1.1.14

Fix the secure boot issue.
1.1.13 release
2026-06-29 06:28:13 +00:00 · 2026-06-24 20:55:20 +08:00 · 2026-06-24 20:52:56 +08:00 · 2026-06-24 18:41:35 +08:00 · 2026-06-24 18:41:24 +08:00 · 2026-06-24 18:41:03 +08:00
80 changed files with 3356 additions and 1317 deletions
--- a/BLOB_List.md
+++ b/BLOB_List.md
@@ -46,132 +46,132 @@
        <tr> <td>./IMG/cpio_x86/ventoy/tool/zstdcat</td> <td>build</td>  <td>Same with ./ZSTD/zstdcat<br/>Check the file hash to confirm</td>    </tr>
        <tr> <td>./IMG/cpio_x86/ventoy/tool/zstdcat64</td> <td>build</td>  <td>Same with ./ZSTD/zstdcat64<br/>Check the file hash to confirm</td>    </tr>
        <tr> <td>./INSTALL/EFI/BOOT/BOOTAA64.EFI</td> <td rowspan=4>build</td>  <td rowspan=4>Build Instructions:<br/> ./DOC/BuildVentoyFromSource.txt 4.1-Build grub2</td>                                     </tr>        
-        <tr> <td>./INSTALL/EFI/BOOT/BOOTMIPS.EFI</td>     
-        <tr> <td>./INSTALL/EFI/BOOT/grubia32_real.efi</td>
-        <tr> <td>./INSTALL/EFI/BOOT/grubx64_real.efi</td>
-        <tr> <td>./INSTALL/EFI/BOOT/grub.efi</td> <td rowspan=6>upstream</td>    <td rowspan=6>https://github.com/ValdikSS/Super-UEFIinSecureBoot-Disk </td>      </tr>        
-        <tr> <td>./INSTALL/EFI/BOOT/BOOTIA32.EFI</td> 
-        <tr> <td>./INSTALL/EFI/BOOT/BOOTX64.EFI</td> 
-        <tr> <td>./INSTALL/EFI/BOOT/grubia32.efi</td>
-        <tr> <td>./INSTALL/EFI/BOOT/mmia32.efi</td>
-        <tr> <td>./INSTALL/EFI/BOOT/MokManager.efi</td>
+        <tr> <td>./INSTALL/EFI/BOOT/BOOTMIPS.EFI</td>     </tr>
+        <tr> <td>./INSTALL/EFI/BOOT/grubia32_real.efi</td></tr>
+        <tr> <td>./INSTALL/EFI/BOOT/grubx64_real.efi</td></tr>
+        <tr> <td>./INSTALL/EFI/BOOT/BOOTIA32.EFI</td> <td rowspan=3>upstream</td>    <td rowspan=3>https://github.com/ValdikSS/Super-UEFIinSecureBoot-Disk </td>      </tr>        
+        <tr> <td>./INSTALL/EFI/BOOT/grubia32.efi</td></tr>
+        <tr> <td>./INSTALL/EFI/BOOT/mmia32.efi</td></tr>        
+        <tr> <td>./INSTALL/EFI/BOOT/BOOTX64.EFI</td> <td rowspan=2>upstream</td>    <td rowspan=2>From Rocky Linux 9.8 x86_64 ISO file<br/>Check the file hash to confirm </td>      </tr>        
+        <tr> <td>./INSTALL/EFI/BOOT/mmx64.efi</td></tr>        
        <tr> <td>./INSTALL/tool/aarch64/ash</td> <td rowspan=12>build</td>    <td rowspan=12>Build Instructions:<br/>./DOC/BUSYBOX/build.txt</td>    </tr>
-        <tr> <td>./INSTALL/tool/aarch64/hexdump</td>
-        <tr> <td>./INSTALL/tool/aarch64/xzcat</td>
-        <tr> <td>./INSTALL/tool/i386/ash</td>
-        <tr> <td>./INSTALL/tool/i386/hexdump</td>
-        <tr> <td>./INSTALL/tool/i386/xzcat</td>
-        <tr> <td>./INSTALL/tool/mips64el/ash</td>
-        <tr> <td>./INSTALL/tool/mips64el/hexdump</td>
-        <tr> <td>./INSTALL/tool/mips64el/xzcat</td>
-        <tr> <td>./INSTALL/tool/x86_64/ash</td>
-        <tr> <td>./INSTALL/tool/x86_64/hexdump</td>
-        <tr> <td>./INSTALL/tool/x86_64/xzcat</td>
+        <tr> <td>./INSTALL/tool/aarch64/hexdump</td></tr>
+        <tr> <td>./INSTALL/tool/aarch64/xzcat</td></tr>
+        <tr> <td>./INSTALL/tool/i386/ash</td></tr>
+        <tr> <td>./INSTALL/tool/i386/hexdump</td></tr>
+        <tr> <td>./INSTALL/tool/i386/xzcat</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/ash</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/hexdump</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/xzcat</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/ash</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/hexdump</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/xzcat</td></tr>
        <tr> <td>./INSTALL/tool/aarch64/Ventoy2Disk.gtk3</td> <td rowspan=6>build</td>    <td rowspan=6>Build Instructions:<br/>./LinuxGUI/build_gtk.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.gtk3</td>
-        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.gtk2</td>
-        <tr> <td>./INSTALL/tool/mips64el/Ventoy2Disk.gtk3</td>
-        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.gtk3</td>
-        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.gtk2</td>
+        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.gtk3</td></tr>
+        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.gtk2</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/Ventoy2Disk.gtk3</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.gtk3</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.gtk2</td></tr>
        <tr> <td>./INSTALL/tool/aarch64/Ventoy2Disk.qt5</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./LinuxGUI/build_qt.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.qt5</td>
-        <tr> <td>./INSTALL/tool/mips64el/Ventoy2Disk.qt5</td>
-        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.qt5</td>
+        <tr> <td>./INSTALL/tool/i386/Ventoy2Disk.qt5</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/Ventoy2Disk.qt5</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/Ventoy2Disk.qt5</td></tr>
        <tr> <td>./INSTALL/tool/aarch64/Plugson</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./Plugson/build.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/Plugson</td>
-        <tr> <td>./INSTALL/tool/mips64el/Plugson</td>
-        <tr> <td>./INSTALL/tool/x86_64/Plugson</td>
+        <tr> <td>./INSTALL/tool/i386/Plugson</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/Plugson</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/Plugson</td></tr>
        <tr> <td>./INSTALL/tool/aarch64/V2DServer</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./LinuxGUI/build.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/V2DServer</td>
-        <tr> <td>./INSTALL/tool/mips64el/V2DServer</td>
-        <tr> <td>./INSTALL/tool/x86_64/V2DServer</td>
+        <tr> <td>./INSTALL/tool/i386/V2DServer</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/V2DServer</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/V2DServer</td></tr>
        <tr> <td>./INSTALL/tool/aarch64/mkexfatfs</td> <td rowspan=9>build</td>    <td rowspan=8>Build Instructions:<br/>./DOC/BuildVentoyFromSource.txt 4.9<br/>./ExFAT/buidexfat.sh<br/>./ExFAT/buidexfat_aarch64.sh<br/>./ExFAT/buidlibfuse.sh<br/>./ExFAT/buidlibfuse_aarch64.sh<br/></td>    </tr>
-        <tr> <td>./INSTALL/tool/aarch64/mount.exfat-fuse</td>
-        <tr> <td>./INSTALL/tool/i386/mkexfatfs</td>
-        <tr> <td>./INSTALL/tool/i386/mount.exfat-fuse</td>
-        <tr> <td>./INSTALL/tool/mips64el/mkexfatfs</td>
-        <tr> <td>./INSTALL/tool/mips64el/mount.exfat-fuse</td>
-        <tr> <td>./INSTALL/tool/x86_64/mkexfatfs</td>
-        <tr> <td>./INSTALL/tool/x86_64/mkexfatfs_static</td>
-        <tr> <td>./INSTALL/tool/x86_64/mount.exfat-fuse</td>    
+        <tr> <td>./INSTALL/tool/aarch64/mount.exfat-fuse</td></tr>
+        <tr> <td>./INSTALL/tool/i386/mkexfatfs</td></tr>
+        <tr> <td>./INSTALL/tool/i386/mount.exfat-fuse</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/mkexfatfs</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/mount.exfat-fuse</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/mkexfatfs</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/mkexfatfs_static</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/mount.exfat-fuse</td>   </tr> 
        <tr> <td>./INSTALL/tool/aarch64/vlnk</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./Vlnk/build.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/vlnk</td>
-        <tr> <td>./INSTALL/tool/mips64el/vlnk</td>
-        <tr> <td>./INSTALL/tool/x86_64/vlnk</td>
+        <tr> <td>./INSTALL/tool/i386/vlnk</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/vlnk</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/vlnk</td></tr>
        <tr> <td>./INSTALL/tool/aarch64/vtoycli</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./vtoycli/build.sh</td>    </tr>
-        <tr> <td>./INSTALL/tool/i386/vtoycli</td>
-        <tr> <td>./INSTALL/tool/mips64el/vtoycli</td>
-        <tr> <td>./INSTALL/tool/x86_64/vtoycli</td>
+        <tr> <td>./INSTALL/tool/i386/vtoycli</td></tr>
+        <tr> <td>./INSTALL/tool/mips64el/vtoycli</td></tr>
+        <tr> <td>./INSTALL/tool/x86_64/vtoycli</td></tr>
        <tr> <td>./INSTALL/ventoy/imdisk/32/imdisk.cpl</td>  <td rowspan=6>upstream</td>  <td rowspan=6>Download from imdisk project.<br/>URL & File Hash documented in<br/> ./DOC/BuildVentoyFromSource.txt 5.8</td>      </tr>
-        <tr> <td>./INSTALL/ventoy/imdisk/32/imdisk.exe</td>
-        <tr> <td>./INSTALL/ventoy/imdisk/32/imdisk.sys</td>
-        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.cpl</td>
-        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.exe</td>
-        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.sys</td>
+        <tr> <td>./INSTALL/ventoy/imdisk/32/imdisk.exe</td></tr>
+        <tr> <td>./INSTALL/ventoy/imdisk/32/imdisk.sys</td></tr>
+        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.cpl</td></tr>
+        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.exe</td></tr>
+        <tr> <td>./INSTALL/ventoy/imdisk/64/imdisk.sys</td></tr>
        <tr> <td>./INSTALL/ventoy/iso9660_aa64.efi</td> <td rowspan=6>build</td>    <td rowspan=6>Build Instructions:<br/>./DOC/BuildVentoyFromSource.txt 4.17</td>    </tr>
-        <tr> <td>./INSTALL/ventoy/udf_aa64.efi</td>
-        <tr> <td>./INSTALL/ventoy/iso9660_ia32.efi</td>
-        <tr> <td>./INSTALL/ventoy/udf_ia32.efi</td>
-        <tr> <td>./INSTALL/ventoy/iso9660_x64.efi</td>
-        <tr> <td>./INSTALL/ventoy/udf_x64.efi</td>
+        <tr> <td>./INSTALL/ventoy/udf_aa64.efi</td></tr>
+        <tr> <td>./INSTALL/ventoy/iso9660_ia32.efi</td></tr>
+        <tr> <td>./INSTALL/ventoy/udf_ia32.efi</td></tr>
+        <tr> <td>./INSTALL/ventoy/iso9660_x64.efi</td></tr>
+        <tr> <td>./INSTALL/ventoy/udf_x64.efi</td></tr>
        <tr> <td>./INSTALL/VentoyGUI.aarch64</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./LinuxGUI/build_gtk.sh</td>    </tr>
-        <tr> <td>./INSTALL/VentoyGUI.i386</td>
-        <tr> <td>./INSTALL/VentoyGUI.mips64el</td>
-        <tr> <td>./INSTALL/VentoyGUI.x86_64</td>
+        <tr> <td>./INSTALL/VentoyGUI.i386</td></tr>
+        <tr> <td>./INSTALL/VentoyGUI.mips64el</td></tr>
+        <tr> <td>./INSTALL/VentoyGUI.x86_64</td></tr>
        <tr> <td>./INSTALL/Ventoy2Disk.exe</td> <td rowspan=4>build</td>    <td rowspan=4>Build Instructions:<br/>./Ventoy2Disk/Ventoy2Disk.sln</td>    </tr>
-        <tr> <td>./INSTALL/Ventoy2Disk_ARM.exe</td>
-        <tr> <td>./INSTALL/Ventoy2Disk_ARM64.exe</td>
-        <tr> <td>./INSTALL/Ventoy2Disk_X64.exe</td>
+        <tr> <td>./INSTALL/Ventoy2Disk_ARM.exe</td></tr>
+        <tr> <td>./INSTALL/Ventoy2Disk_ARM64.exe</td></tr>
+        <tr> <td>./INSTALL/Ventoy2Disk_X64.exe</td></tr>
        <tr> <td>./INSTALL/ventoy/vtoyjump32.exe</td> <td rowspan=2>build</td>    <td rowspan=2>Build Instructions:<br/>./vtoyjump/vtoyjump.sln</td>    </tr>
-        <tr> <td>./INSTALL/ventoy/vtoyjump64.exe</td>
-        <tr> <td>./INSTALL/ventoy/ventoy_aa64.efi</td>  <td rowspan=6>build</td>  <td rowspan=6>Build Instructions:<br/>./EDK2/buildedk.sh</td>    </tr>
-        <tr> <td>./INSTALL/ventoy/ventoy_ia32.efi</td>
-        <tr> <td>./INSTALL/ventoy/ventoy_x64.efi</td>
-        <tr> <td>./INSTALL/ventoy/vtoyutil_aa64.efi</td>
-        <tr> <td>./INSTALL/ventoy/vtoyutil_ia32.efi</td>
-        <tr> <td>./INSTALL/ventoy/vtoyutil_x64.efi</td>
+        <tr> <td>./INSTALL/ventoy/vtoyjump64.exe</td></tr>
+        <tr> <td>./INSTALL/ventoy/ventoy_aa64.efi</td>  <td rowspan=7>build</td>  <td rowspan=7>Build Instructions:<br/>./EDK2/buildedk.sh</td>    </tr>
+        <tr> <td>./INSTALL/ventoy/ventoy_ia32.efi</td></tr>
+        <tr> <td>./INSTALL/ventoy/ventoy_x64.efi</td></tr>
+        <tr> <td>./INSTALL/ventoy/vtoyutil_aa64.efi</td></tr>
+        <tr> <td>./INSTALL/ventoy/vtoyutil_ia32.efi</td></tr>
+        <tr> <td>./INSTALL/ventoy/vtoyutil_x64.efi</td></tr>
+        <tr> <td>./INSTALL/EFI/BOOT/fbx64.efi</td></tr>
        <tr> <td>./INSTALL/ventoy/ipxe.krn</td> <td>build</td>  <td>Build Instructions:<br/>./IPXE/buildipxe.sh</td>    </tr>
        <tr> <td>./INSTALL/ventoy/memdisk</td> <td>upstream</td>  <td>Download from syslinux project.<br/>URL & File Hash documented in<br/> ./DOC/BuildVentoyFromSource.txt 5.9</td>      </tr>        
        <tr> <td>./LiveCD/ISO/EFI/boot/vmlinuz64</td> <td>upstream</td>  <td>Download from TinyLinux website.<br/>URL & File Hash documented in<br/> ./DOC/BuildVentoyFromSource.txt 5.14</td>      </tr>
        <tr> <td>./LiveCDGUI/EXT/busybox-x86_64</td> <td>build</td>  <td>Same with ./IMG/cpio_x86/ventoy/busybox/busybox64<br/>Check the file hash to confirm</td>    </tr>
        <tr> <td>./LiveCDGUI/GRUB/bootx64.efi</td> <td rowspan=2>build</td>  <td rowspan=2>./DOC/BuildVentoyFromSource.txt 4.1-Build grub2</td>    </tr>
-        <tr> <td>./LiveCD/GRUB/bootx64.efi</td>
+        <tr> <td>./LiveCD/GRUB/bootx64.efi</td></tr>
        <tr> <td>./LZIP/lunzip32</td> <td rowspan=3>build</td>  <td rowspan=3>Build Instructions:<br/>./DOC/BuildVentoyFromSource.txt 4.19</td>    </tr>
-        <tr> <td>./LZIP/lunzip64</td>
-        <tr> <td>./LZIP/lunzipaa64</td>
+        <tr> <td>./LZIP/lunzip64</td></tr>
+        <tr> <td>./LZIP/lunzipaa64</td></tr>
        <tr> <td>./LZIP/lz4cat64</td> <td rowspan=3>build</td>  <td rowspan=3>Build Instructions:<br/>./LZIP/buildlz4.txt</td>    </tr>
-        <tr> <td>./LZIP/lz4cataa64</td>
-        <tr> <td>./LZIP/lz4catm64e</td>
+        <tr> <td>./LZIP/lz4cataa64</td></tr>
+        <tr> <td>./LZIP/lz4catm64e</td></tr>
        <tr> <td>./Plugson/vs/VentoyPlugson/Release/VentoyPlugson.exe</td> <td rowspan=2>build</td>    <td rowspan=2>Build Instructions:<br/>./Plugson/vs/VentoyPlugson/VentoyPlugson.sln</td>    </tr>
-        <tr> <td>./Plugson/vs/VentoyPlugson/x64/Release/VentoyPlugson_X64.exe</td>
+        <tr> <td>./Plugson/vs/VentoyPlugson/x64/Release/VentoyPlugson_X64.exe</td></tr>
        <tr> <td>./SQUASHFS/unsquashfs_32</td> <td rowspan=3>build</td>    <td rowspan=3>Build Instructions:<br/>./SQUASHFS/build.sh</td>    </tr>
-        <tr> <td>./SQUASHFS/unsquashfs_64</td>
-        <tr> <td>./SQUASHFS/unsquashfs_aa64</td>
+        <tr> <td>./SQUASHFS/unsquashfs_64</td></tr>
+        <tr> <td>./SQUASHFS/unsquashfs_aa64</td></tr>
        <tr> <td>./Unix/ventoy_unix/DragonFly/sbin/dmsetup</td> <td>upstream</td>   <td>Get from DragonFly ISO.<br/>URL & File Hash documented in<br/> ./DOC/BuildVentoyFromSource.txt 5.13</td>      </tr>
        <tr> <td>./Unix/ventoy_unix/DragonFly/sbin/init</td> <td>build</td>    <td>Build Instructions:<br/>./Unix/ventoy_unix_src/DragonFly/build.sh</td>    </tr>
        <tr> <td>./VBLADE/vblade-master/vblade_32</td> <td rowspan=3>build</td>    <td rowspan=3>Build Instructions:<br/>./VBLADE/vblade-master/build.sh</td>    </tr>
-        <tr> <td>./VBLADE/vblade-master/vblade_64</td>
-        <tr> <td>./VBLADE/vblade-master/vblade_aa64</td>
+        <tr> <td>./VBLADE/vblade-master/vblade_64</td></tr>
+        <tr> <td>./VBLADE/vblade-master/vblade_aa64</td></tr>
        <tr> <td>./Vlnk/vs/VentoyVlnk/Release/VentoyVlnk.exe</td> <td>build</td>     <td>Build Instructions:<br/>./Vlnk/vs/VentoyVlnk/VentoyVlnk.sln</td>    </tr>
        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_32</td> <td rowspan=6>build</td>    <td rowspan=6>Build Instructions:<br/>./VtoyTool/build.sh</td>    </tr>
-        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_64</td>
-        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_aa64</td>
-        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_m64e</td>
-        <tr> <td>./VtoyTool/vtoytool/01/vtoytool_64</td>
-        <tr> <td>./VtoyTool/vtoytool/02/vtoytool_64</td>
+        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_64</td></tr>
+        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_aa64</td></tr>
+        <tr> <td>./VtoyTool/vtoytool/00/vtoytool_m64e</td></tr>
+        <tr> <td>./VtoyTool/vtoytool/01/vtoytool_64</td></tr>
+        <tr> <td>./VtoyTool/vtoytool/02/vtoytool_64</td></tr>
        <tr> <td>./ZSTD/zstdcat</td> <td rowspan=3>build</td>    <td rowspan=3>Build Instructions:<br/>./ZSTD/build.txt</td>    </tr>
-        <tr> <td>./ZSTD/zstdcat64</td>
-        <tr> <td>./ZSTD/zstdcataa64</td>
+        <tr> <td>./ZSTD/zstdcat64</td></tr>
+        <tr> <td>./ZSTD/zstdcataa64</td></tr>
        <tr> <td>./IMG/cpio_x86/ventoy/busybox/busybox32</td> <td rowspan=6>build</td>    <td rowspan=6>Build Instructions:<br/>./BUSYBOX/build.txt full busybox</td>    </tr>
-        <tr> <td>./IMG/cpio_x86/ventoy/busybox/busybox64</td>
-        <tr> <td>./IMG/cpio_x86/ventoy/busybox/xzcat32_musl</td>
-        <tr> <td>./IMG/cpio_x86/ventoy/busybox/xzcat64_musl</td>
-        <tr> <td>./IMG/cpio_arm64/ventoy/busybox/busyboxaa64</td>
-        <tr> <td>./IMG/cpio_mips64/ventoy/busybox/busyboxm64e</td>          
+        <tr> <td>./IMG/cpio_x86/ventoy/busybox/busybox64</td></tr>
+        <tr> <td>./IMG/cpio_x86/ventoy/busybox/xzcat32_musl</td></tr>
+        <tr> <td>./IMG/cpio_x86/ventoy/busybox/xzcat64_musl</td></tr>
+        <tr> <td>./IMG/cpio_arm64/ventoy/busybox/busyboxaa64</td></tr>
+        <tr> <td>./IMG/cpio_mips64/ventoy/busybox/busyboxm64e</td> </tr>         
        <tr> <td>ISNTALL/ventoy/7z/64/7za.exe</td>  <td rowspan=2>upstream</td>  <td>Download from 7z project.<br/>URL & File Hash documented in<br/> ./DOC/BuildVentoyFromSource.txt 5.12</td>      </tr>
-        <tr> <td>ISNTALL/ventoy/7z/32/7za.exe</td>  
+        <tr> <td>ISNTALL/ventoy/7z/32/7za.exe</td></tr>  
        <tr> <td>./INSTALL/ventoy/wimboot.i386.efi</td> <td rowspan=2>build</td>    <td rowspan=2>Build Instructions:<br/>./wimboot/build.sh</td>    </tr>
-        <tr> <td>./INSTALL/ventoy/wimboot.x86_64</td>        
+        <tr> <td>./INSTALL/ventoy/wimboot.x86_64</td></tr>        
        <tr> <td> ./Unix/ventoy_unix/ClonOS/geom_ventoy_ko/13.x/64/geom_ventoy.ko</td> <td rowspan=18>build</td>    <td rowspan=18>Build Instructions:<br/>./Unix/BuildUnixKmod.txt</td>    </tr>
        <tr> <td> ./Unix/ventoy_unix/FreeBSD/geom_ventoy_ko/10.x/32/geom_ventoy.ko</td></tr>
        <tr> <td> ./Unix/ventoy_unix/FreeBSD/geom_ventoy_ko/10.x/64/geom_ventoy.ko</td></tr>
--- a/EDK2/build_shim.sh
+++ b/EDK2/build_shim.sh
@@ -0,0 +1,55 @@
+#!/bin/sh
+
+if [ -z "$1" ]; then
+    EDKARCH=X64
+    postfix=x64
+elif [ "$1" = "ia32" ]; then
+    EDKARCH=IA32
+    postfix=ia32
+    shift
+elif [ "$1" = "aa64" ]; then
+    EDKARCH=AARCH64
+    postfix=aa64
+    shift
+fi
+
+cd edk2-edk2-stable201911
+
+rm -rf ./Conf/.cache
+rm -f ./Conf/.AutoGenIdFile.txt
+
+VTEFI_PATH=Build/MdeModule/RELEASE_GCC48/$EDKARCH/MdeModulePkg/Application/VtoyShim/VtoyShim/OUTPUT/VtoyShim.efi
+DST_PATH=../../INSTALL/EFI/BOOT/fb${postfix}.efi
+
+
+rm -f $VTEFI_PATH
+rm -f $DST_PATH
+
+unset WORKSPACE
+source ./edksetup.sh
+
+if [ "$EDKARCH" = "AARCH64" ]; then    
+    PATH=$PATH:/opt/gcc-linaro-7.4.1-2019.02-x86_64_aarch64-linux-gnu/bin \
+    GCC48_AARCH64_PREFIX=aarch64-linux-gnu- \
+    build -p MdeModulePkg/MdeModulePkg.dsc -a $EDKARCH -b RELEASE -t GCC48  -m MdeModulePkg/Application/VtoyShim/VtoyShim.inf
+else
+    build -p MdeModulePkg/MdeModulePkg.dsc -a $EDKARCH -b RELEASE -t GCC48  -m MdeModulePkg/Application/VtoyShim/VtoyShim.inf
+fi
+
+if [ -e $VTEFI_PATH ]; then
+    objcopy \
+        --add-section .sbat="MdeModulePkg/Application/VtoyShim/sbat.csv" \
+        --set-section-flags .sbat=alloc,load,readonly,data \
+        "$VTEFI_PATH" "$DST_PATH"
+        
+    objcopy --adjust-section-vma .sbat=0x1000 "$DST_PATH"
+
+    echo -e '\n\n====================== SUCCESS ========================\n\n'    
+
+    cd ..
+else
+    echo -e '\n\n====================== FAILED ========================\n\n'
+    cd ..
+    exit 1
+fi
+
--- a/EDK2/buildedk.sh
+++ b/EDK2/buildedk.sh
@@ -19,3 +19,7 @@ sh ./build.sh aa64 || exit 1
 echo '======== build EDK2 for x86_64-efi ==============='
 sh ./build.sh      || exit 1

