img_start_sector, chunk[i].img_end_sector, 
+               i, chunk[i].img_start_sector, chunk[i].img_end_sector,
               chunk[i].disk_start_sector, chunk[i].disk_end_sector);

        if (i > 0 && (chunk[i].img_start_sector != chunk[i - 1].img_end_sector + 1))
@@ -161,7 +161,7 @@ static void EFIAPI ventoy_dump_img_chunk(ventoy_chain_head *chain)
    {
        debug("image chunk size check failed %d", errcnt);
    }
-    
+
    ventoy_debug_pause();
 }

@@ -169,7 +169,7 @@ static void EFIAPI ventoy_dump_override_chunk(ventoy_chain_head *chain)
 {
    UINT32 i;
    ventoy_override_chunk *chunk;
-    
+
    chunk = (ventoy_override_chunk *)((char *)chain + chain->override_chunk_offset);

    debug("##################### ventoy_dump_override_chunk #######################");
@@ -186,7 +186,7 @@ static void EFIAPI ventoy_dump_virt_chunk(ventoy_chain_head *chain)
 {
    UINT32 i;
    ventoy_virt_chunk *node;
-     
+
    debug("##################### ventoy_dump_virt_chunk #######################");
    debug("virt_chunk_offset=%u", chain->virt_chunk_offset);
    debug("virt_chunk_num=%u",    chain->virt_chunk_num);
@@ -194,7 +194,7 @@ static void EFIAPI ventoy_dump_virt_chunk(ventoy_chain_head *chain)
    node = (ventoy_virt_chunk *)((char *)chain + chain->virt_chunk_offset);
    for (i = 0; i < chain->virt_chunk_num; i++, node++)
    {
-        debug("%2u: mem:[ %u, %u, %u ]  remap:[ %u, %u, %u ]", i, 
+        debug("%2u: mem:[ %u, %u, %u ]  remap:[ %u, %u, %u ]", i,
               node->mem_sector_start,
               node->mem_sector_end,
               node->mem_sector_offset,
@@ -202,7 +202,7 @@ static void EFIAPI ventoy_dump_virt_chunk(ventoy_chain_head *chain)
               node->remap_sector_end,
               node->org_sector_start);
    }
-    
+
    ventoy_debug_pause();
 }

@@ -211,7 +211,7 @@ static void EFIAPI ventoy_dump_chain(ventoy_chain_head *chain)
    UINT32 i = 0;
    UINT8 chksum = 0;
    UINT8 *guid;
-    
+
    guid = chain->os_param.vtoy_disk_guid;
    for (i = 0; i < sizeof(ventoy_os_param); i++)
    {
@@ -229,10 +229,10 @@ static void EFIAPI ventoy_dump_chain(ventoy_chain_head *chain)
    debug("os_param->vtoy_img_size=<%llu>",    chain->os_param.vtoy_img_size);
    debug("os_param->vtoy_img_location_addr=<0x%llx>", chain->os_param.vtoy_img_location_addr);
    debug("os_param->vtoy_img_location_len=<%u>",    chain->os_param.vtoy_img_location_len);
-    debug("os_param->vtoy_reserved=<%u %u %u %u %u %u %u>",    
-          g_os_param_reserved[0], 
-          g_os_param_reserved[1], 
-          g_os_param_reserved[2], 
+    debug("os_param->vtoy_reserved=<%u %u %u %u %u %u %u>",
+          g_os_param_reserved[0],
+          g_os_param_reserved[1],
+          g_os_param_reserved[2],
          g_os_param_reserved[3],
          g_os_param_reserved[4],
          g_os_param_reserved[5],
@@ -240,7 +240,7 @@ static void EFIAPI ventoy_dump_chain(ventoy_chain_head *chain)
          );

    ventoy_debug_pause();
-    
+
    debug("chain->disk_drive=0x%x",          chain->disk_drive);
    debug("chain->disk_sector_size=%u",      chain->disk_sector_size);
    debug("chain->real_img_size_in_bytes=%llu",   chain->real_img_size_in_bytes);
@@ -252,7 +252,7 @@ static void EFIAPI ventoy_dump_chain(ventoy_chain_head *chain)
    debug("chain->override_chunk_num=%u",    chain->override_chunk_num);

    ventoy_debug_pause();
-    
+
    ventoy_dump_img_chunk(chain);
    ventoy_dump_override_chunk(chain);
    ventoy_dump_virt_chunk(chain);
@@ -344,7 +344,7 @@ EFI_HANDLE EFIAPI ventoy_get_parent_handle(IN EFI_DEVICE_PATH_PROTOCOL *pDevPath
    EFI_DEVICE_PATH_PROTOCOL *pLastNode = NULL;
    EFI_DEVICE_PATH_PROTOCOL *pCurNode = NULL;
    EFI_DEVICE_PATH_PROTOCOL *pTmpDevPath = NULL;
-    
+
    pTmpDevPath = DuplicateDevicePath(pDevPath);
    if (!pTmpDevPath)
    {
@@ -387,8 +387,8 @@ EFI_STATUS EFIAPI ventoy_save_ramdisk_param(VOID)
    {
        debug("find previous ramdisk variable <%llu>", g_backup_ramdisk_param.DiskSize);
    }
-    
-    Status = gRT->SetVariable(L"VentoyRamDisk", &VarGuid, 
+
+    Status = gRT->SetVariable(L"VentoyRamDisk", &VarGuid,
                  EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
                  sizeof(g_ramdisk_param), &(g_ramdisk_param));
    debug("set ramdisk variable %r", Status);
@@ -403,14 +403,14 @@ EFI_STATUS EFIAPI ventoy_delete_ramdisk_param(VOID)

    if (g_backup_ramdisk_param.DiskSize > 0 && g_backup_ramdisk_param.PhyAddr > 0)
    {
-        Status = gRT->SetVariable(L"VentoyRamDisk", &VarGuid, 
+        Status = gRT->SetVariable(L"VentoyRamDisk", &VarGuid,
                  EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
                  sizeof(g_backup_ramdisk_param), &g_backup_ramdisk_param);
        debug("resotre ramdisk variable %r", Status);
    }
    else
    {
-        Status = gRT->SetVariable(L"VentoyRamDisk", &VarGuid, 
+        Status = gRT->SetVariable(L"VentoyRamDisk", &VarGuid,
                  EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
                  0, NULL);
        debug("delete ramdisk variable %r", Status);
@@ -432,7 +432,7 @@ EFI_STATUS EFIAPI ventoy_save_variable(VOID)
        debug("find previous efi variable <%a>", g_backup_os_param_var.vtoy_img_path);
    }

-    Status = gRT->SetVariable(L"VentoyOsParam", &VarGuid, 
+    Status = gRT->SetVariable(L"VentoyOsParam", &VarGuid,
                  EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
                  sizeof(g_chain->os_param), &(g_chain->os_param));
    debug("set efi variable %r", Status);
@@ -447,14 +447,14 @@ EFI_STATUS EFIAPI ventoy_delete_variable(VOID)

    if (0 == CompareMem(&(g_backup_os_param_var.guid), &VarGuid, sizeof(EFI_GUID)))
    {
-        Status = gRT->SetVariable(L"VentoyOsParam", &VarGuid, 
+        Status = gRT->SetVariable(L"VentoyOsParam", &VarGuid,
                  EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
                  sizeof(g_backup_os_param_var), &(g_backup_os_param_var));
        debug("restore efi variable %r", Status);
    }
    else
    {
-        Status = gRT->SetVariable(L"VentoyOsParam", &VarGuid, 
+        Status = gRT->SetVariable(L"VentoyOsParam", &VarGuid,
                  EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
                  0, NULL);
        debug("delete efi variable %r", Status);
@@ -481,7 +481,7 @@ STATIC VOID ventoy_warn_invalid_device(VOID)

    gST->ConOut->OutputString(gST->ConOut, L"This is NOT a standard Ventoy device and is NOT supported.\r\n\r\n");
    gST->ConOut->OutputString(gST->ConOut, L"You should follow the official instructions in https://www.ventoy.net\r\n");
-    
+
    gST->ConOut->OutputString(gST->ConOut, L"\r\n\r\nWill exit after 10 seconds ...... ");

    sleep(10);
@@ -489,7 +489,7 @@ STATIC VOID ventoy_warn_invalid_device(VOID)
 #else
 STATIC VOID ventoy_warn_invalid_device(VOID)
 {
-    
+
 }
 #endif

@@ -513,19 +513,19 @@ STATIC EFI_STATUS EFIAPI ventoy_load_image
    pFilePath->Header.Length[0] = FileNameLen + sizeof(EFI_DEVICE_PATH_PROTOCOL);
    pFilePath->Header.Length[1] = 0;
    CopyMem(pFilePath->PathName, FileName, FileNameLen);
-    
+
    pImgPath = AppendDevicePathNode(pDevicePath, (EFI_DEVICE_PATH_PROTOCOL *)pFilePath);
    if (!pImgPath)
    {
        return EFI_NOT_FOUND;
    }
-    
+
    Status = gBS->LoadImage(FALSE, ImageHandle, pImgPath, NULL, 0, Image);
-    
+
    debug("Load Image File %r DP: <%s>", Status, ConvertDevicePathToText(pImgPath, FALSE, FALSE));

    FreePool(pImgPath);
-    
+
    return Status;
 }

@@ -547,7 +547,7 @@ STATIC EFI_STATUS EFIAPI ventoy_find_iso_disk(IN EFI_HANDLE ImageHandle)
        return EFI_OUT_OF_RESOURCES;
    }

-    Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiBlockIoProtocolGuid, 
+    Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiBlockIoProtocolGuid,
                                     NULL, &Count, &Handles);
    if (EFI_ERROR(Status))
    {
@@ -591,16 +591,16 @@ STATIC EFI_STATUS EFIAPI ventoy_find_iso_disk(IN EFI_HANDLE ImageHandle)
                    ventoy_warn_invalid_device();
                }
            }
-        
+
            gBlockData.RawBlockIoHandle = Handles[i];
            gBlockData.pRawBlockIo = pBlockIo;
-            gBS->OpenProtocol(Handles[i], &gEfiDevicePathProtocolGuid, 
+            gBS->OpenProtocol(Handles[i], &gEfiDevicePathProtocolGuid,
                              (VOID **)&(gBlockData.pDiskDevPath),
                              ImageHandle,
                              Handles[i],
                              EFI_OPEN_PROTOCOL_GET_PROTOCOL);
-            
-            debug("Find Ventoy Disk Sig Handle:%p DP:%s", Handles[i], 
+
+            debug("Find Ventoy Disk Sig Handle:%p DP:%s", Handles[i],
                ConvertDevicePathToText(gBlockData.pDiskDevPath, FALSE, FALSE));
            break;
        }
@@ -629,7 +629,7 @@ STATIC EFI_STATUS EFIAPI ventoy_find_iso_disk_fs(IN EFI_HANDLE ImageHandle)
    EFI_SIMPLE_FILE_SYSTEM_PROTOCOL *pFile = NULL;
    EFI_DEVICE_PATH_PROTOCOL *pDevPath = NULL;

-    Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiSimpleFileSystemProtocolGuid, 
+    Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiSimpleFileSystemProtocolGuid,
                                     NULL, &Count, &Handles);
    if (EFI_ERROR(Status))
    {
@@ -646,7 +646,7 @@ STATIC EFI_STATUS EFIAPI ventoy_find_iso_disk_fs(IN EFI_HANDLE ImageHandle)
            continue;
        }

-        Status = gBS->OpenProtocol(Handles[i], &gEfiDevicePathProtocolGuid, 
+        Status = gBS->OpenProtocol(Handles[i], &gEfiDevicePathProtocolGuid,
                                   (VOID **)&pDevPath,
                                   ImageHandle,
                                   Handles[i],
@@ -683,29 +683,29 @@ STATIC EFI_STATUS EFIAPI ventoy_load_isoefi_driver(IN EFI_HANDLE ImageHandle)

    if (gIsoUdf)
    {
-        Status = ventoy_load_image(ImageHandle, gBlockData.pDiskFsDevPath, 
-                                   gUdfEfiDriverPath, 
-                                   sizeof(gUdfEfiDriverPath), 
+        Status = ventoy_load_image(ImageHandle, gBlockData.pDiskFsDevPath,
+                                   gUdfEfiDriverPath,
+                                   sizeof(gUdfEfiDriverPath),
                                   &Image);
        debug("load iso UDF efi driver status:%r", Status);
    }
    else
    {
-        Status = ventoy_load_image(ImageHandle, gBlockData.pDiskFsDevPath, 
-                                   gIso9660EfiDriverPath, 
-                                   sizeof(gIso9660EfiDriverPath), 
+        Status = ventoy_load_image(ImageHandle, gBlockData.pDiskFsDevPath,
+                                   gIso9660EfiDriverPath,
+                                   sizeof(gIso9660EfiDriverPath),
                                   &Image);
-        debug("load iso 9660 efi driver status:%r", Status);        
+        debug("load iso 9660 efi driver status:%r", Status);
    }

    if (gDebugPrint)
    {
-        gRT->SetVariable(L"FS_LOGGING", &gShellVariableGuid, 
+        gRT->SetVariable(L"FS_LOGGING", &gShellVariableGuid,
                         EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
                         sizeof(LogVar), LogVar);
    }

-    gRT->SetVariable(L"FS_NAME_NOCASE", &gShellVariableGuid, 
+    gRT->SetVariable(L"FS_NAME_NOCASE", &gShellVariableGuid,
                     EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
                     sizeof(LogVar), LogVar);

@@ -732,7 +732,7 @@ STATIC EFI_STATUS ventoy_proc_img_replace_name(ventoy_grub_param_file_replace *r
    }

    AsciiStrCpyS(tmp, sizeof(tmp), replace->old_file_name[0]);
-    
+
    for (i = 0; i < 256 && tmp[i]; i++)
    {
        if (tmp[i] == '/')
@@ -755,7 +755,7 @@ EFI_STATUS EFIAPI ventoy_get_variable_wrapper
 )
 {
    EFI_STATUS Status = EFI_SUCCESS;
-    
+
    Status = g_org_get_variable(VariableName, VendorGuid, Attributes, DataSize, Data);
    if (StrCmp(VariableName, L"SecureBoot") == 0)
    {
@@ -779,7 +779,7 @@ EFI_STATUS EFIAPI ventoy_exit_boot_service_wrapper
        gRT->GetVariable = g_org_get_variable;
        g_org_get_variable = NULL;
    }
-    
+
    return g_org_exit_boot_service(ImageHandle, MapKey);
 }

@@ -803,12 +803,12 @@ STATIC EFI_STATUS EFIAPI ventoy_disable_secure_boot(IN EFI_HANDLE ImageHandle)

    /* step1: wrapper security protocol. */
    /* Do we still need it since we have been loaded ? */
-    
-    
+
+
    /* step2: fake SecureBoot variable */
    g_org_exit_boot_service = gBS->ExitBootServices;
    gBS->ExitBootServices = ventoy_exit_boot_service_wrapper;
-    
+
    g_org_get_variable = gRT->GetVariable;
    gRT->GetVariable = ventoy_get_variable_wrapper;

@@ -817,7 +817,7 @@ STATIC EFI_STATUS EFIAPI ventoy_disable_secure_boot(IN EFI_HANDLE ImageHandle)


 STATIC EFI_STATUS EFIAPI ventoy_parse_cmdline(IN EFI_HANDLE ImageHandle)
-{   
+{
    UINT32 i = 0;
    UINT32 old_cnt = 0;
    UINTN size = 0;
@@ -846,12 +846,12 @@ STATIC EFI_STATUS EFIAPI ventoy_parse_cmdline(IN EFI_HANDLE ImageHandle)
    {
        gDebugPrint = TRUE;
    }
-    
+
    if (StrStr(pCmdLine, L"fallback"))
    {
        gBootFallBack = TRUE;
    }
-    
+
    if (StrStr(pCmdLine, L"dotefi"))
    {
        gDotEfiBoot = TRUE;
@@ -861,7 +861,7 @@ STATIC EFI_STATUS EFIAPI ventoy_parse_cmdline(IN EFI_HANDLE ImageHandle)
    {
        gLoadIsoEfi = TRUE;
    }
-    
+
    if (StrStr(pCmdLine, L"iso_udf"))
    {
        gIsoUdf = TRUE;
@@ -899,7 +899,7 @@ STATIC EFI_STATUS EFIAPI ventoy_parse_cmdline(IN EFI_HANDLE ImageHandle)
    {
        return EFI_INVALID_PARAMETER;
    }
-    
+
    pGrubParam = (ventoy_grub_param *)StrHexToUintn(pPos + StrLen(L"env_param="));
    grub_env_set = pGrubParam->grub_env_set;
    grub_env_get = pGrubParam->grub_env_get;
@@ -914,7 +914,7 @@ STATIC EFI_STATUS EFIAPI ventoy_parse_cmdline(IN EFI_HANDLE ImageHandle)
        ventoy_warn_invalid_device();
        return EFI_INVALID_PARAMETER;
    }
-    
+
    g_file_replace_list = &pGrubParam->file_replace;
    old_cnt = g_file_replace_list->old_file_cnt;
    debug("file replace: magic:0x%x virtid:%u name count:%u <%a> <%a> <%a> <%a>",
@@ -927,7 +927,7 @@ STATIC EFI_STATUS EFIAPI ventoy_parse_cmdline(IN EFI_HANDLE ImageHandle)
        old_cnt > 3 ? g_file_replace_list->old_file_name[3] : ""
        );

-    
+
    for (i = 0; i < VTOY_MAX_CONF_REPLACE; i++)
    {
        replace = pGrubParam->img_replace + i;
@@ -948,7 +948,7 @@ STATIC EFI_STATUS EFIAPI ventoy_parse_cmdline(IN EFI_HANDLE ImageHandle)
        }
    }

-    
+
    pPos = StrStr(pCmdLine, L"mem:");
    chain = (ventoy_chain_head *)StrHexToUintn(pPos + 4);

@@ -977,7 +977,7 @@ STATIC EFI_STATUS EFIAPI ventoy_parse_cmdline(IN EFI_HANDLE ImageHandle)
        debug("This is normal mode");
        g_chain = AllocatePool(size);
        CopyMem(g_chain, chain, size);
-    
+
        g_chunk = (ventoy_img_chunk *)((char *)g_chain + g_chain->img_chunk_offset);
        g_img_chunk_num = g_chain->img_chunk_num;
        g_override_chunk = (ventoy_override_chunk *)((char *)g_chain + g_chain->override_chunk_offset);
@@ -997,7 +997,7 @@ STATIC EFI_STATUS EFIAPI ventoy_parse_cmdline(IN EFI_HANDLE ImageHandle)
        {
            g_hook_keyboard = TRUE;
        }
-        
+
        if (g_os_param_reserved[5] == 1 && g_os_param_reserved[2] == ventoy_chain_linux)
        {
            ventoy_disable_secure_boot(ImageHandle);
@@ -1024,7 +1024,7 @@ STATIC EFI_STATUS EFIAPI ventoy_parse_cmdline(IN EFI_HANDLE ImageHandle)
    }

    g_fix_windows_1st_cdrom_issue = FALSE;
-    if (ventoy_chain_windows == g_os_param_reserved[2] || 
+    if (ventoy_chain_windows == g_os_param_reserved[2] ||
        ventoy_chain_wim == g_os_param_reserved[2])
    {
        if (ventoy_is_cdrom_dp_exist())
@@ -1066,7 +1066,7 @@ EFI_STATUS EFIAPI ventoy_clean_env(VOID)

    if (!gMemdiskMode)
    {
-        FreePool(g_chain);        
+        FreePool(g_chain);
    }

    return EFI_SUCCESS;
@@ -1126,7 +1126,7 @@ EFI_STATUS EFIAPI ventoy_boot(IN EFI_HANDLE ImageHandle)
        Count = 0;
        Handles = NULL;

-        Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiSimpleFileSystemProtocolGuid, 
+        Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiSimpleFileSystemProtocolGuid,
                                     NULL, &Count, &Handles);
        if (EFI_ERROR(Status))
        {
@@ -1145,7 +1145,7 @@ EFI_STATUS EFIAPI ventoy_boot(IN EFI_HANDLE ImageHandle)

            debug("FS:%u Protocol:%p  OpenVolume:%p", i, pFile, pFile->OpenVolume);

-            Status = gBS->OpenProtocol(Handles[i], &gEfiDevicePathProtocolGuid, 
+            Status = gBS->OpenProtocol(Handles[i], &gEfiDevicePathProtocolGuid,
                                       (VOID **)&pDevPath,
                                       ImageHandle,
                                       Handles[i],
@@ -1165,7 +1165,7 @@ EFI_STATUS EFIAPI ventoy_boot(IN EFI_HANDLE ImageHandle)

            for (j = gBootFileStartIndex; j < ARRAY_SIZE(gEfiBootFileName); j++)
            {
-                Status = ventoy_load_image(ImageHandle, pDevPath, gEfiBootFileName[j], 
+                Status = ventoy_load_image(ImageHandle, pDevPath, gEfiBootFileName[j],
                                           StrSize(gEfiBootFileName[j]), &Image);
                if (EFI_SUCCESS == Status)
                {
@@ -1187,7 +1187,7 @@ EFI_STATUS EFIAPI ventoy_boot(IN EFI_HANDLE ImageHandle)
            {
                gST->ConIn->Reset(gST->ConIn, FALSE);
            }
-            
+
            if ((g_file_replace_list && g_file_replace_list->magic == GRUB_FILE_REPLACE_MAGIC) || g_img_replace_list)
            {
                ventoy_wrapper_push_openvolume(pFile->OpenVolume);
@@ -1199,7 +1199,7 @@ EFI_STATUS EFIAPI ventoy_boot(IN EFI_HANDLE ImageHandle)
            //ventoy_wrapper_system();
            Status = gBS->StartImage(Image, NULL, NULL);
            ventoy_hook_stop();
-            
+
            if (EFI_ERROR(Status))
            {
                debug("Failed to start image %r", Status);
@@ -1217,7 +1217,7 @@ EFI_STATUS EFIAPI ventoy_boot(IN EFI_HANDLE ImageHandle)
            {
                break;
            }
-        
+
            debug("Fs not found, now wait and retry...");
            sleep(1);
        }
@@ -1239,7 +1239,7 @@ EFI_STATUS EFIAPI VentoyEfiMain
 {
    EFI_STATUS Status = EFI_SUCCESS;
    EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL *Protocol;
-    
+
    g_sector_flag_num = 512; /* initial value */

    g_sector_flag = AllocatePool(g_sector_flag_num * sizeof(ventoy_sector_flag));
@@ -1263,6 +1263,11 @@ EFI_STATUS EFIAPI VentoyEfiMain
        return Status;
    }

+    if (g_os_param_reserved[11])
+    {
+        ventoy_lock_res(g_os_param_reserved[11]);
+    }
+
    ventoy_disable_ex_filesystem();

    if (gMemdiskMode)
@@ -1278,12 +1283,12 @@ EFI_STATUS EFIAPI VentoyEfiMain
            ventoy_find_iso_disk_fs(ImageHandle);
            ventoy_load_isoefi_driver(ImageHandle);
        }
-        
+
        ventoy_install_blockio(ImageHandle, g_iso_buf_size);
        ventoy_debug_pause();

        Status = ventoy_boot(ImageHandle);
-        
+
        ventoy_delete_ramdisk_param();

        if (gLoadIsoEfi && gBlockData.IsoDriverImage)
@@ -1310,14 +1315,14 @@ EFI_STATUS EFIAPI VentoyEfiMain
            }

            ventoy_debug_pause();
-            
+
            ventoy_install_blockio(ImageHandle, g_chain->virt_img_size_in_bytes);

            ventoy_debug_pause();

            Status = ventoy_boot(ImageHandle);
        }
-        
+
        ventoy_clean_env();
    }

@@ -1330,17 +1335,22 @@ EFI_STATUS EFIAPI VentoyEfiMain
            sleep(30);
        }
    }
-    
+
    ventoy_clear_input();
    gST->ConOut->ClearScreen(gST->ConOut);

    if (gDotEfiBoot && (EFI_NOT_FOUND == Status))
    {
-        grub_env_set("vtoy_dotefi_retry", "YES");            
+        grub_env_set("vtoy_dotefi_retry", "YES");
    }

    ventoy_enable_ex_filesystem();

+    if (g_os_param_reserved[11])
+    {
+        ventoy_unlock_res();
+    }
+
    return EFI_SUCCESS;
 }

@@ -7,22 +7,24 @@
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 3 of the
 * License, or (at your option) any later version.
- * 
+ *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
- * 
+ *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see <http://www.gnu.org/licenses/>.
 *
 */
- 
+
 #ifndef __VENTOY_H__
 #define __VENTOY_H__

 #define COMPILE_ASSERT(expr)  extern char __compile_assert[(expr) ? 1 : -1]

+#define VTOY_SHIM_POLICY_GUID    {0x90a29d14, 0x3968, 0x48fe, { 0x85, 0x81, 0x6b, 0x7f, 0x7d, 0xc4, 0x70, 0x55 }};
+
 #define VENTOY_GUID { 0x77772020, 0x2e77, 0x6576, { 0x6e, 0x74, 0x6f, 0x79, 0x2e, 0x6e, 0x65, 0x74 }}

 typedef enum ventoy_chain_type
@@ -54,7 +56,7 @@ typedef struct ventoy_image_disk_region
 typedef struct ventoy_image_location
 {
    ventoy_guid  guid;
-    
+
    /* image sector size, currently this value is always 2048 */
    UINT32   image_sector_size;

@@ -62,10 +64,10 @@ typedef struct ventoy_image_location
    UINT32   disk_sector_size;

    UINT32   region_count;
-    
+
    /*
     * disk region data
-     * If the image file has more than one fragments in disk, 
+     * If the image file has more than one fragments in disk,
     * there will be more than one region data here.
     *
     */
@@ -86,7 +88,7 @@ typedef struct ventoy_os_param
    char    vtoy_img_path[384];   // It seems to be enough, utf-8 format
    UINT64  vtoy_img_size;        // image file size in bytes

-    /* 
+    /*
     * Ventoy will write a copy of ventoy_image_location data into runtime memory
     * this is the physically address and length of that memory.
     * Address 0 means no such data exist.
@@ -95,7 +97,7 @@ typedef struct ventoy_os_param
     */
    UINT64  vtoy_img_location_addr;
    UINT32  vtoy_img_location_len;
-    
+
    UINT64  vtoy_reserved[4];     // Internal use by ventoy

    UINT8   vtoy_disk_signature[4];
@@ -124,7 +126,7 @@ typedef struct ventoy_chain_head
    UINT64 virt_img_size_in_bytes;
    UINT32 boot_catalog;
    UINT8  boot_catalog_sector[2048];
-    
+
    UINT32 img_chunk_offset;
    UINT32 img_chunk_num;

@@ -199,11 +201,11 @@ typedef struct ventoy_virt_chunk
 typedef struct ventoy_sector_flag
 {
    UINT8 flag; // 0:init   1:mem  2:remap
-    UINT64 remap_lba;    
+    UINT64 remap_lba;
 }ventoy_sector_flag;


-typedef struct vtoy_block_data 
+typedef struct vtoy_block_data
 {
 	EFI_HANDLE Handle;
 	EFI_BLOCK_IO_MEDIA Media;       /* Media descriptor */
@@ -272,7 +274,7 @@ typedef struct ventoy_grub_param
    grub_env_set_pf grub_env_set;
    ventoy_grub_param_file_replace file_replace;
    ventoy_grub_param_file_replace img_replace[VTOY_MAX_CONF_REPLACE];
-    grub_env_printf_pf grub_env_printf;    
+    grub_env_printf_pf grub_env_printf;
 }ventoy_grub_param;

 typedef struct ventoy_ram_disk
@@ -318,7 +320,7 @@ typedef struct MBR_HEAD
 #pragma pack()


-typedef struct well_known_guid 
+typedef struct well_known_guid
 {
 	EFI_GUID *guid;
 	const char *name;
@@ -331,7 +333,7 @@ typedef struct ventoy_system_wrapper

    EFI_HANDLE_PROTOCOL NewHandleProtocol;
    EFI_HANDLE_PROTOCOL OriHandleProtocol;
-    
+
    EFI_OPEN_PROTOCOL NewOpenProtocol;
    EFI_OPEN_PROTOCOL OriOpenProtocol;

@@ -382,7 +384,7 @@ typedef struct DriverBindWrapper
 extern BOOLEAN gDebugPrint;
 VOID EFIAPI VtoyDebug(IN CONST CHAR8  *Format, ...);
 EFI_STATUS EFIAPI ventoy_wrapper_system(VOID);
-EFI_STATUS EFIAPI ventoy_block_io_read 
+EFI_STATUS EFIAPI ventoy_block_io_read
 (
    IN EFI_BLOCK_IO_PROTOCOL          *This,
    IN UINT32                          MediaId,
@@ -428,6 +430,8 @@ EFI_STATUS ventoy_hook_1st_cdrom_start(VOID);
 EFI_STATUS ventoy_hook_1st_cdrom_stop(VOID);
 EFI_STATUS ventoy_disable_ex_filesystem(VOID);
 EFI_STATUS ventoy_enable_ex_filesystem(VOID);
+EFI_STATUS ventoy_lock_res(UINT8 LockType);
+EFI_STATUS ventoy_unlock_res(VOID);

 #endif

@@ -24,6 +24,10 @@
  VERSION_STRING                 = 1.0
  ENTRY_POINT                    = VentoyEfiMain

+  
+[BuildOptions]
+  # Force standard GNU ld to pack and align ELF segments to 4KB page boundaries
+  GCC:*_*_*_DLINK_FLAGS = -Wl,-z,common-page-size=0x1000 -Wl,-z,max-page-size=0x1000

 [Sources]
  Ventoy.h
@@ -7,12 +7,12 @@
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 3 of the
 * License, or (at your option) any later version.
- * 
+ *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
- * 
+ *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see <http://www.gnu.org/licenses/>.
 *
@@ -85,7 +85,7 @@ BOOLEAN ventoy_is_cdrom_dp_exist(VOID)
    EFI_STATUS Status = EFI_SUCCESS;
    EFI_DEVICE_PATH_PROTOCOL *DevicePath = NULL;

-    Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiDevicePathProtocolGuid, 
+    Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiDevicePathProtocolGuid,
                                     NULL, &Count, &Handles);
    if (EFI_ERROR(Status))
    {
@@ -107,24 +107,24 @@ BOOLEAN ventoy_is_cdrom_dp_exist(VOID)
                FreePool(Handles);
                return TRUE;
            }
-        
+
            DevicePath = NextDevicePathNode(DevicePath);
        }
    }

    FreePool(Handles);
-    return FALSE;         
+    return FALSE;
 }

 #if 0
 /* Block IO procotol */
 #endif

-EFI_STATUS EFIAPI ventoy_block_io_reset 
+EFI_STATUS EFIAPI ventoy_block_io_reset
 (
    IN EFI_BLOCK_IO_PROTOCOL          *This,
    IN BOOLEAN                        ExtendedVerification
-) 
+)
 {
    (VOID)This;
    (VOID)ExtendedVerification;
@@ -151,8 +151,8 @@ STATIC EFI_STATUS EFIAPI ventoy_read_iso_sector
    ventoy_img_chunk *pchunk = g_chunk;
    ventoy_override_chunk *pOverride = g_override_chunk;
    EFI_BLOCK_IO_PROTOCOL *pRawBlockIo = gBlockData.pRawBlockIo;
-    
-    debug("read iso sector %lu count %u Buffer:%p Align:%u blk:%u", 
+
+    debug("read iso sector %lu count %u Buffer:%p Align:%u blk:%u",
        Sector, Count, Buffer, pRawBlockIo->Media->IoAlign, pRawBlockIo->Media->BlockSize);

    ReadStart = Sector * 2048;
@@ -207,7 +207,7 @@ STATIC EFI_STATUS EFIAPI ventoy_read_iso_sector
    {
        OverrideStart = pOverride->img_offset;
        OverrideEnd = pOverride->img_offset + pOverride->override_size;
-    
+
        if (OverrideStart >= ReadEnd || ReadStart >= OverrideEnd)
        {
            continue;
@@ -217,7 +217,7 @@ STATIC EFI_STATUS EFIAPI ventoy_read_iso_sector
        {
            if (ReadEnd <= OverrideEnd)
            {
-                CopyMem(pCurBuf + OverrideStart - ReadStart, pOverride->override_data, ReadEnd - OverrideStart);  
+                CopyMem(pCurBuf + OverrideStart - ReadStart, pOverride->override_data, ReadEnd - OverrideStart);
            }
            else
            {
@@ -228,7 +228,7 @@ STATIC EFI_STATUS EFIAPI ventoy_read_iso_sector
        {
            if (ReadEnd <= OverrideEnd)
            {
-                CopyMem(pCurBuf, pOverride->override_data + ReadStart - OverrideStart, ReadEnd - ReadStart); 
+                CopyMem(pCurBuf, pOverride->override_data + ReadStart - OverrideStart, ReadEnd - ReadStart);
            }
            else
            {
@@ -236,7 +236,7 @@ STATIC EFI_STATUS EFIAPI ventoy_read_iso_sector
            }
        }

-        if (g_fixup_iso9660_secover_enable && (!g_fixup_iso9660_secover_start) && 
+        if (g_fixup_iso9660_secover_enable && (!g_fixup_iso9660_secover_start) &&
            pOverride->override_size == sizeof(ventoy_iso9660_override))
        {
            ventoy_iso9660_override *dirent = (ventoy_iso9660_override *)pOverride->override_data;
@@ -256,7 +256,7 @@ STATIC EFI_STATUS EFIAPI ventoy_read_iso_sector
        }
    }

-    return EFI_SUCCESS;    
+    return EFI_SUCCESS;
 }

 STATIC EFI_STATUS EFIAPI ventoy_write_iso_sector
@@ -276,7 +276,7 @@ STATIC EFI_STATUS EFIAPI ventoy_write_iso_sector
    UINT8 *pCurBuf = (UINT8 *)Buffer;
    ventoy_img_chunk *pchunk = g_chunk;
    EFI_BLOCK_IO_PROTOCOL *pRawBlockIo = gBlockData.pRawBlockIo;
-    
+
    debug("write iso sector %lu  count %u", Sector, Count);

    ReadStart = Sector * 2048;
@@ -321,17 +321,17 @@ STATIC EFI_STATUS EFIAPI ventoy_write_iso_sector
        }
    }

-    return EFI_SUCCESS;    
+    return EFI_SUCCESS;
 }

-EFI_STATUS EFIAPI ventoy_block_io_ramdisk_write 
+EFI_STATUS EFIAPI ventoy_block_io_ramdisk_write
 (
    IN EFI_BLOCK_IO_PROTOCOL          *This,
    IN UINT32                          MediaId,
    IN EFI_LBA                         Lba,
    IN UINTN                           BufferSize,
    IN VOID                           *Buffer
-) 
+)
 {
    (VOID)This;
    (VOID)MediaId;
@@ -349,14 +349,14 @@ EFI_STATUS EFIAPI ventoy_block_io_ramdisk_write
 	return EFI_SUCCESS;
 }

-EFI_STATUS EFIAPI ventoy_block_io_ramdisk_read 
+EFI_STATUS EFIAPI ventoy_block_io_ramdisk_read
 (
    IN EFI_BLOCK_IO_PROTOCOL          *This,
    IN UINT32                          MediaId,
    IN EFI_LBA                         Lba,
    IN UINTN                           BufferSize,
    OUT VOID                          *Buffer
-) 
+)
 {
    //debug("### ventoy_block_io_ramdisk_read sector:%u count:%u", (UINT32)Lba, (UINT32)BufferSize / 2048);

@@ -364,12 +364,12 @@ EFI_STATUS EFIAPI ventoy_block_io_ramdisk_read
    (VOID)MediaId;

    CopyMem(Buffer, g_iso_data_buf + (Lba * 2048), BufferSize);
-    
+
    if (g_blockio_start_record_bcd && FALSE == g_blockio_bcd_read_done)
    {
        if (*(UINT32 *)Buffer == 0x66676572)
        {
-            g_blockio_bcd_read_done = TRUE;            
+            g_blockio_bcd_read_done = TRUE;
        }
    }

@@ -429,14 +429,14 @@ end:
    return Lba;
 }

-EFI_STATUS EFIAPI ventoy_block_io_read_real 
+EFI_STATUS EFIAPI ventoy_block_io_read_real
 (
    IN EFI_BLOCK_IO_PROTOCOL          *This,
    IN UINT32                          MediaId,
    IN EFI_LBA                         Lba,
    IN UINTN                           BufferSize,
    OUT VOID                          *Buffer
-) 
+)
 {
    UINT32 i = 0;
    UINT32 j = 0;
@@ -450,7 +450,7 @@ EFI_STATUS EFIAPI ventoy_block_io_read_real
    UINT8 *lastbuffer;
    ventoy_sector_flag *cur_flag;
    ventoy_virt_chunk *node;
-    
+
    debug("### block_io_read_real sector:%u count:%u Buffer:%p", (UINT32)Lba, (UINT32)BufferSize / 2048, Buffer);

    secNum = BufferSize / 2048;
@@ -510,7 +510,7 @@ EFI_STATUS EFIAPI ventoy_block_io_read_real
        {
            if (curlba >= node->mem_sector_start && curlba < node->mem_sector_end)
            {
-                CopyMem((UINT8 *)Buffer + j * 2048, 
+                CopyMem((UINT8 *)Buffer + j * 2048,
                       (char *)g_virt_chunk + node->mem_sector_offset + (curlba - node->mem_sector_start) * 2048,
                       2048);
                cur_flag->flag = 1;
@@ -564,7 +564,7 @@ EFI_STATUS EFIAPI ventoy_block_io_read
    IN EFI_LBA                         Lba,
    IN UINTN                           BufferSize,
    OUT VOID                          *Buffer
-) 
+)
 {
    UINT32 IoAlign = 0;
    VOID *NewBuf = NULL;
@@ -593,18 +593,18 @@ EFI_STATUS EFIAPI ventoy_block_io_read
    return Status;
 }

-EFI_STATUS EFIAPI ventoy_block_io_write 
+EFI_STATUS EFIAPI ventoy_block_io_write
 (
    IN EFI_BLOCK_IO_PROTOCOL          *This,
    IN UINT32                          MediaId,
    IN EFI_LBA                         Lba,
    IN UINTN                           BufferSize,
    IN VOID                           *Buffer
-) 
+)
 {
    UINT32 secNum = 0;
    UINT64 offset = 0;
-    
+
    (VOID)This;
    (VOID)MediaId;