+
+echo '======== build EDK2 for x86_64-efi ==============='
+sh ./build_shim.sh      || exit 1
+
--- a/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/Ventoy/Ventoy.c
+++ b/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/Ventoy/Ventoy.c
@@ -1231,6 +1231,32 @@ EFI_STATUS EFIAPI ventoy_boot(IN EFI_HANDLE ImageHandle)
    return EFI_SUCCESS;
 }

+#if defined (MDE_CPU_X64)
+STATIC BOOLEAN EFIAPI CheckVtoyShim(VOID)
+{
+    UINT8 SecureBoot = 0;
+	UINTN DataSize;
+	EFI_STATUS Status;
+    EFI_GUID Guid = VTOY_SHIM_POLICY_GUID;
+    VOID *Prot = NULL;
+
+	DataSize = sizeof(SecureBoot);
+	Status = gST->RuntimeServices->GetVariable(L"SecureBoot", &gEfiGlobalVariableGuid, NULL,
+				     &DataSize, &SecureBoot);
+	if (!EFI_ERROR(Status) && SecureBoot)
+    {
+        Status = gBS->LocateProtocol(&Guid, NULL, (VOID**)&Prot);
+        if (EFI_ERROR(Status))
+        {
+            VtoyDebug("Failed to locate Vtoy Shim Protocol %lx\r\n", Status);
+            return FALSE;
+        }
+    }
+
+    return TRUE;
+}
+#endif
+
 EFI_STATUS EFIAPI VentoyEfiMain
 (
    IN EFI_HANDLE         ImageHandle,
@@ -1240,6 +1266,15 @@ EFI_STATUS EFIAPI VentoyEfiMain
    EFI_STATUS Status = EFI_SUCCESS;
    EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL *Protocol;

+#if defined (MDE_CPU_X64)
+    /* check that Ventoy Shim must exist */
+    if (!CheckVtoyShim())
+    {
+        sleep(5);
+        return EFI_NOT_FOUND;
+    }
+#endif
+
    g_sector_flag_num = 512; /* initial value */

    g_sector_flag = AllocatePool(g_sector_flag_num * sizeof(ventoy_sector_flag));
@@ -1263,9 +1298,9 @@ EFI_STATUS EFIAPI VentoyEfiMain
        return Status;
    }

-    if (g_os_param_reserved[11] == 1)
+    if (g_os_param_reserved[11])
    {
-        ventoy_lock_max_res();
+        ventoy_lock_res(g_os_param_reserved[11]);
    }

    ventoy_disable_ex_filesystem();
@@ -1346,9 +1381,9 @@ EFI_STATUS EFIAPI VentoyEfiMain

    ventoy_enable_ex_filesystem();

-    if (g_os_param_reserved[11] == 1)
+    if (g_os_param_reserved[11])
    {
-        ventoy_unlock_max_res();
+        ventoy_unlock_res();
    }

    return EFI_SUCCESS;
--- a/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/Ventoy/Ventoy.h
+++ b/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/Ventoy/Ventoy.h
@@ -23,6 +23,8 @@

 #define COMPILE_ASSERT(expr)  extern char __compile_assert[(expr) ? 1 : -1]

+#define VTOY_SHIM_POLICY_GUID    {0x90a29d14, 0x3968, 0x48fe, { 0x85, 0x81, 0x6b, 0x7f, 0x7d, 0xc4, 0x70, 0x55 }};
+
 #define VENTOY_GUID { 0x77772020, 0x2e77, 0x6576, { 0x6e, 0x74, 0x6f, 0x79, 0x2e, 0x6e, 0x65, 0x74 }}

 typedef enum ventoy_chain_type
@@ -428,8 +430,8 @@ EFI_STATUS ventoy_hook_1st_cdrom_start(VOID);
 EFI_STATUS ventoy_hook_1st_cdrom_stop(VOID);
 EFI_STATUS ventoy_disable_ex_filesystem(VOID);
 EFI_STATUS ventoy_enable_ex_filesystem(VOID);
-EFI_STATUS ventoy_lock_max_res(VOID);
-EFI_STATUS ventoy_unlock_max_res(VOID);
+EFI_STATUS ventoy_lock_res(UINT8 LockType);
+EFI_STATUS ventoy_unlock_res(VOID);

 #endif

--- a/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/Ventoy/Ventoy.inf
+++ b/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/Ventoy/Ventoy.inf
@@ -25,6 +25,10 @@
  ENTRY_POINT                    = VentoyEfiMain

  
+[BuildOptions]
+  # Force standard GNU ld to pack and align ELF segments to 4KB page boundaries
+  GCC:*_*_*_DLINK_FLAGS = -Wl,-z,common-page-size=0x1000 -Wl,-z,max-page-size=0x1000
+
 [Sources]
  Ventoy.h
  Ventoy.c
--- a/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/Ventoy/VentoyProtocol.c
+++ b/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/Ventoy/VentoyProtocol.c
@@ -1804,7 +1804,7 @@ EFI_STATUS ventoy_hook_1st_cdrom_stop(VOID)
 #endif


-STATIC UINT32 g_org_mode_num;
+STATIC UINT32 g_org_mode_num = 0;
 STATIC EFI_GRAPHICS_OUTPUT_PROTOCOL_SET_MODE  g_org_set_mode = NULL;

 STATIC EFI_STATUS EFIAPI ventoy_set_mode
@@ -1820,13 +1820,38 @@ STATIC EFI_STATUS EFIAPI ventoy_set_mode
    return EFI_SUCCESS;
 }

-EFI_STATUS ventoy_lock_max_res(VOID)
+STATIC EFI_STATUS EFIAPI ventoy_set_mode2
+(
+  IN  EFI_GRAPHICS_OUTPUT_PROTOCOL *This,
+  IN  UINT32                       ModeNumber
+)
+{
+    UINTN Size;
+    EFI_STATUS rc;
+    EFI_GRAPHICS_OUTPUT_MODE_INFORMATION *info = NULL;
+
+    /* Force >= 1024x768 */
+    rc = This->QueryMode(This, ModeNumber, &Size, &info);
+    if (rc == EFI_SUCCESS)
+    {
+        if (info->HorizontalResolution < 1024 || info->VerticalResolution < 768)
+        {
+            return EFI_SUCCESS;
+        }
+    }
+
+    return g_org_set_mode(This, ModeNumber);
+}
+
+EFI_STATUS ventoy_lock_res(UINT8 LockType)
 {
 	UINT32 i = 0;
 	UINT32 x = 0;
    UINT32 y = 0;
+    UINT32 SelMode = 0;
    UINT32 CurMode = 0;
    UINT32 Highest = 0;
+    UINT32 M1024_768 = MAX_UINT32;
 	UINTN  Size;
 	EFI_STATUS rc;
    EFI_GRAPHICS_OUTPUT_PROTOCOL *gop = NULL;
@@ -1838,6 +1863,12 @@ EFI_STATUS ventoy_lock_max_res(VOID)
        return EFI_SUCCESS;
    }

+    /* 1: Highest   2: 1024x768 3: >= 1024x768 */
+    if (LockType == 0 || LockType > 3)
+    {
+        return EFI_SUCCESS;
+    }
+
    rc = gBS->LocateProtocol(&gEfiGraphicsOutputProtocolGuid, NULL, (void **)&gop);
    if (rc != EFI_SUCCESS)
    {
@@ -1845,6 +1876,16 @@ EFI_STATUS ventoy_lock_max_res(VOID)
        return EFI_SUCCESS;
    }

+
+    if (LockType == 3)
+    {
+        g_org_mode_num = MAX_UINT32;
+        g_org_set_mode = gop->SetMode;
+        gop->SetMode = ventoy_set_mode2;
+        return EFI_SUCCESS;
+    }
+
+
    CurMode = gop->Mode->Mode;

    for (i = 0 ; i < gop->Mode->MaxMode ; i++)
@@ -1852,6 +1893,11 @@ EFI_STATUS ventoy_lock_max_res(VOID)
 		/* Get mode information */
 		if (gop->QueryMode(gop, i, &Size, &info) == EFI_SUCCESS)
        {
+            if (info->HorizontalResolution == 1024 && info->VerticalResolution == 768)
+            {
+                M1024_768 = i;
+            }
+
            if (x < info->HorizontalResolution ||
               (x == info->HorizontalResolution && y < info->VerticalResolution))
            {
@@ -1862,12 +1908,31 @@ EFI_STATUS ventoy_lock_max_res(VOID)
 		}
    }

-    if (Highest != CurMode)
+
+    if (LockType == 1)
    {
-        gop->SetMode(gop, Highest);
+        SelMode = Highest;
+    }
+    else
+    {
+        if (M1024_768 == MAX_UINT32)
+        {
+            SelMode = Highest;
+        }
+        else
+        {
+            SelMode = M1024_768;
+            x = 1024;
+            y = 768;
+        }
    }

-    debug("Lock resolution to Mode:%d  %d x %d", Highest, x, y);
+    if (SelMode != CurMode)
+    {
+        gop->SetMode(gop, SelMode);
+    }
+    debug("Lock resolution to Mode:%d  %d x %d", SelMode, x, y);
+

    g_org_mode_num = CurMode;
    g_org_set_mode = gop->SetMode;
@@ -1876,7 +1941,7 @@ EFI_STATUS ventoy_lock_max_res(VOID)
    return EFI_SUCCESS;
 }

-EFI_STATUS ventoy_unlock_max_res(VOID)
+EFI_STATUS ventoy_unlock_res(VOID)
 {
 	EFI_STATUS rc;
    EFI_GRAPHICS_OUTPUT_PROTOCOL *gop = NULL;
@@ -1894,7 +1959,10 @@ EFI_STATUS ventoy_unlock_max_res(VOID)
        return EFI_SUCCESS;
    }

+    if (g_org_mode_num != MAX_UINT32)
+    {
        g_org_set_mode(gop, g_org_mode_num);
+    }