@@ -636,8 +636,8 @@ STATIC UINTN ventoy_get_current_device_path_id(VOID)
    EFI_STATUS Status = EFI_SUCCESS;
    EFI_DEVICE_PATH_PROTOCOL *DevicePath = NULL;
    VENDOR_DEVICE_PATH *venPath = NULL;
-    
-    Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiDevicePathProtocolGuid, 
+
+    Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiDevicePathProtocolGuid,
                                     NULL, &Count, &Handles);
    if (EFI_ERROR(Status))
    {
@@ -688,7 +688,7 @@ EFI_STATUS EFIAPI ventoy_fill_device_path(VOID)
    venPath->Header.Length[1] = 0;
    CopyMem(&venPath->Guid, &gVtoyBlockDevicePathGuid, sizeof(EFI_GUID));
    CopyMem(venPath + 1, VtoyDpName, NameLen);
-    
+
    gBlockData.Path = AppendDevicePathNode(NULL, (EFI_DEVICE_PATH_PROTOCOL *)TmpBuf);
    gBlockData.DevicePathCompareLen = sizeof(VENDOR_DEVICE_PATH) + NameLen;

@@ -710,7 +710,7 @@ EFI_STATUS EFIAPI ventoy_connect_driver(IN EFI_HANDLE ControllerHandle, IN CONST

    debug("ventoy_connect_driver <%s>...", DrvName);

-    Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiComponentName2ProtocolGuid, 
+    Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiComponentName2ProtocolGuid,
                                     NULL, &Count, &Handles);
    if (EFI_ERROR(Status))
    {
@@ -748,7 +748,7 @@ EFI_STATUS EFIAPI ventoy_connect_driver(IN EFI_HANDLE ControllerHandle, IN CONST
    FreePool(Handles);
    Handles = NULL;

-    Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiComponentNameProtocolGuid, 
+    Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiComponentNameProtocolGuid,
                                     NULL, &Count, &Handles);
    if (EFI_ERROR(Status))
    {
@@ -781,10 +781,10 @@ EFI_STATUS EFIAPI ventoy_connect_driver(IN EFI_HANDLE ControllerHandle, IN CONST
    }

    Status = EFI_NOT_FOUND;
-    
+
 end:
    FreePool(Handles);
-    
+
    return Status;
 }

@@ -805,11 +805,11 @@ STATIC BOOLEAN ventoy_filesystem_need_wrapper(IN CONST CHAR16 *DrvName)
    }

    /*
-     * suppress some file system drivers 
+     * suppress some file system drivers
     *  1. rEFInd File System Driver
     *
     */
-    
+
    if (StrStr(UpperDrvName, L"REFIND") && StrStr(UpperDrvName, L"FILE SYSTEM"))
    {
        return TRUE;
@@ -820,7 +820,7 @@ STATIC BOOLEAN ventoy_filesystem_need_wrapper(IN CONST CHAR16 *DrvName)

 STATIC VOID ventoy_add_filesystem_wrapper
 (
-    IN EFI_DRIVER_BINDING_PROTOCOL *DriverBindProtocol, 
+    IN EFI_DRIVER_BINDING_PROTOCOL *DriverBindProtocol,
    IN CONST CHAR16 *DriverName
 )
 {
@@ -865,10 +865,10 @@ STATIC EFI_STATUS ventoy_find_filesystem_driverbind(VOID)
    EFI_COMPONENT_NAME_PROTOCOL *NameProtocol = NULL;
    EFI_COMPONENT_NAME2_PROTOCOL *Name2Protocol = NULL;
    EFI_DRIVER_BINDING_PROTOCOL *DriverBindProtocol = NULL;
-    
+
    debug("ventoy_find_filesystem_driverbind...");

-    Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiComponentName2ProtocolGuid, 
+    Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiComponentName2ProtocolGuid,
                                     NULL, &Count, &Handles);
    if (EFI_ERROR(Status))
    {
@@ -899,7 +899,7 @@ STATIC EFI_STATUS ventoy_find_filesystem_driverbind(VOID)
    FreePool(Handles);
    Handles = NULL;

-    Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiComponentNameProtocolGuid, 
+    Status = gBS->LocateHandleBuffer(ByProtocol, &gEfiComponentNameProtocolGuid,
                                     NULL, &Count, &Handles);
    if (EFI_ERROR(Status))
    {
@@ -927,7 +927,7 @@ STATIC EFI_STATUS ventoy_find_filesystem_driverbind(VOID)
    }

    FreePool(Handles);
-    
+
    return EFI_SUCCESS;
 }

@@ -988,7 +988,7 @@ EFI_STATUS ventoy_disable_ex_filesystem(VOID)

    debug("Wrapper Ex Driver Binding %lu", g_DriverBindWrapperCnt);
    ventoy_debug_pause();
-    
+
    return EFI_SUCCESS;
 }

@@ -1046,10 +1046,10 @@ EFI_STATUS EFIAPI ventoy_block_io_read_512
    if (BufferSize >= 2048)
    {
        ReadSize = BufferSize / 2048 * 2048;
-            
+
        Status |= g_sector_2048_read(This, MediaId, Lba / 4, ReadSize, CurBuf);
        CurBuf += ReadSize;
-        
+
        Lba += ReadSize / 512;
        BufferSize -= ReadSize;
    }
@@ -1096,7 +1096,7 @@ EFI_STATUS EFIAPI ventoy_block_io_write_512
            ReadSize = (4 - Mod) * 512;
            CopyMem(g_sector_buf + Mod * 512, CurBuf, ReadSize);
            g_sector_2048_write(This, MediaId, Lba / 4, 2048, g_sector_buf);
-            
+
            CurBuf += ReadSize;
            Lba += (4 - Mod);
            BufferSize -= ReadSize;
@@ -1106,10 +1106,10 @@ EFI_STATUS EFIAPI ventoy_block_io_write_512
    if (BufferSize >= 2048)
    {
        ReadSize = BufferSize / 2048 * 2048;
-            
+
        Status |= g_sector_2048_write(This, MediaId, Lba / 4, ReadSize, CurBuf);
        CurBuf += ReadSize;
-        
+
        Lba += ReadSize / 512;
        BufferSize -= ReadSize;
    }
@@ -1117,7 +1117,7 @@ EFI_STATUS EFIAPI ventoy_block_io_write_512
    if (BufferSize > 0)
    {
        Status |= g_sector_2048_read(This, MediaId, Lba / 4, 2048, g_sector_buf);
-        
+
        CopyMem(g_sector_buf, CurBuf, BufferSize);
        g_sector_2048_write(This, MediaId, Lba / 4, 2048, g_sector_buf);
    }
@@ -1126,10 +1126,10 @@ EFI_STATUS EFIAPI ventoy_block_io_write_512
 }

 EFI_STATUS EFIAPI ventoy_install_blockio(IN EFI_HANDLE ImageHandle, IN UINT64 ImgSize)
-{   
+{
    EFI_STATUS Status = EFI_SUCCESS;
    EFI_BLOCK_IO_PROTOCOL *pBlockIo = &(gBlockData.BlockIo);
-    
+
    ventoy_fill_device_path();

    debug("install block io protocol %p", ImageHandle);
@@ -1144,10 +1144,10 @@ EFI_STATUS EFIAPI ventoy_install_blockio(IN EFI_HANDLE ImageHandle, IN UINT64 Im
    else
    {
        gBlockData.Media.BlockSize = 2048;
-        gBlockData.Media.LastBlock = ImgSize / 2048 - 1;        
+        gBlockData.Media.LastBlock = ImgSize / 2048 - 1;
        gBlockData.Media.ReadOnly = TRUE;
    }
-    
+
    gBlockData.Media.MediaPresent = 1;
    gBlockData.Media.LogicalBlocksPerPhysicalBlock = 1;

@@ -1164,10 +1164,10 @@ EFI_STATUS EFIAPI ventoy_install_blockio(IN EFI_HANDLE ImageHandle, IN UINT64 Im
    }
    else
    {
-        pBlockIo->ReadBlocks = gMemdiskMode ? ventoy_block_io_ramdisk_read : ventoy_block_io_read;        
+        pBlockIo->ReadBlocks = gMemdiskMode ? ventoy_block_io_ramdisk_read : ventoy_block_io_read;
    	pBlockIo->WriteBlocks = ventoy_block_io_write;
    }
-        
+
 	pBlockIo->FlushBlocks = ventoy_block_io_flush;

    Status = gBS->InstallMultipleProtocolInterfaces(&gBlockData.Handle,
@@ -1295,7 +1295,7 @@ DEF_WRAP_FUNC(7);
 #error "VTOY_MAX_CONF_REPLACE overflow"
 #endif

-static EFI_FILE_FLUSH_EX g_img_flush_func[VTOY_MAX_CONF_REPLACE] = 
+static EFI_FILE_FLUSH_EX g_img_flush_func[VTOY_MAX_CONF_REPLACE] =
 {
    ventoy_wrapper_file_flush_ex_img0,
    ventoy_wrapper_file_flush_ex_img1,
@@ -1335,7 +1335,7 @@ STATIC ventoy_efi_file_replace *ventoy_wrapper_get_replace(EFI_FILE_HANDLE This)
            return g_img_file_replace + i;
        }
    }
-    
+
    return NULL;
 }

@@ -1369,7 +1369,7 @@ ventoy_wrapper_file_set_pos(EFI_FILE_HANDLE This, UINT64 Position)
    ventoy_efi_file_replace *replace = NULL;

    replace = ventoy_wrapper_get_replace(This);
-    
+
    if (Position <= replace->FileSizeBytes)
    {
        replace->CurPos = Position;
@@ -1378,7 +1378,7 @@ ventoy_wrapper_file_set_pos(EFI_FILE_HANDLE This, UINT64 Position)
    {
        replace->CurPos = replace->FileSizeBytes;
    }
-    
+
    return EFI_SUCCESS;
 }

@@ -1425,7 +1425,7 @@ ventoy_wrapper_file_get_info(EFI_FILE_HANDLE This, EFI_GUID *Type, UINTN *Len, V
    //Info->FileName = EFI_FILE_READ_ONLY;

    *Len = Info->Size;
-    
+
    return EFI_SUCCESS;
 }

@@ -1437,7 +1437,7 @@ ventoy_wrapper_file_read(EFI_FILE_HANDLE This, UINTN *Len, VOID *Data)
    ventoy_efi_file_replace *replace = NULL;

    replace = ventoy_wrapper_get_replace(This);
-    
+
    debug("ventoy_wrapper_file_read ... %u", *Len);

    if (replace->CurPos + ReadLen > replace->FileSizeBytes)
@@ -1494,7 +1494,7 @@ STATIC EFI_STATUS EFIAPI ventoy_wrapper_file_procotol(EFI_FILE_PROTOCOL *File, B
 STATIC BOOLEAN EFIAPI ventoy_replace_name_match(CHAR8 *pReplace, CHAR8 *pName)
 {
    UINTN Len1, Len2;
-    
+
    Len1 = AsciiStrLen(pReplace);
    Len2 = AsciiStrLen(pName);

@@ -1521,10 +1521,10 @@ STATIC BOOLEAN EFIAPI ventoy_replace_name_match(CHAR8 *pReplace, CHAR8 *pName)

 STATIC EFI_STATUS EFIAPI ventoy_wrapper_file_open
 (
-    EFI_FILE_HANDLE This, 
+    EFI_FILE_HANDLE This,
    EFI_FILE_HANDLE *New,
-    CHAR16 *Name, 
-    UINT64 Mode, 
+    CHAR16 *Name,
+    UINT64 Mode,
    UINT64 Attributes
 )
 {
@@ -1571,7 +1571,7 @@ STATIC EFI_STATUS EFIAPI ventoy_wrapper_file_open
                virt = g_virt_chunk + g_file_replace_list->new_file_virtual_id;

                Sectors = (virt->mem_sector_end - virt->mem_sector_start) + (virt->remap_sector_end - virt->remap_sector_start);
-                
+
                g_efi_file_replace.BlockIoSectorStart = virt->mem_sector_start;
                g_efi_file_replace.FileSizeBytes = Sectors * 2048;

@@ -1581,7 +1581,7 @@ STATIC EFI_STATUS EFIAPI ventoy_wrapper_file_open
                        g_efi_file_replace.BlockIoSectorStart, Sectors, Sectors * 2048);
                    sleep(3);
                }
-                
+
                return Status;
            }
        }
@@ -1605,9 +1605,9 @@ STATIC EFI_STATUS EFIAPI ventoy_wrapper_file_open
        {
            AsciiStrCpyS(OldName, sizeof(OldName), replace->old_file_name[j]);
            if ((0 == AsciiStrCmp(OldName, TmpName)) ||
-                 (AsciiStrnCmp(OldName, "\\loader\\entries\\", 16) == 0 && 
+                 (AsciiStrnCmp(OldName, "\\loader\\entries\\", 16) == 0 &&
                  AsciiStrCmp(OldName + 16, TmpName) == 0
-                  )  
+                  )
                )
            {
                g_original_fclose(*New);
@@ -1617,7 +1617,7 @@ STATIC EFI_STATUS EFIAPI ventoy_wrapper_file_open
                virt = g_virt_chunk + replace->new_file_virtual_id;

                Sectors = (virt->mem_sector_end - virt->mem_sector_start) + (virt->remap_sector_end - virt->remap_sector_start);
-                
+
                g_img_file_replace[i].BlockIoSectorStart = virt->mem_sector_start;
                g_img_file_replace[i].FileSizeBytes = Sectors * 2048;

@@ -1627,7 +1627,7 @@ STATIC EFI_STATUS EFIAPI ventoy_wrapper_file_open
                        g_img_file_replace[i].BlockIoSectorStart, Sectors, Sectors * 2048);
                    sleep(3);
                }
-                
+
                return Status;
            }
        }
@@ -1648,7 +1648,7 @@ EFI_STATUS EFIAPI ventoy_wrapper_open_volume
 )
 {
    EFI_STATUS Status = EFI_SUCCESS;
-    
+
    Status = g_original_open_volume(This, Root);
    if (!EFI_ERROR(Status))
    {
@@ -1685,10 +1685,10 @@ STATIC EFI_STATUS EFIAPI ventoy_wrapper_read_key_ex
        KeyData->Key.UnicodeChar = 0;
        KeyData->KeyState.KeyShiftState = 0;
        KeyData->KeyState.KeyToggleState = 0;
-        
+
        return EFI_SUCCESS;
    }
-    
+
    return g_org_read_key_ex(This, KeyData);
 }

@@ -1725,7 +1725,7 @@ EFI_STATUS ventoy_hook_keyboard_start(VOID)

    g_org_read_key = gST->ConIn->ReadKeyStroke;
    gST->ConIn->ReadKeyStroke = ventoy_wrapper_read_key;
-    
+
    return EFI_SUCCESS;
 }

@@ -1763,7 +1763,7 @@ STATIC EFI_STATUS EFIAPI ventoy_wrapper_locate_handle
    EFI_STATUS Status = EFI_SUCCESS;

    Status = g_org_locate_handle(SearchType, Protocol, SearchKey, BufferSize, Buffer);
-    
+
    if (EFI_SUCCESS == Status && Protocol && CompareGuid(&gEfiBlockIoProtocolGuid, Protocol))
    {
        for (i = 0; i < (*BufferSize) / sizeof(EFI_HANDLE); i++)
@@ -1785,7 +1785,7 @@ EFI_STATUS ventoy_hook_1st_cdrom_start(VOID)
 {
    g_org_locate_handle = gBS->LocateHandle;
    gBS->LocateHandle = ventoy_wrapper_locate_handle;
-    
+
    return EFI_SUCCESS;
 }

@@ -1793,7 +1793,180 @@ EFI_STATUS ventoy_hook_1st_cdrom_stop(VOID)
 {
    gBS->LocateHandle = g_org_locate_handle;
    g_org_locate_handle = NULL;
-    
+
    return EFI_SUCCESS;
 }

+
+
+#if 0
+/* For force highest resolution for Windows/WinPE */
+#endif
+
+
+STATIC UINT32 g_org_mode_num = 0;
+STATIC EFI_GRAPHICS_OUTPUT_PROTOCOL_SET_MODE  g_org_set_mode = NULL;
+
+STATIC EFI_STATUS EFIAPI ventoy_set_mode
+(
+  IN  EFI_GRAPHICS_OUTPUT_PROTOCOL *This,
+  IN  UINT32                       ModeNumber
+)
+{
+    (void)This;
+    (void)ModeNumber;
+
+    /* Force highest resolution */
+    return EFI_SUCCESS;
+}
+
+STATIC EFI_STATUS EFIAPI ventoy_set_mode2
+(
+  IN  EFI_GRAPHICS_OUTPUT_PROTOCOL *This,
+  IN  UINT32                       ModeNumber
+)
+{
+    UINTN Size;
+    EFI_STATUS rc;
+    EFI_GRAPHICS_OUTPUT_MODE_INFORMATION *info = NULL;
+
+    /* Force >= 1024x768 */
+    rc = This->QueryMode(This, ModeNumber, &Size, &info);
+    if (rc == EFI_SUCCESS)
+    {
+        if (info->HorizontalResolution < 1024 || info->VerticalResolution < 768)
+        {
+            return EFI_SUCCESS;
+        }
+    }
+
+    return g_org_set_mode(This, ModeNumber);
+}
+
+EFI_STATUS ventoy_lock_res(UINT8 LockType)
+{
+	UINT32 i = 0;
+	UINT32 x = 0;
+    UINT32 y = 0;
+    UINT32 SelMode = 0;
+    UINT32 CurMode = 0;
+    UINT32 Highest = 0;
+    UINT32 M1024_768 = MAX_UINT32;
+	UINTN  Size;
+	EFI_STATUS rc;
+    EFI_GRAPHICS_OUTPUT_PROTOCOL *gop = NULL;
+	EFI_GRAPHICS_OUTPUT_MODE_INFORMATION *info = NULL;
+
+    /* already hook */
+    if (g_org_set_mode)
+    {
+        return EFI_SUCCESS;
+    }
+
+    /* 1: Highest   2: 1024x768 3: >= 1024x768 */
+    if (LockType == 0 || LockType > 3)
+    {
+        return EFI_SUCCESS;
+    }
+
+    rc = gBS->LocateProtocol(&gEfiGraphicsOutputProtocolGuid, NULL, (void **)&gop);
+    if (rc != EFI_SUCCESS)
+    {
+        debug("Failed to locate GOP protocol");
+        return EFI_SUCCESS;
+    }
+
+
+    if (LockType == 3)
+    {
+        g_org_mode_num = MAX_UINT32;
+        g_org_set_mode = gop->SetMode;
+        gop->SetMode = ventoy_set_mode2;
+        return EFI_SUCCESS;
+    }
+
+
+    CurMode = gop->Mode->Mode;
+
+    for (i = 0 ; i < gop->Mode->MaxMode ; i++)
+    {
+		/* Get mode information */
+		if (gop->QueryMode(gop, i, &Size, &info) == EFI_SUCCESS)
+        {
+            if (info->HorizontalResolution == 1024 && info->VerticalResolution == 768)
+            {
+                M1024_768 = i;
+            }
+
+            if (x < info->HorizontalResolution ||
+               (x == info->HorizontalResolution && y < info->VerticalResolution))
+            {
+                Highest = i;
+                x = info->HorizontalResolution;
+                y = info->VerticalResolution;
+            }
+		}
+    }
+
+
+    if (LockType == 1)
+    {
+        SelMode = Highest;
+    }
+    else
+    {
+        if (M1024_768 == MAX_UINT32)
+        {
+            SelMode = Highest;
+        }
+        else
+        {
+            SelMode = M1024_768;
+            x = 1024;
+            y = 768;
+        }
+    }
+
+    if (SelMode != CurMode)
+    {
+        gop->SetMode(gop, SelMode);
+    }
+    debug("Lock resolution to Mode:%d  %d x %d", SelMode, x, y);
+
+
+    g_org_mode_num = CurMode;
+    g_org_set_mode = gop->SetMode;
+    gop->SetMode = ventoy_set_mode;
+
+    return EFI_SUCCESS;
+}
+
+EFI_STATUS ventoy_unlock_res(VOID)
+{
+	EFI_STATUS rc;
+    EFI_GRAPHICS_OUTPUT_PROTOCOL *gop = NULL;
+
+    /* not hooked yet */
+    if (!g_org_set_mode)
+    {
+        return EFI_SUCCESS;
+    }
+
+    rc = gBS->LocateProtocol(&gEfiGraphicsOutputProtocolGuid, NULL, (void **)&gop);
+    if (rc != EFI_SUCCESS)
+    {
+        debug("Failed to locate GOP protocol");
+        return EFI_SUCCESS;
+    }
+
+    if (g_org_mode_num != MAX_UINT32)
+    {
+        g_org_set_mode(gop, g_org_mode_num);
+    }
+
+    gop->SetMode = g_org_set_mode;
+    g_org_set_mode = NULL;
+    return EFI_SUCCESS;
+}
+
+
@@ -0,0 +1,739 @@
+/******************************************************************************
+ * VtoyShim.c
+ *
+ * Copyright (c) 2017 - 2018, Intel Corporation. All rights reserved.<BR>
+ * SPDX-License-Identifier: BSD-2-Clause-Patent
+ *
+ */
+
+#include <Uefi.h>
+
+#include <Library/DebugLib.h>
+#include <Library/PrintLib.h>
+#include <Library/UefiLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DevicePathLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/UefiBootServicesTableLib.h>
+#include <Library/UefiRuntimeServicesTableLib.h>
+#include <Library/UefiApplicationEntryPoint.h>
+#include <Library/PeCoffLib.h>
+#include <Protocol/LoadedImage.h>
+#include <Guid/FileInfo.h>
+#include <Guid/FileSystemInfo.h>
+#include <Guid/ImageAuthentication.h>
+#include <Protocol/BlockIo.h>
+#include <Protocol/RamDisk.h>
+#include <Protocol/SimpleFileSystem.h>
+#include <Protocol/DevicePathToText.h>
+#include <Protocol/DevicePathFromText.h>
+#include <Protocol/LoadedImage.h>
+#include <Protocol/Security.h>
+#include <Protocol/Security2.h>
+#include <IndustryStandard/PeImage.h>
+#include <VtoyShim.h>
+
+#define CUR_SBAT_VER    1
+
+STATIC UINT8 gVtoyGrubSha256Hash[32] __attribute__((aligned(32)))  = {
+    0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26,
+    0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26,
+    0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26,
+    0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26
+};
+
+STATIC BOOLEAN gGrubLaunched = FALSE;
+STATIC EFI_GUID gShimLockGUID = SHIM_LOCK_GUID;
+STATIC EFI_GUID gMsftDBXSVNOwnerGUID = MSFT_DBX_SVN_OWN_GUID;
+STATIC EFI_GUID gBootMgrDBXSVNGUID = EFI_BOOTMGR_DBXSVN_GUID;
+STATIC EFI_SECURITY_FILE_AUTHENTICATION_STATE gSysSecFileAuth = NULL;
+STATIC EFI_SECURITY2_FILE_AUTHENTICATION gSysSec2FileAuth = NULL;
+STATIC BOOLEAN gVtoyByPassSB = FALSE; /* must be FALSE by default for revoke */
+STATIC VTOY_SHIM gVtoyShimProtocol;
+STATIC EFI_HANDLE gVtoyShimProtHandle;
+STATIC SHIM_LOCK gShimLock;
+
+STATIC EFI_EXIT_BOOT_SERVICES gSysExitBootServices = NULL;
+STATIC EFI_GET_VARIABLE gSysGetVariable = NULL;
+
+STATIC VOID EFIAPI HookSystemService(VOID);
+STATIC VOID EFIAPI UnHookSystemService(VOID);
+
+
+STATIC VOID EFIAPI VtoyLog(CONST CHAR16 *Format, ...)
+{
+    VA_LIST         Marker;
+    CHAR16          Buffer[512];
+    UINTN           BufLen = 0;
+
+    Buffer[0] = 0;
+    VA_START(Marker, Format);
+    BufLen = UnicodeVSPrint(Buffer, sizeof(Buffer), Format, Marker);
+    VA_END(Marker);
+
+    if (gST->ConOut && gST->ConOut->OutputString)
+    {
+        gST->ConOut->OutputString(gST->ConOut, Buffer);
+    }
+}
+
+
+STATIC VOID EFIAPI DumpDevicePath(const EFI_DEVICE_PATH_PROTOCOL *DevicePath)
+{
+    CHAR16 *DPStr = NULL;
+
+    if (DevicePath)
+    {
+        DPStr = ConvertDevicePathToText(DevicePath, TRUE, TRUE);
+    }
+
+    if (DPStr)
+    {
+        vLog(L"%s", DPStr);
+        FreePool(DPStr);
+    }
+    else
+    {
+        vLog(L"NULL");
+    }
+}
+
+STATIC VOID EFIAPI ShowSBWarning(const EFI_DEVICE_PATH_PROTOCOL *DevicePath)
+{
+    vLog(L"\r\n=======================================================");
+    vLog(L"=======================================================\r\n");
+
+    DumpDevicePath(DevicePath);
+
+    vLog(L"\r\n####### Ventoy Security Boot Violation ##########\r\n");
+
+    vLog(L"=======================================================");
+    vLog(L"=======================================================");
+
+    VtoySleep(5);
+}
+
+
+STATIC VOID * EFIAPI FindShimFuncAddr(UINT64 FuncOffset)
+{
+    EFI_STATUS Status;
+    SHIM_IMAGE_LOADER *ImgLoader = NULL;
+    EFI_GUID ShimImgLoaderGuid = SHIM_IMAGE_LOADER_GUID;
+
+    Status = gBS->LocateProtocol(&ShimImgLoaderGuid, NULL, (VOID **)&ImgLoader);
+    if (EFI_ERROR(Status) || !ImgLoader || !ImgLoader->LoadImage)
+    {
+        vLog(L"Failed to locate shim image loader protocol %lx %p", Status, ImgLoader);
+        return NULL;
+    }
+
+    if (NM_SHIM_LOAD_IMAGE_OFFSET > FuncOffset)
+    {
+        return (UINT8 *)ImgLoader->LoadImage - (NM_SHIM_LOAD_IMAGE_OFFSET - FuncOffset);
+    }
+    else
+    {
+        return (UINT8 *)ImgLoader->LoadImage + (FuncOffset - NM_SHIM_LOAD_IMAGE_OFFSET);
+    }
+}
+
+EFI_STATUS EFIAPI LaunchRealGrub(EFI_HANDLE ImageHandle, CONST CHAR16 *FileName)
+{
+    EFI_STATUS Status;
+    UINTN BufferSize = 0;
+    CHAR16 *DevDpStr = NULL;
+    CHAR16 *NewDpStr = NULL;
+    EFI_HANDLE ChildHandle = NULL;
+    EFI_LOADED_IMAGE_PROTOCOL *Li = NULL;
+    EFI_DEVICE_PATH_PROTOCOL *DeviceDP = NULL;
+    EFI_DEVICE_PATH_PROTOCOL *TargetDp = NULL;
+
+    Status = gBS->HandleProtocol(ImageHandle, &gEfiLoadedImageProtocolGuid, (VOID**)&Li);
+    if (EFI_ERROR(Status))
+    {
+        vLog(L"Failed to locate loaded image protocol %lx", Status);
+        return Status;
+    }
+
+    DeviceDP = DevicePathFromHandle(Li->DeviceHandle);
+    if (!DeviceDP || !IsDevicePathValid(DeviceDP, 0))
+    {
+        vLog(L"Failed to get device path of device handle %p", Li->DeviceHandle);
+        Status = EFI_NOT_FOUND;
+        goto END;
+    }
+
+    DevDpStr = ConvertDevicePathToText(DeviceDP, FALSE, TRUE);
+    if (!DevDpStr)
+    {
+        vLog(L"Failed to convert device path to text");
+        Status = EFI_OUT_OF_RESOURCES;
+        goto END;
+    }
+
+    BufferSize = (StrLen(DevDpStr) + 64) * sizeof(CHAR16);
+    NewDpStr = (CHAR16 *)AllocatePool(BufferSize);
+    if (!NewDpStr)
+    {
+        vLog(L"Failed to alloc new device path string buffer size:%lu", BufferSize);
+        Status = EFI_OUT_OF_RESOURCES;
+        goto END;
+    }
+
+    UnicodeSPrint(NewDpStr, BufferSize, L"%s/EFI/BOOT/%s", DevDpStr, FileName);
+
+    TargetDp = ConvertTextToDevicePath(NewDpStr);
+    if (!TargetDp)
+    {
+        vLog(L"Failed to convert new text <%s> to device path", NewDpStr);
+        Status = EFI_NOT_FOUND;
+        goto END;
+    }
+
+    Status = gBS->LoadImage(FALSE, ImageHandle, TargetDp, NULL, 0, &ChildHandle);
+    if (EFI_ERROR(Status))
+    {
+        vLog(L"Failed to LoadImage %lx", Status);
+        goto END;
+    }
+
+    Status = gBS->StartImage(ChildHandle, NULL, NULL);
+    if (EFI_ERROR(Status))
+    {
+        vLog(L"Failed to StartImage %lx", Status);
+        gBS->UnloadImage(ChildHandle);
+        goto END;
+    }
+
+END:
+
+    CheckFreePool(DevDpStr);
+    CheckFreePool(NewDpStr);
+    CheckFreePool(TargetDp);
+
+    return Status;
+}
+
+
+STATIC EFI_STATUS EFIAPI CheckVtoyGrub
+(
+    VOID *FileBuffer,
+	UINTN FileSize
+)
+{
+    UINT8 Sha256Hash[64];
+
+    if (!FileBuffer || FileSize < sizeof(EFI_IMAGE_DOS_HEADER))
+    {
+        vErr(L"Invalid FileBuffer:%p or size:%ld", FileBuffer, FileSize);
+        return EFI_SECURITY_VIOLATION;
+    }
+
+    ZeroMem(Sha256Hash, sizeof(Sha256Hash));
+    calc_sha256(FileBuffer, (UINT64)FileSize, Sha256Hash);
+
+    if (CompareMem(Sha256Hash, gVtoyGrubSha256Hash, 32) != 0)
+    {
+        vErr(L"Ventoy hash check failed.");
+        gRT->ResetSystem(EfiResetWarm, EFI_SECURITY_VIOLATION, 0, NULL);
+        return EFI_SECURITY_VIOLATION;
+    }
+
+    return EFI_SUCCESS;
+}
+
+STATIC EFI_STATUS EFIAPI SecurityPolicyAuth
+(
+	const EFI_SECURITY_ARCH_PROTOCOL *This,
+	UINT32 AuthenticationStatus,
+	const EFI_DEVICE_PATH_PROTOCOL *DevicePathConst
+)
+{
+    /*
+     * Some old UEFI firmware (without Security2 protocol) will hang when run OpenVolume.
+     * So finally I decide not to support such UEFI firmware.
+     * It means that for UEFI firmware before 2.5 (about 2015) Ventoy only supports Bypass policy.
+     *
+     */
+
+    (VOID)This;
+    (VOID)AuthenticationStatus;
+    (VOID)DevicePathConst;
+    return EFI_SUCCESS;
+}
+
+STATIC EFI_STATUS EFIAPI Security2PolicyAuth
+(
+	const EFI_SECURITY2_ARCH_PROTOCOL *This,
+	const EFI_DEVICE_PATH_PROTOCOL *DevicePath,
+	VOID *FileBuffer,
+	UINTN FileSize,
+	BOOLEAN	BootPolicy
+)
+{
+    EFI_STATUS Status;
+
+    /* Just return OK if the user choose to bypass SB */
+    if (gVtoyByPassSB)
+    {
+        return EFI_SUCCESS;
+    }
+
+    if (!gGrubLaunched)
+    {
+        return CheckVtoyGrub(FileBuffer, FileSize);
+    }
+
+    /*
+     * Step 1:
+     * Use original UEFI firmware auth API.
+     * If it's OK, it may be signed with Microsoft UEFI CA. (e.g. bootmgr/shim/...)
+     */
+    if (gSysSec2FileAuth)
+    {
+        Status = gSysSec2FileAuth(This, DevicePath, FileBuffer, FileSize, BootPolicy);
+        if (!EFI_ERROR(Status))
+        {
+            return EFI_SUCCESS;
+        }
+    }
+
+
+    /*
+     * Step 2:
+     * Use shim verify API.
+     * If it's OK, it may be signed with a MOK key. (e.g. Ventoy EFI files)
+     */
+    if (gShimLock.Verify)
+    {
+        if (FileBuffer && FileSize > 0 && FileSize < 0xFFFFFFFFUL)
+        {
+            Status = gShimLock.Verify(FileBuffer, (UINT32)FileSize);
+            if (!EFI_ERROR(Status))
+            {
+                return EFI_SUCCESS;
+            }
+        }
+    }
+
+    ShowSBWarning(DevicePath);
+
+    return EFI_SECURITY_VIOLATION;
+}
+
+
+STATIC EFI_STATUS EFIAPI HookSecurityPolicy(VOID)
+{
+	EFI_STATUS Status;
+	EFI_STATUS Status2;
+	EFI_SECURITY_ARCH_PROTOCOL *Security = NULL;
+	EFI_SECURITY2_ARCH_PROTOCOL *Security2 = NULL;
+
+	Status = gBS->LocateProtocol(&gEfiSecurityArchProtocolGuid, NULL, (VOID **)&Security);
+	Status2 = gBS->LocateProtocol(&gEfiSecurity2ArchProtocolGuid, NULL, (VOID **)&Security2);
+    if (EFI_ERROR(Status) && EFI_ERROR(Status2))
+    {
+        vLog(L"Failed to locate security or security2 protocol. %lx %lx %p %p",
+             Status, Status2, Security, Security2);
+        return EFI_NOT_FOUND;
+    }
+
+    if (Security2)
+    {
+        gSysSec2FileAuth = Security2->FileAuthentication;
+        Security2->FileAuthentication = Security2PolicyAuth;
+    }
+
+    if (Security)
+    {
+        gSysSecFileAuth = Security->FileAuthenticationState;
+        Security->FileAuthenticationState = SecurityPolicyAuth;
+    }
+
+	return EFI_SUCCESS;
+}
+
+STATIC VOID EFIAPI UnHookSecurityPolicy(VOID)
+{
+	EFI_STATUS Status;
+	EFI_STATUS Status2;
+	EFI_SECURITY_ARCH_PROTOCOL *Security = NULL;
+	EFI_SECURITY2_ARCH_PROTOCOL *Security2 = NULL;
+
+    if (!gSysSec2FileAuth && !gSysSecFileAuth)
+    {
+        return;
+    }
+
+	Status = gBS->LocateProtocol(&gEfiSecurityArchProtocolGuid, NULL, (VOID **)&Security);
+	Status2 = gBS->LocateProtocol(&gEfiSecurity2ArchProtocolGuid, NULL, (VOID **)&Security2);
+    if (EFI_ERROR(Status) && EFI_ERROR(Status2))
+    {
+        vLog(L"Failed to locate security or security2 protocol. %lx %lx %p %p",
+             Status, Status2, Security, Security2);
+        return;
+    }
+
+    if (Security2 && gSysSec2FileAuth && Security2->FileAuthentication == Security2PolicyAuth)
+    {
+        Security2->FileAuthentication = gSysSec2FileAuth;
+        gSysSec2FileAuth = NULL;
+    }
+
+    if (Security && gSysSecFileAuth && Security->FileAuthenticationState == SecurityPolicyAuth)
+    {
+        Security->FileAuthenticationState = gSysSecFileAuth;
+        gSysSecFileAuth = NULL;
+    }
+}
+
+STATIC VOID EFIAPI VtoyByPassSB(VOID)
+{
+    gVtoyByPassSB = TRUE;
+}
+
+STATIC VOID EFIAPI VtoyCheckSB(VOID)
+{
+    gVtoyByPassSB = FALSE;
+}
+
+STATIC VOID EFIAPI VtoyLaunched(VOID)
+{
+    gGrubLaunched = TRUE;
+}
+
+STATIC VOID EFIAPI UnInstallVtoyShimProtocol(VOID)
+{
+    EFI_GUID Guid = VTOY_SHIM_POLICY_GUID;
+
+    if (gVtoyShimProtHandle)
+    {
+        gBS->UninstallProtocolInterface(gVtoyShimProtHandle, &Guid, &gVtoyShimProtocol);
+        gVtoyShimProtHandle = NULL;
+    }
+}
+
+STATIC EFI_STATUS EFIAPI InstallVtoyShimProtocol(VOID)
+{
+	EFI_STATUS Status;
+    EFI_GUID Guid = VTOY_SHIM_POLICY_GUID;
+    VTOY_SHIM *Prot = NULL;
+
+    gVtoyShimProtocol.ByPassSB = VtoyByPassSB;
+    gVtoyShimProtocol.CheckSB = VtoyCheckSB;
+    gVtoyShimProtocol.Launched = VtoyLaunched;
+
+    Status = gBS->LocateProtocol(&Guid, NULL, (VOID**)&Prot);
+    if (!EFI_ERROR(Status))
+    {
+        vLog(L"Ventoy shim already loaded, cannot be nested.");
+        return EFI_ALREADY_STARTED;
+    }
+
+    Status = gBS->InstallProtocolInterface(&gVtoyShimProtHandle, &Guid,
+                    EFI_NATIVE_INTERFACE, &gVtoyShimProtocol);
+    if (EFI_ERROR(Status))
+    {
+        vLog(L"Failed to install protocol %lx", Status);
+    }
+
+    return Status;
+}
+
+STATIC BOOLEAN EFIAPI IsSecureBootEnabled(VOID)
+{
+    UINT8 SecureBoot = 0;
+	UINTN DataSize;
+	EFI_STATUS Status;
+
+	DataSize = sizeof(SecureBoot);
+	Status = gST->RuntimeServices->GetVariable(L"SecureBoot", &gEfiGlobalVariableGuid, NULL,
+				     &DataSize, &SecureBoot);
+	if (EFI_ERROR(Status))
+    {
+        return FALSE;
+    }
+
+	return SecureBoot ? TRUE : FALSE;
+}
+
+STATIC BOOLEAN EFIAPI IsSetupMode(VOID)
+{
+    UINT8 SetupMode = 0;
+	UINTN DataSize;
+	EFI_STATUS Status;
+
+	DataSize = sizeof(SetupMode);
+	Status = gST->RuntimeServices->GetVariable(L"SetupMode", &gEfiGlobalVariableGuid, NULL,
+				     &DataSize, &SetupMode);
+	if (EFI_ERROR(Status))
+    {
+        return FALSE;
+    }
+
+	return SetupMode ? TRUE : FALSE;
+}
+
+STATIC EFI_STATUS EFIAPI ShimEfiMain
+(
+    IN EFI_HANDLE         ImageHandle,
+    IN EFI_SYSTEM_TABLE  *SystemTable
+)
+{
+    EFI_STATUS Status;
+    SHIM_LOCK *ShimLock = NULL;
+    shim_void_func_pf Func1 = NULL;
+    shim_void_func_pf Func2 = NULL;
+
+    /* We must be launched by shim */
+    Status = gBS->LocateProtocol(&gShimLockGUID, NULL, (VOID**)&ShimLock);
+    if (EFI_ERROR(Status) || !ShimLock)
+    {
+        vErr(L"Failed to locate SHIM LOCK Protocol %lx", Status);
+        return Status;
+    }
+
+    /* Backup shim Lock because we will remove it later  */
+    gShimLock.Verify = ShimLock->Verify;
+    gShimLock.Hash = ShimLock->Hash;
+    gShimLock.Context = ShimLock->Context;
+
+    Status = InstallVtoyShimProtocol();
+    if (EFI_ERROR(Status))
+    {
+        vErr(L"Failed to install ventoy shim protocol");
+        return Status;
+    }
+
+
+    /*
+     * IMPORTANT: All recent shim implementations hook the UEFI Boot Services
+     * (e.g. LoadImage, StartImage) to enforce signature verification.
+     *
+     * We must restore the original system service pointers here. If we fail to do this,
+     * we will be unable to launch Ventoy-signed EFI binaries or any other unsigned
+     * EFI applications later, even when the user has explicitly opted to disable
+     * all Secure Boot validation checks.
+     *
+     * To the best of my knowledge, there is no official way to remove these hooks.
+     * This is a tricky hack that relies on shim's internal implementation details.
+     * It may break in future versions of shim, and a better approach may exist.
+     *
+     */
+    Func1 = FindShimFuncAddr(NM_UNHOOK_SYSTEM_SERVICES_OFFSET);
+    Func2 = FindShimFuncAddr(NM_UNINSTALL_SHIM_PROTOCOLS_OFFSET);
+    if (!Func1 || !Func2)
+    {
+        vErr(L"Can not find shim func %p %p", Func1, Func2);
+        Status = EFI_NOT_FOUND;
+        goto END;
+    }
+
+    Func1(); /* call shim unhook_system_services() */
+    Func2(); /* call shim uninstall_shim_protocols() */
+
+    HookSystemService();
+
+    /* Hook the system security policy */
+    Status = HookSecurityPolicy();
+    if (EFI_ERROR(Status))
+    {
+        vErr(L"Failed to hook system security policy");
+        goto END;
+    }
+
+
+    /* Finally launch Ventoy grub */
+    Status = LaunchRealGrub(ImageHandle, REAL_GRUB_FILE);
+    if (EFI_ERROR(Status))
+    {
+        vErr(L"Failed to finally launch real grub %s", REAL_GRUB_FILE);
+        goto END;
+    }
+
+END:
+
+    /* UnHook system security policy */
+    UnHookSecurityPolicy();
+
+    UnInstallVtoyShimProtocol();
+
+    UnHookSystemService();
+
+    return Status;
+}
+
+STATIC EFI_STATUS EFIAPI VtoyHookDBX(UINTN DataSize, VOID *Data)
+{
+    UINT32 i = 0;
+    UINT32 Count = 0;
+    UINTN Offset = 0;
+    EFI_SIGNATURE_LIST *pstCurSig = NULL;
+    EFI_SIGNATURE_DATA *pstSigData = NULL;
+
+    for (Offset = 0; Offset + sizeof(EFI_SIGNATURE_LIST) <= DataSize; Offset += pstCurSig->SignatureListSize)
+    {
+        pstCurSig = (EFI_SIGNATURE_LIST *)((UINT8 *)Data + Offset);
+        if (pstCurSig->SignatureSize == 0 || pstCurSig->SignatureListSize == 0 ||
+            Offset + pstCurSig->SignatureListSize > DataSize ||
+            pstCurSig->SignatureListSize < sizeof(EFI_SIGNATURE_LIST) + pstCurSig->SignatureHeaderSize)
+        {
+            break;
+        }
+
+        if (!CompareGuid(&pstCurSig->SignatureType, &gEfiCertSha256Guid))
+        {
+            continue;
+        }
+
+        pstSigData = (EFI_SIGNATURE_DATA *)((UINT8 *)pstCurSig + sizeof(EFI_SIGNATURE_LIST) + pstCurSig->SignatureHeaderSize);
+        Count = (pstCurSig->SignatureListSize - sizeof(EFI_SIGNATURE_LIST) - pstCurSig->SignatureHeaderSize) / pstCurSig->SignatureSize;
+
+#if 0
+    if (Count > 0 && pstCurSig->SignatureSize == 48)
+    {
+        vDbg(L"Make a fake SVN signature for test");
+        CopyMem(&pstSigData->SignatureOwner, &gMsftDBXSVNOwnerGUID, sizeof(EFI_GUID));
+        ZeroMem(pstSigData->SignatureData, pstCurSig->SignatureSize);
+        CopyMem(&pstSigData->SignatureData + 1, &gBootMgrDBXSVNGUID, sizeof(EFI_GUID));
+        pstSigData->SignatureData[0]  = 1;
+        DBX_SVN_SET(pstSigData->SignatureData, 100);
+        break;
+    }
+#endif
+
+        for (i = 0; i < Count; i++)
+        {
+            if (CompareGuid(&pstSigData->SignatureOwner, &gMsftDBXSVNOwnerGUID) &&
+                CompareGuid((CONST EFI_GUID *)(pstSigData->SignatureData + 1), &gBootMgrDBXSVNGUID))
+            {
+                DBX_SVN_SET(pstSigData->SignatureData, 1);
+                return EFI_SUCCESS;
+            }
+            pstSigData = (EFI_SIGNATURE_DATA *)((UINT8 *)pstSigData + pstCurSig->SignatureSize);
+        }
+    }
+
+    return EFI_SUCCESS;
+}
+
+EFI_STATUS EFIAPI VtoyGetVariable
+(
+    IN     CHAR16                      *VariableName,
+    IN     EFI_GUID                    *VendorGuid,
+    OUT    UINT32                      *Attributes,    OPTIONAL
+    IN OUT UINTN                       *DataSize,
+    OUT    VOID                        *Data           OPTIONAL
+)
+{
+    BOOLEAN bChk = FALSE;
+    EFI_STATUS Status;
+
+    if (gVtoyByPassSB && VariableName && VendorGuid && DataSize && Data)
+    {
+        bChk = TRUE;
+    }
+
+    Status = gSysGetVariable(VariableName, VendorGuid, Attributes, DataSize, Data);
+    if (bChk && EFI_SUCCESS == Status)
+    {
+        if (EFI_VAR_MATCH(&gShimLockGUID, L"MokSBState"))
+        {
+            *(UINT8 *)Data = 1;
+        }
+        else if (EFI_VAR_MATCH(&gEfiImageSecurityDatabaseGuid, L"dbx"))
+        {
+            VtoyHookDBX(*DataSize, Data);
+        }
+    }
+
+    return Status;
+}
+
+STATIC VOID EFIAPI UnHookSystemService(VOID)
+{
+    UINT32 uiNewCRC = 0;
+    EFI_TABLE_HEADER *Hdr = &gST->RuntimeServices->Hdr;
+
+    if (gSysExitBootServices)
+    {
+        gBS->ExitBootServices = gSysExitBootServices;
+        gSysExitBootServices = NULL;
+    }
+
+    if (gSysGetVariable)
+    {
+        gST->RuntimeServices->GetVariable = gSysGetVariable;
+        gSysGetVariable = NULL;
+
+        Hdr->CRC32 = 0;
+        gBS->CalculateCrc32(Hdr, Hdr->HeaderSize, &uiNewCRC);
+        Hdr->CRC32 = uiNewCRC;
+    }
+}
+
+
+STATIC EFI_STATUS EFIAPI VtoyExitBootServices
+(
+    IN  EFI_HANDLE  ImageHandle,
+    IN  UINTN       MapKey
+)
+{
+    EFI_EXIT_BOOT_SERVICES SysExitBS;
+
+    /* UnHookSystemService will set gSysExitBootServices NULL */
+    SysExitBS = gSysExitBootServices;
+
+    UnHookSecurityPolicy();
+    UnInstallVtoyShimProtocol();
+    UnHookSystemService();
+
+    return SysExitBS(ImageHandle, MapKey);
+}
+
+STATIC VOID EFIAPI HookSystemService(VOID)
+{
+    UINT32 uiNewCRC = 0;
+    EFI_TABLE_HEADER  *Hdr = &gST->RuntimeServices->Hdr;
+
+    gSysExitBootServices = gBS->ExitBootServices;
+    gBS->ExitBootServices = VtoyExitBootServices;
+
+    gSysGetVariable = gST->RuntimeServices->GetVariable;
+    gST->RuntimeServices->GetVariable = VtoyGetVariable;
+
+    Hdr->CRC32 = 0;
+    gBS->CalculateCrc32(Hdr, Hdr->HeaderSize, &uiNewCRC);
+    Hdr->CRC32 = uiNewCRC;
+}
+
+EFI_STATUS EFIAPI VtoyShimEfiMain
+(
+    IN EFI_HANDLE         ImageHandle,
+    IN EFI_SYSTEM_TABLE  *SystemTable
+)
+{
+    BOOLEAN IsSetup = FALSE;
+    BOOLEAN IsSecureBoot = FALSE;
+    EFI_STATUS Status;
+
+    IsSetup = IsSetupMode();
+    IsSecureBoot = IsSecureBootEnabled();
+
+    if (!IsSecureBoot || IsSetup)
+    {
+        /* If secure boot is not enabled or in SetupMode, nothing needed, just launch Ventoy grub */
+        Status = LaunchRealGrub(ImageHandle, REAL_GRUB_FILE);
+        if (EFI_ERROR(Status))
+        {
+            vErr(L"Failed to launch %s", REAL_GRUB_FILE);
+        }
+    }
+    else
+    {
+        Status = ShimEfiMain(ImageHandle, SystemTable);
+    }
+
+    return Status;
+}
+
@@ -0,0 +1,132 @@
+/******************************************************************************
+ * VtoyShim.h
+ *
+ * Copyright (c) 2017 - 2018, Intel Corporation. All rights reserved.<BR>
+ * SPDX-License-Identifier: BSD-2-Clause-Patent
+ *
+ */
+
+#ifndef __VTOYSHIM_H__
+#define __VTOYSHIM_H__
+
+#if defined (MDE_CPU_IA32)
+#define REAL_GRUB_FILE    L"grubia32_real.efi"
+#elif defined (MDE_CPU_X64)
+#define REAL_GRUB_FILE    L"grubx64_real.efi"
+#elif defined (MDE_CPU_AARCH64)
+#define REAL_GRUB_FILE    L"grubaa64_real.efi"
+#else
+#error "Not supported now"
+#endif
+
+
+/* The following definations are copied from shim source code */
+
+#define SHIM_LOCK_GUID  {0x605dab50, 0xe046, 0x4300, {0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23 } }
+#define MSFT_DBX_SVN_OWN_GUID { 0x9d132b6c, 0x59d5, 0x4388, {0xab, 0x1c, 0x18, 0x5c, 0xfc, 0xb2, 0xeb, 0x92}}
+#define EFI_BOOTMGR_DBXSVN_GUID { 0x9d132b61, 0x59d5, 0x4388, {0xab, 0x1c, 0x18, 0x5c, 0x3c, 0xb2, 0xeb, 0x92}}
+
+
+#define EFI_VAR_MATCH(pguid, name) \
+    (CompareMem((pguid), VendorGuid, 16) == 0 && StrCmp(VariableName, (name)) == 0)
+
+#define DBX_SVN_SET(SigData, SVN) \
+do { \
+    SigData[17] = 0; \
+    SigData[18] = 0; \
+    SigData[19] = (SVN); \
+    SigData[20] = 0; \
+} while (0)
+
+
+
+typedef
+EFI_STATUS
+(*EFI_SHIM_LOCK_VERIFY) (
+	IN VOID *buffer,
+	IN UINT32 size
+	);
+
+typedef
+EFI_STATUS
+(*EFI_SHIM_LOCK_HASH) (
+	IN char *data,
+	IN int datasize,
+	PE_COFF_LOADER_IMAGE_CONTEXT *context,
+	UINT8 *sha256hash,
+	UINT8 *sha1hash
+	);
+
+typedef
+EFI_STATUS
+(*EFI_SHIM_LOCK_CONTEXT) (
+	IN VOID *data,
+	IN unsigned int datasize,
+	PE_COFF_LOADER_IMAGE_CONTEXT *context
+	);
+
+typedef struct _SHIM_LOCK {
+	EFI_SHIM_LOCK_VERIFY Verify;
+	EFI_SHIM_LOCK_HASH Hash;
+	EFI_SHIM_LOCK_CONTEXT Context;
+} SHIM_LOCK;
+
+
+
+#define SHIM_IMAGE_LOADER_GUID {0x1f492041, 0xfadb, 0x4e59, {0x9e, 0x57, 0x7c, 0xaf, 0xe7, 0x3a, 0x55, 0xab } }
+
+typedef struct _SHIM_IMAGE_LOADER {
+	EFI_IMAGE_LOAD LoadImage;
+	EFI_IMAGE_START StartImage;
+	EFI_EXIT Exit;
+	EFI_IMAGE_UNLOAD UnloadImage;
+} SHIM_IMAGE_LOADER;
+
+typedef VOID (*shim_void_func_pf)(VOID);
+
+
+/*
+ * The two offset here are extract from the shim file which used in Ventoy.
+ * nm BOOTX64.EFI | grep shim_load_image
+ * nm BOOTX64.EFI | grep unhook_system_services
+ * nm BOOTX64.EFI | grep uninstall_shim_protocols
+ *
+ * It means that they must be updated every time Ventoy update the shim file.
+ *
+ */
+#define NM_SHIM_LOAD_IMAGE_OFFSET             0x2dc12
+#define NM_UNHOOK_SYSTEM_SERVICES_OFFSET      0x2e278
+#define NM_UNINSTALL_SHIM_PROTOCOLS_OFFSET    0x26264
+
+
+
+
+#define VtoySleep(sec)      gBS->Stall(1000000 * (sec))
+#define vLog(fmt, ...)      VtoyLog(fmt "\r\n", ##__VA_ARGS__)
+#define vErr(fmt, ...)      VtoyLog(fmt "\r\n", ##__VA_ARGS__); VtoySleep(5)
+#define vDbg(fmt, ...)      VtoyLog(fmt "\r\n", ##__VA_ARGS__); VtoySleep(1)
+
+#define CheckFreePool(p) \
+do { \
+    if (p) { \
+        FreePool(p); \
+        (p) = NULL; \
+    }\
+} while (0)
+
+
+#define VTOY_SHIM_POLICY_GUID    {0x90a29d14, 0x3968, 0x48fe, { 0x85, 0x81, 0x6b, 0x7f, 0x7d, 0xc4, 0x70, 0x55 }};
+
+typedef VOID (EFIAPI *VTOY_BYPASS_SB)(VOID);
+typedef VOID (EFIAPI *VTOY_CHECK_SB)(VOID);
+typedef VOID (EFIAPI *VTOY_LAUNCHED)(VOID);
+typedef struct _VTOY_SHIM{
+	VTOY_BYPASS_SB ByPassSB;
+	VTOY_BYPASS_SB CheckSB;
+	VTOY_LAUNCHED Launched;
+} VTOY_SHIM;
+
+void calc_sha256(const void *data, UINT64 len, void *output);
+
+#endif
+
@@ -0,0 +1,86 @@
+#************************************************************************************
+# Copyright (c) 2026, longpanda <admin@ventoy.net>
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, see <http://www.gnu.org/licenses/>.
+#
+#************************************************************************************
+
+[Defines]
+  INF_VERSION                    = 0x00010005
+  BASE_NAME                      = VtoyShim
+  FILE_GUID                      = 6d7c7406-b32c-461f-8454-ddaa5243d93d
+  MODULE_TYPE                    = UEFI_APPLICATION
+  VERSION_STRING                 = 1.0
+  ENTRY_POINT                    = VtoyShimEfiMain
+  
+[BuildOptions]
+  # Force standard GNU ld to pack and align ELF segments to 4KB page boundaries
+  GCC:*_*_*_DLINK_FLAGS = -Wl,-z,common-page-size=0x1000 -Wl,-z,max-page-size=0x1000
+
+[Sources]
+  VtoyShim.h
+  VtoyShim.c
+  sha256.c
+  
+[Packages]
+  MdePkg/MdePkg.dec
+  MdeModulePkg/MdeModulePkg.dec
+  ShellPkg/ShellPkg.dec
+
+[LibraryClasses]
+  UefiApplicationEntryPoint
+  UefiLib
+  DevicePathLib
+  DebugLib
+
+[Guids]
+  gEfiGlobalVariableGuid
+  gEfiImageSecurityDatabaseGuid
+  gEfiCertSha256Guid
+  gShellVariableGuid
+  gEfiVirtualCdGuid
+  gEfiFileInfoGuid
+
+[Protocols]
+  gEfiSecurityArchProtocolGuid
+  gEfiSecurity2ArchProtocolGuid
+  gEfiLoadedImageProtocolGuid
+  gEfiBlockIoProtocolGuid
+  gEfiDevicePathProtocolGuid
+  gEfiDevicePathToTextProtocolGuid
+  gEfiDevicePathFromTextProtocolGuid
+  gEfiSimpleFileSystemProtocolGuid
+  gEfiRamDiskProtocolGuid
+  gEfiAbsolutePointerProtocolGuid
+  gEfiAcpiTableProtocolGuid
+  gEfiBlockIo2ProtocolGuid
+  gEfiBusSpecificDriverOverrideProtocolGuid
+  gEfiComponentNameProtocolGuid
+  gEfiComponentName2ProtocolGuid
+  gEfiDriverBindingProtocolGuid
+  gEfiDiskIoProtocolGuid
+  gEfiDiskIo2ProtocolGuid
+  gEfiGraphicsOutputProtocolGuid
+  gEfiHiiConfigAccessProtocolGuid
+  gEfiHiiFontProtocolGuid
+  gEfiLoadFileProtocolGuid
+  gEfiLoadFile2ProtocolGuid
+  gEfiLoadedImageProtocolGuid
+  gEfiLoadedImageDevicePathProtocolGuid
+  gEfiPciIoProtocolGuid
+  gEfiSerialIoProtocolGuid
+  gEfiSimpleTextInProtocolGuid
+  gEfiSimpleTextInputExProtocolGuid
+  gEfiSimpleTextOutProtocolGuid
+
@@ -0,0 +1,2 @@
+sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
+ventoy-shim,1,Ventoy,ventoy-shim,1.0,https://www.ventoy.net/
@@ -0,0 +1,170 @@
+/******************************************************************************
+ * VtoyShim.c
+ *
+ * Copyright (c) 2017 - 2018, Intel Corporation. All rights reserved.<BR>
+ * SPDX-License-Identifier: BSD-2-Clause-Patent
+ *
+ */
+
+#include <Uefi.h>
+#include <Library/DebugLib.h>
+#include <Library/PrintLib.h>
+#include <Library/UefiLib.h>
+#include <Library/BaseMemoryLib.h>
+
+
+static const UINT32 sha256_initial_h[8]
+    = { 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
+        0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19 };
+
+static const UINT32 sha256_round_k[64]
+    = { 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
+        0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+        0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+        0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+        0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+        0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+        0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+        0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+        0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+        0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+        0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2 };
+
+static void sha256_endian_reverse64(UINT64 input, UINT8 *output) {
+    output[7] = (input >> 0) & 0xff;
+    output[6] = (input >> 8) & 0xff;
+    output[5] = (input >> 16) & 0xff;
+    output[4] = (input >> 24) & 0xff;
+    output[3] = (input >> 32) & 0xff;
+    output[2] = (input >> 40) & 0xff;
+    output[1] = (input >> 48) & 0xff;
+    output[0] = (input >> 56) & 0xff;
+}
+
+static UINT32 sha256_endian_read32(UINT8 *input) {
+    UINT32 output = 0;
+    output |= (input[0] << 24);
+    output |= (input[1] << 16);
+    output |= (input[2] << 8);
+    output |= (input[3] << 0);
+
+    return output;
+}
+
+static void sha256_endian_reverse32(UINT32 input, UINT8 *output) {
+    output[3] = (input >> 0) & 0xff;
+    output[2] = (input >> 8) & 0xff;
+    output[1] = (input >> 16) & 0xff;
+    output[0] = (input >> 24) & 0xff;
+}
+
+static UINT32 sha256_ror(UINT32 input, UINT32 by) {
+    return (input >> by) | (((input & ((1 << by) - 1))) << (32 - by));
+}
+
+void calc_sha256(const void *data, UINT64 len, void *output)
+{
+    int i = 0;
+    int j = 0;
+    UINT8 padding[80];
+    UINT64 current = (len + 1) % 64;
+    // want to be == 56 % 64.
+    UINT64 needed = (64 + 56 - current) % 64;
+    UINT64 extra = needed + 9;
+    UINT64 total = len + extra;
+    UINT32 v[8];
+    UINT64 cursor = 0;
+
+    for(i = 1; i < 80; i++)
+    {
+        padding[i] = 0;
+    }
+    padding[0] = 0x80;
+
+    sha256_endian_reverse64(len * 8, padding + total - len - 8);
+
+    for(i = 0; i < 8; i++)
+    {
+        v[i] = sha256_initial_h[i];
+    }
+
+    for(cursor = 0; cursor * 64 < total; cursor++)
+    {
+        UINT32 t[8];
+        UINT32 w[64];
+
+        for(i = 0; i < 8; i++)
+        {
+            t[i] = v[i];
+        }
+
+
+        if(cursor * 64 + 64 <= len)
+        {
+            for(j = 0; j < 16; j++)
+            {
+                w[j] = sha256_endian_read32((UINT8 *)data + cursor * 64 + j * 4);
+            }
+        }
+        else
+        {
+            if(cursor * 64 < len)
+            {
+                UINT64 size = len - cursor * 64;
+                if(size > 0)
+                {
+                    CopyMem(w, (UINT8 *)data + cursor * 64, size);
+                }
+                CopyMem((UINT8 *)w + size, padding, 64 - size);
+            }
+            else
+            {
+                UINT64 off = (cursor * 64 - len) % 64;
+                CopyMem((UINT8 *)w, padding + off, 64);
+            }
+
+            for(j = 0; j < 16; j++)
+            {
+                w[j] = sha256_endian_read32((UINT8 *)&w[j]);
+            }
+        }
+
+        for(j = 16; j < 64; j++)
+        {
+            UINT32 s1 = sha256_ror(w[j - 2], 17) ^ sha256_ror(w[j - 2], 19) ^ (w[j - 2] >> 10);
+            UINT32 s0 = sha256_ror(w[j - 15], 7) ^ sha256_ror(w[j - 15], 18) ^ (w[j - 15] >> 3);
+            w[j] = s1 + w[j - 7] + s0 + w[j - 16];
+        }
+
+        for(j = 0; j < 64; j++)
+        {
+            UINT32 ch = (t[4] & t[5]) ^ (~t[4] & t[6]);
+            UINT32 maj = (t[0] & t[1]) ^ (t[0] & t[2]) ^ (t[1] & t[2]);
+            UINT32 S0 = sha256_ror(t[0], 2) ^ sha256_ror(t[0], 13) ^ sha256_ror(t[0], 22);
+            UINT32 S1 = sha256_ror(t[4], 6) ^ sha256_ror(t[4], 11) ^ sha256_ror(t[4], 25);
+            UINT32 t1 = t[7] + S1 + ch + sha256_round_k[j] + w[j];
+            UINT32 t2 = S0 + maj;
+
+            t[7] = t[6];
+            t[6] = t[5];
+            t[5] = t[4];
+            t[4] = t[3] + t1;
+            t[3] = t[2];
+            t[2] = t[1];
+            t[1] = t[0];
+            t[0] = t1 + t2;
+        }
+
+        for(i = 0; i < 8; i++)
+        {
+            v[i] += t[i];
+        }
+    }
+
+    for(i = 0; i < 8; i++)
+    {
+        sha256_endian_reverse32(v[i], (UINT8 *)output + i * 4);
+    }
+}
+
+
@@ -7,12 +7,12 @@
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 3 of the
 * License, or (at your option) any later version.
- * 
+ *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
- * 
+ *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see <http://www.gnu.org/licenses/>.
 *
@@ -41,7 +41,7 @@ STATIC CONST CHAR16 *gCurFeature= NULL;
 STATIC CHAR16 *gCmdLine = NULL;
 STATIC grub_env_printf_pf g_env_printf = NULL;

-STATIC VtoyUtilFeature gFeatureList[] = 
+STATIC VtoyUtilFeature gFeatureList[] =
 {
    { L"fix_windows_mmap", FixWindowsMemhole },
    { L"show_efi_drivers", ShowEfiDrivers    },
@@ -93,7 +93,7 @@ VOID EFIAPI VtoyUtilDebug(IN CONST CHAR8  *Format, ...)
 }

 STATIC EFI_STATUS ParseCmdline(IN EFI_HANDLE ImageHandle)
-{   
+{
    CHAR16 *pPos = NULL;
    CHAR16 *pCmdLine = NULL;
    EFI_STATUS Status = EFI_SUCCESS;
@@ -117,7 +117,7 @@ STATIC EFI_STATUS ParseCmdline(IN EFI_HANDLE ImageHandle)
        gST->ConOut->OutputString(gST->ConOut, L"\r\n##########################");
        return EFI_SUCCESS;
    }
-    
+
    if (StrStr(pCmdLine, L"debug"))
    {
        gVtoyDebugPrint = TRUE;
@@ -139,9 +139,9 @@ STATIC EFI_STATUS ParseCmdline(IN EFI_HANDLE ImageHandle)
    }

    gCurFeature = pPos + StrLen(L"feature=");
-    
+
    gCmdLine = pCmdLine;
-    
+
    return EFI_SUCCESS;
 }

@@ -153,7 +153,7 @@ EFI_STATUS EFIAPI VtoyUtilEfiMain
 {
    UINTN i;
    UINTN Len;
-    
+
    ParseCmdline(ImageHandle);

    for (i = 0; gCurFeature && i < ARRAY_SIZE(gFeatureList); i++)
@@ -170,7 +170,7 @@ EFI_STATUS EFIAPI VtoyUtilEfiMain
    if (gCmdLine)
    {
        FreePool(gCmdLine);
-        gCmdLine = NULL;        
+        gCmdLine = NULL;
    }

    return EFI_SUCCESS;
@@ -7,20 +7,22 @@
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 3 of the
 * License, or (at your option) any later version.
- * 
+ *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
- * 
+ *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see <http://www.gnu.org/licenses/>.
 *
 */
- 
+
 #ifndef __VTOYUTIL_H__
 #define __VTOYUTIL_H__

+#define VTOY_SHIM_POLICY_GUID    {0x90a29d14, 0x3968, 0x48fe, { 0x85, 0x81, 0x6b, 0x7f, 0x7d, 0xc4, 0x70, 0x55 }};
+
 #pragma pack(1)

 typedef EFI_STATUS (*VTOY_UTIL_PROC_PF)(IN EFI_HANDLE ImageHandle, IN CONST CHAR16 *CmdLine);
@@ -44,14 +46,14 @@ typedef struct ventoy_grub_param
    grub_env_set_pf grub_env_set;
    ventoy_grub_param_file_replace file_replace;
    ventoy_grub_param_file_replace img_replace[VTOY_MAX_CONF_REPLACE];
-    grub_env_printf_pf grub_env_printf;    
+    grub_env_printf_pf grub_env_printf;
 }ventoy_grub_param;
 #pragma pack()


 typedef struct VtoyUtilFeature
 {
-    CONST CHAR16 *Cmd;    
+    CONST CHAR16 *Cmd;
    VTOY_UTIL_PROC_PF MainProc;
 }VtoyUtilFeature;

@@ -23,7 +23,10 @@
  MODULE_TYPE                    = UEFI_APPLICATION
  VERSION_STRING                 = 1.0
  ENTRY_POINT                    = VtoyUtilEfiMain
-
+ 
+[BuildOptions]
+  # Force standard GNU ld to pack and align ELF segments to 4KB page boundaries
+  GCC:*_*_*_DLINK_FLAGS = -Wl,-z,common-page-size=0x1000 -Wl,-z,max-page-size=0x1000