    gop->SetMode = g_org_set_mode;
    g_org_set_mode = NULL;
--- a/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyShim/VtoyShim.c
+++ b/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyShim/VtoyShim.c
@@ -0,0 +1,709 @@
+/******************************************************************************
+ * VtoyShim.c
+ *
+ * Copyright (c) 2017 - 2018, Intel Corporation. All rights reserved.<BR>
+ * SPDX-License-Identifier: BSD-2-Clause-Patent
+ *
+ */
+
+#include <Uefi.h>
+
+#include <Library/DebugLib.h>
+#include <Library/PrintLib.h>
+#include <Library/UefiLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DevicePathLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/UefiBootServicesTableLib.h>
+#include <Library/UefiRuntimeServicesTableLib.h>
+#include <Library/UefiApplicationEntryPoint.h>
+#include <Library/PeCoffLib.h>
+#include <Protocol/LoadedImage.h>
+#include <Guid/FileInfo.h>
+#include <Guid/FileSystemInfo.h>
+#include <Protocol/BlockIo.h>
+#include <Protocol/RamDisk.h>
+#include <Protocol/SimpleFileSystem.h>
+#include <Protocol/DevicePathToText.h>
+#include <Protocol/DevicePathFromText.h>
+#include <Protocol/LoadedImage.h>
+#include <Protocol/Security.h>
+#include <Protocol/Security2.h>
+#include <IndustryStandard/PeImage.h>
+#include <VtoyShim.h>
+
+#define CUR_SBAT_VER    1
+
+STATIC EFI_GUID gVtoySbatGUID = { 0xf755068a, 0xe04f, 0x452b, { 0x9d, 0x6d, 0x7c, 0x55, 0x96, 0xb3, 0xc0, 0x7d }};
+STATIC EFI_DEVICE_PATH_TO_TEXT_PROTOCOL *gDpToText = NULL;
+STATIC EFI_DEVICE_PATH_FROM_TEXT_PROTOCOL *gTextToDp = NULL;
+STATIC EFI_SECURITY_FILE_AUTHENTICATION_STATE gSysSecFileAuth = NULL;
+STATIC EFI_SECURITY2_FILE_AUTHENTICATION gSysSec2FileAuth = NULL;
+STATIC BOOLEAN gVtoyByPassSB = FALSE; /* must be FALSE by default for revoke */
+STATIC VTOY_SHIM gVtoyShimProtocol;
+STATIC EFI_HANDLE gVtoyShimProtHandle;
+STATIC SHIM_LOCK *gShimLock = NULL;
+
+STATIC VOID EFIAPI VtoyLog(CONST CHAR16 *Format, ...)
+{
+    VA_LIST         Marker;
+    CHAR16          Buffer[512];
+    UINTN           BufLen = 0;
+
+    Buffer[0] = 0;
+    VA_START(Marker, Format);
+    BufLen = UnicodeVSPrint(Buffer, sizeof(Buffer), Format, Marker);
+    VA_END(Marker);
+
+    if (gST->ConOut && gST->ConOut->OutputString)
+    {
+        gST->ConOut->OutputString(gST->ConOut, Buffer);
+    }
+}
+
+
+STATIC VOID EFIAPI DumpDevicePath(const EFI_DEVICE_PATH_PROTOCOL *DevicePath)
+{
+    CHAR16 *DPStr = NULL;
+
+    DPStr = gDpToText->ConvertDevicePathToText(DevicePath, TRUE, TRUE);
+    if (DPStr)
+    {
+        vLog(L"%s", DPStr);
+        gBS->FreePool(DPStr);
+    }
+    else
+    {
+        vLog(L"NULL");
+    }
+}
+
+STATIC VOID EFIAPI ShowSBWarning(BOOLEAN Reboot, const EFI_DEVICE_PATH_PROTOCOL *DevicePath)
+{
+    UINTN Index = 0;
+
+    vLog(L"\r\n=======================================================");
+    vLog(L"=======================================================\r\n");
+
+    DumpDevicePath(DevicePath);
+
+    vLog(L"\r\n####### Security Boot Violation ##########\r\n");
+
+    vLog(L"=======================================================");
+    vLog(L"=======================================================");
+
+    if (Reboot)
+    {
+        vLog(L"\r\n###### Press Enter to reboot... ######");
+        gST->ConIn->Reset(gST->ConIn, FALSE);
+        gBS->WaitForEvent(1, &gST->ConIn->WaitForKey, &Index);
+        gRT->ResetSystem(EfiResetWarm, EFI_SECURITY_VIOLATION, 0, NULL);
+    }
+    else
+    {
+        VtoySleep(5);
+    }
+}
+
+
+STATIC VOID * EFIAPI FindShimFuncAddr(UINT64 FuncOffset)
+{
+    EFI_STATUS Status;
+    SHIM_IMAGE_LOADER *ImgLoader = NULL;
+    EFI_GUID ShimImgLoaderGuid = SHIM_IMAGE_LOADER_GUID;
+
+    Status = gBS->LocateProtocol(&ShimImgLoaderGuid, NULL, (VOID **)&ImgLoader);
+    if (EFI_ERROR(Status) || !ImgLoader || !ImgLoader->LoadImage)
+    {
+        vLog(L"Failed to locate shim image loader protocol %lx %p", Status, ImgLoader);
+        return NULL;
+    }
+
+    if (NM_SHIM_LOAD_IMAGE_OFFSET > FuncOffset)
+    {
+        return (UINT8 *)ImgLoader->LoadImage - (NM_SHIM_LOAD_IMAGE_OFFSET - FuncOffset);
+    }
+    else
+    {
+        return (UINT8 *)ImgLoader->LoadImage + (FuncOffset - NM_SHIM_LOAD_IMAGE_OFFSET);
+    }
+}
+
+
+EFI_STATUS EFIAPI LaunchRealGrub(EFI_HANDLE ImageHandle, CONST CHAR16 *FileName)
+{
+    EFI_STATUS Status;
+    UINTN BufferSize = 0;
+    CHAR16 *DevDpStr = NULL;
+    CHAR16 *NewDpStr = NULL;
+    EFI_HANDLE ChildHandle = NULL;
+    EFI_LOADED_IMAGE_PROTOCOL *Li = NULL;
+    EFI_DEVICE_PATH_PROTOCOL *DeviceDP = NULL;
+    EFI_DEVICE_PATH_PROTOCOL *TargetDp = NULL;
+
+    Status = gBS->HandleProtocol(ImageHandle, &gEfiLoadedImageProtocolGuid, (VOID**)&Li);
+    if (EFI_ERROR(Status))
+    {
+        vLog(L"Failed to locate loaded image protocol %lx", Status);
+        return Status;
+    }
+
+    DeviceDP = DevicePathFromHandle(Li->DeviceHandle);
+    if (!DeviceDP || !IsDevicePathValid(DeviceDP, 0))
+    {
+        vLog(L"Failed to get device path of device handle %p", Li->DeviceHandle);
+        Status = EFI_NOT_FOUND;
+        goto END;
+    }
+
+    DevDpStr = gDpToText->ConvertDevicePathToText(DeviceDP, FALSE, TRUE);
+    if (!DevDpStr)
+    {
+        vLog(L"Failed to convert device path to text");
+        Status = EFI_OUT_OF_RESOURCES;
+        goto END;
+    }
+
+    BufferSize = (StrLen(DevDpStr) + 64) * sizeof(CHAR16);
+    NewDpStr = (CHAR16 *)AllocatePool(BufferSize);
+    if (!NewDpStr)
+    {
+        vLog(L"Failed to alloc new device path string buffer size:%lu", BufferSize);
+        Status = EFI_OUT_OF_RESOURCES;
+        goto END;
+    }
+
+    UnicodeSPrint(NewDpStr, BufferSize, L"%s/EFI/BOOT/%s", DevDpStr, FileName);
+
+    TargetDp = gTextToDp->ConvertTextToDevicePath(NewDpStr);
+    if (!TargetDp)
+    {
+        vLog(L"Failed to convert new text <%s> to device path", NewDpStr);
+        Status = EFI_NOT_FOUND;
+        goto END;
+    }
+
+    Status = gBS->LoadImage(FALSE, ImageHandle, TargetDp, NULL, 0, &ChildHandle);
+    if (EFI_ERROR(Status))
+    {
+        vLog(L"Failed to LoadImage %lx", Status);
+        goto END;
+    }
+
+
+    Status = gBS->StartImage(ChildHandle, NULL, NULL);
+    if (EFI_ERROR(Status))
+    {
+        vLog(L"Failed to StartImage %lx", Status);
+        gBS->UnloadImage(ChildHandle);
+        goto END;
+    }
+
+
+END:
+
+    CheckBSFreePool(DevDpStr);
+    CheckFreePool(NewDpStr);
+    CheckBSFreePool(TargetDp);
+
+    return Status;
+}
+
+
+
+STATIC EFI_STATUS EFIAPI ReadAuthFile
+(
+    const EFI_DEVICE_PATH_PROTOCOL *DevicePathConst,
+    VOID **Buffer,
+    UINT32 *Size
+)
+{
+    EFI_STATUS Status;
+    UINTN TmpSize = 0;
+    CHAR16 *DpStr = NULL;
+	EFI_HANDLE Handle = NULL;
+    EFI_DEVICE_PATH *DevPath = NULL;
+    EFI_DEVICE_PATH *TmpPath = NULL;
+	EFI_FILE_IO_INTERFACE *FileIO = NULL;
+	EFI_FILE *File = NULL;
+	EFI_FILE *Root = NULL;
+    UINT8 *FileData = NULL;
+    EFI_FILE_INFO *FInfo = NULL;
+    UINT8 Buf[1024];
+
+	DevPath	= TmpPath = DuplicateDevicePath(DevicePathConst);
+    if (!DevPath)
+    {
+        Status = EFI_OUT_OF_RESOURCES;
+        goto END;
+    }
+
+	Status = gBS->LocateDevicePath(&gEfiSimpleFileSystemProtocolGuid, &DevPath, &Handle);
+    if (EFI_ERROR(Status))
+    {
+        vLog(L"Failed to locate simple file protocol %lx", Status);
+        goto END;
+    }
+
+    DpStr = gDpToText->ConvertDevicePathToText(DevPath, FALSE, TRUE);
+    if (!DpStr)
+    {
+        Status = EFI_OUT_OF_RESOURCES;
+        goto END;
+    }
+
+    Status = gBS->HandleProtocol(Handle, &gEfiSimpleFileSystemProtocolGuid, (VOID **)&FileIO);
+    if (EFI_ERROR(Status))
+    {
+        vLog(L"Failed to handle simple file protocol %lx", Status);
+        goto END;
+    }
+
+    Status = FileIO->OpenVolume(Handle, &Root);
+	if (EFI_ERROR(Status))
+    {
+		vLog(L"Failed to open drive volume (%lx)\n", Status);
+		goto END;
+	}
+
+    Status = Root->Open(Root, &File, DpStr, EFI_FILE_MODE_READ, 0);
+    if (EFI_ERROR(Status))
+    {
+		vLog(L"Failed to open file (%s) (%lx)\n", DpStr, Status);
+		goto END;
+	}
+
+    FInfo = (EFI_FILE_INFO *)Buf;
+    TmpSize = sizeof(Buf);
+    ZeroMem(FInfo, sizeof(EFI_FILE_INFO));
+
+    Status = File->GetInfo(File, &gEfiFileInfoGuid, &TmpSize, FInfo);
+    if (EFI_ERROR(Status) || FInfo->FileSize == 0 || FInfo->FileSize >= 0xFFFFFFFFUL)
+    {
+		vLog(L"Failed to open file (%s) (%lx) Size(%ld)\n", DpStr, Status, (UINTN)FInfo->FileSize);
+		goto END;
+	}
+
+    FileData = AllocatePool(FInfo->FileSize);
+    if (!FileData)
+    {
+        Status = EFI_OUT_OF_RESOURCES;
+        goto END;
+    }
+
+    TmpSize = FInfo->FileSize;
+    Status = File->Read(File, &TmpSize, FileData);
+    if (EFI_ERROR(Status) || TmpSize != (UINTN)FInfo->FileSize)
+    {
+		vLog(L"Failed to read file (%lx) Read:%ld Size:%ld\n", Status, TmpSize, (UINTN)FInfo->FileSize);
+		goto END;
+	}
+
+
+END:
+
+    if (File)
+    {
+        File->Close(File);
+    }
+
+    if (Root)
+    {
+        Root->Close(Root);
+    }
+
+    CheckFreePool(TmpPath);
+    CheckBSFreePool(DpStr);
+
+    if (EFI_ERROR(Status))
+    {
+        CheckFreePool(FileData);
+    }
+    else
+    {
+        *Buffer = FileData;
+        *Size = (UINT32)FInfo->FileSize;
+    }
+
+    return Status;
+}
+
+
+STATIC BOOLEAN VtoyCheckRevoke(VOID *Buffer, UINTN Size)
+{
+    UINT32 uiVer = 0;
+    EFI_IMAGE_DOS_HEADER *DosHead = (EFI_IMAGE_DOS_HEADER *)Buffer;
+
+    if (Size > sizeof(EFI_IMAGE_DOS_HEADER))
+    {
+        if (CompareMem(DosHead->e_res2, &gVtoySbatGUID, 16) == 0)
+        {
+            CopyMem(&uiVer, DosHead->e_res2 + 8, 4);
+            if (uiVer < CUR_SBAT_VER)
+            {
+                vLog(L"Ventoy EFI file revoke (%u < %u)", uiVer, CUR_SBAT_VER);
+                return FALSE;
+            }
+        }
+    }
+
+    return TRUE;
+}
+
+STATIC EFI_STATUS EFIAPI SecurityPolicyAuth
+(
+	const EFI_SECURITY_ARCH_PROTOCOL *This,
+	UINT32 AuthenticationStatus,
+	const EFI_DEVICE_PATH_PROTOCOL *DevicePathConst
+)
+{
+    EFI_STATUS Status;
+    BOOLEAN bRevokeChkOK = TRUE;
+    UINT32 Size = 0;
+    VOID *Buffer = NULL;
+
+    /* Just return OK if the user choose to bypass SB */
+    if (gVtoyByPassSB)
+    {
+        return EFI_SUCCESS;
+    }
+
+    /*
+     * Step 1:
+     * Use original UEFI firmware auth API.
+     * If it's OK, it may be signed with Microsoft UEFI CA. (e.g. bootmgr/shim/...)
+     */
+    if (gSysSecFileAuth)
+    {
+        Status = gSysSecFileAuth(This, AuthenticationStatus, DevicePathConst);
+        if (!EFI_ERROR(Status))
+        {
+            return EFI_SUCCESS;
+        }
+    }
+
+
+    /*
+     * Step 2:
+     * Use shim verify API.
+     * If it's OK, it may be signed with a MOK key. (e.g. Ventoy EFI files)
+     */
+    if (gShimLock && gShimLock->Verify)
+    {
+        Status = ReadAuthFile(DevicePathConst, &Buffer, &Size);
+        if (!EFI_ERROR(Status))
+        {
+            Status = gShimLock->Verify(Buffer, Size);
+            if (!EFI_ERROR(Status))
+            {
+                bRevokeChkOK = VtoyCheckRevoke(Buffer, Size);
+                if (bRevokeChkOK)
+                {
+                    FreePool(Buffer);
+                    return EFI_SUCCESS;
+                }
+            }
+            FreePool(Buffer);
+        }
+    }
+
+    ShowSBWarning(!bRevokeChkOK, DevicePathConst);
+
+    return EFI_SECURITY_VIOLATION;
+}
+
+STATIC EFI_STATUS EFIAPI Security2PolicyAuth
+(
+	const EFI_SECURITY2_ARCH_PROTOCOL *This,
+	const EFI_DEVICE_PATH_PROTOCOL *DevicePath,
+	VOID *FileBuffer,
+	UINTN FileSize,
+	BOOLEAN	BootPolicy
+)
+{
+    EFI_STATUS Status;
+    BOOLEAN bRevokeChkOK = TRUE;
+
+    /* Just return OK if the user choose to bypass SB */
+    if (gVtoyByPassSB)
+    {
+        return EFI_SUCCESS;
+    }
+
+    /*
+     * Step 1:
+     * Use original UEFI firmware auth API.
+     * If it's OK, it may be signed with Microsoft UEFI CA. (e.g. bootmgr/shim/...)
+     */
+    if (gSysSec2FileAuth)
+    {
+        Status = gSysSec2FileAuth(This, DevicePath, FileBuffer, FileSize, BootPolicy);
+        if (!EFI_ERROR(Status))
+        {
+            return EFI_SUCCESS;
+        }
+    }
+
+
+    /*
+     * Step 2:
+     * Use shim verify API.
+     * If it's OK, it may be signed with a MOK key. (e.g. Ventoy EFI files)
+     */
+    if (gShimLock && gShimLock->Verify)
+    {
+        if (FileBuffer && FileSize > 0 && FileSize < 0xFFFFFFFFUL)
+        {
+            Status = gShimLock->Verify(FileBuffer, (UINT32)FileSize);
+            if (!EFI_ERROR(Status))
+            {
+                bRevokeChkOK = VtoyCheckRevoke(FileBuffer, FileSize);
+                if (bRevokeChkOK)
+                {
+                    return EFI_SUCCESS;
+                }
+            }
+        }
+    }
+
+    ShowSBWarning(!bRevokeChkOK, DevicePath);
+
+    return EFI_SECURITY_VIOLATION;
+}
+
+
+STATIC EFI_STATUS EFIAPI HookSecurityPolicy(VOID)
+{
+	EFI_STATUS Status;
+	EFI_STATUS Status2;
+	EFI_SECURITY_ARCH_PROTOCOL *Security = NULL;
+	EFI_SECURITY2_ARCH_PROTOCOL *Security2 = NULL;
+
+	Status = gBS->LocateProtocol(&gEfiSecurityArchProtocolGuid, NULL, (VOID **)&Security);
+	Status2 = gBS->LocateProtocol(&gEfiSecurity2ArchProtocolGuid, NULL, (VOID **)&Security2);
+    if (EFI_ERROR(Status) && EFI_ERROR(Status2))
+    {
+        vLog(L"Failed to locate security or security2 protocol. %lx %lx %p %p",
+             Status, Status2, Security, Security2);
+        return EFI_NOT_FOUND;
+    }
+
+    if (Security2)
+    {
+        gSysSec2FileAuth = Security2->FileAuthentication;
+        Security2->FileAuthentication = Security2PolicyAuth;
+    }
+
+    if (Security)
+    {
+        gSysSecFileAuth = Security->FileAuthenticationState;
+        Security->FileAuthenticationState = SecurityPolicyAuth;
+    }
+
+	return EFI_SUCCESS;
+}
+
+STATIC VOID EFIAPI UnHookSecurityPolicy(VOID)
+{
+	EFI_STATUS Status;
+	EFI_STATUS Status2;
+	EFI_SECURITY_ARCH_PROTOCOL *Security = NULL;
+	EFI_SECURITY2_ARCH_PROTOCOL *Security2 = NULL;
+
+    if (!gSysSec2FileAuth && !gSysSecFileAuth)
+    {
+        return;
+    }
+
+	Status = gBS->LocateProtocol(&gEfiSecurityArchProtocolGuid, NULL, (VOID **)&Security);
+	Status2 = gBS->LocateProtocol(&gEfiSecurity2ArchProtocolGuid, NULL, (VOID **)&Security2);
+    if (EFI_ERROR(Status) && EFI_ERROR(Status2))
+    {
+        vLog(L"Failed to locate security or security2 protocol. %lx %lx %p %p",
+             Status, Status2, Security, Security2);
+        return;
+    }
+
+    if (Security2 && gSysSec2FileAuth)
+    {
+        Security2->FileAuthentication = gSysSec2FileAuth;
+        gSysSec2FileAuth = NULL;
+    }
+
+    if (Security && gSysSecFileAuth)
+    {
+        Security->FileAuthenticationState = gSysSecFileAuth;
+        gSysSecFileAuth = NULL;
+    }
+}
+
+STATIC VOID EFIAPI VtoyByPassSB(VOID)
+{
+    gVtoyByPassSB = TRUE;
+}
+
+STATIC VOID EFIAPI VtoyCheckSB(VOID)
+{
+    gVtoyByPassSB = FALSE;
+}
+
+STATIC VOID EFIAPI UnInstallVtoyShimProtocol(VOID)
+{
+    EFI_GUID Guid = VTOY_SHIM_POLICY_GUID;
+
+    if (gVtoyShimProtHandle)
+    {
+        gBS->UninstallProtocolInterface(gVtoyShimProtHandle, &Guid, &gVtoyShimProtocol);
+        gVtoyShimProtHandle = NULL;
+    }
+}
+
+STATIC EFI_STATUS EFIAPI InstallVtoyShimProtocol(VOID)
+{
+	EFI_STATUS Status;
+    EFI_GUID Guid = VTOY_SHIM_POLICY_GUID;
+    VTOY_SHIM *Prot = NULL;
+
+    gVtoyShimProtocol.ByPassSB = VtoyByPassSB;
+    gVtoyShimProtocol.CheckSB = VtoyCheckSB;
+
+    Status = gBS->LocateProtocol(&Guid, NULL, (VOID**)&Prot);
+    if (!EFI_ERROR(Status))
+    {
+        vLog(L"Ventoy shim already loaded, cannot be nested.");
+        return EFI_ALREADY_STARTED;
+    }
+
+    Status = gBS->InstallProtocolInterface(&gVtoyShimProtHandle, &Guid,
+                    EFI_NATIVE_INTERFACE, &gVtoyShimProtocol);
+    if (EFI_ERROR(Status))
+    {
+        vLog(L"Failed to install protocol %lx", Status);
+    }
+
+    return Status;
+}
+
+STATIC BOOLEAN EFIAPI IsSecureBootEnabled(VOID)
+{
+    UINT8 SecureBoot = 0;
+	UINTN DataSize;
+	EFI_STATUS Status;
+
+	DataSize = sizeof(SecureBoot);
+	Status = gST->RuntimeServices->GetVariable(L"SecureBoot", &gEfiGlobalVariableGuid, NULL,
+				     &DataSize, &SecureBoot);
+	if (EFI_ERROR(Status))
+    {
+        return FALSE;
+    }
+
+	return SecureBoot ? TRUE : FALSE;
+}
+
+STATIC EFI_STATUS EFIAPI EnvInit(VOID)
+{
+    EFI_STATUS Status;
+    EFI_GUID Guid = SHIM_LOCK_GUID;
+
+    Status = gBS->LocateProtocol(&gEfiDevicePathToTextProtocolGuid, NULL, (VOID**)&gDpToText);
+	if (EFI_ERROR(Status) || !gDpToText || !gDpToText->ConvertDevicePathToText)
+    {
+        vLog(L"Failed to locate PathToText Protocol %lx", Status);
+        return Status;
+    }
+
+    Status = gBS->LocateProtocol(&gEfiDevicePathFromTextProtocolGuid, NULL, (VOID**)&gTextToDp);
+	if (EFI_ERROR(Status) || !gTextToDp || !gTextToDp->ConvertTextToDevicePath)
+    {
+        vLog(L"Failed to locate PathFromText Protocol %lx", Status);
+        return Status;
+    }
+
+    Status = gBS->LocateProtocol(&Guid, NULL, (VOID**)&gShimLock);
+    if (EFI_ERROR(Status) || !gShimLock)
+    {
+        vLog(L"Failed to locate SHIM LOCK Protocol %lx", Status);
+        return Status;
+    }
+
+    return EFI_SUCCESS;
+}
+
+
+EFI_STATUS EFIAPI VtoyShimEfiMain
+(
+    IN EFI_HANDLE         ImageHandle,
+    IN EFI_SYSTEM_TABLE  *SystemTable
+)
+{
+    EFI_STATUS Status;
+    unhook_system_services_pf Func = NULL;
+
+    /* If secure boot is not enabled, nothing needed, just launch Ventoy grub */
+    if (!IsSecureBootEnabled())
+    {
+        return LaunchRealGrub(ImageHandle, REAL_GRUB_FILE);
+    }
+
+    Status = EnvInit();
+	if (EFI_ERROR(Status))
+    {
+        vErr(L"Failed to prepare env");
+        return Status;
+    }
+
+    Status = InstallVtoyShimProtocol();
+    if (EFI_ERROR(Status))
+    {
+        vErr(L"Failed to install ventoy shim protocol");
+        return Status;
+    }
+
+
+    /*
+     * IMPORTANT: All recent shim implementations hook the UEFI Boot Services
+     * (e.g. LoadImage, StartImage) to enforce signature verification.
+     *
+     * We must restore the original system service pointers here. If we fail to do this,
+     * we will be unable to launch Ventoy-signed EFI binaries or any other unsigned
+     * EFI applications later, even when the user has explicitly opted to disable
+     * all Secure Boot validation checks.
+     *
+     * To the best of my knowledge, there is no official way to remove these hooks.
+     * This is a tricky hack that relies on shim's internal implementation details.
+     * It may break in future versions of shim, and a better approach may exist.
+     *
+     */
+    Func = FindShimFuncAddr(NM_UNHOOK_SYSTEM_SERVICES_OFFSET);
+    if (!Func)
+    {
+        vErr(L"Can not find shim unhook_system_services");
+        Status = EFI_NOT_FOUND;
+        goto END;
+    }
+
+    Func(); /* call shim unhook_system_services() */
+
+
+    /* Hook the system security policy */
+    Status = HookSecurityPolicy();
+    if (EFI_ERROR(Status))
+    {
+        vErr(L"Failed to hook system security policy");
+        goto END;
+    }
+
+    /* Finally launch Ventoy grub */
+    Status = LaunchRealGrub(ImageHandle, REAL_GRUB_FILE);
+
+END:
+
+    /* UnHook system security policy */
+    UnHookSecurityPolicy();
+
+    UnInstallVtoyShimProtocol();
+
+    return Status;
+}
+
--- a/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyShim/VtoyShim.h
+++ b/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyShim/VtoyShim.h
@@ -0,0 +1,121 @@
+/******************************************************************************
+ * VtoyShim.h
+ *
+ * Copyright (c) 2017 - 2018, Intel Corporation. All rights reserved.<BR>
+ * SPDX-License-Identifier: BSD-2-Clause-Patent
+ *
+ */
+
+#ifndef __VTOYSHIM_H__
+#define __VTOYSHIM_H__
+
+#if defined (MDE_CPU_IA32)
+#define REAL_GRUB_FILE    L"grubia32_real.efi"
+#elif defined (MDE_CPU_X64)
+#define REAL_GRUB_FILE    L"grubx64_real.efi"
+#elif defined (MDE_CPU_AARCH64)
+#define REAL_GRUB_FILE    L"grubaa64_real.efi"
+#else
+#error "Not supported now"
+#endif
+
+
+/* The following definations are copied from shim source code */
+
+#define SHIM_LOCK_GUID  {0x605dab50, 0xe046, 0x4300, {0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23 } };
+
+typedef
+EFI_STATUS
+(*EFI_SHIM_LOCK_VERIFY) (
+	IN VOID *buffer,
+	IN UINT32 size
+	);
+
+typedef
+EFI_STATUS
+(*EFI_SHIM_LOCK_HASH) (
+	IN char *data,
+	IN int datasize,
+	PE_COFF_LOADER_IMAGE_CONTEXT *context,
+	UINT8 *sha256hash,
+	UINT8 *sha1hash
+	);
+
+typedef
+EFI_STATUS
+(*EFI_SHIM_LOCK_CONTEXT) (
+	IN VOID *data,
+	IN unsigned int datasize,
+	PE_COFF_LOADER_IMAGE_CONTEXT *context
+	);
+
+typedef struct _SHIM_LOCK {
+	EFI_SHIM_LOCK_VERIFY Verify;
+	EFI_SHIM_LOCK_HASH Hash;
+	EFI_SHIM_LOCK_CONTEXT Context;
+} SHIM_LOCK;
+
+
+
+#define SHIM_IMAGE_LOADER_GUID {0x1f492041, 0xfadb, 0x4e59, {0x9e, 0x57, 0x7c, 0xaf, 0xe7, 0x3a, 0x55, 0xab } }
+
+typedef struct _SHIM_IMAGE_LOADER {
+	EFI_IMAGE_LOAD LoadImage;
+	EFI_IMAGE_START StartImage;
+	EFI_EXIT Exit;
+	EFI_IMAGE_UNLOAD UnloadImage;
+} SHIM_IMAGE_LOADER;
+
+typedef VOID (*unhook_system_services_pf)(VOID);
+
+
+/*
+ * The two offset here are extract from the shim file which used in Ventoy.
+ * nm BOOTX64.EFI | grep shim_load_image
+ * nm BOOTX64.EFI | grep unhook_system_services
+ *
+ * It means that they must be updated every time Ventoy update the shim file.
+ *
+ */
+#define NM_SHIM_LOAD_IMAGE_OFFSET             0x2dc12
+#define NM_UNHOOK_SYSTEM_SERVICES_OFFSET      0x2e278
+
+
+
+
+#define VtoySleep(sec)      gBS->Stall(1000000 * (sec))
+#define vLog(fmt, ...)      VtoyLog(fmt "\r\n", ##__VA_ARGS__)
+#define vErr(fmt, ...)      VtoyLog(fmt "\r\n", ##__VA_ARGS__); VtoySleep(5)
+
+#define CheckFreePool(p) \
+do { \
+    if (p) { \
+        FreePool(p); \
+        (p) = NULL; \
+    }\
+} while (0)
+
+#define CheckBSFreePool(p) \
+do { \
+    if (p) { \
+        gBS->FreePool(p); \
+        (p) = NULL; \
+    }\
+} while (0)
+
+
+
+#define VTOY_SHIM_POLICY_GUID    {0x90a29d14, 0x3968, 0x48fe, { 0x85, 0x81, 0x6b, 0x7f, 0x7d, 0xc4, 0x70, 0x55 }};
+
+
+typedef VOID (EFIAPI *VTOY_BYPASS_SB)(VOID);
+typedef VOID (EFIAPI *VTOY_CHECK_SB)(VOID);
+typedef struct _VTOY_SHIM{
+	VTOY_BYPASS_SB ByPassSB;
+	VTOY_BYPASS_SB CheckSB;
+} VTOY_SHIM;
+
+CONST UINT8 * ventoy_get_der_data(UINT32 *Len);
+
+#endif
+
--- a/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyShim/VtoyShim.inf
+++ b/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyShim/VtoyShim.inf
@@ -0,0 +1,83 @@
+#************************************************************************************
+# Copyright (c) 2026, longpanda <admin@ventoy.net>
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, see <http://www.gnu.org/licenses/>.
+#
+#************************************************************************************
+
+[Defines]
+  INF_VERSION                    = 0x00010005
+  BASE_NAME                      = VtoyShim
+  FILE_GUID                      = 6d7c7406-b32c-461f-8454-ddaa5243d93d
+  MODULE_TYPE                    = UEFI_APPLICATION
+  VERSION_STRING                 = 1.0
+  ENTRY_POINT                    = VtoyShimEfiMain
+  
+[BuildOptions]
+  # Force standard GNU ld to pack and align ELF segments to 4KB page boundaries
+  GCC:*_*_*_DLINK_FLAGS = -Wl,-z,common-page-size=0x1000 -Wl,-z,max-page-size=0x1000
+
+[Sources]
+  VtoyShim.h
+  VtoyShim.c
+  
+[Packages]
+  MdePkg/MdePkg.dec
+  MdeModulePkg/MdeModulePkg.dec
+  ShellPkg/ShellPkg.dec
+
+[LibraryClasses]
+  UefiApplicationEntryPoint
+  UefiLib
+  DevicePathLib
+  DebugLib
+
+[Guids]
+  gEfiGlobalVariableGuid
+  gShellVariableGuid
+  gEfiVirtualCdGuid
+  gEfiFileInfoGuid
+
+[Protocols]
+  gEfiSecurityArchProtocolGuid
+  gEfiSecurity2ArchProtocolGuid
+  gEfiLoadedImageProtocolGuid
+  gEfiBlockIoProtocolGuid
+  gEfiDevicePathProtocolGuid
+  gEfiDevicePathToTextProtocolGuid
+  gEfiDevicePathFromTextProtocolGuid
+  gEfiSimpleFileSystemProtocolGuid
+  gEfiRamDiskProtocolGuid
+  gEfiAbsolutePointerProtocolGuid
+  gEfiAcpiTableProtocolGuid
+  gEfiBlockIo2ProtocolGuid
+  gEfiBusSpecificDriverOverrideProtocolGuid
+  gEfiComponentNameProtocolGuid
+  gEfiComponentName2ProtocolGuid
+  gEfiDriverBindingProtocolGuid
+  gEfiDiskIoProtocolGuid
+  gEfiDiskIo2ProtocolGuid
+  gEfiGraphicsOutputProtocolGuid
+  gEfiHiiConfigAccessProtocolGuid
+  gEfiHiiFontProtocolGuid
+  gEfiLoadFileProtocolGuid
+  gEfiLoadFile2ProtocolGuid
+  gEfiLoadedImageProtocolGuid
+  gEfiLoadedImageDevicePathProtocolGuid
+  gEfiPciIoProtocolGuid
+  gEfiSerialIoProtocolGuid
+  gEfiSimpleTextInProtocolGuid
+  gEfiSimpleTextInputExProtocolGuid
+  gEfiSimpleTextOutProtocolGuid
+
--- a/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyShim/sbat.csv
+++ b/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyShim/sbat.csv
@@ -0,0 +1,2 @@
+sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
+ventoy-shim,1,Ventoy,ventoy-shim,1.0,https://www.ventoy.net/
--- a/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyUtil/VtoyUtil.c
+++ b/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyUtil/VtoyUtil.c
@@ -145,6 +145,32 @@ STATIC EFI_STATUS ParseCmdline(IN EFI_HANDLE ImageHandle)
    return EFI_SUCCESS;
 }