 [Sources]
  VtoyUtil.h
@@ -205,6 +205,7 @@
 [Components]
  MdeModulePkg/Application/Ventoy/Ventoy.inf
  MdeModulePkg/Application/VtoyUtil/VtoyUtil.inf
+  MdeModulePkg/Application/VtoyShim/VtoyShim.inf
  MdeModulePkg/Application/VDiskChain/VDiskChain.inf
  MdeModulePkg/Application/HelloWorld/HelloWorld.inf
  MdeModulePkg/Application/DumpDynPcd/DumpDynPcd.inf
@@ -0,0 +1,98 @@
+/* fwsetup.c - Reboot into firmware setup menu. */
+/*
+ *  GRUB  --  GRand Unified Bootloader
+ *  Copyright (C) 2012  Free Software Foundation, Inc.
+ *
+ *  GRUB is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  GRUB is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <grub/types.h>
+#include <grub/mm.h>
+#include <grub/misc.h>
+#include <grub/efi/api.h>
+#include <grub/efi/efi.h>
+#include <grub/command.h>
+#include <grub/i18n.h>
+
+GRUB_MOD_LICENSE ("GPLv3+");
+
+static grub_efi_boolean_t efifwsetup_is_supported (void);
+
+static grub_err_t
+grub_cmd_fwsetup (grub_command_t cmd __attribute__ ((unused)),
+		  int argc __attribute__ ((unused)),
+		  char **args __attribute__ ((unused)))
+{
+  grub_efi_uint64_t *old_os_indications;
+  grub_efi_uint64_t os_indications = GRUB_EFI_OS_INDICATIONS_BOOT_TO_FW_UI;
+  grub_err_t status;
+  grub_size_t oi_size;
+  grub_efi_guid_t global = GRUB_EFI_GLOBAL_VARIABLE_GUID;
+
+  if (argc >= 1 && grub_strcmp(args[0], "--is-supported") == 0)
+    return !efifwsetup_is_supported ();
+
+  if (!efifwsetup_is_supported ())
+        return grub_error (GRUB_ERR_INVALID_COMMAND,
+                   N_("reboot to firmware setup is not supported by the current firmware"));
+
+  old_os_indications = grub_efi_get_variable ("OsIndications", &global,
+					      &oi_size);
+
+  if (old_os_indications != NULL && oi_size == sizeof (os_indications))
+    os_indications |= *old_os_indications;
+
+  status = grub_efi_set_variable ("OsIndications", &global, &os_indications,
+				  sizeof (os_indications));
+  if (status != GRUB_ERR_NONE)
+    return status;
+
+  grub_reboot ();
+
+  return GRUB_ERR_BUG;
+}
+
+static grub_command_t cmd = NULL;
+
+static grub_efi_boolean_t
+efifwsetup_is_supported (void)
+{
+  grub_efi_uint64_t *os_indications_supported = NULL;
+  grub_size_t oi_size = 0;
+  grub_efi_guid_t global = GRUB_EFI_GLOBAL_VARIABLE_GUID;
+
+  os_indications_supported = grub_efi_get_variable ("OsIndicationsSupported",
+						    &global, &oi_size);
+
+  if (!os_indications_supported)
+    return 0;
+
+  if (*os_indications_supported & GRUB_EFI_OS_INDICATIONS_BOOT_TO_FW_UI)
+    return 1;
+
+  return 0;
+}
+
+GRUB_MOD_INIT (efifwsetup)
+{
+    cmd = grub_register_command ("fwsetup", grub_cmd_fwsetup, NULL,
+				 N_("Reboot into firmware setup menu."));
+
+}
+
+GRUB_MOD_FINI (efifwsetup)
+{
+  if (cmd)
+    grub_unregister_command (cmd);
+}
@@ -0,0 +1,313 @@
+/*
+ *  GRUB  --  GRand Unified Bootloader
+ *  Copyright (C) 2009,2010  Free Software Foundation, Inc.
+ *
+ *  GRUB is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  GRUB is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <grub/mm.h>
+#include <grub/dl.h>
+#include <grub/command.h>
+#include <grub/term.h>
+#include <grub/i18n.h>
+#include <grub/misc.h>
+
+GRUB_MOD_LICENSE ("GPLv3+");
+
+static grub_uint8_t g_terminal_lock = 0;
+
+struct grub_term_autoload *grub_term_input_autoload = NULL;
+struct grub_term_autoload *grub_term_output_autoload = NULL;
+
+struct abstract_terminal
+{
+  struct abstract_terminal *next;
+  struct abstract_terminal *prev;
+  const char *name;
+  grub_err_t (*init) (struct abstract_terminal *term);
+  grub_err_t (*fini) (struct abstract_terminal *term);
+};
+
+static grub_err_t
+handle_command (int argc, char **args, struct abstract_terminal **enabled,
+               struct abstract_terminal **disabled,
+               struct grub_term_autoload *autoloads,
+               const char *active_str,
+               const char *available_str)
+{
+  int i;
+  struct abstract_terminal *term;
+  struct grub_term_autoload *aut;
+
+  if (argc == 0)
+    {
+      grub_puts_ (active_str);
+      for (term = *enabled; term; term = term->next)
+       grub_printf ("%s ", term->name);
+      grub_printf ("\n");
+      grub_puts_ (available_str);
+      for (term = *disabled; term; term = term->next)
+       grub_printf ("%s ", term->name);
+      /* This is quadratic but we don't expect mode than 30 terminal
+        modules ever.  */
+      for (aut = autoloads; aut; aut = aut->next)
+       {
+         for (term = *disabled; term; term = term->next)
+           if (grub_strcmp (term->name, aut->name) == 0
+	       || (aut->name[0] && aut->name[grub_strlen (aut->name) - 1] == '*'
+		   && grub_memcmp (term->name, aut->name,
+				   grub_strlen (aut->name) - 1) == 0))
+             break;
+         if (!term)
+           for (term = *enabled; term; term = term->next)
+             if (grub_strcmp (term->name, aut->name) == 0
+		 || (aut->name[0] && aut->name[grub_strlen (aut->name) - 1] == '*'
+		     && grub_memcmp (term->name, aut->name,
+				     grub_strlen (aut->name) - 1) == 0))
+               break;
+         if (!term)
+           grub_printf ("%s ", aut->name);
+       }
+      grub_printf ("\n");
+      return GRUB_ERR_NONE;
+    }
+  i = 0;
+
+  if (grub_strcmp (args[0], "--append") == 0
+      || grub_strcmp (args[0], "--remove") == 0)
+    i++;
+
+  if (i == argc)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_ ("no terminal specified"));
+
+  for (; i < argc; i++)
+    {
+      int again = 0;
+      while (1)
+       {
+         for (term = *disabled; term; term = term->next)
+           if (grub_strcmp (args[i], term->name) == 0
+	       || (grub_strcmp (args[i], "ofconsole") == 0
+		   && grub_strcmp ("console", term->name) == 0))
+             break;
+         if (term == 0)
+           for (term = *enabled; term; term = term->next)
+             if (grub_strcmp (args[i], term->name) == 0
+		 || (grub_strcmp (args[i], "ofconsole") == 0
+		     && grub_strcmp ("console", term->name) == 0))
+               break;
+         if (term)
+           break;
+         if (again)
+	   return grub_error (GRUB_ERR_BAD_ARGUMENT,
+			      N_("terminal `%s' isn't found"),
+			      args[i]);
+         for (aut = autoloads; aut; aut = aut->next)
+           if (grub_strcmp (args[i], aut->name) == 0
+	       || (grub_strcmp (args[i], "ofconsole") == 0
+		   && grub_strcmp ("console", aut->name) == 0)
+	       || (aut->name[0] && aut->name[grub_strlen (aut->name) - 1] == '*'
+		   && grub_memcmp (args[i], aut->name,
+				   grub_strlen (aut->name) - 1) == 0))
+             {
+               grub_dl_t mod;
+               mod = grub_dl_load (aut->modname);
+               if (mod)
+                 grub_dl_ref (mod);
+               grub_errno = GRUB_ERR_NONE;
+               break;
+             }
+	 if (grub_memcmp (args[i], "serial_usb",
+				  sizeof ("serial_usb") - 1) == 0
+	     && grub_term_poll_usb)
+	   {
+	     grub_term_poll_usb (1);
+	     again = 1;
+	     continue;
+	   }
+         if (!aut)
+           return grub_error (GRUB_ERR_BAD_ARGUMENT,
+			      N_("terminal `%s' isn't found"),
+                              args[i]);
+         again = 1;
+       }
+    }
+
+  if (grub_strcmp (args[0], "--append") == 0)
+    {
+      for (i = 1; i < argc; i++)
+       {
+         for (term = *disabled; term; term = term->next)
+           if (grub_strcmp (args[i], term->name) == 0
+	       || (grub_strcmp (args[i], "ofconsole") == 0
+		   && grub_strcmp ("console", term->name) == 0))
+             break;
+         if (term)
+           {
+              if (term->init && term->init (term) != GRUB_ERR_NONE)
+                return grub_errno;
+
+             grub_list_remove (GRUB_AS_LIST (term));
+             grub_list_push (GRUB_AS_LIST_P (enabled), GRUB_AS_LIST (term));
+           }
+       }
+      return GRUB_ERR_NONE;
+    }
+
+  if (grub_strcmp (args[0], "--remove") == 0)
+    {
+      for (i = 1; i < argc; i++)
+       {
+         for (term = *enabled; term; term = term->next)
+           if (grub_strcmp (args[i], term->name) == 0
+	       || (grub_strcmp (args[i], "ofconsole") == 0
+		   && grub_strcmp ("console", term->name) == 0))
+             break;
+         if (term)
+           {
+             if (!term->next && term == *enabled)
+               return grub_error (GRUB_ERR_BAD_ARGUMENT,
+                                  "can't remove the last terminal");
+             grub_list_remove (GRUB_AS_LIST (term));
+             if (term->fini)
+               term->fini (term);
+             grub_list_push (GRUB_AS_LIST_P (disabled), GRUB_AS_LIST (term));
+           }
+       }
+      return GRUB_ERR_NONE;
+    }
+  for (i = 0; i < argc; i++)
+    {
+      for (term = *disabled; term; term = term->next)
+       if (grub_strcmp (args[i], term->name) == 0
+	   || (grub_strcmp (args[i], "ofconsole") == 0
+	       && grub_strcmp ("console", term->name) == 0))
+         break;
+      if (term)
+       {
+         if (term->init && term->init (term) != GRUB_ERR_NONE)
+           return grub_errno;
+
+         grub_list_remove (GRUB_AS_LIST (term));
+         grub_list_push (GRUB_AS_LIST_P (enabled), GRUB_AS_LIST (term));
+       }
+    }
+
+  {
+    struct abstract_terminal *next;
+    for (term = *enabled; term; term = next)
+      {
+       next = term->next;
+       for (i = 0; i < argc; i++)
+         if (grub_strcmp (args[i], term->name) == 0
+	     || (grub_strcmp (args[i], "ofconsole") == 0
+		 && grub_strcmp ("console", term->name) == 0))
+           break;
+       if (i == argc)
+         {
+           if (!term->next && term == *enabled)
+             return grub_error (GRUB_ERR_BAD_ARGUMENT,
+                                "can't remove the last terminal");
+           grub_list_remove (GRUB_AS_LIST (term));
+           if (term->fini)
+             term->fini (term);
+           grub_list_push (GRUB_AS_LIST_P (disabled), GRUB_AS_LIST (term));
+         }
+      }
+  }
+
+  return GRUB_ERR_NONE;
+}
+
+static grub_err_t
+grub_cmd_terminal_lock (grub_command_t cmd __attribute__ ((unused)),
+			 int argc, char **args)
+{
+    (void)argc;
+    (void)args;
+
+    if (args[0] && args[0][0] == '1')
+        g_terminal_lock = 1;
+    else
+        g_terminal_lock = 0;
+
+    return 0;
+}
+
+static grub_err_t
+grub_cmd_terminal_input (grub_command_t cmd __attribute__ ((unused)),
+			 int argc, char **args)
+{
+  (void) GRUB_FIELD_MATCH (grub_term_inputs, struct abstract_terminal *, next);
+  (void) GRUB_FIELD_MATCH (grub_term_inputs, struct abstract_terminal *, prev);
+  (void) GRUB_FIELD_MATCH (grub_term_inputs, struct abstract_terminal *, name);
+  (void) GRUB_FIELD_MATCH (grub_term_inputs, struct abstract_terminal *, init);
+  (void) GRUB_FIELD_MATCH (grub_term_inputs, struct abstract_terminal *, fini);
+
+  if (g_terminal_lock) return 0;
+
+  return handle_command (argc, args,
+			 (struct abstract_terminal **) (void *) &grub_term_inputs,
+			 (struct abstract_terminal **) (void *) &grub_term_inputs_disabled,
+			 grub_term_input_autoload,
+			 N_ ("Active input terminals:"),
+			 N_ ("Available input terminals:"));
+}
+
+static grub_err_t
+grub_cmd_terminal_output (grub_command_t cmd __attribute__ ((unused)),
+                         int argc, char **args)
+{
+  (void) GRUB_FIELD_MATCH (grub_term_outputs, struct abstract_terminal *, next);
+  (void) GRUB_FIELD_MATCH (grub_term_outputs, struct abstract_terminal *, prev);
+  (void) GRUB_FIELD_MATCH (grub_term_outputs, struct abstract_terminal *, name);
+  (void) GRUB_FIELD_MATCH (grub_term_outputs, struct abstract_terminal *, init);
+  (void) GRUB_FIELD_MATCH (grub_term_outputs, struct abstract_terminal *, fini);
+
+  if (g_terminal_lock) return 0;
+
+  return handle_command (argc, args,
+			 (struct abstract_terminal **) (void *) &grub_term_outputs,
+			 (struct abstract_terminal **) (void *) &grub_term_outputs_disabled,
+			 grub_term_output_autoload,
+			 N_ ("Active output terminals:"),
+			 N_ ("Available output terminals:"));
+}
+
+static grub_command_t cmd_terminal_input, cmd_terminal_output, cmd_lock_terminal;
+
+GRUB_MOD_INIT(terminal)
+{
+  cmd_lock_terminal =
+    grub_register_command ("terminal_lock", grub_cmd_terminal_lock,
+			   0, N_("lock terminal."));
+
+  cmd_terminal_input =
+    grub_register_command ("terminal_input", grub_cmd_terminal_input,
+			   N_("[--append|--remove] "
+			      "[TERMINAL1] [TERMINAL2] ..."),
+			   N_("List or select an input terminal."));
+  cmd_terminal_output =
+    grub_register_command ("terminal_output", grub_cmd_terminal_output,
+			   N_("[--append|--remove] "
+			      "[TERMINAL1] [TERMINAL2] ..."),
+			   N_("List or select an output terminal."));
+}
+
+GRUB_MOD_FINI(terminal)
+{
+  grub_unregister_command (cmd_lock_terminal);
+  grub_unregister_command (cmd_terminal_input);
+  grub_unregister_command (cmd_terminal_output);
+}
@@ -0,0 +1,117 @@
+/* font_cmd.c - Font command definition. */
+/*
+ *  GRUB  --  GRand Unified Bootloader
+ *  Copyright (C) 2003,2005,2006,2007,2008,2009  Free Software Foundation, Inc.
+ *
+ *  GRUB is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  GRUB is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <grub/font.h>
+#include <grub/dl.h>
+#include <grub/misc.h>
+#include <grub/command.h>
+#include <grub/i18n.h>
+
+static grub_uint8_t g_font_lock = 0;
+
+static grub_err_t
+loadfont_command (grub_command_t cmd __attribute__ ((unused)),
+		  int argc,
+		  char **args)
+{
+  if (argc == 0)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));
+
+  if (g_font_lock) return 0;
+
+  while (argc--)
+    if (grub_font_load (*args++) == 0)
+      {
+	if (!grub_errno)
+	  return grub_error (GRUB_ERR_BAD_FONT, "invalid font");
+	return grub_errno;
+      }
+
+  return GRUB_ERR_NONE;
+}
+
+static grub_err_t
+lsfonts_command (grub_command_t cmd __attribute__ ((unused)),
+                 int argc __attribute__ ((unused)),
+                 char **args __attribute__ ((unused)))
+{
+  struct grub_font_node *node;
+
+  grub_puts_ (N_("Loaded fonts:"));
+  for (node = grub_font_list; node; node = node->next)
+    {
+      grub_font_t font = node->value;
+      grub_printf ("%s\n", grub_font_get_name (font));
+    }
+
+  return GRUB_ERR_NONE;
+}
+
+static grub_err_t
+lockfont_command (grub_command_t cmd __attribute__ ((unused)),
+                 int argc __attribute__ ((unused)),
+                 char **args __attribute__ ((unused)))
+{
+  if (args[0] && args[0][0] == '1')
+  {
+    g_font_lock = 1;
+  }
+  else
+  {
+    g_font_lock = 0;
+  }
+
+  return GRUB_ERR_NONE;
+}
+
+static grub_command_t cmd_loadfont, cmd_lsfonts, cmd_lockfont;
+
+#if defined (GRUB_MACHINE_MIPS_LOONGSON) || defined (GRUB_MACHINE_COREBOOT)
+void grub_font_init (void)
+#else
+GRUB_MOD_INIT(font)
+#endif
+{
+  grub_font_loader_init ();
+
+  cmd_loadfont =
+    grub_register_command ("loadfont", loadfont_command,
+			   N_("FILE..."),
+			   N_("Specify one or more font files to load."));
+  cmd_lsfonts =
+    grub_register_command ("lsfonts", lsfonts_command,
+			   0, N_("List the loaded fonts."));
+  cmd_lockfont =
+    grub_register_command ("lockfont", lockfont_command,
+			   0, N_("Lock fonts."));
+}
+
+#if defined (GRUB_MACHINE_MIPS_LOONGSON) || defined (GRUB_MACHINE_COREBOOT)
+void grub_font_fini (void)
+#else
+GRUB_MOD_FINI(font)
+#endif
+{
+  /* TODO: Determine way to free allocated resources.
+     Warning: possible pointer references could be in use.  */
+
+  grub_unregister_command (cmd_loadfont);
+  grub_unregister_command (cmd_lsfonts);
+  grub_unregister_command (cmd_lockfont);
+}
@@ -0,0 +1,200 @@
+/* corecmd.c - critical commands which are registered in kernel */
+/*
+ *  GRUB  --  GRand Unified Bootloader
+ *  Copyright (C) 2009  Free Software Foundation, Inc.
+ *
+ *  GRUB is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  GRUB is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <grub/mm.h>
+#include <grub/dl.h>
+#include <grub/err.h>
+#include <grub/env.h>
+#include <grub/misc.h>
+#include <grub/term.h>
+#include <grub/file.h>
+#include <grub/device.h>
+#include <grub/command.h>
+#include <grub/i18n.h>
+
+/* set ENVVAR=VALUE */
+static grub_err_t
+grub_core_cmd_set (struct grub_command *cmd __attribute__ ((unused)),
+		   int argc, char *argv[])
+{
+  char *var;
+  char *val;
+
+  if (argc < 1)
+    {
+      struct grub_env_var *env;
+      FOR_SORTED_ENV (env)
+	grub_printf ("%s=%s\n", env->name, grub_env_get (env->name));
+      return 0;
+    }
+
+  var = argv[0];
+  val = grub_strchr (var, '=');
+  if (! val)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, "not an assignment");
+
+  val[0] = 0;
+  grub_env_set (var, val + 1);
+  val[0] = '=';
+
+  return 0;
+}
+
+static grub_err_t
+grub_core_cmd_unset (struct grub_command *cmd __attribute__ ((unused)),
+		     int argc, char *argv[])
+{
+  if (argc < 1)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT,
+		       N_("one argument expected"));
+
+  grub_env_unset (argv[0]);
+  return 0;
+}
+
+/* insmod MODULE */
+static grub_err_t
+grub_core_cmd_insmod (struct grub_command *cmd __attribute__ ((unused)),
+		      int argc, char *argv[])
+{
+  grub_dl_t mod;
+
+  if (argc == 0)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("one argument expected"));
+
+  /* For simple, just disable insmod when SecureBoot is enabled. */
+  if (g_sys_sb && g_sb_policy == VTOY_SB_POLICY_CHECK)
+  {
+      return grub_error (GRUB_ERR_BAD_SIGNATURE, "Cannot insmod when SecureBoot is enabled and Policy is check.");
+  }
+
+  if (grub_strcmp(argv[0], "steamenv") == 0) {
+      grub_printf("Ventoy skip module steamenv ...\n");
+      return 0;
+  }
+
+  if (argv[0][0] == '/' || argv[0][0] == '(' || argv[0][0] == '+')
+    mod = grub_dl_load_file (argv[0]);
+  else
+    mod = grub_dl_load (argv[0]);
+
+  if (mod)
+    grub_dl_ref (mod);
+
+  return 0;
+}
+
+static int
+grub_mini_print_devices (const char *name, void *data __attribute__ ((unused)))
+{
+  grub_printf ("(%s) ", name);
+
+  return 0;
+}
+
+static int
+grub_mini_print_files (const char *filename,
+		       const struct grub_dirhook_info *info,
+		       void *data __attribute__ ((unused)))
+{
+  grub_printf ("%s%s ", filename, info->dir ? "/" : "");
+
+  return 0;
+}
+
+/* ls [ARG] */
+static grub_err_t
+grub_core_cmd_ls (struct grub_command *cmd __attribute__ ((unused)),
+		  int argc, char *argv[])
+{
+  if (argc < 1)
+    {
+      grub_device_iterate (grub_mini_print_devices, NULL);
+      grub_xputs ("\n");
+      grub_refresh ();
+    }
+  else
+    {
+      char *device_name;
+      grub_device_t dev = 0;
+      grub_fs_t fs;
+      char *path;
+
+      device_name = grub_file_get_device_name (argv[0]);
+      if (grub_errno)
+	goto fail;
+      dev = grub_device_open (device_name);
+      if (! dev)
+	goto fail;
+
+      fs = grub_fs_probe (dev);
+      path = grub_strchr (argv[0], ')');
+      if (! path)
+	path = argv[0];
+      else
+	path++;
+
+      if (! *path && ! device_name)
+	{
+	  grub_error (GRUB_ERR_BAD_ARGUMENT, "invalid argument");
+	  goto fail;
+	}
+
+      if (! *path)
+	{
+	  if (grub_errno == GRUB_ERR_UNKNOWN_FS)
+	    grub_errno = GRUB_ERR_NONE;
+
+	  grub_printf ("(%s): Filesystem is %s.\n",
+		       device_name, fs ? fs->name : "unknown");
+	}
+      else if (fs)
+	{
+	  (fs->fs_dir) (dev, path, grub_mini_print_files, NULL);
+	  grub_xputs ("\n");
+	  grub_refresh ();
+	}
+
+    fail:
+      if (dev)
+	grub_device_close (dev);
+
+      grub_free (device_name);
+    }
+
+  return grub_errno;
+}
+
+void
+grub_register_core_commands (void)
+{
+  grub_command_t cmd;
+  cmd = grub_register_command ("set", grub_core_cmd_set,
+			       N_("[ENVVAR=VALUE]"),
+			       N_("Set an environment variable."));
+  if (cmd)
+    cmd->flags |= GRUB_COMMAND_FLAG_EXTRACTOR;
+  grub_register_command ("unset", grub_core_cmd_unset,
+			 N_("ENVVAR"),
+			 N_("Remove an environment variable."));
+  grub_register_command ("ls", grub_core_cmd_ls,
+			 N_("[ARG]"), N_("List devices or files."));
+  grub_register_command ("insmod", grub_core_cmd_insmod,
+			 N_("MODULE"), N_("Insert a module."));
+}
@@ -22,6 +22,9 @@
 #include <grub/misc.h>
 #include <grub/mm.h>

+grub_uint8_t g_sys_sb = 0;
+grub_uint8_t g_sb_policy = VTOY_SB_POLICY_BYPASS;
+
 /* The initial context.  */
 static struct grub_env_context initial_context;

@@ -238,12 +241,12 @@ grub_env_export (const char *name)
  if (! var)
    {
      grub_err_t err;
-      
+
      err = grub_env_set (name, "");
      if (err)
 	return err;
      var = grub_env_find (name);
-    }    
+    }
  var->global = 1;

  return GRUB_ERR_NONE;
@@ -51,8 +51,8 @@ struct syslinux_menuentry
  char hotkey;
  int make_default;
  struct syslinux_say *say;
-  
-  enum { KERNEL_NO_KERNEL, KERNEL_LINUX, KERNEL_CHAINLOADER, 
+
+  enum { KERNEL_NO_KERNEL, KERNEL_LINUX, KERNEL_CHAINLOADER,
 	 KERNEL_BIN, KERNEL_PXE, KERNEL_CHAINLOADER_BPB,
 	 KERNEL_COM32, KERNEL_COM, KERNEL_IMG, KERNEL_CONFIG, LOCALBOOT }
    entry_type;
@@ -170,7 +170,7 @@ print_num (struct output_buffer *outbuf, int n)
 {
  char buf[20];
  grub_snprintf (buf, sizeof (buf), "%d", n);
-  return print (outbuf, buf, grub_strlen (buf)); 
+  return print (outbuf, buf, grub_strlen (buf));
 }

 static grub_err_t
@@ -233,7 +233,7 @@ kernel (const char *line, struct syslinux_menu *menu)

  if (end - line >= 4 && grub_strcasecmp (end - 4, ".img") == 0)
    menu->entries->entry_type = KERNEL_IMG;
-  
+
  return GRUB_ERR_NONE;
 }

@@ -247,7 +247,7 @@ cmd_linux (const char *line, struct syslinux_menu *menu)
  if (!menu->entries->kernel_file)
    return grub_errno;
  menu->entries->entry_type = KERNEL_LINUX;
-  
+
  return GRUB_ERR_NONE;
 }

@@ -261,7 +261,7 @@ cmd_boot (const char *line, struct syslinux_menu *menu)
  if (!menu->entries->kernel_file)
    return grub_errno;
  menu->entries->entry_type = KERNEL_CHAINLOADER;
-  
+
  return GRUB_ERR_NONE;
 }

@@ -275,7 +275,7 @@ cmd_bss (const char *line, struct syslinux_menu *menu)
  if (!menu->entries->kernel_file)
    return grub_errno;
  menu->entries->entry_type = KERNEL_CHAINLOADER_BPB;
-  
+
  return GRUB_ERR_NONE;
 }

@@ -289,7 +289,7 @@ cmd_pxe (const char *line, struct syslinux_menu *menu)
  if (!menu->entries->kernel_file)
    return grub_errno;
  menu->entries->entry_type = KERNEL_PXE;
-  
+
  return GRUB_ERR_NONE;
 }

@@ -303,7 +303,7 @@ cmd_fdimage (const char *line, struct syslinux_menu *menu)
  if (!menu->entries->kernel_file)
    return grub_errno;
  menu->entries->entry_type = KERNEL_IMG;
-  
+
  return GRUB_ERR_NONE;
 }

@@ -317,7 +317,7 @@ cmd_comboot (const char *line, struct syslinux_menu *menu)
  if (!menu->entries->kernel_file)
    return grub_errno;
  menu->entries->entry_type = KERNEL_COM;
-  
+
  return GRUB_ERR_NONE;
 }

@@ -331,7 +331,7 @@ cmd_com32 (const char *line, struct syslinux_menu *menu)
  if (!menu->entries->kernel_file)
    return grub_errno;
  menu->entries->entry_type = KERNEL_COM32;
-  
+
  return GRUB_ERR_NONE;
 }

@@ -354,7 +354,7 @@ cmd_config (const char *line, struct syslinux_menu *menu)
 	return grub_errno;
    }
  menu->entries->entry_type = KERNEL_CONFIG;
-  
+
  return GRUB_ERR_NONE;
 }

@@ -368,7 +368,7 @@ cmd_append (const char *line, struct syslinux_menu *menu)
  menu->entries->append = grub_strdup (line);
  if (!menu->entries->append)
    return grub_errno;
-  
+
  return GRUB_ERR_NONE;
 }

@@ -377,6 +377,8 @@ cmd_initrd (const char *line, struct syslinux_menu *menu)
 {
  struct initrd_list *ninitrd;
  const char *comma;
+  char *pcPos;
+
  if (!menu->entries)
    return grub_error (GRUB_ERR_BAD_ARGUMENT, "kernel without label");

@@ -393,6 +395,14 @@ cmd_initrd (const char *line, struct syslinux_menu *menu)
 	  grub_free (ninitrd);
 	  return grub_errno;
 	}
+
+      pcPos = grub_strstr(ninitrd->file, " quiet");
+      if (pcPos)
+      {
+          *pcPos = 0;
+      }
+
+
      ninitrd->next = NULL;
      if (menu->entries->initrds_last)
 	menu->entries->initrds_last->next = ninitrd;
@@ -406,7 +416,7 @@ cmd_initrd (const char *line, struct syslinux_menu *menu)
      while (*line == ',')
 	line++;
    }
-  
+
  return GRUB_ERR_NONE;
 }

@@ -416,7 +426,7 @@ cmd_default (const char *line, struct syslinux_menu *menu)
  menu->def = grub_strdup (line);
  if (!menu->def)
    return grub_errno;
-  
+
  return GRUB_ERR_NONE;
 }

@@ -434,7 +444,7 @@ cmd_menudefault (const char *line __attribute__ ((unused)),
  if (!menu->entries)
    return grub_error (GRUB_ERR_BAD_ARGUMENT, "kernel without label");

-  menu->entries->make_default = 1; 
+  menu->entries->make_default = 1;
  return GRUB_ERR_NONE;
 }

@@ -457,7 +467,7 @@ cmd_localboot (const char *line,
  if (!menu->entries->kernel_file)
    return grub_errno;
  menu->entries->entry_type = LOCALBOOT;
-  
+
  return GRUB_ERR_NONE;
 }

@@ -485,7 +495,7 @@ cmd_extlabel (const char *line, struct syslinux_menu *menu)
      *out++ = *in++;
    }
  *out = 0;
-  
+
  return GRUB_ERR_NONE;
 }

@@ -548,7 +558,7 @@ syslinux_parse (const char *filename,
  ret = syslinux_parse_real (menu);
  if (ret == GRUB_ERR_FILE_NOT_FOUND
      || ret == GRUB_ERR_BAD_FILENAME)
-    {	
+    {
      grub_errno = ret = GRUB_ERR_NONE;
      add_comment (menu, "# File ", 0);
      add_comment (menu, nf, 0);
@@ -761,7 +771,7 @@ syslinux_parse_real (struct syslinux_menu *menu)
 }

 static grub_err_t
-print_escaped (struct output_buffer *outbuf, 
+print_escaped (struct output_buffer *outbuf,
 	       const char *from, const char *to)
 {
  const char *ptr;
@@ -1037,7 +1047,7 @@ write_entry (struct output_buffer *outbuf,
    case KERNEL_COM:
      {
 	char *basename = NULL;
-	
+
 	{
 	  char *ptr;
 	  for (ptr = curentry->kernel_file; *ptr; ptr++)
@@ -1244,8 +1254,8 @@ write_entry (struct output_buffer *outbuf,
 	if (grub_strcasecmp (basename, "whichsys.c32") == 0)
 	  {
 	    grub_syslinux_flavour_t flavour = GRUB_SYSLINUX_ISOLINUX;
-	    const char *flav[] = 
-	      { 
+	    const char *flav[] =
+	      {
 		[GRUB_SYSLINUX_ISOLINUX] = "iso",
 		[GRUB_SYSLINUX_PXELINUX] = "pxe",
 		[GRUB_SYSLINUX_SYSLINUX] = "sys"
@@ -1416,7 +1426,7 @@ free_menu (struct syslinux_menu *menu)
 	  grub_free (initrd->file);
 	  grub_free (initrd);
 	}
- 
+
      grub_free (entry->comments);
      grub_free (entry->kernel_file);
      grub_free (entry->label);
@@ -1455,7 +1465,7 @@ config_file (struct output_buffer *outbuf,
  {
      menu.timeout = 100;
  }
-  
+
  err = syslinux_parse_real (&menu);
  if (err)
    return err;
@@ -1512,7 +1522,7 @@ config_file (struct output_buffer *outbuf,
 	  print_string ("\n");
 	}
      for (curentry = lentry; curentry; curentry = curentry->prev)
-	{      
+	{
 	  print_string ("menuentry ");
 	  err = print_escaped (outbuf,
 			       curentry->extlabel ? : curentry->label, NULL);
@@ -185,11 +185,11 @@ static void ventoy_debug_pause(void)
 {
    char key;

-    if (0 == ventoy_debug) 
+    if (0 == ventoy_debug)
    {
        return;
    }
-    
+
    grub_printf("press Enter to continue ......\n");
    while (1)
    {
@@ -198,7 +198,7 @@ static void ventoy_debug_pause(void)
        {
            break;
        }
-    }    
+    }
 }

 static int ventoy_preboot(void)
@@ -207,7 +207,7 @@ static int ventoy_preboot(void)
    const char *file;
    char buf[128];

-    if (ventoy_debug) 
+    if (ventoy_debug)
    {
        grub_printf("ventoy_preboot %d %d\n", ventoy_linux_argc, ventoy_initrd_called);
        ventoy_debug_pause();
@@ -234,7 +234,7 @@ static int ventoy_preboot(void)
        ventoy_extra_initrd_list[ventoy_extra_initrd_num++] = grub_strdup(file);
    }

-    if (ventoy_debug) 
+    if (ventoy_debug)
    {
        grub_printf("========== initrd list ==========\n");
        for (i = 0; i < ventoy_extra_initrd_num; i++)
@@ -242,7 +242,7 @@ static int ventoy_preboot(void)
            grub_printf("%s\n", ventoy_extra_initrd_list[i]);
        }
        grub_printf("=================================\n");
-        
+
        ventoy_debug_pause();
    }

@@ -272,14 +272,14 @@ static int ventoy_boot_opt_filter(char *opt)
        }
        return 0;
    }
-    
+
    if (grub_strncmp(opt, "init=", 5) == 0)
    {
        opt[0] = 'v';
        opt[1] = 't';
        return 0;
    }
-    
+
    if (grub_strncmp(opt, "dm=", 3) == 0)
    {
        opt[0] = 'D';
@@ -293,12 +293,12 @@ static int ventoy_boot_opt_filter(char *opt)
        {
            return 1;
        }
-        
+
        if (grub_strncmp(opt, "loglevel=", 9) == 0)
        {
            return 1;
        }
-        
+
        if (grub_strcmp(opt, "splash") == 0)
        {
            return 1;
@@ -345,7 +345,7 @@ static int ventoy_bootopt_hook(int argc, char *argv[])
    {
        ventoy_linux_args[count] = ventoy_linux_args[i + (LINUX_MAX_ARGC / 2)];
        ventoy_linux_args[i + (LINUX_MAX_ARGC / 2)] = NULL;
-        
+
        if (ventoy_linux_args[count][0] == '@')
        {
            env = grub_env_get(ventoy_linux_args[count] + 1);
@@ -391,7 +391,7 @@ static int ventoy_bootopt_hook(int argc, char *argv[])
                    {
                        if (0 == ventoy_boot_opt_filter(last))
                        {
-                            ventoy_linux_args[count++] = grub_strdup(last);                            
+                            ventoy_linux_args[count++] = grub_strdup(last);
                        }
                        break;
                    }
@@ -406,7 +406,7 @@ static int ventoy_bootopt_hook(int argc, char *argv[])
        }
        else
        {
-            count++;            
+            count++;
        }
    }

@@ -434,10 +434,10 @@ static int ventoy_bootopt_hook(int argc, char *argv[])
        for (i = 0; i < count; i++)
        {
            grub_printf("%s ", ventoy_linux_args[i]);
-        }  
+        }
        grub_printf("\n================================\n");
    }
-    
+
    return 0;
 }

@@ -470,7 +470,7 @@ grub_cmd_unset_boot_opt (grub_command_t cmd __attribute__ ((unused)),
 		int argc, char *argv[])
 {
    int i;
-    
+
    (void)argc;
    (void)argv;

@@ -493,16 +493,44 @@ static grub_err_t
 grub_cmd_extra_initrd_append (grub_command_t cmd __attribute__ ((unused)),
 		int argc, char *argv[])
 {
+    grub_uint32_t i;
    int newclen = 0;
    char *pos = NULL;
    char *end = NULL;
    char buf[256] = {0};
-    
+    const char *suffix = NULL;
+    const char *check_suffix[] = { ".ko", ".ko.zst", ".ko.xz", ".ko.gz" };
+
    if (argc != 1)
    {
        return 1;
    }

+    if (grub_strstr(argv[0], ".ko"))
+    {
+        if (ventoy_check_file_exist("%s", argv[0]))
+        {
+            suffix = "";
+        }
+    }
+    else
+    {
+        for (i = 0; i < sizeof(check_suffix) / sizeof(check_suffix[0]); i++)
+        {
+            if (ventoy_check_file_exist("%s%s", argv[0], check_suffix[i]))
+            {
+                suffix = check_suffix[i];
+                break;
+            }
+        }
+    }
+
+    if (!suffix)
+    {
+        grub_printf("ko file <%s> not exist\n", argv[0]);
+        return 0;
+    }
+
    for (pos = argv[0]; *pos; pos++)
    {
        if (*pos == '/')
@@ -517,28 +545,29 @@ grub_cmd_extra_initrd_append (grub_command_t cmd __attribute__ ((unused)),
        newclen = (int)grub_strlen(end + 1);
        if ((110 + newclen) % 4 == 0)
        {
-            grub_snprintf(buf, sizeof(buf), "newc:.%s:%s", end + 1, argv[0]);
+            grub_snprintf(buf, sizeof(buf), "newc:.%s%s:%s%s", end + 1, suffix, argv[0], suffix);
        }
        else
        {
-            grub_snprintf(buf, sizeof(buf), "newc:%s:%s", end + 1, argv[0]);
+            grub_snprintf(buf, sizeof(buf), "newc:%s%s:%s%s", end + 1, suffix, argv[0], suffix);
        }
-    
+
        if (ventoy_extra_initrd_num < 256)
        {
-            ventoy_extra_initrd_list[ventoy_extra_initrd_num++] = grub_strdup(buf);        
+            ventoy_extra_initrd_list[ventoy_extra_initrd_num++] = grub_strdup(buf);
        }
    }

    return 0;
 }

+
 static grub_err_t
 grub_cmd_extra_initrd_reset (grub_command_t cmd __attribute__ ((unused)),
 		int argc, char *argv[])
 {
    int i;
-    
+
    (void)argc;
    (void)argv;

@@ -741,7 +770,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
    				    cmdline_size,
    				    GRUB_VERIFY_KERNEL_CMDLINE);  }
  else
-  {      
+  {
      err = grub_create_loader_cmdline (argc, argv,
    				    linux_args + sizeof (LINUX_IMAGE) - 1,
    				    cmdline_size,
@@ -789,7 +818,7 @@ ventoy_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),

    if (ventoy_linux_argc == 0)
    {
-        return grub_cmd_initrd(cmd, argc, argv);        
+        return grub_cmd_initrd(cmd, argc, argv);
    }

    grub_snprintf(buf, sizeof(buf), "mem:%s:size:%s", grub_env_get("ventoy_cpio_addr"), grub_env_get("ventoy_cpio_size"));
@@ -820,7 +849,7 @@ ventoy_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
        }
        grub_printf("=================================\n");
    }
-    
+
    return grub_cmd_initrd(cmd, ventoy_extra_initrd_num, ventoy_extra_initrd_list);
 }

@@ -843,12 +872,12 @@ GRUB_MOD_INIT (linux)

  cmd_set_bootopt = grub_register_command ("vt_set_boot_opt", grub_cmd_set_boot_opt, 0, N_("set ext boot opt"));
  cmd_unset_bootopt = grub_register_command ("vt_unset_boot_opt", grub_cmd_unset_boot_opt, 0, N_("unset ext boot opt"));
-  
+
  cmd_extra_initrd_append = grub_register_command ("vt_img_extra_initrd_append", grub_cmd_extra_initrd_append, 0, N_(""));
  cmd_extra_initrd_reset = grub_register_command ("vt_img_extra_initrd_reset", grub_cmd_extra_initrd_reset, 0, N_(""));

  ventoy_linux_args = grub_zalloc(sizeof(char *) * LINUX_MAX_ARGC);
-                      
+
  my_mod = mod;
 }

@@ -35,6 +35,8 @@
 #include <grub/i18n.h>
 #include <grub/lib/cmdline.h>
 #include <grub/linux.h>
+#include <grub/time.h>
+#include <grub/env.h>
 #include <grub/machine/kernel.h>

 GRUB_MOD_LICENSE ("GPLv3+");
@@ -297,7 +299,7 @@ grub_linux_setup_video (struct linux_kernel_params *params)
 	  params->lfb_size >>= 16;
 	  params->have_vga = GRUB_VIDEO_LINUX_TYPE_VESA;
 	  break;
-	
+
 	case GRUB_VIDEO_DRIVER_EFI_UGA:
 	case GRUB_VIDEO_DRIVER_EFI_GOP:
 	  params->have_vga = GRUB_VIDEO_LINUX_TYPE_EFIFB;
@@ -413,11 +415,11 @@ static void ventoy_debug_pause(void)
 {
    char key;

-    if (0 == ventoy_debug) 
+    if (0 == ventoy_debug)
    {
        return;
    }
-    
+
    grub_printf("press Enter to continue ......\n");
    while (1)
    {
@@ -426,7 +428,7 @@ static void ventoy_debug_pause(void)
        {
            break;
        }
-    }    
+    }
 }

 static int ventoy_preboot(void)
@@ -435,7 +437,7 @@ static int ventoy_preboot(void)
    const char *file;
    char buf[128];

-    if (ventoy_debug) 
+    if (ventoy_debug)
    {
        grub_printf("ventoy_preboot %d %d\n", ventoy_linux_argc, ventoy_initrd_called);
        ventoy_debug_pause();
@@ -462,7 +464,7 @@ static int ventoy_preboot(void)
        ventoy_extra_initrd_list[ventoy_extra_initrd_num++] = grub_strdup(file);
    }

-    if (ventoy_debug) 
+    if (ventoy_debug)
    {
        grub_printf("========== initrd list ==========\n");
        for (i = 0; i < ventoy_extra_initrd_num; i++)
@@ -470,7 +472,7 @@ static int ventoy_preboot(void)
            grub_printf("%s\n", ventoy_extra_initrd_list[i]);
        }
        grub_printf("=================================\n");
-        
+
        ventoy_debug_pause();
    }

@@ -500,7 +502,7 @@ static int ventoy_boot_opt_filter(char *opt)
        }
        return 0;
    }
-    
+
    if (grub_strncmp(opt, "init=", 5) == 0)
    {
        opt[0] = 'v';
@@ -521,12 +523,12 @@ static int ventoy_boot_opt_filter(char *opt)
        {
            return 1;
        }
-        
+
        if (grub_strncmp(opt, "loglevel=", 9) == 0)
        {
            return 1;
        }
-        
+
        if (grub_strcmp(opt, "splash") == 0)
        {
            return 1;
@@ -573,7 +575,7 @@ static int ventoy_bootopt_hook(int argc, char *argv[])
    {
        ventoy_linux_args[count] = ventoy_linux_args[i + (LINUX_MAX_ARGC / 2)];
        ventoy_linux_args[i + (LINUX_MAX_ARGC / 2)] = NULL;
-        
+
        if (ventoy_linux_args[count][0] == '@')
        {
            env = grub_env_get(ventoy_linux_args[count] + 1);
@@ -619,7 +621,7 @@ static int ventoy_bootopt_hook(int argc, char *argv[])
                    {
                        if (0 == ventoy_boot_opt_filter(last))
                        {
-                            ventoy_linux_args[count++] = grub_strdup(last);                            
+                            ventoy_linux_args[count++] = grub_strdup(last);
                        }
                        break;
                    }
@@ -634,7 +636,7 @@ static int ventoy_bootopt_hook(int argc, char *argv[])
        }
        else
        {
-            count++;            
+            count++;
        }
    }

@@ -662,10 +664,10 @@ static int ventoy_bootopt_hook(int argc, char *argv[])
        for (i = 0; i < count; i++)
        {
            grub_printf("%s ", ventoy_linux_args[i]);
-        }  
+        }
        grub_printf("\n================================\n");
    }
-    
+
    return 0;
 }

@@ -673,16 +675,44 @@ static grub_err_t
 grub_cmd_extra_initrd_append (grub_command_t cmd __attribute__ ((unused)),
 		int argc, char *argv[])
 {
+    grub_uint32_t i;
    int newclen = 0;
    char *pos = NULL;
    char *end = NULL;
    char buf[256] = {0};
-    
+    const char *suffix = NULL;
+    const char *check_suffix[] = { ".ko", ".ko.zst", ".ko.xz", ".ko.gz" };
+
    if (argc != 1)
    {
        return 1;
    }

+    if (grub_strstr(argv[0], ".ko"))
+    {
+        if (ventoy_check_file_exist("%s", argv[0]))
+        {
+            suffix = "";
+        }
+    }
+    else
+    {
+        for (i = 0; i < sizeof(check_suffix) / sizeof(check_suffix[0]); i++)
+        {
+            if (ventoy_check_file_exist("%s%s", argv[0], check_suffix[i]))
+            {
+                suffix = check_suffix[i];
+                break;
+            }
+        }
+    }
+
+    if (!suffix)
+    {
+        grub_printf("ko file <%s> not exist\n", argv[0]);
+        return 0;
+    }
+
    for (pos = argv[0]; *pos; pos++)
    {
        if (*pos == '/')
@@ -697,28 +727,29 @@ grub_cmd_extra_initrd_append (grub_command_t cmd __attribute__ ((unused)),
        newclen = (int)grub_strlen(end + 1);
        if ((110 + newclen) % 4 == 0)
        {
-            grub_snprintf(buf, sizeof(buf), "newc:.%s:%s", end + 1, argv[0]);
+            grub_snprintf(buf, sizeof(buf), "newc:.%s%s:%s%s", end + 1, suffix, argv[0], suffix);
        }
        else
        {
-            grub_snprintf(buf, sizeof(buf), "newc:%s:%s", end + 1, argv[0]);
+            grub_snprintf(buf, sizeof(buf), "newc:%s%s:%s%s", end + 1, suffix, argv[0], suffix);
        }
-    
+
        if (ventoy_extra_initrd_num < 256)
        {
-            ventoy_extra_initrd_list[ventoy_extra_initrd_num++] = grub_strdup(buf);        
+            ventoy_extra_initrd_list[ventoy_extra_initrd_num++] = grub_strdup(buf);
        }
    }

    return 0;
 }

+
 static grub_err_t
 grub_cmd_extra_initrd_reset (grub_command_t cmd __attribute__ ((unused)),
 		int argc, char *argv[])
 {
    int i;
-    
+
    (void)argc;
    (void)argv;

@@ -750,6 +781,16 @@ grub_linux_boot (void)
  grub_size_t mmap_size;
  grub_size_t cl_offset;

+  /* To be simple, just deny to boot linux kernel when SecureBoot is enabled and Policy is check */
+  if (g_sys_sb && g_sb_policy == VTOY_SB_POLICY_CHECK)
+  {
+      grub_printf("\n\n ######### Can not do linux boot in SecureBoot Policy Check #######\n\n");
+      grub_refresh();
+      grub_sleep(5);
+      grub_errno = GRUB_ERR_BAD_SIGNATURE;
+      return 0;
+  }
+
  ventoy_preboot();

 #ifdef GRUB_MACHINE_IEEE1275
@@ -924,9 +965,9 @@ grub_linux_boot (void)
 					 &efi_desc_size, &efi_desc_version);
    if (err)
      return err;
-    
+
    /* Note that no boot services are available from here.  */
-    efi_mmap_target = ctx.real_mode_target 
+    efi_mmap_target = ctx.real_mode_target
      + ((grub_uint8_t *) efi_mmap_buf - (grub_uint8_t *) real_mode_mem);
    /* Pass EFI parameters.  */
    if (grub_le_to_cpu16 (ctx.params->version) >= 0x0208)
@@ -1008,7 +1049,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
      if (tip)
      {
          grub_printf("%s\n", tip);
-          grub_refresh();          
+          grub_refresh();
      }
  }

@@ -1086,7 +1127,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
      align = 0;
      relocatable = 0;
    }
-    
+
  if (grub_le_to_cpu16 (lh.version) >= 0x020a)
    {
      min_align = lh.min_alignment;
@@ -1361,7 +1402,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
 				      - (sizeof (LINUX_IMAGE) - 1),
 				      GRUB_VERIFY_KERNEL_CMDLINE);
    }
-    
+
    if (err)
      goto fail;
  }
@@ -1495,7 +1536,7 @@ ventoy_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),

    if (ventoy_linux_argc == 0)
    {
-        return grub_cmd_initrd(cmd, argc, argv);        
+        return grub_cmd_initrd(cmd, argc, argv);
    }

    grub_snprintf(buf, sizeof(buf), "mem:%s:size:%s", grub_env_get("ventoy_cpio_addr"), grub_env_get("ventoy_cpio_size"));
@@ -1526,7 +1567,7 @@ ventoy_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
        }
        grub_printf("=================================\n");
    }
-    
+
    return grub_cmd_initrd(cmd, ventoy_extra_initrd_num, ventoy_extra_initrd_list);
 }

@@ -1537,7 +1578,7 @@ grub_cmd_set_boot_opt (grub_command_t cmd __attribute__ ((unused)),
    int i;
    const char *vtdebug;
    grub_command_t regcmd;
-        
+
    for (i = 0; i < argc; i++)
    {
        ventoy_linux_args[ventoy_linux_argc + (LINUX_MAX_ARGC / 2) ] = grub_strdup(argv[i]);
@@ -1559,7 +1600,7 @@ grub_cmd_set_boot_opt (grub_command_t cmd __attribute__ ((unused)),
        ventoy_linux16_func = regcmd->func;
        regcmd->func = grub_cmd_linux;
    }
-    
+
    regcmd = grub_command_find("initrd16");
    if (regcmd)
    {
@@ -1576,7 +1617,7 @@ grub_cmd_unset_boot_opt (grub_command_t cmd __attribute__ ((unused)),
 {
    int i;
    grub_command_t regcmd;
-    
+
    (void)argc;
    (void)argv;

@@ -1612,7 +1653,7 @@ grub_cmd_unset_boot_opt (grub_command_t cmd __attribute__ ((unused)),
        }
        ventoy_initrd16_func = NULL;
    }
-    
+
    return 0;
 }

@@ -1633,7 +1674,7 @@ GRUB_MOD_INIT(linux)
 				      0, N_("Load initrd."));
  cmd_set_bootopt = grub_register_command ("vt_set_boot_opt", grub_cmd_set_boot_opt, 0, N_("set ext boot opt"));
  cmd_unset_bootopt = grub_register_command ("vt_unset_boot_opt", grub_cmd_unset_boot_opt, 0, N_("unset ext boot opt"));
-  
+
  cmd_extra_initrd_append = grub_register_command ("vt_img_extra_initrd_append", grub_cmd_extra_initrd_append, 0, N_(""));
  cmd_extra_initrd_reset = grub_register_command ("vt_img_extra_initrd_reset", grub_cmd_extra_initrd_reset, 0, N_(""));

@@ -64,7 +64,7 @@ grub_uint64_t tempMemsize = 0;
 grub_uint32_t free_index = 0;
 grub_uint32_t reserve_index = 0;
 grub_uint32_t acpi_table_index = 0;
-grub_uint32_t acpi_nvs_index = 0;  
+grub_uint32_t acpi_nvs_index = 0;

 #define LINUX_MAX_ARGC  1024
 static int ventoy_debug = 0;
@@ -133,11 +133,11 @@ static void ventoy_debug_pause(void)
 {
    char key;

-    if (0 == ventoy_debug) 
+    if (0 == ventoy_debug)
    {
        return;
    }
-    
+
    grub_printf("press Enter to continue ......\n");
    while (1)
    {
@@ -146,7 +146,7 @@ static void ventoy_debug_pause(void)
        {
            break;
        }
-    }    
+    }
 }

 static int ventoy_preboot(void)
@@ -155,7 +155,7 @@ static int ventoy_preboot(void)
    const char *file;
    char buf[128];

-    if (ventoy_debug) 
+    if (ventoy_debug)
    {
        grub_printf("ventoy_preboot %d %d\n", ventoy_linux_argc, ventoy_initrd_called);
        ventoy_debug_pause();
@@ -182,7 +182,7 @@ static int ventoy_preboot(void)
        ventoy_extra_initrd_list[ventoy_extra_initrd_num++] = grub_strdup(file);
    }

-    if (ventoy_debug) 
+    if (ventoy_debug)
    {
        grub_printf("========== initrd list ==========\n");
        for (i = 0; i < ventoy_extra_initrd_num; i++)
@@ -190,7 +190,7 @@ static int ventoy_preboot(void)
            grub_printf("%s\n", ventoy_extra_initrd_list[i]);
        }
        grub_printf("=================================\n");
-        
+
        ventoy_debug_pause();
    }

@@ -220,7 +220,7 @@ static int ventoy_boot_opt_filter(char *opt)
        }
        return 0;
    }
-    
+
    if (grub_strncmp(opt, "init=", 5) == 0)
    {
        opt[0] = 'v';
@@ -241,12 +241,12 @@ static int ventoy_boot_opt_filter(char *opt)
        {
            return 1;
        }
-        
+
        if (grub_strncmp(opt, "loglevel=", 9) == 0)
        {
            return 1;
        }
-        
+
        if (grub_strcmp(opt, "splash") == 0)
        {
            return 1;
@@ -293,7 +293,7 @@ static int ventoy_bootopt_hook(int argc, char *argv[])
    {
        ventoy_linux_args[count] = ventoy_linux_args[i + (LINUX_MAX_ARGC / 2)];
        ventoy_linux_args[i + (LINUX_MAX_ARGC / 2)] = NULL;
-        
+
        if (ventoy_linux_args[count][0] == '@')
        {
            env = grub_env_get(ventoy_linux_args[count] + 1);
@@ -339,7 +339,7 @@ static int ventoy_bootopt_hook(int argc, char *argv[])
                    {
                        if (0 == ventoy_boot_opt_filter(last))
                        {
-                            ventoy_linux_args[count++] = grub_strdup(last);                            
+                            ventoy_linux_args[count++] = grub_strdup(last);
                        }
                        break;
                    }
@@ -354,7 +354,7 @@ static int ventoy_bootopt_hook(int argc, char *argv[])
        }
        else
        {
-            count++;            
+            count++;
        }
    }

@@ -382,10 +382,10 @@ static int ventoy_bootopt_hook(int argc, char *argv[])
        for (i = 0; i < count; i++)
        {
            grub_printf("%s ", ventoy_linux_args[i]);
-        }  
+        }
        grub_printf("\n================================\n");
    }
-    
+
    return 0;
 }

@@ -418,7 +418,7 @@ grub_cmd_unset_boot_opt (grub_command_t cmd __attribute__ ((unused)),
 		int argc, char *argv[])
 {
    int i;
-    
+
    (void)argc;
    (void)argv;

@@ -441,16 +441,44 @@ static grub_err_t
 grub_cmd_extra_initrd_append (grub_command_t cmd __attribute__ ((unused)),
 		int argc, char *argv[])
 {
+    grub_uint32_t i;
    int newclen = 0;
    char *pos = NULL;
    char *end = NULL;
    char buf[256] = {0};
-    
+    const char *suffix = NULL;
+    const char *check_suffix[] = { ".ko", ".ko.zst", ".ko.xz", ".ko.gz" };
+
    if (argc != 1)
    {
        return 1;
    }

+    if (grub_strstr(argv[0], ".ko"))
+    {
+        if (ventoy_check_file_exist("%s", argv[0]))
+        {
+            suffix = "";
+        }
+    }
+    else
+    {
+        for (i = 0; i < sizeof(check_suffix) / sizeof(check_suffix[0]); i++)
+        {
+            if (ventoy_check_file_exist("%s%s", argv[0], check_suffix[i]))
+            {
+                suffix = check_suffix[i];
+                break;
+            }
+        }
+    }
+
+    if (!suffix)
+    {
+        grub_printf("ko file <%s> not exist\n", argv[0]);
+        return 0;
+    }
+
    for (pos = argv[0]; *pos; pos++)
    {
        if (*pos == '/')
@@ -465,16 +493,16 @@ grub_cmd_extra_initrd_append (grub_command_t cmd __attribute__ ((unused)),
        newclen = (int)grub_strlen(end + 1);
        if ((110 + newclen) % 4 == 0)
        {
-            grub_snprintf(buf, sizeof(buf), "newc:.%s:%s", end + 1, argv[0]);
+            grub_snprintf(buf, sizeof(buf), "newc:.%s%s:%s%s", end + 1, suffix, argv[0], suffix);
        }
        else
        {
-            grub_snprintf(buf, sizeof(buf), "newc:%s:%s", end + 1, argv[0]);
+            grub_snprintf(buf, sizeof(buf), "newc:%s%s:%s%s", end + 1, suffix, argv[0], suffix);
        }
-    
+
        if (ventoy_extra_initrd_num < 256)
        {
-            ventoy_extra_initrd_list[ventoy_extra_initrd_num++] = grub_strdup(buf);        
+            ventoy_extra_initrd_list[ventoy_extra_initrd_num++] = grub_strdup(buf);
        }
    }

@@ -486,7 +514,7 @@ grub_cmd_extra_initrd_reset (grub_command_t cmd __attribute__ ((unused)),
 		int argc, char *argv[])
 {
    int i;
-    
+
    (void)argc;
    (void)argv;

@@ -539,7 +567,7 @@ grub_linux_boot (void)
    struct memmap free_mem[GRUB_EFI_LOONGSON_MMAP_MAX];
    struct memmap acpi_table_mem[GRUB_EFI_LOONGSON_MMAP_MAX];
    struct memmap acpi_nvs_mem[GRUB_EFI_LOONGSON_MMAP_MAX];
-  
+
    grub_memset(reserve_mem, 0, sizeof(struct memmap) * GRUB_EFI_LOONGSON_MMAP_MAX);
    grub_memset(free_mem, 0, sizeof(struct memmap) * GRUB_EFI_LOONGSON_MMAP_MAX);
    grub_memset(acpi_table_mem, 0, sizeof(struct memmap) * GRUB_EFI_LOONGSON_MMAP_MAX);
@@ -573,7 +601,7 @@ grub_linux_boot (void)
    }else{
      new_interface_flag = 0;
      grub_dprintf("loongson", "get old parameter interface\n");
-      
+
    }
    state.gpr[6] = (grub_uint64_t)tmp_boot_params;
    grub_dprintf("loongson", "boot_params is 0x%llx\n", (_ull)state.gpr[6]);
@@ -600,7 +628,7 @@ grub_linux_boot (void)

      /*
       According to UEFI SPEC,mmap_buf is the accurate Memory Map array \
-       now we can fill platform specific memory structure. 
+       now we can fill platform specific memory structure.
       */
      for(lsdesc = mmap_buf; lsdesc < (grub_efi_memory_descriptor_t *)((char *)mmap_buf + mmap_size); lsdesc = (grub_efi_memory_descriptor_t *)((char *)lsdesc + desc_size))
      {
@@ -610,7 +638,7 @@ grub_linux_boot (void)
 			(lsdesc->type != GRUB_EFI_RUNTIME_SERVICES_DATA) && \
 			(lsdesc->type != GRUB_EFI_RUNTIME_SERVICES_CODE) && \
 			(lsdesc->type != GRUB_EFI_RESERVED_MEMORY_TYPE) && \
-			(lsdesc->type != GRUB_EFI_PAL_CODE)) 
+			(lsdesc->type != GRUB_EFI_PAL_CODE))
 	{

 	  free_mem[free_index].memtype = GRUB_EFI_LOONGSON_SYSTEM_RAM_LOW;
@@ -631,7 +659,7 @@ grub_linux_boot (void)
 	  acpi_nvs_index++;

 	  /* Reserve */
-	}else{ 
+	}else{
 	  reserve_mem[reserve_index].memtype = GRUB_EFI_LOONGSON_MEMORY_RESERVED;
 	  reserve_mem[reserve_index].memstart = (lsdesc->physical_start) & 0xffffffffffff;
 	  reserve_mem[reserve_index].memsize = lsdesc->num_pages * 4096;
@@ -645,12 +673,12 @@ grub_linux_boot (void)
        tempMemsize = free_mem[j].memsize;
        for(t = j + 1; t < free_index; t++)
        {
-          if((free_mem[j].memstart + tempMemsize == free_mem[t].memstart) && (free_mem[j].memtype == free_mem[t].memtype)) 
+          if((free_mem[j].memstart + tempMemsize == free_mem[t].memstart) && (free_mem[j].memtype == free_mem[t].memtype))
          {
 		  tempMemsize += free_mem[t].memsize;
-	  }else{            
+	  }else{
 		  break;
-	  }      
+	  }
 	}
 	if(free_mem[j].memstart >= 0x10000000) /*HIGH MEM*/
 	  new_interface_mem->map[tmp_index].memtype = GRUB_EFI_LOONGSON_SYSTEM_RAM_HIGH;
@@ -978,7 +1006,7 @@ ventoy_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),

    if (ventoy_linux_argc == 0)
    {
-        return grub_cmd_initrd(cmd, argc, argv);        
+        return grub_cmd_initrd(cmd, argc, argv);
    }

    grub_snprintf(buf, sizeof(buf), "mem:%s:size:%s", grub_env_get("ventoy_cpio_addr"), grub_env_get("ventoy_cpio_size"));
@@ -1009,10 +1037,10 @@ ventoy_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
        }
        grub_printf("=================================\n");
    }
-    
+
    return grub_cmd_initrd(cmd, ventoy_extra_initrd_num, ventoy_extra_initrd_list);
 }
-         
+
 static grub_command_t cmd_linux, cmd_initrd;
 static grub_command_t cmd_set_bootopt, cmd_unset_bootopt, cmd_extra_initrd_append, cmd_extra_initrd_reset;

@@ -1025,7 +1053,7 @@ GRUB_MOD_INIT(linux)

  cmd_set_bootopt = grub_register_command ("vt_set_boot_opt", grub_cmd_set_boot_opt, 0, N_("set ext boot opt"));
  cmd_unset_bootopt = grub_register_command ("vt_unset_boot_opt", grub_cmd_unset_boot_opt, 0, N_("unset ext boot opt"));
-  
+
  cmd_extra_initrd_append = grub_register_command ("vt_img_extra_initrd_append", grub_cmd_extra_initrd_append, 0, N_(""));
  cmd_extra_initrd_reset = grub_register_command ("vt_img_extra_initrd_reset", grub_cmd_extra_initrd_reset, 0, N_(""));

@@ -438,11 +438,11 @@ static void menu_set_chosen_tip(grub_menu_t menu, int entry)

    if (g_ventoy_theme_path[0])
    {
-        grub_env_set("theme", g_ventoy_theme_path);        
+        grub_env_set("theme", g_ventoy_theme_path);
    }

    g_ventoy_tip_msg1 = g_ventoy_tip_msg2 = NULL;
-    if (e && e->id && grub_strncmp(e->id, "VID_", 4) == 0) 
+    if (e && e->id && grub_strncmp(e->id, "VID_", 4) == 0)
    {
        g_ventoy_theme_path[0] = 0;
        img = (img_info *)(void *)grub_strtoul(e->id + 4, NULL, 16);
@@ -480,7 +480,7 @@ static void
 menu_set_chosen_entry (grub_menu_t menu, int entry)
 {
  struct grub_menu_viewer *cur;
-  
+
  menu_set_chosen_tip(menu, entry);
  for (cur = viewers; cur; cur = cur->next)
    cur->set_chosen_entry (entry, cur->data);
@@ -972,7 +972,7 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot)
                        ;
                    menu_fini ();
                    goto refresh;
-                }                
+                }
            }
            break;
        case (GRUB_TERM_CTRL | 'd'):
@@ -981,7 +981,7 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot)
            {
                menu_fini ();
                g_ventoy_memdisk_mode = 1 - g_ventoy_memdisk_mode;
-                g_ventoy_menu_refresh = 1;                
+                g_ventoy_menu_refresh = 1;
                goto refresh;
            }
            break;
@@ -992,7 +992,7 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot)
                menu_fini ();
                g_ventoy_iso_raw = 1 - g_ventoy_iso_raw;
                g_ventoy_menu_refresh = 1;
-                goto refresh;                
+                goto refresh;
            }
            break;
        case (GRUB_TERM_CTRL | 'r'):
@@ -1001,10 +1001,10 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot)
            {
                menu_fini ();
                g_ventoy_grub2_mode = 1 - g_ventoy_grub2_mode;
-                g_ventoy_menu_refresh = 1;                
+                g_ventoy_menu_refresh = 1;
                goto refresh;
            }
-            break;            
+            break;
        case (GRUB_TERM_CTRL | 'w'):
        case 'w':
            if (0 == g_ventoy_secondary_menu_on)
@@ -1039,7 +1039,7 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot)
        case 'm':
        {
            if (0 == g_ventoy_secondary_menu_on)
-            {                
+            {
                if (g_ventoy_cur_img_path)
                {
                    grub_env_set("VTOY_CHKSUM_FILE_PATH", g_ventoy_cur_img_path);
@@ -1128,16 +1128,17 @@ static struct grub_menu_execute_callback execution_callback =
 static grub_err_t
 show_menu (grub_menu_t menu, int nested, int autobooted)
 {
-    const char *def;    
+    const char *def;
    def = grub_env_get("VTOY_DEFAULT_IMAGE");
-    
+
  while (1)
    {
      int ndown;
+      char *pos = NULL;
      int boot_entry;
      grub_menu_entry_t e;
      int auto_boot;
-      
+
      boot_entry = run_menu (menu, nested, &auto_boot);
      if (boot_entry < 0)
 	break;
@@ -1149,7 +1150,7 @@ show_menu (grub_menu_t menu, int nested, int autobooted)
      if (autobooted == 0 && auto_boot == 0) {
          g_ventoy_last_entry = boot_entry;
          if (g_ventoy_menu_esc)
-              break;          
+              break;
      }

      if (autobooted == 0 && g_ventoy_menu_esc && auto_boot) {
@@ -1162,7 +1163,7 @@ show_menu (grub_menu_t menu, int nested, int autobooted)
 	continue; /* Menu is empty.  */

      if (2 == e->argc && e->args && e->args[1] && grub_strncmp(e->args[1], "VTOY_RET", 8) == 0)
-        break;  
+        break;

      grub_cls ();

@@ -1175,16 +1176,29 @@ show_menu (grub_menu_t menu, int nested, int autobooted)
 	break;

      if (2 == e->argc && e->args && e->args[1] && grub_strncmp(e->args[1], "VTOY_RUN_RET", 12) == 0)
-        break; 
-      else if (2 == e->argc && e->args && e->args[1] && grub_strncmp(e->args[1], "VTOY_RUN_SET", 12) == 0) {        
-        ndown = (int)grub_strtol(e->args[1] + 12, NULL, 10);
+        break;
+      else if (2 == e->argc && e->args && e->args[1] && grub_strncmp(e->args[1], "VTOY_RUN_SET_", 13) == 0) {
+        pos = NULL;
+        ndown = (int)grub_strtol(e->args[1] + 13, &pos, 10);
        while (ndown > 0)
        {
            ventoy_menu_push_key(GRUB_TERM_KEY_DOWN);
            ndown--;
        }
+
        ventoy_menu_push_key('\n');
-        break;         
+
+        if (pos && *pos == '_')
+        {
+            ndown = (int)grub_strtol(pos + 1, NULL, 10);
+            while (ndown > 0)
+            {
+                ventoy_menu_push_key(GRUB_TERM_KEY_DOWN);
+                ndown--;
+            }
+        }
+
+        break;
      }
    }

@@ -1,5 +1,5 @@
 /******************************************************************************
- * ventoy.c 
+ * ventoy.c
 *
 * Copyright (c) 2020, longpanda <admin@ventoy.net>
 *
@@ -7,12 +7,12 @@
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 3 of the
 * License, or (at your option) any later version.
- * 
+ *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
- * 
+ *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see <http://www.gnu.org/licenses/>.
 *
@@ -49,6 +49,14 @@ int g_ventoy_debug = 0;
 static int g_efi_os = 0xFF;
 grub_uint32_t g_ventoy_plat_data;

+static grub_uint8_t g_timeout_lock = 0;
+static grub_uint8_t g_theme_lock = 0;
+static char *g_lock_theme = NULL;
+
+#ifdef GRUB_MACHINE_EFI
+static VTOY_SHIM *g_vtoy_shim = NULL;
+#endif
+
 void ventoy_debug(const char *fmt, ...)
 {
    va_list args;
@@ -137,7 +145,7 @@ int ventoy_str_len_alnum(const char *str, int len)
 {
    int i;
    int slen;
-    
+
    if (NULL == str || 0 == *str)
    {
        return 0;
@@ -168,7 +176,7 @@ int ventoy_str_len_alnum(const char *str, int len)
 char * ventoy_str_basename(char *path)
 {
    char *pos = NULL;
-    
+
    pos = grub_strrchr(path, '/');
    if (pos)
    {
@@ -185,17 +193,17 @@ char * ventoy_str_basename(char *path)
 int ventoy_str_chrcnt(const char *str, char c)
 {
    int n = 0;
-    
+
    if (str)
    {
        while (*str)
        {
            if (*str == c)
            {
-                n++;                
+                n++;
            }
            str++;
-        }        
+        }
    }

    return n;
@@ -232,10 +240,33 @@ int ventoy_strncmp (const char *pattern, const char *str, grub_size_t n)
    return (int)(grub_uint8_t)*pattern - (int)(grub_uint8_t)*str;
 }

+void ventoy_timeout_lock(int lock)
+{
+    g_timeout_lock = lock ? 1 : 0;
+}
+
+void ventoy_theme_lock(int lock)
+{
+    const char *env = NULL;
+
+    g_theme_lock = 0;
+    grub_check_free(g_lock_theme);
+
+    if (lock)
+    {
+        env = grub_env_get("theme");
+        if (env)
+        {
+            g_lock_theme = grub_strdup(env);
+            g_theme_lock = 1;
+        }
+    }
+}
+
 grub_err_t ventoy_env_int_set(const char *name, int value)
 {
    char buf[16];
-    
+
    grub_snprintf(buf, sizeof(buf), "%d", value);
    return grub_env_set(name, buf);
 }
@@ -248,13 +279,13 @@ void ventoy_debug_dump_guid(const char *prefix, grub_uint8_t *guid)
    {
        return;
    }
-    
+
    debug("%s", prefix);
    for (i = 0; i < 16; i++)
    {
        grub_printf("%02x ", guid[i]);
    }
-    grub_printf("\n");       
+    grub_printf("\n");
 }

 int ventoy_is_efi_os(void)
@@ -290,7 +321,7 @@ void ventoy_memfile_env_set(const char *prefix, const void *buf, unsigned long l
    grub_snprintf(name, sizeof(name), "%s_addr", prefix);
    grub_snprintf(val, sizeof(val), "0x%llx", (ulonglong)(ulong)buf);
    grub_env_set(name, val);
-    
+
    grub_snprintf(name, sizeof(name), "%s_size", prefix);
    grub_snprintf(val, sizeof(val), "%llu", len);
    grub_env_set(name, val);
@@ -298,9 +329,152 @@ void ventoy_memfile_env_set(const char *prefix, const void *buf, unsigned long l
    return;
 }

+#ifdef GRUB_MACHINE_EFI
+static void ventoy_get_uefi_version(char *str, grub_size_t len)
+{
+    grub_efi_uint8_t uefi_minor_1, uefi_minor_2;
+
+    uefi_minor_1 = (grub_efi_system_table->hdr.revision & 0xffff) / 10;
+    uefi_minor_2 = (grub_efi_system_table->hdr.revision & 0xffff) % 10;
+    grub_snprintf(str, len, "%d.%d", (grub_efi_system_table->hdr.revision >> 16), uefi_minor_1);
+    if (uefi_minor_2)
+        grub_snprintf(str, len, "%s.%d", str, uefi_minor_2);
+}
+
+static void ventoy_get_pi_version(char *str, grub_size_t len)
+{
+    grub_uint32_t data = 0;
+    grub_efi_uintn_t i = 0;
+    grub_efi_guid_t dxest =
+        { 0x05ad34ba, 0x6f02, 0x4214, {0x95, 0x2e, 0x4d, 0xa0, 0x39, 0x8e, 0x2b, 0xb9 } };
+
+    for (i = 0; i < grub_efi_system_table->num_table_entries; i++)
+    {
+        if (grub_memcmp(&dxest, &grub_efi_system_table->configuration_table[i].vendor_guid, 16) == 0)
+        {
+            grub_memcpy(&data, (char *)grub_efi_system_table->configuration_table[i].vendor_table + 8, 4);
+            break;
+        }
+    }
+
+    grub_snprintf(str, len, "%d.%d", (data >> 16) & 0xFFFF, (data & 0xFFFF) / 10);
+}
+
+int ventoy_set_sb_policy(void)
+{
+    const char *env = NULL;
+    static int set_once = 0;
+
+    /* no need when SecureBoot is disabled */
+    if (g_sys_sb == 0)
+    {
+        return 0;
+    }
+
+    /* can only set once */
+    if (set_once > 0)
+    {
+        return 0;
+    }
+    set_once = 1;
+
+    /* VTOY_SECURE_BOOT_POLICY only take affect once during init */
+    env = grub_env_get("VTOY_SECURE_BOOT_POLICY");
+    if (env)
+    {
+        g_sb_policy = (grub_uint8_t)(env[0] - '0');
+    }
+
+    if (g_sb_policy == VTOY_SB_POLICY_BYPASS)
+    {
+        if (g_vtoy_shim && g_vtoy_shim->ByPassSB)
+        {
+            g_vtoy_shim->ByPassSB();
+        }
+    }
+    else if (g_sb_policy == VTOY_SB_POLICY_CHECK)
+    {
+        if (g_vtoy_shim && g_vtoy_shim->CheckSB)
+        {
+            g_vtoy_shim->CheckSB();
+        }
+    }
+
+    return 0;
+}
+
+static void ventoy_get_uefi_sb(void)
+{
+    grub_uint8_t secure_boot = 0;
+    grub_uint8_t setup_mode = 0;
+    grub_uint8_t *var = NULL;
+    grub_size_t size = 0;
+    grub_efi_guid_t global = GRUB_EFI_GLOBAL_VARIABLE_GUID;
+
+    var = grub_efi_get_variable("SecureBoot", &global, &size);
+    if (var && size == 1 && *var == 1)
+    {
+        secure_boot = 1;
+    }
+    grub_check_free(var);
+
+    size = 0;
+    var = grub_efi_get_variable("SetupMode", &global, &size);
+    if (var && size == 1 && *var == 1)
+    {
+        setup_mode = 1;
+    }
+
+    if (secure_boot == 1 && setup_mode == 0)
+    {
+        g_sys_sb = 1;
+    }
+
+    grub_check_free(var);
+}
+
+static int ventoy_secure_boot_init(void)
+{
+    grub_efi_guid_t ProtGuid = VTOY_SHIM_POLICY_GUID;
+
+    ventoy_get_uefi_sb();
+
+    if (g_sys_sb == 0)
+    {
+        return 0;
+    }
+
+
+    if (g_ventoy_plat_data == VTOY_PLAT_X86_64_UEFI)
+    {
+        g_vtoy_shim = grub_efi_locate_protocol(&ProtGuid, NULL);
+        if (g_vtoy_shim == NULL || g_vtoy_shim->ByPassSB == NULL ||
+            g_vtoy_shim->CheckSB == NULL || g_vtoy_shim->Launched == NULL)
+        {
+            /*
+             * Generally when SecureBoot enabled, Ventoy grub must be launched by Ventoy Shim.
+             * But there are some exceptions:
+             *   1. Ventoy key was enrolled directly to the UEFI DB
+             *   2. Some UEFI firmware (MSI) has Image Execution Policy as Always Execute which
+             *      means Secure Boot is effectively disabled.
+             */
+        }
+        else
+        {
+            g_vtoy_shim->Launched();
+        }
+    }
+
+    return 0;
+}
+
+
+#endif
+
 static int ventoy_arch_mode_init(void)
 {
    #ifdef GRUB_MACHINE_EFI
+
    if (grub_strcmp(GRUB_TARGET_CPU, "i386") == 0)
    {
        g_ventoy_plat_data = VTOY_PLAT_I386_UEFI;
@@ -329,19 +503,6 @@ static int ventoy_arch_mode_init(void)
    return 0;
 }

-#ifdef GRUB_MACHINE_EFI
-static void ventoy_get_uefi_version(char *str, grub_size_t len)
-{
-    grub_efi_uint8_t uefi_minor_1, uefi_minor_2;
-
-    uefi_minor_1 = (grub_efi_system_table->hdr.revision & 0xffff) / 10;
-    uefi_minor_2 = (grub_efi_system_table->hdr.revision & 0xffff) % 10;
-    grub_snprintf(str, len, "%d.%d", (grub_efi_system_table->hdr.revision >> 16), uefi_minor_1);
-    if (uefi_minor_2)
-        grub_snprintf(str, len, "%s.%d", str, uefi_minor_2);
-}
-#endif
-
 static int ventoy_calc_totalmem(grub_uint64_t addr, grub_uint64_t size, grub_memory_type_t type, void *data)
 {
    grub_uint64_t *total_mem = (grub_uint64_t *)data;
@@ -367,14 +528,18 @@ static int ventoy_hwinfo_init(void)
 #ifdef GRUB_MACHINE_EFI
    ventoy_get_uefi_version(str, sizeof(str));
    ventoy_env_export("grub_uefi_version", str);
+
+    ventoy_get_pi_version(str, sizeof(str));
+    ventoy_env_export("grub_pi_version", str);
 #else
    ventoy_env_export("grub_uefi_version", "NA");
+    ventoy_env_export("grub_pi_version", "NA");
 #endif

    return 0;
 }

-static global_var_cfg g_global_vars[] = 
+static global_var_cfg g_global_vars[] =
 {
    { "gfxmode",            "1024x768",   NULL },
    { ventoy_left_key,      "5%",         NULL },
@@ -415,6 +580,19 @@ static char * ventoy_global_var_write_hook(struct grub_env_var *var, const char
    return grub_strdup(val);
 }

+static char * ventoy_timeout_write_hook(struct grub_env_var *var, const char *val)
+{
+    (void)var;
+    return grub_strdup(g_timeout_lock ? "-1" : val);
+}
+
+static char * ventoy_theme_write_hook(struct grub_env_var *var, const char *val)
+{
+    (void)var;
+    return grub_strdup(g_theme_lock ? g_lock_theme : val);
+}
+
+
 int ventoy_global_var_init(void)
 {
    int i;
@@ -422,20 +600,24 @@ int ventoy_global_var_init(void)
    for (i = 0; g_global_vars[i].name; i++)
    {
        g_global_vars[i].value = grub_strdup(g_global_vars[i].defval);
-        ventoy_env_export(g_global_vars[i].name, g_global_vars[i].defval);        
+        ventoy_env_export(g_global_vars[i].name, g_global_vars[i].defval);
        grub_register_variable_hook(g_global_vars[i].name, ventoy_global_var_read_hook, ventoy_global_var_write_hook);
    }

+    grub_register_variable_hook("timeout", NULL, ventoy_timeout_write_hook);
+    grub_register_variable_hook("theme", NULL, ventoy_theme_write_hook);
+
    return 0;
 }

-static ctrl_var_cfg g_ctrl_vars[] = 
+static ctrl_var_cfg g_ctrl_vars[] =
 {
-    { "VTOY_WIN11_BYPASS_CHECK",  1 },
-    { "VTOY_WIN11_BYPASS_NRO",    1 },
-    { "VTOY_LINUX_REMOUNT",       0 },
-    { "VTOY_SECONDARY_BOOT_MENU", 1 },
-    { NULL, 0 }
+    { "VTOY_WIN11_BYPASS_CHECK",  "1" },
+    { "VTOY_WIN11_BYPASS_NRO",    "1" },
+    { "VTOY_LINUX_REMOUNT",       "0" },
+    { "VTOY_SECONDARY_BOOT_MENU", "1" },
+    { "VTOY_WIN_UEFI_RES_LOCK",   "3" },
+    { NULL, "" }
 };

 static const char * ventoy_ctrl_var_read_hook(struct grub_env_var *var, const char *val)
@@ -446,7 +628,7 @@ static const char * ventoy_ctrl_var_read_hook(struct grub_env_var *var, const ch
    {
        if (grub_strcmp(g_ctrl_vars[i].name, var->name) == 0)
        {
-            return g_ctrl_vars[i].value ? "1" : "0";
+            return g_ctrl_vars[i].szval;
        }
    }

@@ -461,14 +643,14 @@ static char * ventoy_ctrl_var_write_hook(struct grub_env_var *var, const char *v
    {
        if (grub_strcmp(g_ctrl_vars[i].name, var->name) == 0)
        {
-            if (val && val[0] == '1' && val[1] == 0)
+            if (val && grub_isdigit(val[0]) && val[1] == 0)
            {
-                g_ctrl_vars[i].value = 1;
-                return grub_strdup("1");
+                g_ctrl_vars[i].szval[0] = val[0];
+                return grub_strdup(val);
            }
            else
            {
-                g_ctrl_vars[i].value = 0;
+                g_ctrl_vars[i].szval[0] = '0';
                return grub_strdup("0");
            }
        }
@@ -479,12 +661,13 @@ static char * ventoy_ctrl_var_write_hook(struct grub_env_var *var, const char *v

 int ventoy_ctrl_var_init(void)
 {
-    int i;
+    ctrl_var_cfg *cfg = g_ctrl_vars;

-    for (i = 0; g_ctrl_vars[i].name; i++)
+    while (cfg->name)
    {
-        ventoy_env_export(g_ctrl_vars[i].name, g_ctrl_vars[i].value ? "1" : "0");
-        grub_register_variable_hook(g_ctrl_vars[i].name, ventoy_ctrl_var_read_hook, ventoy_ctrl_var_write_hook);
+        ventoy_env_export(cfg->name, cfg->szval);
+        grub_register_variable_hook(cfg->name, ventoy_ctrl_var_read_hook, ventoy_ctrl_var_write_hook);
+        cfg++;
    }

    return 0;
@@ -495,6 +678,11 @@ GRUB_MOD_INIT(ventoy)
    ventoy_hwinfo_init();
    ventoy_env_init();
    ventoy_arch_mode_init();
+
+#ifdef GRUB_MACHINE_EFI
+    ventoy_secure_boot_init();
+#endif
+
    ventoy_register_all_cmd();
 }

@@ -7,12 +7,12 @@
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 3 of the
 * License, or (at your option) any later version.
- * 
+ *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
- * 
+ *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see <http://www.gnu.org/licenses/>.
 *
@@ -37,6 +37,7 @@
 #define VTOY_SIZE_4MB     (4 * 1024 * 1024)
 #define VTOY_SIZE_512KB   (512 * 1024)
 #define VTOY_SIZE_1KB     1024
+#define VTOY_SIZE_4KB     4096
 #define VTOY_SIZE_32KB    (32 * 1024)
 #define VTOY_SIZE_128KB   (128 * 1024)

@@ -141,7 +142,7 @@ typedef enum VTOY_FILE_FLT
    VTOY_FILE_FLT_IMG,     /* .img */
    VTOY_FILE_FLT_VHD,     /* .vhd(x) */
    VTOY_FILE_FLT_VTOY,    /* .vtoy */
-    
+
    VTOY_FILE_FLT_BUTT
 }VTOY_FILE_FLT;

@@ -159,7 +160,7 @@ typedef struct cmd_para
    grub_extcmd_func_t func;
    grub_command_flags_t flags;
    const struct grub_arg_option *parser;
-    
+
    const char *summary;
    const char *description;

@@ -170,7 +171,7 @@ typedef struct cmd_para
 #define ventoy_align(value, align)  (((value) + ((align) - 1)) & (~((align) - 1)))

 #pragma pack(1)
-typedef struct cpio_newc_header 
+typedef struct cpio_newc_header
 {
    char  c_magic[6];
    char  c_ino[8];
@@ -194,6 +195,18 @@ typedef struct cpio_newc_header
 #define check_free(p, func) if (p) { func(p); p = NULL; }
 #define grub_check_free(p) if (p) { grub_free(p); p = NULL; }

+#define VTOY_SHIM_POLICY_GUID    {0x90a29d14, 0x3968, 0x48fe, { 0x85, 0x81, 0x6b, 0x7f, 0x7d, 0xc4, 0x70, 0x55 }};
+
+typedef void (*VTOY_BYPASS_SB)(void);
+typedef void (*VTOY_CHECK_SB)(void);
+typedef void (*VTOY_LAUNCHED)(void);
+typedef struct _VTOY_SHIM{
+	VTOY_BYPASS_SB ByPassSB;
+	VTOY_CHECK_SB CheckSB;
+	VTOY_LAUNCHED Launched;
+} VTOY_SHIM;
+
+
 typedef int (*grub_char_check_func)(int c);
 #define ventoy_is_decimal(str)  ventoy_string_check(str, grub_isdigit)

@@ -205,7 +218,7 @@ typedef struct ventoy_patch_vhd
    grub_uint8_t  part_offset_or_guid[16];
    grub_uint32_t reserved1;
    grub_uint32_t part_type;
-    grub_uint8_t  disk_signature_or_guid[16];    
+    grub_uint8_t  disk_signature_or_guid[16];
    grub_uint8_t  reserved2[16];
    grub_uint8_t  vhd_file_path[1];
 }ventoy_patch_vhd;
@@ -283,7 +296,7 @@ typedef struct img_info
    const char *tip2;
    const char *class;
    const char *menu_prefix;
-    
+
    int id;
    int type;
    int plugin_list_index;
@@ -312,8 +325,8 @@ typedef struct img_iterator_node

    struct img_iterator_node *parent;
    struct img_iterator_node *firstchild;
-    
-    void *firstiso;    
+
+    void *firstiso;
 }img_iterator_node;