+#if defined (MDE_CPU_X64)
+STATIC BOOLEAN EFIAPI CheckVtoyShim(VOID)
+{
+    UINT8 SecureBoot = 0;
+	UINTN DataSize;
+	EFI_STATUS Status;
+    EFI_GUID Guid = VTOY_SHIM_POLICY_GUID;
+    VOID *Prot = NULL;
+
+	DataSize = sizeof(SecureBoot);
+	Status = gST->RuntimeServices->GetVariable(L"SecureBoot", &gEfiGlobalVariableGuid, NULL,
+				     &DataSize, &SecureBoot);
+	if (!EFI_ERROR(Status) && SecureBoot)
+    {
+        Status = gBS->LocateProtocol(&Guid, NULL, (VOID**)&Prot);
+        if (EFI_ERROR(Status))
+        {
+            gST->ConOut->OutputString(gST->ConOut, L"Can not locate Vtoy Shim\r\n");
+            return FALSE;
+        }
+    }
+
+    return TRUE;
+}
+#endif
+
 EFI_STATUS EFIAPI VtoyUtilEfiMain
 (
    IN EFI_HANDLE         ImageHandle,
@@ -154,6 +180,15 @@ EFI_STATUS EFIAPI VtoyUtilEfiMain
    UINTN i;
    UINTN Len;

+#if defined (MDE_CPU_X64)
+    /* check that Ventoy Shim must exist */
+    if (!CheckVtoyShim())
+    {
+        gBS->Stall(5 * 1000000);
+        return EFI_NOT_FOUND;
+    }
+#endif
+
    ParseCmdline(ImageHandle);

    for (i = 0; gCurFeature && i < ARRAY_SIZE(gFeatureList); i++)
--- a/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyUtil/VtoyUtil.h
+++ b/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyUtil/VtoyUtil.h
@@ -21,6 +21,8 @@
 #ifndef __VTOYUTIL_H__
 #define __VTOYUTIL_H__

+#define VTOY_SHIM_POLICY_GUID    {0x90a29d14, 0x3968, 0x48fe, { 0x85, 0x81, 0x6b, 0x7f, 0x7d, 0xc4, 0x70, 0x55 }};
+
 #pragma pack(1)

 typedef EFI_STATUS (*VTOY_UTIL_PROC_PF)(IN EFI_HANDLE ImageHandle, IN CONST CHAR16 *CmdLine);
--- a/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyUtil/VtoyUtil.inf
+++ b/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/Application/VtoyUtil/VtoyUtil.inf
@@ -24,6 +24,9 @@
  VERSION_STRING                 = 1.0
  ENTRY_POINT                    = VtoyUtilEfiMain
 
+[BuildOptions]
+  # Force standard GNU ld to pack and align ELF segments to 4KB page boundaries
+  GCC:*_*_*_DLINK_FLAGS = -Wl,-z,common-page-size=0x1000 -Wl,-z,max-page-size=0x1000

 [Sources]
  VtoyUtil.h
--- a/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/MdeModulePkg.dsc
+++ b/EDK2/edk2_mod/edk2-edk2-stable201911/MdeModulePkg/MdeModulePkg.dsc
@@ -205,6 +205,7 @@
 [Components]
  MdeModulePkg/Application/Ventoy/Ventoy.inf
  MdeModulePkg/Application/VtoyUtil/VtoyUtil.inf
+  MdeModulePkg/Application/VtoyShim/VtoyShim.inf
  MdeModulePkg/Application/VDiskChain/VDiskChain.inf
  MdeModulePkg/Application/HelloWorld/HelloWorld.inf
  MdeModulePkg/Application/DumpDynPcd/DumpDynPcd.inf
--- a/GRUB2/MOD_SRC/grub-2.04/grub-core/kern/corecmd.c
+++ b/GRUB2/MOD_SRC/grub-2.04/grub-core/kern/corecmd.c
@@ -0,0 +1,195 @@
+/* corecmd.c - critical commands which are registered in kernel */
+/*
+ *  GRUB  --  GRand Unified Bootloader
+ *  Copyright (C) 2009  Free Software Foundation, Inc.
+ *
+ *  GRUB is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  GRUB is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <grub/mm.h>
+#include <grub/dl.h>
+#include <grub/err.h>
+#include <grub/env.h>
+#include <grub/misc.h>
+#include <grub/term.h>
+#include <grub/file.h>
+#include <grub/device.h>
+#include <grub/command.h>
+#include <grub/i18n.h>
+
+/* set ENVVAR=VALUE */
+static grub_err_t
+grub_core_cmd_set (struct grub_command *cmd __attribute__ ((unused)),
+		   int argc, char *argv[])
+{
+  char *var;
+  char *val;
+
+  if (argc < 1)
+    {
+      struct grub_env_var *env;
+      FOR_SORTED_ENV (env)
+	grub_printf ("%s=%s\n", env->name, grub_env_get (env->name));
+      return 0;
+    }
+
+  var = argv[0];
+  val = grub_strchr (var, '=');
+  if (! val)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, "not an assignment");
+
+  val[0] = 0;
+  grub_env_set (var, val + 1);
+  val[0] = '=';
+
+  return 0;
+}
+
+static grub_err_t
+grub_core_cmd_unset (struct grub_command *cmd __attribute__ ((unused)),
+		     int argc, char *argv[])
+{
+  if (argc < 1)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT,
+		       N_("one argument expected"));
+
+  grub_env_unset (argv[0]);
+  return 0;
+}
+
+/* insmod MODULE */
+static grub_err_t
+grub_core_cmd_insmod (struct grub_command *cmd __attribute__ ((unused)),
+		      int argc, char *argv[])
+{
+  grub_dl_t mod;
+
+  if (argc == 0)
+    return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("one argument expected"));
+
+  /* For simple, just disable insmod when SecureBoot is enabled. */
+  if (g_sys_sb && g_sb_policy == VTOY_SB_POLICY_CHECK)
+  {
+      return grub_error (GRUB_ERR_BAD_SIGNATURE, "Cannot insmod when SecureBoot is enabled and Policy is check.");
+  }
+
+  if (argv[0][0] == '/' || argv[0][0] == '(' || argv[0][0] == '+')
+    mod = grub_dl_load_file (argv[0]);
+  else
+    mod = grub_dl_load (argv[0]);
+
+  if (mod)
+    grub_dl_ref (mod);
+
+  return 0;
+}
+
+static int
+grub_mini_print_devices (const char *name, void *data __attribute__ ((unused)))
+{
+  grub_printf ("(%s) ", name);
+
+  return 0;
+}
+
+static int
+grub_mini_print_files (const char *filename,
+		       const struct grub_dirhook_info *info,
+		       void *data __attribute__ ((unused)))
+{
+  grub_printf ("%s%s ", filename, info->dir ? "/" : "");
+
+  return 0;
+}
+
+/* ls [ARG] */
+static grub_err_t
+grub_core_cmd_ls (struct grub_command *cmd __attribute__ ((unused)),
+		  int argc, char *argv[])
+{
+  if (argc < 1)
+    {
+      grub_device_iterate (grub_mini_print_devices, NULL);
+      grub_xputs ("\n");
+      grub_refresh ();
+    }
+  else
+    {
+      char *device_name;
+      grub_device_t dev = 0;
+      grub_fs_t fs;
+      char *path;
+
+      device_name = grub_file_get_device_name (argv[0]);
+      if (grub_errno)
+	goto fail;
+      dev = grub_device_open (device_name);
+      if (! dev)
+	goto fail;
+
+      fs = grub_fs_probe (dev);
+      path = grub_strchr (argv[0], ')');
+      if (! path)
+	path = argv[0];
+      else
+	path++;
+
+      if (! *path && ! device_name)
+	{
+	  grub_error (GRUB_ERR_BAD_ARGUMENT, "invalid argument");
+	  goto fail;
+	}
+
+      if (! *path)
+	{
+	  if (grub_errno == GRUB_ERR_UNKNOWN_FS)
+	    grub_errno = GRUB_ERR_NONE;
+
+	  grub_printf ("(%s): Filesystem is %s.\n",
+		       device_name, fs ? fs->name : "unknown");
+	}
+      else if (fs)
+	{
+	  (fs->fs_dir) (dev, path, grub_mini_print_files, NULL);
+	  grub_xputs ("\n");
+	  grub_refresh ();
+	}
+
+    fail:
+      if (dev)
+	grub_device_close (dev);
+
+      grub_free (device_name);
+    }
+
+  return grub_errno;
+}
+
+void
+grub_register_core_commands (void)
+{
+  grub_command_t cmd;
+  cmd = grub_register_command ("set", grub_core_cmd_set,
+			       N_("[ENVVAR=VALUE]"),
+			       N_("Set an environment variable."));
+  if (cmd)
+    cmd->flags |= GRUB_COMMAND_FLAG_EXTRACTOR;
+  grub_register_command ("unset", grub_core_cmd_unset,
+			 N_("ENVVAR"),
+			 N_("Remove an environment variable."));
+  grub_register_command ("ls", grub_core_cmd_ls,
+			 N_("[ARG]"), N_("List devices or files."));
+  grub_register_command ("insmod", grub_core_cmd_insmod,
+			 N_("MODULE"), N_("Insert a module."));
+}
--- a/GRUB2/MOD_SRC/grub-2.04/grub-core/kern/env.c
+++ b/GRUB2/MOD_SRC/grub-2.04/grub-core/kern/env.c
@@ -22,6 +22,9 @@
 #include <grub/misc.h>
 #include <grub/mm.h>

+grub_uint8_t g_sys_sb = 0;
+grub_uint8_t g_sb_policy = VTOY_SB_POLICY_BYPASS;
+
 /* The initial context.  */
 static struct grub_env_context initial_context;

--- a/GRUB2/MOD_SRC/grub-2.04/grub-core/loader/i386/linux.c
+++ b/GRUB2/MOD_SRC/grub-2.04/grub-core/loader/i386/linux.c
@@ -35,6 +35,8 @@
 #include <grub/i18n.h>
 #include <grub/lib/cmdline.h>
 #include <grub/linux.h>
+#include <grub/time.h>
+#include <grub/env.h>
 #include <grub/machine/kernel.h>

 GRUB_MOD_LICENSE ("GPLv3+");
@@ -750,6 +752,16 @@ grub_linux_boot (void)
  grub_size_t mmap_size;
  grub_size_t cl_offset;

+  /* To be simple, just deny to boot linux kernel when SecureBoot is enabled and Policy is check */
+  if (g_sys_sb && g_sb_policy == VTOY_SB_POLICY_CHECK)
+  {
+      grub_printf("\n\n ######### Can not do linux boot in SecureBoot Policy Check #######\n\n");
+      grub_refresh();
+      grub_sleep(5);
+      grub_errno = GRUB_ERR_BAD_SIGNATURE;
+      return 0;
+  }
+
  ventoy_preboot();

 #ifdef GRUB_MACHINE_IEEE1275
--- a/GRUB2/MOD_SRC/grub-2.04/grub-core/normal/menu.c
+++ b/GRUB2/MOD_SRC/grub-2.04/grub-core/normal/menu.c
@@ -1134,6 +1134,7 @@ show_menu (grub_menu_t menu, int nested, int autobooted)
  while (1)
    {
      int ndown;
+      char *pos = NULL;
      int boot_entry;
      grub_menu_entry_t e;
      int auto_boot;
@@ -1176,14 +1177,27 @@ show_menu (grub_menu_t menu, int nested, int autobooted)

      if (2 == e->argc && e->args && e->args[1] && grub_strncmp(e->args[1], "VTOY_RUN_RET", 12) == 0)
        break;
-      else if (2 == e->argc && e->args && e->args[1] && grub_strncmp(e->args[1], "VTOY_RUN_SET", 12) == 0) {        
-        ndown = (int)grub_strtol(e->args[1] + 12, NULL, 10);
+      else if (2 == e->argc && e->args && e->args[1] && grub_strncmp(e->args[1], "VTOY_RUN_SET_", 13) == 0) {
+        pos = NULL;
+        ndown = (int)grub_strtol(e->args[1] + 13, &pos, 10);
        while (ndown > 0)
        {
            ventoy_menu_push_key(GRUB_TERM_KEY_DOWN);
            ndown--;
        }
+
        ventoy_menu_push_key('\n');
+
+        if (pos && *pos == '_')
+        {
+            ndown = (int)grub_strtol(pos + 1, NULL, 10);
+            while (ndown > 0)
+            {
+                ventoy_menu_push_key(GRUB_TERM_KEY_DOWN);
+                ndown--;
+            }
+        }
+
        break;
      }
    }
--- a/GRUB2/MOD_SRC/grub-2.04/grub-core/ventoy/ventoy.c
+++ b/GRUB2/MOD_SRC/grub-2.04/grub-core/ventoy/ventoy.c
@@ -49,6 +49,10 @@ int g_ventoy_debug = 0;
 static int g_efi_os = 0xFF;
 grub_uint32_t g_ventoy_plat_data;

+#ifdef GRUB_MACHINE_EFI
+static VTOY_SHIM *g_vtoy_shim = NULL;
+#endif
+
 void ventoy_debug(const char *fmt, ...)
 {
    va_list args;
@@ -298,9 +302,119 @@ void ventoy_memfile_env_set(const char *prefix, const void *buf, unsigned long l
    return;
 }

+#ifdef GRUB_MACHINE_EFI
+static void ventoy_get_uefi_version(char *str, grub_size_t len)
+{
+    grub_efi_uint8_t uefi_minor_1, uefi_minor_2;
+
+    uefi_minor_1 = (grub_efi_system_table->hdr.revision & 0xffff) / 10;
+    uefi_minor_2 = (grub_efi_system_table->hdr.revision & 0xffff) % 10;
+    grub_snprintf(str, len, "%d.%d", (grub_efi_system_table->hdr.revision >> 16), uefi_minor_1);
+    if (uefi_minor_2)
+        grub_snprintf(str, len, "%s.%d", str, uefi_minor_2);
+}
+
+int ventoy_set_sb_policy(void)
+{
+    const char *env = NULL;
+    static int set_once = 0;
+
+    /* no need when SecureBoot is disabled */
+    if (g_sys_sb == 0)
+    {
+        return 0;
+    }
+
+    /* can only set once */
+    if (set_once > 0)
+    {
+        return 0;
+    }
+    set_once = 1;
+
+    /* VTOY_SECURE_BOOT_POLICY only take affect once during init */
+    env = grub_env_get("VTOY_SECURE_BOOT_POLICY");
+    if (env)
+    {
+        g_sb_policy = (grub_uint8_t)(env[0] - '0');
+    }
+
+    if (g_sb_policy == VTOY_SB_POLICY_BYPASS)
+    {
+        if (g_vtoy_shim && g_vtoy_shim->ByPassSB)
+        {
+            g_vtoy_shim->ByPassSB();
+        }
+    }
+    else if (g_sb_policy == VTOY_SB_POLICY_CHECK)
+    {
+        if (g_vtoy_shim && g_vtoy_shim->CheckSB)
+        {
+            g_vtoy_shim->CheckSB();
+        }
+    }
+
+    return 0;
+}
+
+static void ventoy_get_uefi_sb(void)
+{
+    grub_uint8_t *var = NULL;
+    grub_size_t size = 0;
+    grub_efi_guid_t global = GRUB_EFI_GLOBAL_VARIABLE_GUID;
+
+    var = grub_efi_get_variable("SecureBoot", &global, &size);
+    if (var && size == 1 && *var == 1)
+    {
+        g_sys_sb = 1;
+    }
+
+    grub_check_free(var);
+}
+
+static int ventoy_secure_boot_init(void)
+{
+    grub_efi_guid_t ProtGuid = VTOY_SHIM_POLICY_GUID;
+
+    ventoy_get_uefi_sb();
+
+    if (g_sys_sb == 0)
+    {
+        return 0;
+    }
+
+
+    /*
+     * When SecureBoot enabled, Ventoy grub must be launched by Ventoy Shim.
+     * Currently only x86_64 support this feature.
+     */
+    if (g_ventoy_plat_data == VTOY_PLAT_X86_64_UEFI)
+    {
+        g_vtoy_shim = grub_efi_locate_protocol(&ProtGuid, NULL);
+        if (g_vtoy_shim == NULL || g_vtoy_shim->ByPassSB == NULL || g_vtoy_shim->CheckSB == NULL)
+        {
+            grub_cls();
+            grub_printf(VTOY_WARNING"\n");
+            grub_printf(VTOY_WARNING"\n");
+            grub_printf(VTOY_WARNING"\n\n\n");
+
+            grub_printf("Ventoy grub is not launched by Ventoy shim.\n\n");
+            grub_refresh();
+
+            ventoy_prompt_end();
+        }
+    }
+
+    return 0;
+}
+
+
+#endif
+
 static int ventoy_arch_mode_init(void)
 {
    #ifdef GRUB_MACHINE_EFI
+
    if (grub_strcmp(GRUB_TARGET_CPU, "i386") == 0)
    {
        g_ventoy_plat_data = VTOY_PLAT_I386_UEFI;
@@ -329,19 +443,6 @@ static int ventoy_arch_mode_init(void)
    return 0;
 }

-#ifdef GRUB_MACHINE_EFI
-static void ventoy_get_uefi_version(char *str, grub_size_t len)
-{
-    grub_efi_uint8_t uefi_minor_1, uefi_minor_2;
-
-    uefi_minor_1 = (grub_efi_system_table->hdr.revision & 0xffff) / 10;
-    uefi_minor_2 = (grub_efi_system_table->hdr.revision & 0xffff) % 10;
-    grub_snprintf(str, len, "%d.%d", (grub_efi_system_table->hdr.revision >> 16), uefi_minor_1);
-    if (uefi_minor_2)
-        grub_snprintf(str, len, "%s.%d", str, uefi_minor_2);
-}
-#endif
-
 static int ventoy_calc_totalmem(grub_uint64_t addr, grub_uint64_t size, grub_memory_type_t type, void *data)
 {
    grub_uint64_t *total_mem = (grub_uint64_t *)data;
@@ -431,12 +532,12 @@ int ventoy_global_var_init(void)

 static ctrl_var_cfg g_ctrl_vars[] =
 {
-    { "VTOY_WIN11_BYPASS_CHECK",  1 },
-    { "VTOY_WIN11_BYPASS_NRO",    1 },
-    { "VTOY_LINUX_REMOUNT",       0 },
-    { "VTOY_SECONDARY_BOOT_MENU", 1 },
-    { "VTOY_WIN_UEFI_MAX_RES",    1 },
-    { NULL, 0 }
+    { "VTOY_WIN11_BYPASS_CHECK",  "1" },
+    { "VTOY_WIN11_BYPASS_NRO",    "1" },
+    { "VTOY_LINUX_REMOUNT",       "0" },
+    { "VTOY_SECONDARY_BOOT_MENU", "1" },
+    { "VTOY_WIN_UEFI_RES_LOCK",   "3" },
+    { NULL, "" }
 };

 static const char * ventoy_ctrl_var_read_hook(struct grub_env_var *var, const char *val)
@@ -447,7 +548,7 @@ static const char * ventoy_ctrl_var_read_hook(struct grub_env_var *var, const ch
    {
        if (grub_strcmp(g_ctrl_vars[i].name, var->name) == 0)
        {
-            return g_ctrl_vars[i].value ? "1" : "0";
+            return g_ctrl_vars[i].szval;
        }
    }

@@ -462,14 +563,14 @@ static char * ventoy_ctrl_var_write_hook(struct grub_env_var *var, const char *v
    {
        if (grub_strcmp(g_ctrl_vars[i].name, var->name) == 0)
        {
-            if (val && val[0] == '1' && val[1] == 0)
+            if (val && grub_isdigit(val[0]) && val[1] == 0)
            {
-                g_ctrl_vars[i].value = 1;
-                return grub_strdup("1");
+                g_ctrl_vars[i].szval[0] = val[0];
+                return grub_strdup(val);
            }
            else
            {
-                g_ctrl_vars[i].value = 0;
+                g_ctrl_vars[i].szval[0] = '0';
                return grub_strdup("0");
            }
        }
@@ -480,12 +581,13 @@ static char * ventoy_ctrl_var_write_hook(struct grub_env_var *var, const char *v

 int ventoy_ctrl_var_init(void)
 {
-    int i;
+    ctrl_var_cfg *cfg = g_ctrl_vars;

-    for (i = 0; g_ctrl_vars[i].name; i++)
+    while (cfg->name)
    {
-        ventoy_env_export(g_ctrl_vars[i].name, g_ctrl_vars[i].value ? "1" : "0");
-        grub_register_variable_hook(g_ctrl_vars[i].name, ventoy_ctrl_var_read_hook, ventoy_ctrl_var_write_hook);
+        ventoy_env_export(cfg->name, cfg->szval);
+        grub_register_variable_hook(cfg->name, ventoy_ctrl_var_read_hook, ventoy_ctrl_var_write_hook);
+        cfg++;
    }

    return 0;
@@ -496,6 +598,11 @@ GRUB_MOD_INIT(ventoy)
    ventoy_hwinfo_init();
    ventoy_env_init();
    ventoy_arch_mode_init();
+
+#ifdef GRUB_MACHINE_EFI
+    ventoy_secure_boot_init();
+#endif
+
    ventoy_register_all_cmd();
 }

--- a/GRUB2/MOD_SRC/grub-2.04/grub-core/ventoy/ventoy_cmd.c
+++ b/GRUB2/MOD_SRC/grub-2.04/grub-core/ventoy/ventoy_cmd.c
@@ -3246,14 +3246,21 @@ void ventoy_fill_os_param(grub_file_t file, ventoy_os_param *param)
    grub_memcpy(param->vtoy_reserved + 7, g_ventoy_part_info->MBR.BootCode + 0x1b8, 4);


-    /* Windows UEFI force highest resolution */
+    /* Windows UEFI force resolution lock */
    if (g_ventoy_chain_type == 1) /* Windows */
    {
-        val = ventoy_get_env("VTOY_WIN_UEFI_MAX_RES");
-        if (val && val[0] == '1' && val[1] == 0)
+        val = ventoy_get_env("VTOY_WIN_UEFI_RES_LOCK");
+        if (val && val[1] == 0)
+        {
+            if (val[0] == '1')
            {
                param->vtoy_reserved[11] = 1;
            }
+            else if (val[0] == '2')
+            {
+                param->vtoy_reserved[11] = 2;
+            }
+        }
    }