@@ -327,7 +340,7 @@ typedef struct initrd_info

    grub_uint8_t  iso_type; // 0: iso9660  1:udf
    grub_uint32_t udf_start_block;
-    
+
    grub_uint64_t override_offset;
    grub_uint32_t override_length;
    char          override_data[32];
@@ -396,7 +409,7 @@ void ventoy_debug(const char *fmt, ...);
 #pragma pack(1)

 /* A WIM resource header */
-typedef struct wim_resource_header 
+typedef struct wim_resource_header
 {
    grub_uint64_t size_in_wim:56; /* Compressed length */
    grub_uint64_t flags:8;        /* flags  */
@@ -408,7 +421,7 @@ typedef struct wim_resource_header
 #define WIM_RESHDR_ZLEN_MASK 0x00ffffffffffffffULL

 /* WIM resource header flags */
-typedef enum wim_resource_header_flags 
+typedef enum wim_resource_header_flags
 {
    WIM_RESHDR_METADATA = ( 0x02ULL << 56 ),       /* Resource contains metadata */
    WIM_RESHDR_COMPRESSED = ( 0x04ULL << 56 ),     /* Resource is compressed */
@@ -418,7 +431,7 @@ typedef enum wim_resource_header_flags
 #define WIM_HEAD_SIGNATURE   "MSWIM\0\0"

 /* WIM header */
-typedef struct wim_header 
+typedef struct wim_header
 {
    grub_uint8_t signature[8];          /* Signature */
    grub_uint32_t header_len;           /* Header length */
@@ -438,21 +451,21 @@ typedef struct wim_header
 } wim_header;

 /* WIM header flags */
-typedef enum wim_header_flags 
+typedef enum wim_header_flags
 {
    WIM_HDR_XPRESS = 0x00020000, /* WIM uses Xpress compresson */
    WIM_HDR_LZX = 0x00040000,    /* WIM uses LZX compression */
 }wim_header_flags;

 /* A WIM file hash */
-typedef struct wim_hash 
+typedef struct wim_hash
 {
    /* SHA-1 hash */
    grub_uint8_t sha1[20];
 }wim_hash;

 /* A WIM lookup table entry */
-typedef struct wim_lookup_entry 
+typedef struct wim_lookup_entry
 {
    wim_resource_header resource; /* Resource header */
    grub_uint16_t part;           /* Part number */
@@ -464,19 +477,19 @@ typedef struct wim_lookup_entry
 #define WIM_CHUNK_LEN 32768

 /* A WIM chunk buffer */
-typedef struct wim_chunk_buffer 
+typedef struct wim_chunk_buffer
 {
    grub_uint8_t data[WIM_CHUNK_LEN]; /*Data */
 }wim_chunk_buffer;

 /* Security data */
-typedef struct wim_security_header 
+typedef struct wim_security_header
 {
    grub_uint32_t len;   /* Length */
    grub_uint32_t count; /* Number of entries */
 }wim_security_header;

-typedef struct wim_stream_entry 
+typedef struct wim_stream_entry
 {
    grub_uint64_t len;
    grub_uint64_t unused1;
@@ -486,7 +499,7 @@ typedef struct wim_stream_entry
 }wim_stream_entry;

 /* Directory entry */
-typedef struct wim_directory_entry 
+typedef struct wim_directory_entry
 {
    grub_uint64_t len;                 /* Length */
    grub_uint32_t attributes;     /* Attributes */
@@ -589,7 +602,7 @@ typedef struct _VTOY_JSON
    struct _VTOY_JSON *pstChild;

    JSON_TYPE enDataType;
-    union 
+    union
    {
        char  *pcStrVal;
        int   iNumVal;
@@ -648,6 +661,8 @@ int ventoy_str_all_digit(const char *str);
 int ventoy_str_all_alnum(const char *str);
 int ventoy_str_len_alnum(const char *str, int len);
 char * ventoy_str_basename(char *path);
+void ventoy_timeout_lock(int lock);
+void ventoy_theme_lock(int lock);
 grub_err_t ventoy_env_int_set(const char *name, int value);
 int ventoy_str_chrcnt(const char *str, char c);
 int ventoy_strcmp(const char *pattern, const char *str);
@@ -662,6 +677,7 @@ grub_uint32_t ventoy_get_iso_boot_catlog(grub_file_t file);
 int ventoy_has_efi_eltorito(grub_file_t file, grub_uint32_t sector);
 grub_err_t ventoy_cmd_linux_chain_data(grub_extcmd_context_t ctxt, int argc, char **args);
 grub_err_t ventoy_cmd_linux_systemd_menu(grub_extcmd_context_t ctxt, int argc, char **args);
+grub_err_t ventoy_cmd_linux_initrd(grub_extcmd_context_t ctxt, int argc, char **args);
 grub_err_t ventoy_cmd_linux_limine_menu(grub_extcmd_context_t ctxt, int argc, char **args);
 grub_err_t ventoy_cmd_linux_locate_initrd(grub_extcmd_context_t ctxt, int argc, char **args);
 grub_err_t ventoy_cmd_initrd_count(grub_extcmd_context_t ctxt, int argc, char **args);
@@ -700,7 +716,7 @@ int vtoy_json_parse_value
 (
    char *pcNewStart,
    char *pcRawStart,
-    VTOY_JSON *pstJson, 
+    VTOY_JSON *pstJson,
    const char *pcData,
    const char **ppcEnd
 );
@@ -716,51 +732,51 @@ int vtoy_json_scan_parse

 int vtoy_json_scan_array
 (
-     VTOY_JSON *pstJson, 
-     const char *szKey, 
+     VTOY_JSON *pstJson,
+     const char *szKey,
     VTOY_JSON **ppstArrayItem
 );

 int vtoy_json_scan_array_ex
 (
-     VTOY_JSON *pstJson, 
-     const char *szKey, 
+     VTOY_JSON *pstJson,
+     const char *szKey,
     VTOY_JSON **ppstArrayItem
 );
 int vtoy_json_scan_object
 (
-     VTOY_JSON *pstJson, 
-     const char *szKey, 
+     VTOY_JSON *pstJson,
+     const char *szKey,
    VTOY_JSON **ppstObjectItem
 );
 int vtoy_json_get_int
 (
-    VTOY_JSON *pstJson, 
-    const char *szKey, 
+    VTOY_JSON *pstJson,
+    const char *szKey,
    int *piValue
 );
 int vtoy_json_get_uint
 (
-    VTOY_JSON *pstJson, 
-    const char *szKey, 
+    VTOY_JSON *pstJson,
+    const char *szKey,
    grub_uint32_t *puiValue
 );
 int vtoy_json_get_uint64
 (
-    VTOY_JSON *pstJson, 
-    const char *szKey, 
+    VTOY_JSON *pstJson,
+    const char *szKey,
    grub_uint64_t *pui64Value
 );
 int vtoy_json_get_bool
 (
    VTOY_JSON *pstJson,
-    const char *szKey, 
+    const char *szKey,
    grub_uint8_t *pbValue
 );
 int vtoy_json_get_string
 (
-     VTOY_JSON *pstJson, 
-     const char *szKey, 
+     VTOY_JSON *pstJson,
+     const char *szKey,
     grub_uint32_t  uiBufLen,
     char *pcBuf
 );
@@ -782,7 +798,7 @@ static inline int ventoy_isspace (int c)

 static inline int ventoy_is_word_end(int c)
 {
-    return (c == 0 || c == ',' || ventoy_isspace(c));    
+    return (c == 0 || c == ',' || ventoy_isspace(c));
 }

 #pragma pack(1)
@@ -954,7 +970,7 @@ typedef struct persistence_config
    int cursel;
    int backendnum;
    file_fullpath *backendpath;
-    
+
    struct persistence_config *next;
 }persistence_config;

@@ -1279,6 +1295,7 @@ typedef struct systemd_menu_ctx
 {
    char *dev;
    char *buf;
+    const char *initrd_cmd;
    int pos;
    int len;
 }systemd_menu_ctx;
@@ -1293,7 +1310,7 @@ typedef struct global_var_cfg
 typedef struct ctrl_var_cfg
 {
    const char *name;
-    int value;
+    char szval[2];
 }ctrl_var_cfg;

 #define vtoy_check_goto_out(p)  if (!p) goto out
@@ -1323,6 +1340,8 @@ int ventoy_ctrl_var_init(void);
 int ventoy_global_var_init(void);
 grub_err_t ventoy_cmd_push_menulang(grub_extcmd_context_t ctxt, int argc, char **args);
 grub_err_t ventoy_cmd_pop_menulang(grub_extcmd_context_t ctxt, int argc, char **args);
+void ventoy_prompt_end(void);
+int ventoy_set_sb_policy(void);

 #endif /* __VENTOY_DEF_H__ */

@@ -1867,7 +1867,7 @@ static int ventoy_systemd_conf_hook(const char *filename, const struct grub_dirh
        ctx->pos = oldpos;
        goto out;
    }
-    vtoy_len_ssprintf(ctx->buf, ctx->pos, ctx->len, "  echo \"Downloading kernel ...\"\n  linux %s ", tag);
+    vtoy_len_ssprintf(ctx->buf, ctx->pos, ctx->len, "  echo \"Loading kernel ...\"\n  linux %s ", tag);

    /* kernel options */
    grub_memcpy(filebuf, bkbuf, file->size);
@@ -1876,7 +1876,7 @@ static int ventoy_systemd_conf_hook(const char *filename, const struct grub_dirh

    
    /* initrd xxx xxx xxx */
-    vtoy_len_ssprintf(ctx->buf, ctx->pos, ctx->len, "  echo \"Downloading initrd ...\"\n  initrd ");
+    vtoy_len_ssprintf(ctx->buf, ctx->pos, ctx->len, "  echo \"Loading initrd ...\"\n  %s ", ctx->initrd_cmd);
    grub_memcpy(filebuf, bkbuf, file->size);
    tag = ventoy_systemd_conf_tag(filebuf, "initrd", 1);
    while (tag)
@@ -1893,6 +1893,34 @@ out:
    return 0;
 }

+grub_err_t ventoy_cmd_linux_initrd(grub_extcmd_context_t ctxt, int argc, char **args)
+{
+    int i;    
+    int pos = 0;
+    char *buf = NULL;
+
+    (void)ctxt;
+
+    buf = (char *)grub_malloc(VTOY_SIZE_4KB);
+    if (!buf)
+    {
+        return 1;
+    }
+
+    pos += grub_snprintf(buf + pos, VTOY_SIZE_4KB - pos, "initrd mem:%s:size:%s",
+        grub_env_get("ventoy_cpio_addr"), grub_env_get("ventoy_cpio_size"));
+    
+    for (i = 0; i < argc; i++)
+    {
+        pos += grub_snprintf(buf + pos, VTOY_SIZE_4KB - pos, " newc:initrd%03d:%s", i + 1, args[i]);
+    }
+
+    grub_script_execute_sourcecode(buf);
+    grub_free(buf);
+
+    return 0;
+}
+
 grub_err_t ventoy_cmd_linux_systemd_menu(grub_extcmd_context_t ctxt, int argc, char **args)
 {
    static char *buf = NULL;
@@ -1936,6 +1964,7 @@ grub_err_t ventoy_cmd_linux_systemd_menu(grub_extcmd_context_t ctxt, int argc, c

    ctx.dev = args[0];
    ctx.buf = buf;
+    ctx.initrd_cmd = args[2] ? args[2] : "initrd";
    ctx.pos = 0;
    ctx.len = VTOY_LINUX_SYSTEMD_MENU_MAX_BUF;
    fs->fs_dir(dev, "/loader/entries", ventoy_systemd_conf_hook, &ctx);
@@ -1,5 +1,5 @@
 /******************************************************************************
- * ventoy_unix.c 
+ * ventoy_unix.c
 *
 * Copyright (c) 2020, longpanda <admin@ventoy.net>
 *
@@ -7,12 +7,12 @@
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 3 of the
 * License, or (at your option) any later version.
- * 
+ *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
- * 
+ *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see <http://www.gnu.org/licenses/>.
 *
@@ -69,9 +69,9 @@ static int ventoy_get_file_override(const char *filename, grub_uint64_t *offset)
    }

    *offset = grub_iso9660_get_last_file_dirent_pos(file) + 2;
-    
+
    grub_file_close(file);
-    
+
    return 0;
 }

@@ -83,12 +83,12 @@ static grub_uint32_t ventoy_unix_get_override_chunk_count(void)
    {
        count++;
    }
-    
+
    if (g_mod_new_len > 0)
    {
        count++;
    }
-    
+
    if (g_ko_fillmap_len > 0)
    {
        count += (g_ko_fillmap_len / 512);
@@ -109,7 +109,7 @@ static grub_uint32_t ventoy_unix_get_virt_chunk_count(void)
    {
        count++;
    }
-    
+
    if (g_mod_new_len > 0)
    {
        count++;
@@ -127,7 +127,7 @@ static grub_uint32_t ventoy_unix_get_virt_chunk_size(void)
    {
        size += ventoy_align_2k(g_conf_new_len);
    }
-    
+
    if (g_mod_new_len > 0)
    {
        size += ventoy_align_2k(g_mod_new_len);
@@ -141,9 +141,9 @@ static void ventoy_unix_fill_map_data(ventoy_chain_head *chain, struct g_ventoy_
    grub_uint32_t i;
    ventoy_img_chunk *chunk = NULL;

-    debug("Fill unix map data: <%llu> <%u> %p\n", 
+    debug("Fill unix map data: <%llu> <%u> %p\n",
        (unsigned long long)chain->os_param.vtoy_disk_size, g_img_chunk_list.cur_chunk, map);
-    
+
    map->magic1[0] = map->magic2[0] = VENTOY_UNIX_SEG_MAGIC0;
    map->magic1[1] = map->magic2[1] = VENTOY_UNIX_SEG_MAGIC1;
    map->magic1[2] = map->magic2[2] = VENTOY_UNIX_SEG_MAGIC2;
@@ -158,12 +158,12 @@ static void ventoy_unix_fill_map_data(ventoy_chain_head *chain, struct g_ventoy_
        debug("####[FAIL] Too many segments for the ISO file %u\n", g_img_chunk_list.cur_chunk);
        map->segnum = VENTOY_UNIX_MAX_SEGNUM;
    }
-    
+
    for (i = 0; i < (grub_uint32_t)(map->segnum); i++)
    {
        chunk = g_img_chunk_list.chunk + i;
        map->seglist[i].seg_start_bytes = chunk->disk_start_sector * 512ULL;
-        map->seglist[i].seg_end_bytes = (chunk->disk_end_sector + 1) * 512ULL;        
+        map->seglist[i].seg_end_bytes = (chunk->disk_end_sector + 1) * 512ULL;
    }
 }

@@ -176,7 +176,7 @@ static void ventoy_unix_fill_override_data(    grub_uint64_t isosize, ventoy_cha
    grub_uint64_t sector;
    ventoy_override_chunk *cur;
    ventoy_iso9660_override *dirent;
-    
+
    sector = (isosize + 2047) / 2048;

    cur = (ventoy_override_chunk *)((char *)chain + chain->override_chunk_offset);
@@ -215,7 +215,7 @@ static void ventoy_unix_fill_override_data(    grub_uint64_t isosize, ventoy_cha
        offset = g_mod_override_offset;

        ventoy_unix_fill_map_data(chain, (struct g_ventoy_map *)data);
-        
+
        for (i = 0; i < g_ko_fillmap_len / 512; i++)
        {
            cur->img_offset = offset;
@@ -252,7 +252,7 @@ static void ventoy_unix_fill_virt_data(    grub_uint64_t isosize, ventoy_chain_h

    override = (char *)chain + chain->virt_chunk_offset;
    cur = (ventoy_virt_chunk *)override;
-    
+
    sector = (isosize + 2047) / 2048;
    offset = 2 * sizeof(ventoy_virt_chunk);

@@ -267,10 +267,10 @@ static void ventoy_unix_fill_virt_data(    grub_uint64_t isosize, ventoy_chain_h
        {
            ventoy_unix_fill_map_data(chain, (struct g_ventoy_map *)(g_mod_new_data + g_mod_search_magic));
        }
-    
+
        ventoy_unix_fill_virt(g_mod_new_data, g_mod_new_len);
    }
-    
+
    return;
 }

@@ -287,7 +287,7 @@ static int ventoy_freebsd_append_conf(char *buf, const char *isopath, const char
    grub_uint8_t disk_guid[16];

    debug("ventoy_freebsd_append_conf %s\n", isopath);
-    
+
    isofile = ventoy_grub_file_open(VENTOY_FILE_TYPE, "%s", isopath);
    if (!isofile)
    {
@@ -296,7 +296,7 @@ static int ventoy_freebsd_append_conf(char *buf, const char *isopath, const char

    vtoy_ssprintf(buf, pos, "ventoy_load=\"%s\"\n", "YES");
    vtoy_ssprintf(buf, pos, "ventoy_name=\"%s\"\n", g_ko_mod_path);
-    
+
    if (alias)
    {
        vtoy_ssprintf(buf, pos, "hint.ventoy.0.alias=\"%s\"\n", alias);
@@ -320,7 +320,7 @@ static int ventoy_freebsd_append_conf(char *buf, const char *isopath, const char
    }

    debug("Fill hint.ventoy info\n");
-    
+
    disk = isofile->device->disk;

    ventoy_get_disk_guid(isofile->name, disk_guid, disk_sig);
@@ -338,7 +338,7 @@ static int ventoy_freebsd_append_conf(char *buf, const char *isopath, const char
    for (i = 0; i < g_img_chunk_list.cur_chunk; i++)
    {
        chunk = g_img_chunk_list.chunk + i;
-        vtoy_ssprintf(buf, pos, "hint.ventoy.%u.seg=\"0x%llx@0x%llx\"\n", 
+        vtoy_ssprintf(buf, pos, "hint.ventoy.%u.seg=\"0x%llx@0x%llx\"\n",
            i, (ulonglong)(chunk->disk_start_sector * 512),
            (ulonglong)((chunk->disk_end_sector + 1) * 512));
    }
@@ -368,7 +368,7 @@ grub_err_t ventoy_cmd_unix_reset(grub_extcmd_context_t ctxt, int argc, char **ar
    (void)ctxt;
    (void)argc;
    (void)args;
-    
+
    g_unix_vlnk_boot = 0;
    g_mod_search_magic = 0;
    g_conf_new_len = 0;
@@ -411,7 +411,7 @@ grub_err_t ventoy_cmd_parse_freenas_ver(grub_extcmd_context_t ctxt, int argc, ch
    const char *ver = NULL;
    char *buf = NULL;
    VTOY_JSON *json = NULL;
-    
+
    (void)ctxt;
    (void)argc;

@@ -472,7 +472,7 @@ grub_err_t ventoy_cmd_unix_freebsd_ver(grub_extcmd_context_t ctxt, int argc, cha
    char *buf;
    char *start = NULL;
    char *nextline = NULL;
-    
+
    (void)ctxt;
    (void)argc;
    (void)args;
@@ -502,7 +502,7 @@ grub_err_t ventoy_cmd_unix_freebsd_ver(grub_extcmd_context_t ctxt, int argc, cha
                nextline++;
            }

-            *nextline = 0;            
+            *nextline = 0;
            break;
        }
        nextline = ventoy_get_line(start);
@@ -521,25 +521,162 @@ grub_err_t ventoy_cmd_unix_freebsd_ver(grub_extcmd_context_t ctxt, int argc, cha

    grub_free(buf);
    grub_file_close(file);
-    
+
    VENTOY_CMD_RETURN(GRUB_ERR_NONE);
 }

+static int ventoy_freebsd_ver_elf(int bit64, grub_elf_t elf, const char *section, const char *env, char *data)
+{
+    int j = 0;
+    int k = 0;
+    int ret = 1;
+    char *str = NULL;
+    void *hdr = NULL;
+    grub_off_t offset = 0;
+    grub_uint32_t len = 0;
+    char ver[64] = {0};
+
+    if (bit64)
+    {
+        Elf64_Ehdr *e = &(elf->ehdr.ehdr64);
+        Elf64_Shdr *h;
+        Elf64_Shdr *s;
+        Elf64_Shdr *t;
+        Elf64_Half i;
+
+        h = hdr = grub_zalloc(e->e_shnum * e->e_shentsize);
+        if (!h)
+        {
+            goto out;
+        }
+
+        debug("read section header %u %u %u\n", e->e_shnum, e->e_shentsize, e->e_shstrndx);
+        grub_file_seek(elf->file, e->e_shoff);
+        grub_file_read(elf->file, h, e->e_shnum * e->e_shentsize);
+
+        s = (Elf64_Shdr *)((char *)h + e->e_shstrndx * e->e_shentsize);
+        str = grub_malloc(s->sh_size + 1);
+        if (!str)
+        {
+            goto out;
+        }
+        str[s->sh_size] = 0;
+
+        debug("read string table %u %u\n", (grub_uint32_t)s->sh_offset, (grub_uint32_t)s->sh_size);
+        grub_file_seek(elf->file, s->sh_offset);
+        grub_file_read(elf->file, str, s->sh_size);
+
+        for (t = h, i = 0; i < e->e_shnum; i++)
+        {
+            if (grub_strcmp(str + t->sh_name, section) == 0)
+            {
+                offset = t->sh_offset;
+                len = t->sh_size;
+                debug("find %s section at %u %u\n", section, (grub_uint32_t)offset, len);
+                break;
+            }
+            t = (Elf64_Shdr *)((char *)t + e->e_shentsize);
+        }
+    }
+    else
+    {
+        Elf32_Ehdr *e = &(elf->ehdr.ehdr32);
+        Elf32_Shdr *h;
+        Elf32_Shdr *s;
+        Elf32_Shdr *t;
+        Elf32_Half i;
+
+        h = hdr = grub_zalloc(e->e_shnum * e->e_shentsize);
+        if (!h)
+        {
+            goto out;
+        }
+
+        debug("read section header %u %u %u\n", e->e_shnum, e->e_shentsize, e->e_shstrndx);
+        grub_file_seek(elf->file, e->e_shoff);
+        grub_file_read(elf->file, h, e->e_shnum * e->e_shentsize);
+
+        s = (Elf32_Shdr *)((char *)h + e->e_shstrndx * e->e_shentsize);
+        str = grub_malloc(s->sh_size + 1);
+        if (!str)
+        {
+            goto out;
+        }
+        str[s->sh_size] = 0;
+
+        debug("read string table %u %u\n", (grub_uint32_t)s->sh_offset, (grub_uint32_t)s->sh_size);
+        grub_file_seek(elf->file, s->sh_offset);
+        grub_file_read(elf->file, str, s->sh_size);
+
+        for (t = h, i = 0; i < e->e_shnum; i++)
+        {
+            if (grub_strcmp(str + t->sh_name, section) == 0)
+            {
+                offset = t->sh_offset;
+                len = t->sh_size;
+                debug("find %s section at %u %u\n", section, (grub_uint32_t)offset, len);
+                break;
+            }
+            t = (Elf32_Shdr *)((char *)t + e->e_shentsize);
+        }
+    }
+
+    if (offset == 0 || len == 0)
+    {
+        debug("%s section not found\n", section);
+        goto out;
+    }
+
+    grub_file_seek(elf->file, offset + len - 8192);
+    grub_file_read(elf->file, data, 8192);
+
+    for (j = 0; j < 8192 - 12; j++)
+    {
+        if (grub_strncmp(data + j, "@(#)FreeBSD ", 12) == 0)
+        {
+            for (k = j + 12; k < 8192; k++)
+            {
+                if (0 == grub_isdigit(data[k]) && data[k] != '.')
+                {
+                    data[k] = 0;
+                    break;
+                }
+            }
+
+            grub_snprintf(ver, sizeof(ver), "%s", data + j + 12);
+            break;
+        }
+    }
+
+
+    if (ver[0])
+    {
+        k = (int)grub_strtoul(ver, NULL, 10);
+        debug("%s freebsd version:<%s> <%d.x>\n", section, ver, k);
+        grub_snprintf(ver, sizeof(ver), "%d.x", k);
+        ventoy_set_env(env, ver);
+        ret = 0;
+    }
+    else
+    {
+        debug("%s freebsd version:<%s>\n", section, "NOT FOUND");
+        ret = 1;
+    }
+
+out:
+    grub_check_free(str);
+    grub_check_free(hdr);
+    return ret;
+}
+
 grub_err_t ventoy_cmd_unix_freebsd_ver_elf(grub_extcmd_context_t ctxt, int argc, char **args)
 {
-    int j;
-    int k;
-    grub_elf_t elf = NULL;
-    grub_off_t offset = 0;
-    grub_uint32_t len = 0;
-    char *str = NULL;
+    int ret = 0;
+    int bit64 = 0;
    char *data = NULL;
-    void *hdr = NULL;
-    char ver[64] = {0};
-    
+    grub_elf_t elf = NULL;
+
    (void)ctxt;
-    (void)argc;
-    (void)args;

    if (argc != 3)
    {
@@ -560,136 +697,18 @@ grub_err_t ventoy_cmd_unix_freebsd_ver_elf(grub_extcmd_context_t ctxt, int argc,
        goto out;
    }

-    if (args[1][0] == '6')
+    bit64 = (args[1][0] == '6') ? 1 : 0;
+
+    ret = ventoy_freebsd_ver_elf(bit64, elf, ".data", args[2], data);
+    if (ret != 0)
    {
-        Elf64_Ehdr *e = &(elf->ehdr.ehdr64);
-        Elf64_Shdr *h;
-        Elf64_Shdr *s;
-        Elf64_Shdr *t;
-        Elf64_Half i;
-        
-        h = hdr = grub_zalloc(e->e_shnum * e->e_shentsize);
-        if (!h)
-        {
-            goto out;
-        }
-
-        debug("read section header %u %u %u\n", e->e_shnum, e->e_shentsize, e->e_shstrndx);
-        grub_file_seek(elf->file, e->e_shoff);
-        grub_file_read(elf->file, h, e->e_shnum * e->e_shentsize);
-
-        s = (Elf64_Shdr *)((char *)h + e->e_shstrndx * e->e_shentsize);        
-        str = grub_malloc(s->sh_size + 1);
-        if (!str)
-        {
-            goto out;
-        }
-        str[s->sh_size] = 0;
-
-        debug("read string table %u %u\n", (grub_uint32_t)s->sh_offset, (grub_uint32_t)s->sh_size);
-        grub_file_seek(elf->file, s->sh_offset);
-        grub_file_read(elf->file, str, s->sh_size);
-
-        for (t = h, i = 0; i < e->e_shnum; i++)
-        {
-            if (grub_strcmp(str + t->sh_name, ".data") == 0)
-            {
-                offset = t->sh_offset;
-                len = t->sh_size;
-                debug("find .data section at %u %u\n", (grub_uint32_t)offset, len);
-                break;
-            }
-            t = (Elf64_Shdr *)((char *)t + e->e_shentsize);
-        }
-    }
-    else
-    {
-        Elf32_Ehdr *e = &(elf->ehdr.ehdr32);
-        Elf32_Shdr *h;
-        Elf32_Shdr *s;
-        Elf32_Shdr *t;
-        Elf32_Half i;
-        
-        h = hdr = grub_zalloc(e->e_shnum * e->e_shentsize);
-        if (!h)
-        {
-            goto out;
-        }
-
-        debug("read section header %u %u %u\n", e->e_shnum, e->e_shentsize, e->e_shstrndx);
-        grub_file_seek(elf->file, e->e_shoff);
-        grub_file_read(elf->file, h, e->e_shnum * e->e_shentsize);
-
-        s = (Elf32_Shdr *)((char *)h + e->e_shstrndx * e->e_shentsize);        
-        str = grub_malloc(s->sh_size + 1);
-        if (!str)
-        {
-            goto out;
-        }
-        str[s->sh_size] = 0;
-
-        debug("read string table %u %u\n", (grub_uint32_t)s->sh_offset, (grub_uint32_t)s->sh_size);
-        grub_file_seek(elf->file, s->sh_offset);
-        grub_file_read(elf->file, str, s->sh_size);
-
-        for (t = h, i = 0; i < e->e_shnum; i++)
-        {
-            if (grub_strcmp(str + t->sh_name, ".data") == 0)
-            {
-                offset = t->sh_offset;
-                len = t->sh_size;
-                debug("find .data section at %u %u\n", (grub_uint32_t)offset, len);
-                break;
-            }
-            t = (Elf32_Shdr *)((char *)t + e->e_shentsize);
-        }
-    }
-
-    if (offset == 0 || len == 0)
-    {
-        debug(".data section not found %s\n", args[0]);
-        goto out;
-    }
-
-    grub_file_seek(elf->file, offset + len - 8192);
-    grub_file_read(elf->file, data, 8192);
-
-    for (j = 0; j < 8192 - 12; j++)
-    {
-        if (grub_strncmp(data + j, "@(#)FreeBSD ", 12) == 0)
-        {
-            for (k = j + 12; k < 8192; k++)
-            {
-                if (0 == grub_isdigit(data[k]) && data[k] != '.')
-                {
-                    data[k] = 0;
-                    break;
-                }
-            }
-        
-            grub_snprintf(ver, sizeof(ver), "%s", data + j + 12);
-            break;
-        }
-    }
-
-    if (ver[0])
-    {
-        k = (int)grub_strtoul(ver, NULL, 10);
-        debug("freebsd version:<%s> <%d.x>\n", ver, k);
-        grub_snprintf(ver, sizeof(ver), "%d.x", k);
-        ventoy_set_env(args[2], ver);
-    }
-    else
-    {
-        debug("freebsd version:<%s>\n", "NOT FOUND");
+        ret = ventoy_freebsd_ver_elf(bit64, elf, ".rodata", args[2], data);
    }

 out:
-    grub_check_free(str);
-    grub_check_free(hdr);
    grub_check_free(data);
    check_free(elf, grub_elf_close);
-    
+
    VENTOY_CMD_RETURN(GRUB_ERR_NONE);
 }

@@ -704,7 +723,7 @@ grub_err_t ventoy_cmd_unix_replace_grub_conf(grub_extcmd_context_t ctxt, int arg
    grub_file_t file;
    char extcfg[512];
    const char *confile = NULL;
-    const char * loader_conf[] = 
+    const char * loader_conf[] =
    {
        "/boot/grub/grub.cfg",
    };
@@ -716,7 +735,7 @@ grub_err_t ventoy_cmd_unix_replace_grub_conf(grub_extcmd_context_t ctxt, int arg
        debug("Replace conf invalid argc %d\n", argc);
        return 1;
    }
- 
+
    for (i = 0; i < sizeof(loader_conf) / sizeof(loader_conf[0]); i++)
    {
        if (ventoy_get_file_override(loader_conf[i], &offset) == 0)
@@ -728,7 +747,7 @@ grub_err_t ventoy_cmd_unix_replace_grub_conf(grub_extcmd_context_t ctxt, int arg
    }

    if (confile == NULL)
-    {   
+    {
        debug("Can't find grub.cfg file from %u locations\n", i);
        return 1;
    }
@@ -745,13 +764,13 @@ grub_err_t ventoy_cmd_unix_replace_grub_conf(grub_extcmd_context_t ctxt, int arg
    data = grub_malloc(VTOY_MAX_SCRIPT_BUF);
    if (!data)
    {
-        grub_file_close(file);    
+        grub_file_close(file);
        return 1;
    }

    grub_file_read(file, data, file->size);
    grub_file_close(file);
-    
+
    g_conf_new_data = data;
    g_conf_new_len = (int)file->size;

@@ -783,7 +802,7 @@ grub_err_t ventoy_cmd_unix_replace_grub_conf(grub_extcmd_context_t ctxt, int arg
        {
            vtoy_ssprintf(extcfg, len, ";set kFreeBSD.hint.ventoy.0.remount=%d", 1);
        }
-        
+
        grub_memmove(pos + len, pos, (int)(file->size - (pos - data)));
        grub_memcpy(pos, extcfg, len);
        g_conf_new_len += len;
@@ -792,7 +811,7 @@ grub_err_t ventoy_cmd_unix_replace_grub_conf(grub_extcmd_context_t ctxt, int arg
    {
        debug("no kfreebsd found\n");
    }
-    
+
    VENTOY_CMD_RETURN(GRUB_ERR_NONE);
 }

@@ -803,7 +822,7 @@ grub_err_t ventoy_cmd_unix_replace_conf(grub_extcmd_context_t ctxt, int argc, ch
    grub_uint64_t offset;
    grub_file_t file;
    const char *confile = NULL;
-    const char * loader_conf[] = 
+    const char * loader_conf[] =
    {
        "/boot/loader.conf",
        "/boot/defaults/loader.conf",
@@ -816,7 +835,7 @@ grub_err_t ventoy_cmd_unix_replace_conf(grub_extcmd_context_t ctxt, int argc, ch
        debug("Replace conf invalid argc %d\n", argc);
        return 1;
    }
- 
+
    for (i = 0; i < sizeof(loader_conf) / sizeof(loader_conf[0]); i++)
    {
        if (ventoy_get_file_override(loader_conf[i], &offset) == 0)
@@ -828,7 +847,7 @@ grub_err_t ventoy_cmd_unix_replace_conf(grub_extcmd_context_t ctxt, int argc, ch
    }

    if (confile == NULL)
-    {   
+    {
        debug("Can't find loader.conf file from %u locations\n", i);
        return 1;
    }
@@ -845,13 +864,13 @@ grub_err_t ventoy_cmd_unix_replace_conf(grub_extcmd_context_t ctxt, int argc, ch
    data = grub_malloc(VTOY_MAX_SCRIPT_BUF);
    if (!data)
    {
-        grub_file_close(file);    
+        grub_file_close(file);
        return 1;
    }

    grub_file_read(file, data, file->size);
    grub_file_close(file);
-    
+
    g_conf_new_data = data;
    g_conf_new_len = (int)file->size;

@@ -863,19 +882,19 @@ grub_err_t ventoy_cmd_unix_replace_conf(grub_extcmd_context_t ctxt, int argc, ch
    {
        g_conf_new_len += ventoy_dragonfly_append_conf(data + file->size, args[1]);
    }
-    
+
    VENTOY_CMD_RETURN(GRUB_ERR_NONE);
 }

 static int ventoy_unix_search_magic(char *data, int len)
 {
    int i;
-    grub_uint32_t *magic = NULL;    
+    grub_uint32_t *magic = NULL;

    for (i = 0; i < len; i += 4096)
    {
        magic = (grub_uint32_t *)(data + i);
-        if (magic[0] == VENTOY_UNIX_SEG_MAGIC0 && magic[1] == VENTOY_UNIX_SEG_MAGIC1 && 
+        if (magic[0] == VENTOY_UNIX_SEG_MAGIC0 && magic[1] == VENTOY_UNIX_SEG_MAGIC1 &&
            magic[2] == VENTOY_UNIX_SEG_MAGIC2 && magic[3] == VENTOY_UNIX_SEG_MAGIC3)
        {
            debug("unix find search magic at 0x%x loop:%d\n", i, (i >> 12));
@@ -910,7 +929,7 @@ grub_err_t ventoy_cmd_unix_replace_ko(grub_extcmd_context_t ctxt, int argc, char
        g_mod_override_offset = offset;
    }
    else
-    {   
+    {
        debug("Can't find replace ko file from %s\n", args[0]);
        return 1;
    }
@@ -928,18 +947,18 @@ grub_err_t ventoy_cmd_unix_replace_ko(grub_extcmd_context_t ctxt, int argc, char
    if (!data)
    {
        debug("Failed to alloc memory for new ko %d\n", (int)file->size);
-        grub_file_close(file);    
+        grub_file_close(file);
        return 1;
    }

    grub_file_read(file, data, file->size);
    grub_file_close(file);
-    
+
    g_mod_new_data = data;
    g_mod_new_len = (int)file->size;

    ventoy_unix_search_magic(g_mod_new_data, g_mod_new_len);
-    
+
    VENTOY_CMD_RETURN(GRUB_ERR_NONE);
 }

@@ -967,7 +986,7 @@ grub_err_t ventoy_cmd_unix_ko_fillmap(grub_extcmd_context_t ctxt, int argc, char
        g_mod_override_offset = grub_iso9660_get_last_read_pos(file);
    }
    else
-    {   
+    {
        debug("Can't find replace ko file from %s\n", args[0]);
        return 1;
    }
@@ -977,8 +996,8 @@ grub_err_t ventoy_cmd_unix_ko_fillmap(grub_extcmd_context_t ctxt, int argc, char
        magic[0] = 0;
        grub_file_seek(file, i);
        grub_file_read(file, magic, sizeof(magic));
-    
-        if (magic[0] == VENTOY_UNIX_SEG_MAGIC0 && magic[1] == VENTOY_UNIX_SEG_MAGIC1 && 
+
+        if (magic[0] == VENTOY_UNIX_SEG_MAGIC0 && magic[1] == VENTOY_UNIX_SEG_MAGIC1 &&
            magic[2] == VENTOY_UNIX_SEG_MAGIC2 && magic[3] == VENTOY_UNIX_SEG_MAGIC3)
        {
            debug("unix find search magic at 0x%x loop:%d\n", i, (i >> 16));
@@ -987,7 +1006,7 @@ grub_err_t ventoy_cmd_unix_ko_fillmap(grub_extcmd_context_t ctxt, int argc, char
        }
    }

-    len = (grub_uint32_t)OFFSET_OF(struct g_ventoy_map, seglist) + 
+    len = (grub_uint32_t)OFFSET_OF(struct g_ventoy_map, seglist) +
        (sizeof(struct g_ventoy_seg) * g_img_chunk_list.cur_chunk);

    g_ko_fillmap_len = (int)len;
@@ -1034,7 +1053,7 @@ grub_err_t ventoy_cmd_unix_fill_image_desc(grub_extcmd_context_t ctxt, int argc,
            if (grub_memcmp(flag, byte + i, 32) == 0)
            {
                debug("Find position flag at %d(0x%x)\n", i, i);
-                break;                
+                break;
            }
        }
    }
@@ -1118,7 +1137,7 @@ grub_err_t ventoy_cmd_unix_chain_data(grub_extcmd_context_t ctxt, int argc, char
    const char *pLastChain = NULL;
    const char *compatible;
    ventoy_chain_head *chain;
-    
+
    (void)ctxt;
    (void)argc;

@@ -1161,9 +1180,9 @@ grub_err_t ventoy_cmd_unix_chain_data(grub_extcmd_context_t ctxt, int argc, char
            return grub_error(GRUB_ERR_BAD_ARGUMENT, "File %s is not bootable", args[0]);
        }
    }
-    
+
    img_chunk_size = g_img_chunk_list.cur_chunk * sizeof(ventoy_img_chunk);
-    
+
    if (ventoy_compatible)
    {
        size = sizeof(ventoy_chain_head) + img_chunk_size;
@@ -1172,11 +1191,11 @@ grub_err_t ventoy_cmd_unix_chain_data(grub_extcmd_context_t ctxt, int argc, char
    {
        override_count = ventoy_unix_get_override_chunk_count();
        override_size = override_count * sizeof(ventoy_override_chunk);
-        
+
        virt_chunk_size = ventoy_unix_get_virt_chunk_size();
        size = sizeof(ventoy_chain_head) + img_chunk_size + override_size + virt_chunk_size;
    }
-    
+
    pLastChain = grub_env_get("vtoy_chain_mem_addr");
    if (pLastChain)
    {
@@ -1239,7 +1258,7 @@ grub_err_t ventoy_cmd_unix_chain_data(grub_extcmd_context_t ctxt, int argc, char
    ventoy_unix_fill_virt_data(isosize, chain);

    grub_file_close(file);
-    
+
    VENTOY_CMD_RETURN(GRUB_ERR_NONE);
 }

@@ -24,6 +24,11 @@
 #include <grub/types.h>
 #include <grub/menu.h>

+#define VTOY_SB_POLICY_BYPASS   0
+#define VTOY_SB_POLICY_CHECK    1
+extern grub_uint8_t EXPORT_VAR(g_sys_sb);
+extern grub_uint8_t EXPORT_VAR(g_sb_policy);
+
 struct grub_env_var;

 typedef const char *(*grub_env_read_hook_t) (struct grub_env_var *var,
@@ -7,12 +7,12 @@
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 3 of the
 * License, or (at your option) any later version.
- * 
+ *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
- * 
+ *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see <http://www.gnu.org/licenses/>.
 *
@@ -82,7 +82,7 @@ typedef struct ventoy_image_location

    /*
     * disk region data (region_count)
-     * If the image file has more than one fragments in disk, 
+     * If the image file has more than one fragments in disk,
     * there will be more than one region data here.
     *
     */
@@ -104,7 +104,7 @@ typedef struct ventoy_os_param
    char           vtoy_img_path[384];   // It seems to be enough, utf-8 format
    grub_uint64_t  vtoy_img_size;        // image file size in bytes

-    /* 
+    /*
     * Ventoy will write a copy of ventoy_image_location data into runtime memory
     * this is the physically address and length of that memory.
     * Address 0 means no such data exist.
@@ -114,7 +114,7 @@ typedef struct ventoy_os_param
    grub_uint64_t  vtoy_img_location_addr;
    grub_uint32_t  vtoy_img_location_len;

-    /* 
+    /*
     * These 32 bytes are reserved by ventoy.
     *
     * vtoy_reserved[0]: vtoy_break_level
@@ -125,6 +125,7 @@ typedef struct ventoy_os_param
     * vtoy_reserved[5]: vtoy_linux_remount
     * vtoy_reserved[6]: vtoy_vlnk
     * vtoy_reserved[7~10]: vtoy_disk_sig[4] used for vlnk
+     * vtoy_reserved[11]: vtoy_win_uefi_max_res
     *
     */
    grub_uint8_t   vtoy_reserved[32];    // Internal use by ventoy
@@ -155,8 +156,8 @@ typedef struct ventoy_windows_data
 typedef struct ventoy_secure_data
 {
    grub_uint8_t magic1[16];     /* VENTOY_GUID */
-    grub_uint8_t diskuuid[16];   
-    grub_uint8_t Checksum[16];    
+    grub_uint8_t diskuuid[16];
+    grub_uint8_t Checksum[16];
    grub_uint8_t adminSHA256[32];
    grub_uint8_t reserved[4000];
    grub_uint8_t magic2[16];     /* VENTOY_GUID */
@@ -200,7 +201,7 @@ typedef struct ventoy_chain_head
    grub_uint64_t virt_img_size_in_bytes;
    grub_uint32_t boot_catalog;
    grub_uint8_t  boot_catalog_sector[2048];
-    
+
    grub_uint32_t img_chunk_offset;
    grub_uint32_t img_chunk_num;

@@ -319,7 +320,7 @@ grub_uint64_t grub_udf_get_file_offset(grub_file_t file);
 grub_uint64_t grub_udf_get_last_pd_size_offset(void);
 grub_uint64_t grub_udf_get_last_file_attr_offset
 (
-    grub_file_t file, 
+    grub_file_t file,
    grub_uint32_t *startBlock,
    grub_uint64_t *fe_entry_size_offset
 );
@@ -0,0 +1,9 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+ventoy_copy_udev_auto_rules
@@ -0,0 +1,19 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+vtoy_udev_auto_hook() {
+    if grep -q 'break.*=.*postmount' /init; then
+        vtlog "udev auto before postmount"
+        sed "/break.*=.*postmount/i\\$BUSYBOX_PATH/sh $VTOY_PATH/hook/manjaro/ventoy-uauto-exec.sh"  -i /init
+    elif [ -d $VT_DRACUT_HOOKS/pre-pivot ]; then
+        vtlog "dracut distro"
+        ventoy_dracut_pivot_udev_rule
+    fi
+}
+
+vtoy_udev_auto_hook
@@ -20,6 +20,6 @@
 . $VTOY_PATH/hook/ventoy-os-lib.sh

 ventoy_set_inotify_script  blackPanther/ventoy-inotifyd-hook.sh
-$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/blackPanther/ventoy-inotifyd-start.sh /lib/dracut/hooks/pre-udev/00-ventoy-inotifyd-start.sh
+$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/blackPanther/ventoy-inotifyd-start.sh $VT_DRACUT_HOOKS/pre-udev/00-ventoy-inotifyd-start.sh

 $SED "s#printf\(.*\)\$CMDLINE#printf\1 root=/dev/ventoy \$CMDLINE root=/dev/ventoy#" -i /lib/dracut-lib.sh
@@ -0,0 +1,16 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+vtoy_udev_auto_hook() {
+    if [ -d $VT_DRACUT_HOOKS/pre-pivot ]; then
+        vtlog "dracut distro"
+        ventoy_dracut_pivot_udev_rule
+    fi
+}
+
+vtoy_udev_auto_hook
@@ -0,0 +1,19 @@
+
+find_cow_device() {
+    tgt_pers_label="${1}"
+    vt_pers_label=""
+    vt_pers_dev=""
+    
+    if [ -f /ventoy/ventoy_persistent_label -a -f /ventoy/ventoy_persistent_dev ]; then
+        vt_pers_label=$(cat /ventoy/ventoy_persistent_label)
+        vt_pers_dev=$(cat /ventoy/ventoy_persistent_dev)        
+    fi
+
+    if [ "$tgt_pers_label" = "$vt_pers_label" ]; then
+        echo "$vt_pers_dev"
+    else
+        find_cow_device_back "$@"
+    fi    
+}
+
+find_cow_device_back() {
@@ -31,6 +31,19 @@ if [ -e /init ] && $GREP -q '^mountroot$' /init; then
            $SED "s#^  *LIVEMEDIA=.*#LIVEMEDIA=/dev/mapper/ventoy#" -i /scripts/casper
        fi
    fi
+    
+    #workaround for issue #3718
+    if [ -f $VTOY_PATH/ventoy_persistent_map -a -f /scripts/casper-helpers ]; then
+        echo 'fix casper cow udev issue' >> $VTLOG
+        if $GREP -q '^find_cow_device\(\).*{' /scripts/casper-helpers; then
+            VTINS_LINE=$($GREP -n '^find_cow_device\(\).*{' /scripts/casper-helpers | $AWK -F':' '{print $1}')
+            $AWK "NR < $VTINS_LINE"  /scripts/casper-helpers  >  /ventoy/casper-helpers-tmp
+            $CAT $VTOY_PATH/hook/debian/casper-perst-wa.sh    >> /ventoy/casper-helpers-tmp
+            $AWK "NR > $VTINS_LINE" /scripts/casper-helpers   >> /ventoy/casper-helpers-tmp
+            $CAT /ventoy/casper-helpers-tmp > /scripts/casper-helpers
+        fi
+    fi
+    
 elif [ -e "$CD_DETECT" ]; then
    echo "$CD_DETECT exist, now add hook in it..." >> $VTLOG
    $SED  "1 a $BUSYBOX_PATH/sh $VTOY_PATH/hook/debian/disk_mount_hook.sh"  -i "$CD_DETECT"
@@ -36,19 +36,24 @@ if [ "$vtdiskname" = "unknown" ]; then
    exit 0
 fi

+if grep -q 'device-mapper' /proc/devices; then
+    vtlog "dm-mod already loaded"
+else
+    vtlog "dm-mod not loaded, get from squashfs"

-vtoydm -i -f $VTOY_PATH/ventoy_image_map -d $vtdiskname > $VTOY_PATH/iso_file_list
+    vtoydm -i -f $VTOY_PATH/ventoy_image_map -d $vtdiskname > $VTOY_PATH/iso_file_list

-vtline=$(grep '[-][-] drivers-.*\.squashfs'  $VTOY_PATH/iso_file_list)
-sector=$(echo $vtline | awk '{print $(NF-1)}')
-length=$(echo $vtline | awk '{print $NF}')
+    vtline=$(grep '[-][-] drivers-.*\.squashfs'  $VTOY_PATH/iso_file_list)
+    sector=$(echo $vtline | awk '{print $(NF-1)}')
+    length=$(echo $vtline | awk '{print $NF}')

-vtoydm -e -f $VTOY_PATH/ventoy_image_map -d $vtdiskname -s $sector -l $length -o $VTOY_PATH/driver.squashfs
-mount -t squashfs $VTOY_PATH/driver.squashfs /lib/modules
-modprobe dm-mod
+    vtoydm -e -f $VTOY_PATH/ventoy_image_map -d $vtdiskname -s $sector -l $length -o $VTOY_PATH/driver.squashfs
+    mount -t squashfs $VTOY_PATH/driver.squashfs /lib/modules
+    modprobe dm-mod

-umount /lib/modules
-rm -f $VTOY_PATH/driver.squashfs
+    umount /lib/modules
+    rm -f $VTOY_PATH/driver.squashfs
+fi

 ventoy_udev_disk_common_hook "${vtdiskname#/dev/}2" "noreplace"

@@ -33,11 +33,13 @@ echo "_vtRet1=$_vtRet1  _vtRet2=$_vtRet2 ..." >> $VTLOG

 if [ $_vtRet1 -ne 0 -a $_vtRet2 -eq 0 ]; then
    vtFindFlag=0
-    $GREP '`value from`' /usr/* -r | $AWK -F: '{print $1}' | while read vtline; do
+    $GREP '`value from`' /usr/* -r | $AWK -F: '{print $1}' > $VTOY_PATH/.porteus
+    while read vtline; do
        echo "hooking $vtline ..." >> $VTLOG
        $SED "s#\`value from\`#$vtPath#g"  -i $vtline
        vtFindFlag=1
-    done
+    done < $VTOY_PATH/.porteus
+    rm -f $VTOY_PATH/.porteus

    if [ $vtFindFlag -eq 0 ]; then
        if $GREP -q '`value from`' /linuxrc; then
@@ -17,5 +17,10 @@
 # 
 #************************************************************************************

+if $GREP -q 'rdinit=/vtoy/vtoy' /proc/cmdline; then
+    echo "fix rdinit" >> $VTLOG
+    $SED "/switch_root.*\/mnt\/.installer-mp/i\ sh $VTOY_PATH/hook/debian/pve-wa.sh /mnt/.installer-mp/sbin/unconfigured.sh" -i /init
+fi
+
 $SED "/\/sys\/block\/hd\*/i\ $BUSYBOX_PATH/sh $VTOY_PATH/hook/debian/pve-disk.sh"  -i /init
 $SED "s#/sys/block/hd\*#/sys/block/dm* /sys/block/hd*#"  -i /init
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+script=$1
+tmpscript=${script}.tmp
+
+LINE=$(grep -n 'proc.*proc.*proc' $script | awk -F':' '{print $1}')
+
+sed -n "1,${LINE}p" $script >> $tmpscript
+
+echo "if grep -q 'rdinit=/vtoy/vtoy' /proc/cmdline; then"    >> $tmpscript
+echo "    sed 's#rdinit=/vtoy/vtoy##g' /proc/cmdline > /etc/cmdline"    >> $tmpscript
+echo "    mount --bind /etc/cmdline  /proc/cmdline"    >> $tmpscript
+echo "fi"    >> $tmpscript
+
+
+let LINE++
+sed -n "${LINE},\$p" $script >> $tmpscript
+
+cat $tmpscript > $script
+
@@ -0,0 +1,11 @@
+[Unit]
+Description=Ventoy CloneZilla Device Cheat
+After=systemd-udevd.service
+
+[Service]
+Type=oneshot
+ExecStart=mv /dev/VTISOPART /dev/bk_VTISOPART
+ExecStart=cp -a /dev/DMXXX  /dev/VTISOPART
+
+[Install]
+WantedBy=sysinit.target
@@ -0,0 +1,3 @@
+[Unit]
+Wants=ventoy-curtin-wa.service
+After=ventoy-curtin-wa.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=Ventoy subiquity curtin Workaround
+
+[Service]
+Type=oneshot
+ExecStart=/etc/ventoy/ventoy-curtin-wa.sh
+PrivateMounts=no
+ProtectSystem=no
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+exec >> /var/log/ventoy-curtin-wa.log 2>&1
+set -x
+
+if [ -e /tmp/ventoy_storage_config.py ]; then
+    echo "no need to patch again"
+elif [ -d /snap/ubuntu-desktop-bootstrap/current/lib ]; then
+    PyVer=$(ls -1 /snap/ubuntu-desktop-bootstrap/current/lib | grep -m1 python)
+    echo "Python Path: $PyVer"
+
+    OldFile=/snap/ubuntu-desktop-bootstrap/current/lib/$PyVer/site-packages/curtin/storage_config.py
+    NewFile=/tmp/ventoy_storage_config.py
+
+    if [ -e $OldFile ]; then
+        echo "Patch curtin storage config script"
+        cp -a $OldFile $NewFile
+
+        #skip Ventoy dm device
+        sed 's#\(if *\(.*\)\[.MAJOR.\] *in *\["11", *"2"\]\)#\1 or re.match(r"[vV]entoy.*|vtoy.*", \2.get("DM_NAME") or "")#g' -i $NewFile
+        mount --bind $NewFile $OldFile
+    else
+        echo "curin file not exist"
+    fi
+else
+    echo "curin snap dir not exit"
+fi
@@ -58,6 +58,9 @@ ventoy_get_debian_distro() {
        if $GREP -q 'Tails' /etc/os-release; then
            echo 'tails'; return
        fi
+        if $GREP -q 'NAME="Kylin"' /etc/os-release; then
+            echo 'kylin'; return
+        fi
    fi

    if $GREP -q 'slax/' /proc/cmdline; then
@@ -0,0 +1,48 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+subiquity_curtin_workaround() {
+    mkdir -p /root/etc/ventoy
+    ventoy_copy_file /ventoy/hook/debian/ventoy-curtin-wa.sh        /root/etc/ventoy/ventoy-curtin-wa.sh       0755
+    ventoy_copy_file /ventoy/hook/debian/ventoy-curtin-wa.conf      /root/etc/ventoy/ventoy-curtin-wa.conf     0644
+    ventoy_copy_file /ventoy/hook/debian/ventoy-curtin-wa.service   /root/etc/ventoy/ventoy-curtin-wa.service  0644
+
+    ln -sf /etc/ventoy/ventoy-curtin-wa.service /root/etc/systemd/system/ventoy-curtin-wa.service
+
+    vtDepDir=/root/etc/systemd/system/snap.ubuntu-desktop-bootstrap.subiquity-server.service.d
+    mkdir -p $vtDepDir
+    ln -sf /etc/ventoy/ventoy-curtin-wa.conf $vtDepDir/10-ventoy-curtin-wa.conf
+}
+
+
+vroot=$(ventoy_new_root_dir)
+if [ -z "$vroot" ]; then
+    vtlog "new sysroot not found"
+else
+    ventoy_copy_udev_auto_rules
+    if ls $vroot/etc/udev/rules.d | grep -q 'snap.*desktop'; then
+        subiquity_curtin_workaround
+    else
+        vtlog "no snap desktop detected"
+    fi
+fi
+
+if [ -d $vroot/usr/share/clonezilla ]; then
+    vtlog "add cheat service for clonezilla"
+    
+    vtDM=$($VTOY_PATH/tool/dmsetup info VentoyPart | grep Major | sed "s/.*[^0-9]\([0-9][0-9]*\)$/\1/")
+    vtRAWDISKNAME=$(head -n1 $VTOY_PATH/ventoy_raw_table | awk '{print $4}')
+    
+    cp -a /ventoy/hook/debian/ventoy-clonezilla-cheat.service /ventoy/udevtmp.service
+    sed "s/DMXXX/dm-${vtDM}/g" -i /ventoy/udevtmp.service
+    sed "s/VTISOPART/${vtRAWDISKNAME#/dev/}/g" -i /ventoy/udevtmp.service
+
+    ventoy_copy_file /ventoy/udevtmp.service  $vroot/etc/systemd/system/ventoy-clonezilla-cheat.service  0644
+    echo 'enable ventoy-clonezilla-cheat.service' > $vroot/etc/systemd/system-preset/90-ventoy-clonezilla.preset
+    ln -sf /etc/systemd/system/ventoy-clonezilla-cheat.service $vroot/etc/systemd/system/sysinit.target.wants/ventoy-clonezilla-cheat.service
+fi
@@ -0,0 +1,36 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+vtoy_udev_auto_hook() {
+    if [ -e /etc/os-release ]; then
+        if grep -q 'ID=ubuntu' /etc/os-release; then
+            if egrep -q 'VERSION_ID=\"2[2-9]\.|VERSION_ID=\"3[0-9]\.' /etc/os-release; then
+                vtlog "ubuntu distro"
+                sed "/^mountroot$/a\\$BUSYBOX_PATH/sh $VTOY_PATH/hook/debian/ventoy-uauto-exec.sh"  -i /init
+                return
+            fi
+        fi
+    fi
+    
+    
+    if [ -e /init ]; then
+        if $GREP -q '^mountroot$' /init; then
+            vtlog "mountroot distro"
+            sed "/^mountroot$/a\\$BUSYBOX_PATH/sh $VTOY_PATH/hook/debian/ventoy-uauto-exec.sh"  -i /init
+            return            
+        fi
+        
+        if $GREP -q '^ *exec.*switch_root' /init; then
+            vtlog "switch_root distro"
+            sed "/^ *exec.*switch_root/i\\$BUSYBOX_PATH/sh $VTOY_PATH/hook/debian/ventoy-uauto-exec.sh"  -i /init
+            return
+        fi        
+    fi
+}
+
+vtoy_udev_auto_hook
@@ -17,19 +17,23 @@
 # 
 #************************************************************************************

+$CAT /proc/cmdline > /ventoy/cmdline
+$SED 's#live-media=[^ ]*#live-media=/dev/mapper/ventoy#g' -i /ventoy/cmdline

 if [ -e /init ] && $GREP -q '^mountroot$' /init; then
    echo "Here before mountroot ..." >> $VTLOG
    
    $SED  "/^mountroot$/i\\$BUSYBOX_PATH/sh $VTOY_PATH/hook/deepin/disk_mount_hook.sh"  -i /init
    $SED  "/^mountroot$/i\\export LIVEMEDIA=/dev/mapper/ventoy"  -i /init
-    $SED  "/^mountroot$/i\\export LIVE_MEDIA=/dev/mapper/ventoy"  -i /init    
+    $SED  "/^mountroot$/i\\export LIVE_MEDIA=/dev/mapper/ventoy"  -i /init
+
+    $SED "/mount *[-]t *proc/a\\mount --bind /ventoy/cmdline /proc/cmdline" -i /init   

    if $GREP -q 'live-media=' /proc/cmdline; then
        if [ -f /scripts/casper ] && $GREP -q '^  *LIVEMEDIA=' /scripts/casper; then
            $SED "s#^  *LIVEMEDIA=.*#LIVEMEDIA=/dev/mapper/ventoy#" -i /scripts/casper
-        fi
-    fi
+        fi        
+    fi           
 else
    echo "Here use udev hook ..." >> $VTLOG
    ventoy_systemd_udevd_work_around
@@ -0,0 +1,10 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+ventoy_copy_udev_auto_rules
+
@@ -0,0 +1,25 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+vtoy_udev_auto_hook() {
+    if [ -e /init ]; then
+        if $GREP -q '^mountroot$' /init; then
+            vtlog "mountroot distro"
+            sed "/^mountroot$/a\\$BUSYBOX_PATH/sh $VTOY_PATH/hook/deepin/ventoy-uauto-exec.sh"  -i /init
+            return            
+        fi
+        
+        if $GREP -q '^ *exec.*switch_root' /init; then
+            vtlog "switch_root distro"
+            sed "/^ *exec.*switch_root/i\\$BUSYBOX_PATH/sh $VTOY_PATH/hook/deepin/ventoy-uauto-exec.sh"  -i /init
+            return
+        fi        
+    fi
+}
+
+vtoy_udev_auto_hook
@@ -0,0 +1,12 @@
+ACTION=="add|change", SUBSYSTEM=="block", KERNEL=="dm-*", \
+    ENV{DM_NAME}=="[vV]entoy*", \
+    ENV{DM_UDEV_DISABLE_SUBSYSTEM_RULES_FLAG}="", \
+    ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="", \
+    ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=""
+
+ACTION=="add|change", SUBSYSTEM=="block", KERNEL=="dm-*", \
+    ENV{DM_NAME}=="vtoy*", \
+    ENV{DM_UDEV_DISABLE_SUBSYSTEM_RULES_FLAG}="", \
+    ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="", \
+    ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=""
+
@@ -0,0 +1,5 @@
+ACTION=="add|change", KERNEL=="dm-[0-9]*", ENV{DM_NAME}=="ventoy[0-9]*", \
+    ENV{DM_UDEV_DISABLE_SYBSYSTEM_RULES_FLAG}="", \
+    ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="", \
+    ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}="", \
+    IMPORT{program}="/ventoy/hook/default/ventoy-udev.sh $env{DM_NAME}"
@@ -0,0 +1,12 @@
+
+ACTION=="add|change", SUBSYSTEM=="block", KERNEL=="DMXXX", \
+    ENV{DM_UDEV_DISABLE_SUBSYSTEM_RULES_FLAG}="", \
+    ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}="", \
+    ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}="", \
+    ENV{UDISKS_SYSTEM}="0", \
+    ENV{UDISKS_REMOVABLE}="1", \
+    ENV{UDISKS_AUTO}="1", \
+    ENV{UDISKS_AUTOMOUNTABLE}="1"
+
+
+KERNEL=="yyy", SUBSYSTEM=="block", ENV{UDISKS_IGNORE}="1"
@@ -0,0 +1,14 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+vtlog "####### $0 $* ########"
+
+for vroot in sysroot newroot root; do
+    if [ -e $vroot/etc/selinux/config ]; then
+        $SED "s/SELINUX=enforcing/SELINUX=permissive/g" -i $vroot/etc/selinux/config
+        break
+    fi
+done
+
+$BUSYBOX_PATH/true
@@ -0,0 +1,9 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+vtlog "####### $0 $* ########"
+
+ventoy_copy_udev_auto_rules
+
+$BUSYBOX_PATH/true
@@ -0,0 +1,16 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+vtoy_udev_auto_hook() {
+    if [ -d $VT_DRACUT_HOOKS/pre-pivot ]; then
+        vtlog "dracut distro"
+        ventoy_dracut_pivot_udev_rule
+    fi
+}
+
+vtoy_udev_auto_hook
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+for i in 0 1 2 3 4 5 6 7 8 9; do
+    [ -b /dev/DMXXX ] && break
+    sleep 1
+done
+
+udevadm trigger --subsystem-match=block --sysname-match=DMXXX
+udevadm settle
@@ -0,0 +1,11 @@
+[Unit]
+Description=Ventoy DM device udev attributes
+After=systemd-udevd.service
+
+[Service]
+Type=oneshot
+ExecStart=-udevadm trigger --subsystem-match=block --sysname-match=DMXXX
+ExecStart=udevadm settle
+
+[Install]
+WantedBy=sysinit.target
@@ -0,0 +1,22 @@
+#!/bin/sh
+
+PATH=$PATH:/ventoy/busybox:/ventoy/tool
+
+echo "$@"  >> /ventoy/log
+
+VT_DMNAME=$1
+VT_PART_NUM="${VT_DMNAME#*ventoy}"
+VT_PARENT_DEV="/dev/mapper/ventoy"
+VT_PARTUUID=
+
+[ -b "$VT_PARENT_DEV" ] || exit 0
+
+VT_PARTUUID=$(/ventoy/tool/vtoygpt $VT_PARENT_DEV $VT_PART_NUM | awk '{print $2}')
+
+echo "$VT_DMNAME  PARTUUID=$VT_PARTUUID" >> /ventoy/log
+
+if [ -n "$VT_PARTUUID" ]; then
+    echo "ID_PART_ENTRY_UUID=$VT_PARTUUID"
+    echo "ID_PART_ENTRY_NUMBER=$VT_PART_NUM"
+    echo "ID_PART_ENTRY_SCHEME=gpt"
+fi
@@ -0,0 +1,24 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+vtlog "######### $0 $* ############"
+
+if is_ventoy_hook_finished; then
+    exit 0
+fi
+
+wait_for_usb_disk_ready
+
+vtdiskname=$(get_ventoy_disk_name)
+if [ "$vtdiskname" = "unknown" ]; then
+    vtlog "ventoy disk not found"
+    exit 0
+fi
+
+vtlog "vtdiskname=$vtdiskname"
+
+ventoy_udev_disk_common_hook "${vtdiskname#/dev/}2" "noreplace"
+
+# OK finish
+set_ventoy_hook_finish
@@ -0,0 +1,7 @@
+
+function ft_mountCdromDir()
+{
+    /ventoy/busybox/sh /ventoy/hook/euleros/disk_mount_hook.sh    
+    ft_mountCdromDirXX "$@"
+}
+
@@ -0,0 +1,42 @@
+#!/ventoy/busybox/sh
+#************************************************************************************
+# Copyright (c) 2020, longpanda <admin@ventoy.net>
+# 
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; either version 3 of the
+# License, or (at your option) any later version.
+# 
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, see <http://www.gnu.org/licenses/>.
+# 
+#************************************************************************************
+
+. $VTOY_PATH/hook/ventoy-os-lib.sh
+
+TRANSFILE=/usr/Euler/project/load/filetransfer.sh
+
+LINE=$($GREP -n 'function ft_mountCdromDir' $TRANSFILE | $AWK -F':' '{print $1}')
+
+echo "LINE=$LINE" >> $VTLOG
+
+$SED 's#FT_SR_DEV=.*#FT_SR_DEV=/dev/mapper/ventoy#g' -i $TRANSFILE
+$SED 's/function ft_mountCdromDir/function ft_mountCdromDirXX/' -i $TRANSFILE
+
+let LINE--
+$SED -n "1,${LINE}p" $TRANSFILE >> /ventoy/filetransfer.sh
+
+$CAT $VTOY_PATH/hook/euleros/hook_func.sh >> /ventoy/filetransfer.sh
+
+let LINE++
+$SED -n "${LINE},\$p" $TRANSFILE >> /ventoy/filetransfer.sh
+
+$BUSYBOX_PATH/mv /ventoy/filetransfer.sh $TRANSFILE
+
+#fix the euler os shell script
+$SED 's/-z ${harddisk_disk_list}/-z "${harddisk_disk_list}"/' -i /usr/Euler/project/disk/disk_tool.sh
@@ -0,0 +1,32 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+VTPATH_OLD=$PATH; PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+for i in 0 1 2 3 4 5 6 7 8 9; do 
+    vtdiskname=$(get_ventoy_disk_name)
+    if [ "$vtdiskname" = "unknown" ]; then
+        vtlog "wait for disk ..."
+        $SLEEP 2
+    else
+        break
+    fi
+done
+
+echo '############ Copy ISO file to memory ... ###############'
+
+vtoydm -C -f $VTOY_PATH/ventoy_image_map -d $vtdiskname -o $VTOY_PATH/dump.iso
+
+[ -d /ventoy/tmpmnt ] || mkdir /ventoy/tmpmnt
+
+mount /ventoy/dump.iso /ventoy/tmpmnt
+cp -a /ventoy/tmpmnt/*  $1/
+
+umount /ventoy/tmpmnt
+rm -f /ventoy/dump.iso
+
+echo '############ Copy ISO file to memory finished OK ###############'
+sleep 2
+
+PATH=$VTPATH_OLD
@@ -30,6 +30,9 @@ elif $GREP -q 'setting up the root filesystem' /init; then
 elif [ -d /etc/udev/rules.d ] || [ -d /lib/udev/rules.d ]; then    
    ventoy_systemd_udevd_work_around
    ventoy_add_udev_rule "$VTOY_PATH/hook/default/udev_disk_hook.sh %k noreplace"
+elif $GREP -q 'NVIDIA CORPORATION' /init; then
+    $SED "s/while true; do/while false; do/" -i /init
+    $SED "/^FOUNDDEV=/a\ $BUSYBOX_PATH/sh $VTOY_PATH/hook/gentoo/mats-hook.sh \"\${ROOTFS}/\${MNTNV}\""  -i /init
 else
    $SED "/mdev *-s/a\ $BUSYBOX_PATH/sh $VTOY_PATH/hook/gentoo/disk_hook.sh"  -i /init    
 fi
@@ -23,4 +23,4 @@ $SED "s#printf\(.*\)\$CMDLINE#printf\1\$CMDLINE root=live:/dev/mapper/ventoy#" -

 ventoy_set_inotify_script  gobo/ventoy-inotifyd-hook.sh

-$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/gobo/ventoy-inotifyd-start.sh /lib/dracut/hooks/pre-udev/01-ventoy-inotifyd-start.sh
+$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/gobo/ventoy-inotifyd-start.sh $VT_DRACUT_HOOKS/pre-udev/01-ventoy-inotifyd-start.sh
@@ -0,0 +1,16 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+vtoy_udev_auto_hook() {
+    if [ -d $VT_DRACUT_HOOKS/pre-pivot ]; then
+        vtlog "dracut distro"
+        ventoy_dracut_pivot_udev_rule
+    fi
+}
+
+vtoy_udev_auto_hook
@@ -0,0 +1,9 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+ventoy_copy_udev_auto_rules
@@ -0,0 +1,19 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+vtoy_udev_auto_hook() {
+    if grep -q 'break.*=.*postmount' /init; then
+        vtlog "udev auto before postmount"
+        sed "/break.*=.*postmount/i\\$BUSYBOX_PATH/sh $VTOY_PATH/hook/hyperbola/ventoy-uauto-exec.sh"  -i /init
+    elif [ -d $VT_DRACUT_HOOKS/pre-pivot ]; then
+        vtlog "dracut distro"
+        ventoy_dracut_pivot_udev_rule
+    fi
+}
+
+vtoy_udev_auto_hook
@@ -0,0 +1,9 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+ventoy_copy_udev_auto_rules
@@ -0,0 +1,25 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+vtoy_udev_auto_hook() {
+    if [ -e /init ]; then
+        if $GREP -q '^mountroot$' /init; then
+            vtlog "mountroot distro"
+            sed "/^mountroot$/a\\$BUSYBOX_PATH/sh $VTOY_PATH/hook/kaos/ventoy-uauto-exec.sh"  -i /init
+            return            
+        fi
+        
+        if $GREP -q '^ *exec.*switch_root' /init; then
+            vtlog "switch_root distro"
+            sed "/^ *exec.*switch_root/i\\$BUSYBOX_PATH/sh $VTOY_PATH/hook/kaos/ventoy-uauto-exec.sh"  -i /init
+            return
+        fi        
+    fi
+}
+
+vtoy_udev_auto_hook
@@ -24,4 +24,4 @@ $SED "s#printf\(.*\)\$CMDLINE#printf\1\$CMDLINE root=/dev/ventoy#" -i /lib/dracu
 $BUSYBOX_PATH/rm -f /usr/lib/systemd/system-generators/systemd-fstab-generator /lib/systemd/system-generators/systemd-fstab-generator

 ventoy_set_inotify_script  lunar/ventoy-inotifyd-hook.sh
-$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/lunar/ventoy-inotifyd-start.sh /lib/dracut/hooks/pre-udev/01-ventoy-inotifyd-start.sh
+$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/lunar/ventoy-inotifyd-start.sh $VT_DRACUT_HOOKS/pre-udev/01-ventoy-inotifyd-start.sh
@@ -23,7 +23,7 @@
 #ventoy_add_udev_rule "$VTOY_PATH/hook/mageia/udev_disk_hook.sh %k noreplace"

 ventoy_set_inotify_script  mageia/ventoy-inotifyd-hook.sh
-$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/mageia/ventoy-inotifyd-start.sh /lib/dracut/hooks/pre-udev/99-ventoy-inotifyd-start.sh
+$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/mageia/ventoy-inotifyd-start.sh $VT_DRACUT_HOOKS/pre-udev/99-ventoy-inotifyd-start.sh



@@ -0,0 +1,9 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+ventoy_copy_udev_auto_rules
@@ -0,0 +1,16 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+vtoy_udev_auto_hook() {
+    if grep -q 'break.*=.*postmount' /init; then
+        vtlog "udev auto before postmount"
+        sed "/break.*=.*postmount/i\\$BUSYBOX_PATH/sh $VTOY_PATH/hook/manjaro/ventoy-uauto-exec.sh"  -i /init
+    fi
+}
+
+vtoy_udev_auto_hook
@@ -93,9 +93,9 @@ else
    vtPriority=01
 fi

-$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/openEuler/ventoy-inotifyd-start.sh /lib/dracut/hooks/pre-udev/${vtPriority}-ventoy-inotifyd-start.sh
-$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/openEuler/ventoy-timeout.sh /lib/dracut/hooks/initqueue/timeout/${vtPriority}-ventoy-timeout.sh
-$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/openEuler/ventoy-repo.sh /lib/dracut/hooks/pre-pivot/99-ventoy-repo.sh
+$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/openEuler/ventoy-inotifyd-start.sh $VT_DRACUT_HOOKS/pre-udev/${vtPriority}-ventoy-inotifyd-start.sh
+$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/openEuler/ventoy-timeout.sh $VT_DRACUT_HOOKS/initqueue/timeout/${vtPriority}-ventoy-timeout.sh
+$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/openEuler/ventoy-repo.sh $VT_DRACUT_HOOKS/pre-pivot/99-ventoy-repo.sh

 if [ -f /sbin/dmsquash-live-root ]; then
    echo "patch /sbin/dmsquash-live-root ..." >> $VTLOG
@@ -109,5 +109,5 @@ fi


 if [ -f $VTOY_PATH/autoinstall ]; then
-    cp -a $VTOY_PATH/hook/openEuler/ventoy-autoexp.sh /lib/dracut/hooks/pre-mount/99-ventoy-autoexp.sh
+    cp -a $VTOY_PATH/hook/openEuler/ventoy-autoexp.sh $VT_DRACUT_HOOKS/pre-mount/99-ventoy-autoexp.sh
 fi
@@ -0,0 +1,16 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+vtoy_udev_auto_hook() {
+    if [ -d $VT_DRACUT_HOOKS/pre-pivot ]; then
+        vtlog "dracut distro"
+        ventoy_dracut_pivot_udev_rule
+    fi
+}
+
+vtoy_udev_auto_hook
@@ -72,6 +72,12 @@ ventoy_udev_disk_common_hook $* "noreplace"

 $BUSYBOX_PATH/mount $VTOY_DM_PATH /mnt/ventoy

+#fix Oracle Linux 6.9 install issue
+if $GREP -q -i 'Oracle Linux'  /mnt/ventoy/.discinfo; then
+    ln -s /mnt/ventoy  /mnt/source
+fi
+
+
 # 
 # We do a trick for rhel6 series here.
 # Use /dev/$vtCheatLoop and wapper it as a removable cdrom with bind mount.
@@ -24,7 +24,7 @@

 if [ -f $VTOY_PATH/autoinstall ]; then
    VTKS="inst.ks=file:$VTOY_PATH/autoinstall"
-    cp -a $VTOY_PATH/hook/rhel7/ventoy-autoexp.sh /lib/dracut/hooks/pre-mount/99-ventoy-autoexp.sh
+    cp -a $VTOY_PATH/hook/rhel7/ventoy-autoexp.sh $VT_DRACUT_HOOKS/pre-mount/99-ventoy-autoexp.sh
 else
    for vtParam in $($CAT /proc/cmdline); do
        if echo $vtParam | $GREP -q 'ks=file:/'; then
@@ -119,7 +119,7 @@ fi
 echo "vtNeedRepo=$vtNeedRepo" >> $VTLOG

 if [ "$vtNeedRepo" = "yes" ]; then
-    $BUSYBOX_PATH/cp -a $VTOY_PATH/hook/rhel7/ventoy-repo.sh /lib/dracut/hooks/pre-pivot/99-ventoy-repo.sh
+    $BUSYBOX_PATH/cp -a $VTOY_PATH/hook/rhel7/ventoy-repo.sh $VT_DRACUT_HOOKS/pre-pivot/99-ventoy-repo.sh
 fi


@@ -161,8 +161,8 @@ else
    vtPriority=01
 fi

-$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/rhel7/ventoy-inotifyd-start.sh /lib/dracut/hooks/pre-udev/${vtPriority}-ventoy-inotifyd-start.sh
-$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/rhel7/ventoy-timeout.sh /lib/dracut/hooks/initqueue/timeout/${vtPriority}-ventoy-timeout.sh
+$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/rhel7/ventoy-inotifyd-start.sh $VT_DRACUT_HOOKS/pre-udev/${vtPriority}-ventoy-inotifyd-start.sh
+$BUSYBOX_PATH/cp -a $VTOY_PATH/hook/rhel7/ventoy-timeout.sh $VT_DRACUT_HOOKS/initqueue/timeout/${vtPriority}-ventoy-timeout.sh


 if [ -e /sbin/dmsquash-live-root ]; then
@@ -178,7 +178,7 @@ fi
 #For Fedora CoreOS
 if $GREP -i -q 'fedora.*coreos' /etc/os-release; then
    $SED "s#isosrc=.*#isosrc=/dev/mapper/ventoy#" -i /lib/systemd/system-generators/live-generator
-    cp -a $VTOY_PATH/hook/rhel7/ventoy-make-link.sh /lib/dracut/hooks/pre-mount/99-ventoy-premount-mklink.sh
+    cp -a $VTOY_PATH/hook/rhel7/ventoy-make-link.sh $VT_DRACUT_HOOKS/pre-mount/99-ventoy-premount-mklink.sh
 fi