@@ -4716,7 +4723,7 @@ static grub_err_t ventoy_cmd_img_unhook_root(grub_extcmd_context_t ctxt, int arg
 static grub_err_t ventoy_cmd_check_secureboot_var(grub_extcmd_context_t ctxt, int argc, char **args)
 {
    int ret = 1;
-    grub_uint8_t *var;
+    grub_uint8_t *var = NULL;
    grub_size_t size;
    grub_efi_guid_t global = GRUB_EFI_GLOBAL_VARIABLE_GUID;

@@ -4727,6 +4734,7 @@ static grub_err_t ventoy_cmd_check_secureboot_var(grub_extcmd_context_t ctxt, in
    var = grub_efi_get_variable("SecureBoot", &global, &size);
    if (var && *var == 1)
    {
+        grub_free(var);
        return 0;
    }

@@ -5111,7 +5119,7 @@ int ventoy_load_part_table(const char *diskname)
    return 0;
 }

-static void ventoy_prompt_end(void)
+void ventoy_prompt_end(void)
 {
    int op = 0;
    char c;
@@ -6405,6 +6413,52 @@ static grub_err_t ventoy_cmd_load_menu_lang(grub_extcmd_context_t ctxt, int argc
    VENTOY_CMD_RETURN(0);
 }

+static grub_err_t ventoy_cmd_update_sb_policy(grub_extcmd_context_t ctxt, int argc, char **args)
+{
+    (void)ctxt;
+    (void)argc;
+    (void)args;
+
+#ifdef GRUB_MACHINE_EFI
+    ventoy_set_sb_policy();
+#endif
+
+    VENTOY_CMD_RETURN(0);
+}
+
+static grub_err_t ventoy_cmd_sb_info(grub_extcmd_context_t ctxt, int argc, char **args)
+{
+    (void)ctxt;
+    (void)argc;
+    (void)args;
+
+#ifdef GRUB_MACHINE_EFI
+    const char *policy = NULL;
+
+    if (g_sb_policy == VTOY_SB_POLICY_BYPASS)
+    {
+        policy = "ByPass";
+    }
+    else if (g_sb_policy == VTOY_SB_POLICY_CHECK)
+    {
+        policy = "Check";
+    }
+    else
+    {
+        policy = "XXX";
+    }
+
+    grub_printf("UEFI Firmware Secure Boot: %s\n", g_sys_sb ? "Enable" : "Disable");
+    grub_printf("Ventoy Secure Boot Policy: %s\n", policy);
+#else
+    grub_printf("Non EFI mode!\n");
+#endif
+
+    grub_refresh();
+
+    VENTOY_CMD_RETURN(0);
+}
+
 static int ventoy_chksum_pathcmp(int chktype, char *rlpath, char *rdpath)
 {
    char *pos1 = NULL;
@@ -7053,6 +7107,9 @@ static cmd_para ventoy_cmds[] =
    { "vt_pop_menu_lang", ventoy_cmd_pop_menulang, 0, NULL, "", "", NULL },
    { "vt_linux_initrd", ventoy_cmd_linux_initrd, 0, NULL, "", "", NULL },

+    { "vt_sbinfo", ventoy_cmd_sb_info, 0, NULL, "", "", NULL },
+    { "vt_update_sb_policy", ventoy_cmd_update_sb_policy, 0, NULL, "", "", NULL },
+
 };

 int ventoy_register_all_cmd(void)
--- a/GRUB2/MOD_SRC/grub-2.04/grub-core/ventoy/ventoy_def.h
+++ b/GRUB2/MOD_SRC/grub-2.04/grub-core/ventoy/ventoy_def.h
@@ -195,6 +195,16 @@ typedef struct cpio_newc_header
 #define check_free(p, func) if (p) { func(p); p = NULL; }
 #define grub_check_free(p) if (p) { grub_free(p); p = NULL; }

+#define VTOY_SHIM_POLICY_GUID    {0x90a29d14, 0x3968, 0x48fe, { 0x85, 0x81, 0x6b, 0x7f, 0x7d, 0xc4, 0x70, 0x55 }};
+
+typedef void (*VTOY_BYPASS_SB)(void);
+typedef void (*VTOY_CHECK_SB)(void);
+typedef struct _VTOY_SHIM{
+	VTOY_BYPASS_SB ByPassSB;
+	VTOY_CHECK_SB CheckSB;
+} VTOY_SHIM;
+
+
 typedef int (*grub_char_check_func)(int c);
 #define ventoy_is_decimal(str)  ventoy_string_check(str, grub_isdigit)

@@ -1296,7 +1306,7 @@ typedef struct global_var_cfg
 typedef struct ctrl_var_cfg
 {
    const char *name;
-    int value;
+    char szval[2];
 }ctrl_var_cfg;

 #define vtoy_check_goto_out(p)  if (!p) goto out
@@ -1326,6 +1336,8 @@ int ventoy_ctrl_var_init(void);
 int ventoy_global_var_init(void);
 grub_err_t ventoy_cmd_push_menulang(grub_extcmd_context_t ctxt, int argc, char **args);
 grub_err_t ventoy_cmd_pop_menulang(grub_extcmd_context_t ctxt, int argc, char **args);
+void ventoy_prompt_end(void);
+int ventoy_set_sb_policy(void);

 #endif /* __VENTOY_DEF_H__ */

--- a/GRUB2/MOD_SRC/grub-2.04/include/grub/env.h
+++ b/GRUB2/MOD_SRC/grub-2.04/include/grub/env.h
@@ -24,6 +24,11 @@
 #include <grub/types.h>
 #include <grub/menu.h>

+#define VTOY_SB_POLICY_BYPASS   0
+#define VTOY_SB_POLICY_CHECK    1
+extern grub_uint8_t EXPORT_VAR(g_sys_sb);
+extern grub_uint8_t EXPORT_VAR(g_sb_policy);
+
 struct grub_env_var;

 typedef const char *(*grub_env_read_hook_t) (struct grub_env_var *var,
--- a/IMG/cpio/ventoy/hook/rhel6/udev_disk_hook.sh
+++ b/IMG/cpio/ventoy/hook/rhel6/udev_disk_hook.sh
@@ -72,6 +72,12 @@ ventoy_udev_disk_common_hook $* "noreplace"

 $BUSYBOX_PATH/mount $VTOY_DM_PATH /mnt/ventoy

+#fix Oracle Linux 6.9 install issue
+if $GREP -q -i 'Oracle Linux'  /mnt/ventoy/.discinfo; then
+    ln -s /mnt/ventoy  /mnt/source
+fi
+
+
 # 
 # We do a trick for rhel6 series here.
 # Use /dev/$vtCheatLoop and wapper it as a removable cdrom with bind mount.
--- a/IMG/cpio/ventoy/hook/ventoy-hook-lib.sh
+++ b/IMG/cpio/ventoy/hook/ventoy-hook-lib.sh
@@ -163,14 +163,15 @@ ventoy_get_vblade_bin() {
 }

 ventoy_find_bin_path() {        
+    #must use built-in dmsetup, so first try ventoy path. Otherwise ubuntu installer unhappy. #3567
+    if $BUSYBOX_PATH/which "$1" > /dev/null; then
+        $BUSYBOX_PATH/which "$1"; return
+    fi
    for vt_path in '/bin' '/sbin' '/usr/bin' '/usr/sbin' '/usr/local/bin' '/usr/local/sbin' '/root/bin'; do
        if [ -e "$vt_path/$1" ]; then
            echo "$vt_path/$1"; return
        fi
    done
-    if $BUSYBOX_PATH/which "$1" > /dev/null; then
-        $BUSYBOX_PATH/which "$1"; return
-    fi

    echo ""
 }
@@ -269,8 +270,8 @@ create_ventoy_device_mapper() {
    
    RAWDISKNAME=$($HEAD -n1 $VTOY_PATH/ventoy_raw_table | $AWK '{print $4}')    
    echo "$VT_DM_BIN create  ${RAWDISKNAME#/dev/}  $VTOY_PATH/ventoy_raw_table"  > /ventoy/ventoy_iso_part_dm_cmd    
-    echo "$VT_DM_BIN mknodes ${RAWDISKNAME#/dev/}"                              >> /ventoy/ventoy_iso_part_dm_cmd    
-    echo "$VT_DM_BIN ls"                                                        >> /ventoy/ventoy_iso_part_dm_cmd    
+    #echo "$VT_DM_BIN mknodes ${RAWDISKNAME#/dev/}"                              >> /ventoy/ventoy_iso_part_dm_cmd    
+    #echo "$VT_DM_BIN ls"                                                        >> /ventoy/ventoy_iso_part_dm_cmd    
 }

 create_persistent_device_mapper() {
--- a/INSTALL/EFI/BOOT/BOOTX64.EFI
+++ b/INSTALL/EFI/BOOT/BOOTX64.EFI
--- a/INSTALL/EFI/BOOT/MokManager.efi
+++ b/INSTALL/EFI/BOOT/MokManager.efi
--- a/INSTALL/EFI/BOOT/grub.efi
+++ b/INSTALL/EFI/BOOT/grub.efi
--- a/INSTALL/EFI/BOOT/mmx64.efi
+++ b/INSTALL/EFI/BOOT/mmx64.efi
--- a/INSTALL/grub/debug.cfg
+++ b/INSTALL/grub/debug.cfg
@@ -4,7 +4,7 @@
 #
 submenu "$VTLANG_CTRL_TEMP_SET" --class=debug_temp_set --class=F5tool {
    menuentry "[ $VTOY_WIN11_BYPASS_CHECK ]  $VTLANG_WIN11_BYPASS_CHECK" --class=debug_temp_win11_bypass --class=debug_temp_set --class=F5tool \
-        VTOY_RUN_SET0 {
+        VTOY_RUN_SET_0_0 {
        if [ "$VTOY_WIN11_BYPASS_CHECK" = "0" ]; then
            set VTOY_WIN11_BYPASS_CHECK=1
        else
@@ -13,7 +13,7 @@ submenu "$VTLANG_CTRL_TEMP_SET" --class=debug_temp_set --class=F5tool {
    }
    
    menuentry "[ $VTOY_WIN11_BYPASS_NRO ]  $VTLANG_WIN11_BYPASS_NRO" --class=debug_temp_win11_nro --class=debug_temp_set --class=F5tool \
-        VTOY_RUN_SET1 {
+        VTOY_RUN_SET_1_0 {
        if [ "$VTOY_WIN11_BYPASS_NRO" = "0" ]; then
            set VTOY_WIN11_BYPASS_NRO=1
        else
@@ -22,7 +22,7 @@ submenu "$VTLANG_CTRL_TEMP_SET" --class=debug_temp_set --class=F5tool {
    }    
    
    menuentry "[ $VTOY_SECONDARY_BOOT_MENU ]  $VTLANG_SECONDARY_BOOT_MENU" --class=debug_temp_second_menu --class=debug_temp_set --class=F5tool \
-        VTOY_RUN_SET2 {
+        VTOY_RUN_SET_2_0 {
        if [ "$VTOY_SECONDARY_BOOT_MENU" = "0" ]; then
            set VTOY_SECONDARY_BOOT_MENU=1
        else
@@ -30,19 +30,46 @@ submenu "$VTLANG_CTRL_TEMP_SET" --class=debug_temp_set --class=F5tool {
        fi
    }    

-    menuentry "[ $VTOY_WIN_UEFI_MAX_RES ]  $VTLANG_WIN_UEFI_MAX_RES" --class=debug_temp_win_uefi_res --class=debug_temp_set --class=F5tool \
-        VTOY_RUN_SET3 {
-        if [ "$VTOY_WIN_UEFI_MAX_RES" = "0" ]; then
-            set VTOY_WIN_UEFI_MAX_RES=1
-        else
-            set VTOY_WIN_UEFI_MAX_RES=0
+    menuentry "$VTLANG_RETURN_PREVIOUS" --class=vtoyret VTOY_RET {
+        echo "Return ..."
+    }
+}
+
+
+if [ "$grub_platform" != "pc" ]; then
+    submenu "$VTLANG_WIN_UEFI_RES_LOCK" --class=debug_uefi_res_lock --class=F5tool {
+        set vtActive0="[ ]"
+        set vtActive1="[ ]"
+        set vtActive2="[ ]"
+        set vtActive3="[ ]"
+        if [ "$VTOY_WIN_UEFI_RES_LOCK" = "0" ]; then
+            set vtActive0="[*]"
+        elif [ "$VTOY_WIN_UEFI_RES_LOCK" = "1" ]; then
+            set vtActive1="[*]"
+        elif [ "$VTOY_WIN_UEFI_RES_LOCK" = "2" ]; then
+            set vtActive2="[*]"
+        elif [ "$VTOY_WIN_UEFI_RES_LOCK" = "3" ]; then
+            set vtActive3="[*]"
        fi
+
+        menuentry "$vtActive0 $VTLANG_UEFI_RES_LOCK_NONE" --class=debug_uefi_res_lock0 --class=F5tool VTOY_RUN_SET_0_1 {
+            set VTOY_WIN_UEFI_RES_LOCK=0
+        }
+        menuentry "$vtActive1 $VTLANG_UEFI_RES_LOCK_MAX" --class=debug_uefi_res_lock1 --class=F5tool VTOY_RUN_SET_1_1 {
+            set VTOY_WIN_UEFI_RES_LOCK=1
+        }
+        menuentry "$vtActive2 $VTLANG_UEFI_RES_LOCK_1024_768" --class=debug_uefi_res_lock2 --class=F5tool VTOY_RUN_SET_2_1 {
+            set VTOY_WIN_UEFI_RES_LOCK=2
+        }
+        menuentry "$vtActive3 $VTLANG_UEFI_RES_LOCK_BE1024_768" --class=debug_uefi_res_lock3 --class=F5tool VTOY_RUN_SET_3_1 {
+            set VTOY_WIN_UEFI_RES_LOCK=3
        }
        
        menuentry "$VTLANG_RETURN_PREVIOUS" --class=vtoyret VTOY_RET {
            echo "Return ..."
        }
-}
+    }
+fi


 submenu "$VTLANG_MENU_LANG" --class=debug_menu_lang --class=F5tool {
--- a/INSTALL/grub/grub.cfg
+++ b/INSTALL/grub/grub.cfg
@@ -2449,7 +2449,7 @@ function mimg_common_menuentry {
 #############################################################
 #############################################################

-set VENTOY_VERSION="1.1.11"
+set VENTOY_VERSION="1.1.14"

 #ACPI not compatible with Window7/8, so disable by default
 set VTOY_PARAM_NO_ACPI=1
@@ -2551,6 +2551,10 @@ else
    vt_check_json_path_case $vtoy_iso_part
 fi