@@ -34,7 +34,7 @@ if is_inotify_ventoy_part $3; then
    vtlog "find ventoy partition ..."
    
    vtReplaceOpt=noreplace
-    if [ -f /lib/dracut/hooks/pre-pivot/99-ventoy-repo.sh ]; then
+    if [ -f $VT_DRACUT_HOOKS/pre-pivot/99-ventoy-repo.sh ]; then
        vtReplaceOpt=""
    fi
    
@@ -30,5 +30,5 @@ else
    
    #don't call it too early issue 2225
    #$BUSYBOX_PATH/sh $vtHook n /dev "${vtdisk#/dev/}2"
-    cp -a  $VTOY_PATH/hook/rhel7/ventoy-inotifyd-call.sh /lib/dracut/hooks/initqueue/settled/90-ventoy-inotifyd-call.sh   
+    cp -a  $VTOY_PATH/hook/rhel7/ventoy-inotifyd-call.sh $VT_DRACUT_HOOKS/initqueue/settled/90-ventoy-inotifyd-call.sh   
 fi
@@ -0,0 +1,27 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+vtoy_udev_auto_hook() {
+    if [ -e /etc/os-release ]; then
+        if grep -q 'ID=fedora' /etc/os-release; then
+            if grep -q 'VERSION_ID=[3-9][0-9]' /etc/os-release; then
+                vtlog "fedora distro"
+                ventoy_dracut_pivot_udev_rule
+                ventoy_dracut_pivot_selinux_off
+                return
+            fi
+        fi
+    fi
+
+    if [ -d $VT_DRACUT_HOOKS/pre-pivot ]; then
+        vtlog "dracut distro"
+        ventoy_dracut_pivot_udev_rule
+    fi
+}
+
+vtoy_udev_auto_hook
@@ -0,0 +1,16 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+vtlog "####### $0 $* ########"
+
+vtoy_udev_auto_hook() {
+    if [ -d $VT_DRACUT_HOOKS/pre-pivot ]; then
+        vtlog "dracut distro"
+        ventoy_dracut_pivot_udev_rule
+    fi
+}
+
+vtoy_udev_auto_hook
@@ -25,7 +25,19 @@ fi

 VTPATH_OLD=$PATH; PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH

-modprobe dm-mod
+vtlog "Loading dax and dm-mod module ..."
+$BUSYBOX_PATH/modprobe dax      > /dev/null 2>&1
+$BUSYBOX_PATH/modprobe dm-mod   > /dev/null 2>&1
+
+if $GREP -q 'device-mapper' /proc/devices; then
+    vtlog "dm-mod module check success ..."
+else
+    vtlog "Need to extract dax and dm-mod module ..."
+    $VTOY_PATH/tool/zstdcat /lib/modules/$(uname -r)/drivers/dax/dax.ko.zst > $VTOY_PATH/extract_dax.ko
+    $BUSYBOX_PATH/insmod $VTOY_PATH/extract_dax.ko
+    $VTOY_PATH/tool/zstdcat /lib/modules/$(uname -r)/drivers/md/dm-mod.ko.zst > $VTOY_PATH/extract_dm_mod.ko
+    $BUSYBOX_PATH/insmod $VTOY_PATH/extract_dm_mod.ko
+fi

 wait_for_usb_disk_ready

@@ -19,6 +19,8 @@

 . $VTOY_PATH/hook/ventoy-os-lib.sh

+$SED  "/Searching/i $BUSYBOX_PATH/sh $VTOY_PATH/hook/t2/disk_hook.sh"  -i /init
+$SED  "/disktype/i x=/dev/ventoy"  -i /init
 $SED  "/getdevice *devicefile/i $BUSYBOX_PATH/sh $VTOY_PATH/hook/t2/disk_hook.sh"  -i /init
 $SED  "/getdevice *devicefile/a devicefile=/dev/ventoy"  -i /init

@@ -32,6 +32,11 @@ VTOY_DM_PATH=/dev/mapper/ventoy
 VTOY_DEBUG_LEVEL=$($BUSYBOX_PATH/hexdump -n 1 -s 450 -e '1/1 "%02x"' $VTOY_PATH/ventoy_os_param)
 VTOY_LINUX_REMOUNT=$($BUSYBOX_PATH/hexdump -n 1 -s 454 -e '1/1 "%02x"' $VTOY_PATH/ventoy_os_param)
 VTOY_VLNK_BOOT=$($BUSYBOX_PATH/hexdump -n 1 -s 455 -e '1/1 "%02x"' $VTOY_PATH/ventoy_os_param)
+if [ -d /var/lib/dracut/hooks ]; then
+    VT_DRACUT_HOOKS=/var/lib/dracut/hooks
+else
+    VT_DRACUT_HOOKS=/lib/dracut/hooks
+fi

 if [ "$VTOY_DEBUG_LEVEL" = "01" ]; then
    if [ -e /dev/console ]; then
@@ -39,6 +44,7 @@ if [ "$VTOY_DEBUG_LEVEL" = "01" ]; then
    fi
 fi

+
 vtlog() {
    if [ "$VTLOG" = "$VTOY_PATH/log" ]; then
        echo "$*" >>$VTLOG
@@ -58,6 +64,14 @@ vterr() {
 }


+ventoy_copy_file() {
+    cp -a "$1" "$2"
+    if [ -n "$3" ]; then
+        chmod $3 "$2"
+    fi
+}
+
+
 is_ventoy_hook_finished() {
    [ -e $VTOY_PATH/hook_finish ]
 }
@@ -67,8 +81,11 @@ set_ventoy_hook_finish() {

    if [ -f /ventoy/ventoy_iso_part_dm_cmd ]; then
        echo "### create iso part raw dm" >> $VTLOG
-        $BUSYBOX_PATH/sh /ventoy/ventoy_iso_part_dm_cmd >>$VTLOG 2>&1
-        $BUSYBOX_PATH/rm -f /ventoy/ventoy_iso_part_dm_cmd
+        $CAT $VTOY_PATH/ventoy_raw_table >> $VTLOG
+        echo "### iso part dm cmd" >> $VTLOG
+        $CAT /ventoy/ventoy_iso_part_dm_cmd >> $VTLOG        
+        $BUSYBOX_PATH/sh /ventoy/ventoy_iso_part_dm_cmd >>$VTLOG 2>&1        
+        $BUSYBOX_PATH/mv /ventoy/ventoy_iso_part_dm_cmd  /ventoy/ventoy_iso_part_dm_cmd_bk
    fi
 }

@@ -159,17 +176,17 @@ ventoy_get_vblade_bin() {
    fi
 }

-ventoy_find_bin_path() {
+ventoy_find_bin_path() {        
+    #must use built-in dmsetup, so first try ventoy path. Otherwise ubuntu installer unhappy. #3567
    if $BUSYBOX_PATH/which "$1" > /dev/null; then
        $BUSYBOX_PATH/which "$1"; return
    fi
-    
    for vt_path in '/bin' '/sbin' '/usr/bin' '/usr/sbin' '/usr/local/bin' '/usr/local/sbin' '/root/bin'; do
        if [ -e "$vt_path/$1" ]; then
            echo "$vt_path/$1"; return
        fi
    done
-    
+
    echo ""
 }

@@ -264,9 +281,68 @@ create_ventoy_device_mapper() {
    else
        $VT_DM_BIN "$2" create ventoy $VTOY_PATH/ventoy_dm_table >>$VTLOG 2>&1
    fi
-    
+
    RAWDISKNAME=$($HEAD -n1 $VTOY_PATH/ventoy_raw_table | $AWK '{print $4}')    
-    echo "$VT_DM_BIN create ${RAWDISKNAME#/dev/}  $VTOY_PATH/ventoy_raw_table" > /ventoy/ventoy_iso_part_dm_cmd    
+    echo "$VT_DM_BIN create  VentoyPart  $VTOY_PATH/ventoy_raw_table"  >  /ventoy/ventoy_iso_part_dm_cmd
+    echo "echo 1 > $VTOY_PATH/ventoy_raw_dm_done"                      >> /ventoy/ventoy_iso_part_dm_cmd
+}
+
+create_ventoy_loop_device_mapper() {
+    vtLoop1=${1#/dev/}
+    vtLoop2=${2#/dev/}
+    
+    vtlog "create_ventoy_loop_device_mapper $*"
+    
+    VT_DM_BIN=$(ventoy_find_bin_path dmsetup)
+    if [ -z "$VT_DM_BIN" ]; then
+        vtlog "no dmsetup avaliable, lastly try inbox dmsetup"
+        VT_DM_BIN=$VTOY_PATH/tool/dmsetup
+    fi
+    
+    vtlog "dmsetup avaliable in system $VT_DM_BIN"
+
+    if ventoy_check_dm_module; then
+        vtlog "device-mapper module check success"
+    else
+        vterr "Error: no dm module avaliable"
+    fi
+
+    vtLoop2Size=$(cat /sys/block/$vtLoop2/size)
+    echo "0 65 linear $1 0" > $VTOY_PATH/ventoy_dm_table
+    echo "65 $vtLoop2Size linear $2 0" >> $VTOY_PATH/ventoy_dm_table
+
+    $VT_DM_BIN "--readonly" create ventoy $VTOY_PATH/ventoy_dm_table >>$VTLOG 2>&1
+}
+
+create_ventoy_wrapper_device_mapper() {
+    vtlog "create_ventoy_wrapper_device_mapper $*"
+    
+    VT_DM_BIN=$(ventoy_find_bin_path dmsetup)
+    if [ -z "$VT_DM_BIN" ]; then
+        vtlog "no dmsetup avaliable, lastly try inbox dmsetup"
+        VT_DM_BIN=$VTOY_PATH/tool/dmsetup
+    fi
+    
+    vtlog "dmsetup avaliable in system $VT_DM_BIN"
+
+    if ventoy_check_dm_module "$1"; then
+        vtlog "device-mapper module check success"
+    else
+        vterr "Error: no dm module avaliable"
+    fi
+    
+    $VTOY_PATH/tool/vtoydm -w -f $VTOY_PATH/ventoy_image_map -d $1 > $VTOY_PATH/ventoy_dm_table
+    
+    VT_LOOP_DEV=$(losetup -f)
+    losetup $VT_LOOP_DEV /ventoy/dmwrapper.bin
+    $SED "s#/dev/loop0#$VT_LOOP_DEV#" -i $VTOY_PATH/ventoy_dm_table
+
+
+    if [ -z "$2" ]; then
+        $VT_DM_BIN create ventoy $VTOY_PATH/ventoy_dm_table >>$VTLOG 2>&1
+    else
+        $VT_DM_BIN "$2" create ventoy $VTOY_PATH/ventoy_dm_table >>$VTLOG 2>&1
+    fi    
 }

 create_persistent_device_mapper() {
@@ -507,6 +583,9 @@ ventoy_create_persistent_link() {
        VTLABEL=casper-rw
    fi

+    echo "$VTLABEL" > $VTOY_PATH/ventoy_persistent_label
+    echo "/dev/$vtDM" > $VTOY_PATH/ventoy_persistent_dev
+
    vtlog "Persistent Label: ##${VTLABEL}##"

    if ! [ -e /dev/disk/by-label/$VTLABEL ]; then
@@ -576,13 +655,64 @@ ventoy_udev_disk_common_hook() {
    else
        ventoy_copy_device_mapper "/dev/$1"
    fi
-    
+
    if [ -f $VTOY_PATH/ventoy_persistent_map ]; then
        create_persistent_device_mapper "/dev/$VTDISK"
        ventoy_create_persistent_link
    fi    
 }

+ventoy_create_wrapper_dm() {
+    if echo $1 | $EGREP -q "nvme.*p[0-9]$|mmc.*p[0-9]$|nbd.*p[0-9]$"; then
+        VTDISK="${1:0:-2}"    
+    else
+        VTDISK="${1:0:-1}"
+    fi
+
+    if [ -e /vtoy/vtoy ]; then
+        VTRWMOD=""
+    else
+        VTRWMOD="--readonly"
+    fi
+    
+    # create device mapper for iso image file
+    if create_ventoy_wrapper_device_mapper "/dev/$VTDISK" $VTRWMOD; then
+        vtlog "==== create wrapper ventoy device mapper success ===="
+    else
+        vtlog "==== create wrapper ventoy device mapper failed ===="
+        
+        $SLEEP 3
+        
+        if $GREP -q "/dev/$VTDISK" /proc/mounts; then
+            $GREP "/dev/$VTDISK" /proc/mounts | while read vtLine; do
+                vtPart=$(echo $vtLine | $AWK '{print $1}')
+                vtMnt=$(echo $vtLine | $AWK '{print $2}')
+                vtlog "$vtPart is mounted on $vtMnt  now umount it ..."
+                $BUSYBOX_PATH/umount $vtMnt
+            done
+        fi
+        
+        if create_ventoy_wrapper_device_mapper "/dev/$VTDISK" $VTRWMOD; then
+            vtlog "==== create wrapper ventoy device mapper success after retry ===="
+        else
+            vtlog "==== create wrapper ventoy device mapper failed after retry ===="
+            return
+        fi
+    fi
+    
+    if [ "$2" = "noreplace" ]; then
+        vtlog "no need to replace block device"
+    else
+        ventoy_copy_device_mapper "/dev/$1"
+    fi
+    
+    if [ -f $VTOY_PATH/ventoy_persistent_map ]; then
+        create_persistent_device_mapper "/dev/$VTDISK"
+        ventoy_create_persistent_link
+    fi
+}
+
+
 ventoy_create_dev_ventoy_part() {   
    blkdev_num=$($VTOY_PATH/tool/dmsetup ls | $GREP ventoy | $SED 's/.*(\([0-9][0-9]*\),.*\([0-9][0-9]*\).*/\1 \2/')
    $BUSYBOX_PATH/mknod -m 0666 /dev/ventoy b $blkdev_num
@@ -602,6 +732,37 @@ ventoy_create_dev_ventoy_part() {
 }


+ventoy_remove_all_dm() {
+    if [ -e /vtoy_dm_table ]; then
+        vtPartid=1                        
+        $CAT /vtoy_dm_table | while read vtline; do            
+            vtlog "dmsetup remove ventoy${vtPartid}"
+            $VTOY_PATH/tool/dmsetup remove ventoy${vtPartid}
+            vtPartid=$(expr $vtPartid + 1)
+        done   
+    fi
+
+    vtlog "dmsetup remove ventoy"
+    $VTOY_PATH/tool/dmsetup remove ventoy >> $VTLOG 2>&1
+    rm -f /dev/ventoy*
+
+    if [ -e $VTOY_PATH/ventoy_raw_dm_done ]; then
+        vtlog "dmsetup remove VentoyPart"
+        $VTOY_PATH/tool/dmsetup remove VentoyPart
+        rm -f $VTOY_PATH/ventoy_iso_part_dm_cmd
+    fi
+
+    if [ -e $VTOY_PATH/persistent_dm_table ]; then
+        if $VTOY_PATH/tool/dmsetup ls | $GREP -qw vtoy_persistent; then
+            vtlog "dmsetup remove vtoy_persistent"
+            $VTOY_PATH/tool/dmsetup remove vtoy_persistent
+        else
+            vtlog "no need to remove DM vtoy_persistent"
+        fi
+    fi
+}
+
+
 ventoy_create_chromeos_ventoy_part() {   
    blkdev_num=$($VTOY_PATH/tool/dmsetup ls | $GREP ventoy | $SED 's/.*(\([0-9][0-9]*\),.*\([0-9][0-9]*\).*/\1 \2/')
    $BUSYBOX_PATH/mknod -m 0666 /dev/ventoy b $blkdev_num
@@ -719,3 +880,212 @@ ventoy_wait_dir() {
        fi
    done
 }
+
+ventoy_load_iso_part_fs_ko() {
+    vtFS=$($VTOY_PATH/tool/vtoydump -s /ventoy/ventoy_os_param)
+    vtlog "ISO part FS is $vtFS"
+    
+    for vtModProbe in /usr/sbin/modprobe /sbin/modprobe /bin/modprobe $BUSYBOX_PATH/modprobe; do
+        if [ -e $vtModProbe ]; then
+            break
+        fi
+    done
+    
+    vtlog "modprobe is $vtModProbe"
+    
+    if [ "$vtFS" = "ext" ]; then    
+        vtlog "modprobe ext2/3/4"
+        $vtModProbe ext2 >> $VTLOG 2>&1
+        $vtModProbe ext3 >> $VTLOG 2>&1
+        $vtModProbe ext4 >> $VTLOG 2>&1
+    elif [ "$vtFS" = "ntfs" ]; then
+        vtlog "modprobe ntfs3"
+        $vtModProbe ntfs3 >> $VTLOG 2>&1
+    elif [ "$vtFS" = "fat" ]; then
+        vtlog "modprobe vfat"
+        $vtModProbe vfat   >> $VTLOG 2>&1      
+    else
+        vtlog "modprobe $vtFS"
+        $vtModProbe $vtFS  >> $VTLOG 2>&1
+    fi
+}
+
+
+ventoy_iso_part_fs_supported() {
+    vtFS=$($VTOY_PATH/tool/vtoydump -s /ventoy/ventoy_os_param)    
+    if [ "$vtFS" = "ext" ]; then
+        vtPattern='ext[2-4]'
+    elif [ "$vtFS" = "fat" ]; then
+        vtPattern='vfat'
+    elif [ "$vtFS" = "ntfs" ]; then
+        vtPattern='ntfs3'
+    else
+        vtPattern="$vtFS"
+    fi
+    
+    vtlog "vtFS=$vtFS Pattern=$vtPattern"
+    if $EGREP -q "$vtPattern" /proc/filesystems; then
+        vtlog "ISO part FS supported OK"
+        $BUSYBOX_PATH/true
+    else
+        vtlog "ISO part FS is NOT supported"
+        $BUSYBOX_PATH/false
+    fi
+}
+
+ventoy_mount_iso_part() {
+    vtDisk=$1
+    vtMnt=$2
+
+    vtlog "mount iso partition $vtDisk"
+
+    if [ -z "$vtMnt" ]; then
+        vtMnt=$VTOY_PATH/tmpmnt
+    fi
+    
+    mkdir -p $vtMnt
+
+    if echo $vtDisk | $EGREP -q "nvme|mmc|nbd"; then
+        vtpart1=${vtDisk}p1
+    else
+        vtpart1=${vtDisk}1
+    fi
+
+    vtFS=$($VTOY_PATH/tool/vtoydump -s /ventoy/ventoy_os_param)    
+    if [ "$vtFS" = "ntfs" ]; then
+        vtlog "mount -t ntfs3 $vtpart1 $vtMnt"
+        mount -t ntfs3 $vtpart1 $vtMnt >> $VTLOG 2>&1
+    elif [ "$vtFS" = "fat" ]; then
+        vtlog "mount -t vfat $vtpart1 $vtMnt"
+        mount -t vfat $vtpart1 $vtMnt >> $VTLOG 2>&1
+    else
+        vtlog "mount $vtpart1 $vtMnt"
+        mount $vtpart1 $vtMnt >> $VTLOG 2>&1
+    fi
+}
+
+
+ventoy_losetup_iso() {
+    vtMnt=$1
+    if [ -z "$vtMnt" ]; then
+        vtMnt=$VTOY_PATH/tmpmnt
+    fi 
+
+    for vtLosetup in /usr/sbin/losetup /sbin/losetup /bin/losetup $BUSYBOX_PATH/losetup; do
+        if [ -e $vtLosetup ]; then
+            break
+        fi
+    done
+
+    vtisoname=$(get_ventoy_iso_name)    
+
+    dd if=/dev/zero of=/ventoy/isoheader.bin bs=512 count=1 >/dev/null 2>&1
+    dd if="${vtMnt}${vtisoname}" bs=512 skip=1 count=64 >>/ventoy/isoheader.bin  2>>/dev/null
+
+    vtfreeloop1=$($vtLosetup -f)
+    if $vtLosetup -r $vtfreeloop1 /ventoy/isoheader.bin >> $VTLOG 2>&1; then    
+        vtfreeloop2=$($vtLosetup -f)
+        if $vtLosetup -r --offset=33280 $vtfreeloop2 "${vtMnt}${vtisoname}" >> $VTLOG 2>&1; then
+            echo -n "$vtfreeloop1 $vtfreeloop2" > /ventoy/vtoy_dm_loop_dev
+        fi
+    fi
+}
+
+
+ventoy_mount_iso() {
+    if [ "$1" = "ko" ]; then
+        shift
+        ventoy_load_iso_part_fs_ko
+    fi
+    if ventoy_iso_part_fs_supported; then
+        if ventoy_mount_iso_part $1; then
+            if ventoy_losetup_iso; then
+                create_ventoy_loop_device_mapper $($CAT /ventoy/vtoy_dm_loop_dev)
+                return
+            else
+                vtlog "losetup ISO file FAILED"
+            fi
+        else
+            vtlog "mount iso partition FAILED"
+        fi
+    fi
+
+    $BUSYBOX_PATH/false
+}
+
+ventoy_init_udev_auto_rules() {
+    ventoy_copy_file /ventoy/hook/default/11-ventoy-dm.rules  /etc/udev/rules.d/11-ventoy-dm.rules  0644
+}
+
+ventoy_new_root_dir() {
+    for vroot in sysroot newroot new_root root live/aufs pup_new; do
+        if [ -d $vroot/etc/udev/rules.d ]; then
+            echo "$vroot"
+            return
+        fi
+    done
+    echo ''
+}
+
+ventoy_copy_udev_auto_rules() {
+    if ! [ -e $VTOY_PATH/ventoy_raw_dm_done ]; then
+        vtlog "ventoy_raw_dm_done not exist, no need for udev auto rule"
+        return
+    fi
+
+    vtlog "==== Copy udev auto rules ===="
+    vroot=$(ventoy_new_root_dir)
+    if [ -z "$vroot" ]; then
+        vtlog "no new root found"
+        return
+    else
+        vtlog "new root is $vroot"
+    fi
+
+    
+    cp -a /ventoy/hook/default/90-ventoy-auto.rules /ventoy/udevtmp.rules        
+    vtDM=$($VTOY_PATH/tool/dmsetup info VentoyPart | $GREP Major | $SED "s/.*[^0-9]\([0-9][0-9]*\)$/\1/")
+    $SED "s/DMXXX/dm-${vtDM}/g" -i /ventoy/udevtmp.rules
+
+    vtRAWDISKNAME=$($HEAD -n1 $VTOY_PATH/ventoy_raw_table | $AWK '{print $4}')
+    $SED "s/yyy/${vtRAWDISKNAME#/dev/}/g" -i /ventoy/udevtmp.rules
+
+    vtlog "VentoyPart is /dev/dm-${vtDM} map to $vtRAWDISKNAME  NewRoot is $vroot"
+
+    ventoy_copy_file /ventoy/udevtmp.rules  $vroot/etc/udev/rules.d/90-ventoy-auto.rules  0644
+    ventoy_copy_file /ventoy/udevtmp.rules  $vroot/etc/udev/rules.d/11-ventoy-auto.rules  0644
+
+    if $GREP -q 'init=.*sysvinit' /proc/cmdline; then
+        vtlog "copy sysvinit udev trigger script"        
+        cp -a /ventoy/hook/default/ventoy-udev-trigger.rc /ventoy/udevtmp.rc
+        $SED "s/DMXXX/dm-${vtDM}/g" -i /ventoy/udevtmp.rc
+
+        mkdir -p $vroot/etc/boot.d        
+        ventoy_copy_file /ventoy/udevtmp.rc  $vroot/etc/boot.d/S01-ventoy-udev-trigger  0755
+    elif [ -d $vroot/etc/systemd/system ]; then
+        vtlog "copy systemd udev trigger service"
+        
+        mkdir -p $vroot/etc/systemd/system/sysinit.target.wants
+        cp -a /ventoy/hook/default/ventoy-udev-trigger.service /ventoy/udevtmp.service
+        $SED "s/DMXXX/dm-${vtDM}/g" -i /ventoy/udevtmp.service
+        ventoy_copy_file /ventoy/udevtmp.service  $vroot/etc/systemd/system/ventoy-udev-trigger.service  0644
+        
+        mkdir -p $vroot/etc/systemd/system-preset
+        echo 'enable ventoy-udev-trigger.service' > $vroot/etc/systemd/system-preset/80-ventoy-udev.preset
+
+        $BUSYBOX_PATH/ln -sf /etc/systemd/system/ventoy-udev-trigger.service $vroot/etc/systemd/system/sysinit.target.wants/ventoy-udev-trigger.service
+    else
+        vtlog "sysinit wants dir not exist"
+    fi
+}
+
+ventoy_dracut_pivot_udev_rule() {
+    echo "#!/bin/sh" > $VT_DRACUT_HOOKS/pre-pivot/99-ventoy-udev-rules.sh
+    echo "/ventoy/busybox/sh $VTOY_PATH/hook/default/ventoy-pivot-udev-rule.sh" >> $VT_DRACUT_HOOKS/pre-pivot/99-ventoy-udev-rules.sh
+}
+
+ventoy_dracut_pivot_selinux_off() {
+    echo "#!/bin/sh" > $VT_DRACUT_HOOKS/pre-pivot/99-ventoy-selinux-off.sh
+    echo "/ventoy/busybox/sh $VTOY_PATH/hook/default/ventoy-pivot-selinux-off.sh" >> $VT_DRACUT_HOOKS/pre-pivot/99-ventoy-selinux-off.sh
+}
+
@@ -22,6 +22,13 @@ VT_PRINTK_LEVEL=0
 VT_UDEV_RULE_FILE_NAME="99-ventoy.rules"
 VT_UDEV_RULE_PREFIX="ACTION==\"add\", SUBSYSTEM==\"block\","

+
+if [ -d /var/lib/dracut/hooks ]; then
+    VT_DRACUT_HOOKS=/var/lib/dracut/hooks
+else
+    VT_DRACUT_HOOKS=/lib/dracut/hooks
+fi
+
 ventoy_close_printk() {
    VT_PRINTK_LEVEL=$($CAT /proc/sys/kernel/printk | $AWK '{print $1}')
    if [ -e /proc/sys/kernel/printk ]; then
@@ -56,6 +63,14 @@ ventoy_get_udev_conf_path() {
    echo "$VT_RULE_DIR/$VT_UDEV_RULE_FILE_NAME"
 }

+ventoy_add_udev_auto_rule() {
+    VT_RULE_DIR=$(ventoy_get_udev_conf_dir)    
+    cp -a $VTOY_PATH/hook/default/90-ventoy-auto.rules $VT_RULE_DIR/11-ventoy-auto.rules
+    cp -a $VTOY_PATH/hook/default/90-ventoy-auto.rules $VT_RULE_DIR/90-ventoy-auto.rules
+    chmod 0644 $VT_RULE_DIR/*ventoy*
+}
+
+
 ventoy_add_kernel_udev_rule() {
    VT_UDEV_RULE_PATH=$(ventoy_get_udev_conf_path)
    echo "KERNEL==\"$1\", $VT_UDEV_RULE_PREFIX RUN+=\"$2\"" >> $VT_UDEV_RULE_PATH
@@ -171,3 +186,8 @@ ventoy_iso_scan_check() {
    
    [ $vtCheckOk -eq 1 ]
 }
+
+ventoy_wrapper_dracut_hook() {
+    echo "#/bin/sh" > $2
+    echo "$BUSYBOX_PATH/sh $1" >> $2    
+}
@@ -0,0 +1,119 @@
+#!/ventoy/busybox/sh
+#************************************************************************************
+# Copyright (c) 2020, longpanda <admin@ventoy.net>
+# 
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; either version 3 of the
+# License, or (at your option) any later version.
+# 
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, see <http://www.gnu.org/licenses/>.
+# 
+#************************************************************************************
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+if is_ventoy_hook_finished; then
+    exit 0
+fi
+
+vtlog "####### $0 $* ########"
+
+VTPATH_OLD=$PATH; PATH=$BUSYBOX_PATH:$VTOY_PATH/tool:$PATH
+
+wait_for_usb_disk_ready
+
+vtdiskname=$(get_ventoy_disk_name)
+if [ "$vtdiskname" = "unknown" ]; then
+    vtlog "ventoy disk not found"
+    exit 0
+fi
+
+/usr/bin/insmod  $VTOY_PATH/modules/dm-mod.ko*
+
+ventoy_udev_disk_common_hook "${vtdiskname#/dev/}2" "noreplace"
+ventoy_create_dev_ventoy_part
+
+
+mkdir -p /ventoy/tmpmnt
+mount /dev/ventoy3 /ventoy/tmpmnt
+mount --bind /ventoy/tmpmnt/lib/modules   /lib/modules
+
+for mod in loop iso9660 ntfs ntfs3 exfat ext2 ext3 ext4 xfs btrfs; do
+    vtlog "modprobe $mod"
+    /usr/bin/modprobe $mod >> $VTLOG 2>&1
+done
+
+umount /lib/modules
+umount /ventoy/tmpmnt
+
+ventoy_remove_all_dm
+
+
+vtimgname=$(get_ventoy_iso_name)
+if [ "$vtimgname" = "unknown" -o -z "$vtimgname" ]; then
+    vterr "image file path not found"
+    exit 0
+fi
+
+if echo "$vtdiskname" | $EGREP -q "nvme|mmc|nbd"; then
+    vtdatapart=${vtdiskname}p1
+else
+    vtdatapart=${vtdiskname}1
+fi
+
+# rw: the holo hook mounts the image rootfs rw
+mkdir -p /run/ventoy-media
+
+if mount "$vtdatapart" /run/ventoy-media >>$VTLOG 2>&1; then    
+    vtlog "mounted $vtdatapart at /run/ventoy-media OK"
+    mount | grep ventoy >>$VTLOG 2>&1    
+else
+    vtlog "mounted $vtdatapart at /run/ventoy-media failed"
+    exit 0
+fi
+
+
+vtimgfile="/run/ventoy-media${vtimgname}"
+if ! [ -f "$vtimgfile" ]; then
+    vterr "$vtimgfile not found on data partition"
+    umount /run/ventoy-media >>$VTLOG 2>&1
+    exit 0
+fi
+
+
+vtloopdev=$(losetup -f)
+if [ -z "$vtloopdev" ]; then
+    vterr "no free loop device"
+    exit 0
+fi
+
+if ! losetup -P "$vtloopdev" "$vtimgfile" >>$VTLOG 2>&1; then
+    vterr "losetup $vtloopdev $vtimgfile failed"
+    exit 0
+fi
+vtlog "attached $vtimgfile to $vtloopdev"
+
+vtloop=0
+while ! [ -e "${vtloopdev}p2" ]; do
+    let vtloop=vtloop+1
+    if [ $vtloop -gt 10 ]; then
+        break
+    fi
+    $SLEEP 0.3
+done
+
+# exact /dev path avoids PARTLABEL/LABEL/UUID collisions with an installed SteamOS
+if [ -e "${vtloopdev}p2" ]; then
+    ln -s "${vtloopdev}p2" /dev/steamos-media-efi
+    vtlog "/dev/steamos-media-efi -> ${vtloopdev}p2"
+else
+    vterr "${vtloopdev}p2 not created, partition scan failed"
+fi
+
@@ -0,0 +1,33 @@
+#!/ventoy/busybox/sh
+#************************************************************************************
+# Copyright (c) 2020, longpanda <admin@ventoy.net>
+# 
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; either version 3 of the
+# License, or (at your option) any later version.
+# 
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, see <http://www.gnu.org/licenses/>.
+# 
+#************************************************************************************
+
+. $VTOY_PATH/hook/ventoy-os-lib.sh
+
+# inject the disk hook before the run_hook phase of the stock mkinitcpio /init
+# if $GREP -q "run_hookfunctions 'run_hook' 'hook'" /init; then
+    # echo "insert ventoy-disk.sh before run_hook" >> $VTLOG
+    # $SED "/run_hookfunctions 'run_hook' 'hook'/i\\$BUSYBOX_PATH/sh $VTOY_PATH/loop/steamos/ventoy-disk-new.sh" -i /init
+# else
+    # echo "run_hook anchor not found in /init" >> $VTLOG
+# fi
+
+
+$SED "s/udev /udev ventoy /g" -i /config
+
+cp -a $VTOY_PATH/loop/steamos/ventoy.hook /hooks/ventoy
@@ -0,0 +1,16 @@
+#!/usr/bin/ash
+
+run_earlyhook() {
+    :
+}
+
+run_hook() {
+    msg ":: Ventoy hook..."    
+    /ventoy/busybox/sh /ventoy/loop/steamos/ventoy-disk.sh    
+}
+
+run_cleanuphook() {
+    :
+}
+
+# vim: set ft=sh ts=4 sw=4 et:
@@ -100,7 +100,11 @@ ventoy_get_os_type() {
        echo 'rhel7'; return

    elif $GREP -q 'euleros' /proc/version; then
-        echo 'rhel7'; return
+        if [ -d /usr/Euler/project/init ]; then
+            echo 'euleros'; return
+        else
+            echo 'rhel7'; return
+        fi

    # SUSE
    elif $GREP -q 'SUSE' /proc/version; then
@@ -169,7 +173,7 @@ ventoy_get_os_type() {
            echo 'debian'; return
        elif $GREP -q 'Solus' /etc/os-release; then
            echo 'rhel7'; return
-        elif $GREP -q 'openEuler' /etc/os-release; then
+        elif $GREP -q -i 'openEuler' /etc/os-release; then
            echo 'openEuler'; return
        elif $GREP -q 'fuyu' /etc/os-release; then
            echo 'openEuler'; return
@@ -177,6 +181,10 @@ ventoy_get_os_type() {
            echo 'deepin'; return
        elif $GREP -q 'chinauos' /etc/os-release; then
            echo 'deepin'; return
+        elif $GREP -qi 'aerynos' /etc/os-release; then
+            echo 'rhel7'; return
+        elif $GREP -qi 'ID_LIKE=debian' /etc/os-release; then
+            echo 'debian'; return
        fi
    fi
    
@@ -312,8 +320,8 @@ ventoy_get_os_type() {
    fi
    
    
-    if [ -e /init ]; then
-        if $GREP -q -m1 'T2 SDE' /init; then
+    if [ -e /etc/initrd-release ]; then
+        if $GREP -q -m1 't2sde' /etc/initrd-release; then
            echo 't2'; return
        fi
    fi
@@ -373,6 +381,13 @@ ventoy_get_os_type() {
            echo 'openEuler'; return
        fi
    fi
+    if [ -f /etc/kylin-release ]; then
+        if $GREP -i -q -m1 'Kylin.*Server.* V1[1-9] ' /etc/kylin-release; then
+            echo 'openEuler'; return
+        fi
+    fi
+
+
    
    if $GREP -q 'chimera' /proc/version; then
        echo 'chimera'; return
@@ -391,7 +406,10 @@ ventoy_get_os_type() {
        fi
    fi
    
-    
+    if [ -f /scripts/casper ]; then
+        echo "debian"; return
+    fi
+
    echo "default"
 }

@@ -400,6 +418,9 @@ echo "OS=###${VTOS}###" >>$VTLOG
 if [ -e "$VTOY_PATH/hook/$VTOS/ventoy-hook.sh" ]; then
    $BUSYBOX_PATH/sh "$VTOY_PATH/hook/$VTOS/ventoy-hook.sh"
 fi
+if [ -e "$VTOY_PATH/hook/$VTOS/ventoy-uauto-hook.sh" ]; then
+    $BUSYBOX_PATH/sh "$VTOY_PATH/hook/$VTOS/ventoy-uauto-hook.sh"
+fi



@@ -425,7 +446,11 @@ fi
 #                                                                  #
 ####################################################################
 if [ -f "/live_injection_7ed136ec_7a61_4b54_adc3_ae494d5106ea/hook.sh" ]; then
-    $BUSYBOX_PATH/sh "/live_injection_7ed136ec_7a61_4b54_adc3_ae494d5106ea/hook.sh" $VTOS
+    echo "==== Begin Call live injection hook.sh $VTOS" >> $VTLOG
+    $BUSYBOX_PATH/sh "/live_injection_7ed136ec_7a61_4b54_adc3_ae494d5106ea/hook.sh" $VTOS  >>$VTLOG 2>&1
+    echo "==== Finish Call live injection hook.sh $VTOS" >> $VTLOG
+else
+    echo "No live injection" >> $VTLOG
 fi


@@ -43,7 +43,7 @@ done
 #                                                                  #
 ####################################################################
 $BUSYBOX_PATH/mkdir -p /ventoy/modules
-$BUSYBOX_PATH/ls -1a / | $EGREP '\.ko$|\.ko.[gx]z$' | while read vtline; do
+$BUSYBOX_PATH/ls -1a / | $EGREP '\.ko$|\.ko.[gx]z$|\.ko.zst$' | while read vtline; do
    if [ "${vtline:0:1}" = "." ]; then
        $BUSYBOX_PATH/mv /${vtline} /ventoy/modules/${vtline:1}
    else
@@ -205,7 +205,7 @@ ventoy_get_os_type() {
            echo 'debian'; return
        elif $GREP -q 'Solus' /etc/os-release; then
            echo 'rhel7'; return
-        elif $GREP -q 'openEuler' /etc/os-release; then
+        elif $GREP -q -i 'openEuler' /etc/os-release; then
            echo 'openEuler'; return
        elif $GREP -q 'fuyu' /etc/os-release; then
            echo 'openEuler'; return
@@ -344,8 +344,8 @@ ventoy_get_os_type() {
    fi
    
    
-    if [ -e /init ]; then
-        if $GREP -q -m1 'T2 SDE' /init; then
+    if [ -e /etc/initrd-release ]; then
+        if $GREP -q -m1 't2sde' /etc/initrd-release; then
            echo 't2'; return
        fi
    fi
--- a/Show More
+++ b/Show More