+#Update Secure Boot Policy
+vt_update_sb_policy
+
+
 if [ -n "$VTOY_MENU_LANGUAGE" ]; then
    vt_init_menu_lang "$VTOY_MENU_LANGUAGE"
 else
--- a/INSTALL/grub/menu/ar_AR.json
+++ b/INSTALL/grub/menu/ar_AR.json
@@ -88,6 +88,11 @@
    "VTLANG_WIN11_BYPASS_NRO": "تجاوز متطلبات الحساب عبر الإنترنت عند تثبيت Windows 11",
    "VTLANG_LINUX_REMOUNT": "ضم قسم Ventoy بعد إقلاع Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "اظهر قائمة الإقلاع الثانوية",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/bn_BN.json
+++ b/INSTALL/grub/menu/bn_BN.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Windows 11 ইনস্টল করার সময় অনলাইন অ্যাকাউন্টের প্রয়োজন বাইপাস করুন",
    "VTLANG_LINUX_REMOUNT": "লিনাক্স বুটের পরে ভেন্টয় পার্টিশনটি মাউন্ট করুন",
    "VTLANG_SECONDARY_BOOT_MENU": "গৌণ বুট মেনু দেখান",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/cs_CZ.json
+++ b/INSTALL/grub/menu/cs_CZ.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Obejít požadování online účtu při instalaci Windows 11",
    "VTLANG_LINUX_REMOUNT": "Připojit Ventoy oddíl po spuštění Linuxu",
    "VTLANG_SECONDARY_BOOT_MENU": "Zobrazit druhou spouštěcí nabídku",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+
    
    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/de_DE.json
+++ b/INSTALL/grub/menu/de_DE.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Umgehen Sie die Online-Kontoanforderung bei der Installation von Windows 11",
    "VTLANG_LINUX_REMOUNT": "Mounten Sie die Ventoy-Partition nach dem Booten von Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "Sekundäres Bootmenü anzeigen",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/el_GR.json
+++ b/INSTALL/grub/menu/el_GR.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Παράκαμψη της απαίτησης online λογαριασμού κατά την εγκατάσταση των Windows 11",
    "VTLANG_LINUX_REMOUNT": "Προσάρτηση διαμερίσματος Ventoy μετά την εκκίνηση του Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "Εμφάνιση δευτερεύοντος μενού εκκίνησης",
+     "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/en_US.json
+++ b/INSTALL/grub/menu/en_US.json
@@ -88,6 +88,11 @@
    "VTLANG_WIN11_BYPASS_NRO": "Bypass online account requirement when install Windows 11",
    "VTLANG_LINUX_REMOUNT": "Mount Ventoy partition after boot Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "Show secondary boot menu",    
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
    
    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/es_ES.json
+++ b/INSTALL/grub/menu/es_ES.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Saltar requerimiento de cuenta en linea al instalar Windows 11",
    "VTLANG_LINUX_REMOUNT": "Montar partición de Ventoy después de arrancar Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "Mostrar menú de arranque secundario",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/fa_IR.json
+++ b/INSTALL/grub/menu/fa_IR.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "دور زدن نیاز به حساب کاربری آنلاین هنگام نصب ویندوز 11",
    "VTLANG_LINUX_REMOUNT": "اتصال پارتیشن Ventoy بعد از بوت لینوکس",
    "VTLANG_SECONDARY_BOOT_MENU": "نمایش منوی بوت ثانویه",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/fr_FR.json
+++ b/INSTALL/grub/menu/fr_FR.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Contourner l'exigence de compte en ligne lors de l'installation de Windows 11",
    "VTLANG_LINUX_REMOUNT": "Monter la partition Ventoy après le démarrage de Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "Afficher le menu de démarrage secondaire",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/hi_HI.json
+++ b/INSTALL/grub/menu/hi_HI.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "विंडोज 11 स्थापित करते समय ऑनलाइन खाते की आवश्यकता बाईपास",
    "VTLANG_LINUX_REMOUNT": "लिनक्स बूट के बाद वेंटॉय विभाजन को माउंट करें",
    "VTLANG_SECONDARY_BOOT_MENU": "द्वितीयक बूट मेनू दिखाएं",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/hr_HR.json
+++ b/INSTALL/grub/menu/hr_HR.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Bypass online account requirement when install Windows 11",
    "VTLANG_LINUX_REMOUNT": "Mount Ventoy partition after boot Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "Show secondary boot menu",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/hu_HU.json
+++ b/INSTALL/grub/menu/hu_HU.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Internetes fiók követelményének megkerülése Windows 11 telepítésekor",
    "VTLANG_LINUX_REMOUNT": "Ventoy partíció csatolása a Linux indítása után",
    "VTLANG_SECONDARY_BOOT_MENU": "Másodlagos indítási menü megjelenítése",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/id_ID.json
+++ b/INSTALL/grub/menu/id_ID.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Melewati persyaratan akun online ketika memasang Windows 11",
    "VTLANG_LINUX_REMOUNT": "Memuat partisi Ventoy setelah boot ke Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "Tampilkan menu boot sekunder",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/it_IT.json
+++ b/INSTALL/grub/menu/it_IT.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Durante l'installazione di Windows 11 bypassa il requisito di un account online ",
    "VTLANG_LINUX_REMOUNT": "Dopo l'avvio di Linux monta la partizione Ventoy ",
    "VTLANG_SECONDARY_BOOT_MENU": "Visualizza menu di avvio secondario",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/ja_JP.json
+++ b/INSTALL/grub/menu/ja_JP.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Bypass online account requirement when install Windows 11",
    "VTLANG_LINUX_REMOUNT": "Mount Ventoy partition after boot Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "Show secondary boot menu",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/ka_GE.json
+++ b/INSTALL/grub/menu/ka_GE.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Bypass online account requirement when install Windows 11",
    "VTLANG_LINUX_REMOUNT": "Mount Ventoy partition after boot Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "Show secondary boot menu",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/ko_KR.json
+++ b/INSTALL/grub/menu/ko_KR.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Windows 11 설치 시 온라인 계정 요구 사항 무시",
    "VTLANG_LINUX_REMOUNT": "Linux 부팅 후 Ventoy 파티션 마운트",
    "VTLANG_SECONDARY_BOOT_MENU": "보조 부팅 메뉴 표시",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/lg_UG.json
+++ b/INSTALL/grub/menu/lg_UG.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Bypass online account requirement when install Windows 11",
    "VTLANG_LINUX_REMOUNT": "Mount Ventoy partition after boot Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "Show secondary boot menu",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/pl_PL.json
+++ b/INSTALL/grub/menu/pl_PL.json
@@ -28,40 +28,40 @@
    "VTLANG_CHKSUM_SHA256_CALC_CHK": "Oblicz i sprawdź sumę sha256",
    "VTLANG_CHKSUM_SHA512_CALC_CHK": "Oblicz i sprawdź sumę sha512",
    
-    "VTLANG_POWER": "Zasilanie",
+    "VTLANG_POWER": "Opcje zasilania",
    "VTLANG_POWER_REBOOT": "Uruchom ponownie",
    "VTLANG_POWER_HALT": "Zakończ",
    "VTLANG_POWER_BOOT_EFIFW": "Uruchom ponownie i przejdź do konfiguracji EFI",
    
    "VTLANG_KEYBRD_LAYOUT": "Układy klawiatury",
-    "VTLANG_HWINFO": "Informacje o sprzęcie",
+    "VTLANG_HWINFO": "Informacje o konfiguracji sprzętowej",
    
    "VTLANG_RESOLUTION_CFG": "Konfiguracja rozdzielczości",
    "VTLANG_SCREEN_MODE": "Tryb wyświetlania ekranu",
    "VTLANG_SCREEN_TEXT_MODE": "Wymuś tryb tekstowy",
    "VTLANG_SCREEN_GUI_MODE": "Wymuś tryb graficzny",
    
-    "VTLANG_THEME_SELECT": "Wybór motywu",
+    "VTLANG_THEME_SELECT": "Wybierz motyw",
    
-    "VTLANG_UEFI_UTIL": "Narzędzia UEFI Ventoy",
+    "VTLANG_UEFI_UTIL": "Narzędzia Ventoy UEFI",
    "VTLANG_UTIL_SHOW_EFI_DRV": "Pokaż sterowniki EFI",
    "VTLANG_UTIL_FIX_BLINIT_FAIL": "Napraw błąd BlinitializeLibrary systemu Windows",
    
-    "VTLANG_JSON_CHK_JSON": "Sprawdź konfigurację wtyczki json (ventoy.json)",
-    "VTLANG_JSON_CHK_CONTROL": "Sprawdź konfigurację wtyczki globalnej kontroli",
-    "VTLANG_JSON_CHK_THEME": "Sprawdź konfigurację wtyczki motywu",
-    "VTLANG_JSON_CHK_AUTOINS": "Sprawdź konfigurację wtyczki automatycznej instalacji",
-    "VTLANG_JSON_CHK_PERSIST": "Sprawdź konfigurację wtyczki trwałości",
-    "VTLANG_JSON_CHK_MENU_ALIAS": "Sprawdź konfigurację wtyczek aliasów menu",
-    "VTLANG_JSON_CHK_MENU_TIP": "Sprawdź konfigurację wtyczki podpowiedzi menu",
-    "VTLANG_JSON_CHK_MENU_CLASS": "Sprawdź konfigurację wtyczki klasy menu",
-    "VTLANG_JSON_CHK_INJECTION": "Sprawdź konfigurację wtyczki wstrzykiwania",
-    "VTLANG_JSON_CHK_AUTO_MEMDISK": "Sprawdź automatyczną konfigurację wtyczki memdisk",
-    "VTLANG_JSON_CHK_IMG_LIST": "Sprawdź konfigurację wtyczki listy obrazów",
-    "VTLANG_JSON_CHK_IMG_BLIST": "Sprawdź konfigurację wtyczki czarnej listy obrazów",
-    "VTLANG_JSON_CHK_CONF_REPLACE": "Sprawdź konfigurację wtyczki zastępującej konfigurację bootowania",
-    "VTLANG_JSON_CHK_DUD": "Sprawdź konfigurację wtyczki dud",
-    "VTLANG_JSON_CHK_PASSWORD": "Sprawdź konfigurację wtyczki hasła",
+    "VTLANG_JSON_CHK_JSON": "Sprawdź konfigurację pluginu json (ventoy.json)",
+    "VTLANG_JSON_CHK_CONTROL": "Sprawdź konfigurację pluginu Global Control",
+    "VTLANG_JSON_CHK_THEME": "Sprawdź konfigurację pluginu Theme",
+    "VTLANG_JSON_CHK_AUTOINS": "Sprawdź konfigurację pluginu Auto Installation",
+    "VTLANG_JSON_CHK_PERSIST": "Sprawdź konfigurację pluginu Persistence",
+    "VTLANG_JSON_CHK_MENU_ALIAS": "Sprawdź konfigurację pluginu Menu Alias",
+    "VTLANG_JSON_CHK_MENU_TIP": "Sprawdź konfigurację pluginu Menu Tip",
+    "VTLANG_JSON_CHK_MENU_CLASS": "Sprawdź konfigurację pluginu Menu Class",
+    "VTLANG_JSON_CHK_INJECTION": "Sprawdź konfigurację pluginu Injection",
+    "VTLANG_JSON_CHK_AUTO_MEMDISK": "Sprawdź konfigurację pluginu Auto Memdisk",
+    "VTLANG_JSON_CHK_IMG_LIST": "Sprawdź konfigurację pluginu Image List",
+    "VTLANG_JSON_CHK_IMG_BLIST": "Sprawdź konfigurację pluginu Blacklist dla obrazów",
+    "VTLANG_JSON_CHK_CONF_REPLACE": "Sprawdź konfigurację pluginu Boot Conf Replace",
+    "VTLANG_JSON_CHK_DUD": "Sprawdź konfigurację pluginu DUD (Driver Update Disk)",
+    "VTLANG_JSON_CHK_PASSWORD": "Sprawdź konfigurację pluginu Password",
    
    "VTLANG_NORMAL_MODE": "Uruchom w trybie normalnym",
    "VTLANG_WIMBOOT_MODE": "Uruchom w trybie Wimboot",
@@ -74,7 +74,7 @@
    "VTLANG_NO_AUTOINS_SCRIPT": "Uruchom bez szablonu automatycznej instalacji",
    "VTLANG_AUTOINS_USE": "Uruchom z",
    
-    "VTLANG_NO_PERSIST": "Uruchom bez zachowania",
+    "VTLANG_NO_PERSIST": "Uruchom bez persistence (zapisywania ustawień)",
    "VTLANG_PERSIST_USE": "Uruchom z",
    
    "VTLANG_BROWER_RETURN": "Powrót",
@@ -84,10 +84,16 @@
    "VTLANG_ENTER_CONTINUE": "naciśnij klawisz Enter, aby kontynuować",
    
    "VTLANG_CTRL_TEMP_SET": "Tymczasowe ustawienia kontroli",
-    "VTLANG_WIN11_BYPASS_CHECK": "Pominięcie kontroli CPU/TPM/SecureBoot podczas instalacji Windows 11",
-    "VTLANG_WIN11_BYPASS_NRO": "Pominięcie wymogu posiadania konta online podczas instalacji systemu Windows 11",
-    "VTLANG_LINUX_REMOUNT": "Zamontuj partycję Ventoy po starcie Linuksa",
-    "VTLANG_SECONDARY_BOOT_MENU": "Pokaż dodatkowe menu startowe",
+    "VTLANG_WIN11_BYPASS_CHECK": "Pominięcie sprawdzania CPU/TPM/SecureBoot podczas instalacji Windows 11",
+    "VTLANG_WIN11_BYPASS_NRO": "Pominięcie wymogu posiadania konta Microsoft podczas instalacji Windows 11",
+    "VTLANG_LINUX_REMOUNT": "Zamontuj partycję Ventoy po uruchomieniu Linuksa",
+    "VTLANG_SECONDARY_BOOT_MENU": "Pokaż dodatkowe menu rozruchowe (boot menu)",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Zablokuj rozdzielczość podczas bootowania UEFI Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "Brak",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Najwyższa",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Stała 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "Co najmniej 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/pt_BR.json
+++ b/INSTALL/grub/menu/pt_BR.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Ignorar o requerimento de conta online quanto instalar o Windows 11",
    "VTLANG_LINUX_REMOUNT": "Montar a partição do Ventoy após iniciar o Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "Mostrar o menu secundário da inicialização",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/pt_PT.json
+++ b/INSTALL/grub/menu/pt_PT.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Ignorar requerimento de conta online quanto instalando Windows 11",
    "VTLANG_LINUX_REMOUNT": "Montar partição Ventoy após boot do Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "Mostar menu seundário de boot",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/ru_RU.json
+++ b/INSTALL/grub/menu/ru_RU.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Обойти требование сетевой учётной записи при установке Windows 11",
    "VTLANG_LINUX_REMOUNT": "Смонтировать раздел Ventoy после загрузки Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "Показать вторичное загрузочное меню",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/sl_si.json
+++ b/INSTALL/grub/menu/sl_si.json
@@ -88,6 +88,12 @@
  "VTLANG_WIN11_BYPASS_NRO": "Obid zahteve po spletnem računu pri namestitvi sistema Windows 11",
  "VTLANG_LINUX_REMOUNT": "Priklopi Ventoy particijo po zagonu Linuxa",
  "VTLANG_SECONDARY_BOOT_MENU": "Prikaz sekundarnega zagonskega menija",
+  "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+  "VTLANG_UEFI_RES_LOCK_NONE": "None",
+  "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+  "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

  "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/sr_RS.json
+++ b/INSTALL/grub/menu/sr_RS.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Bypass online account requirement when install Windows 11",
    "VTLANG_LINUX_REMOUNT": "Mount Ventoy partition after boot Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "Show secondary boot menu",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/ta_IN.json
+++ b/INSTALL/grub/menu/ta_IN.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "விண்டோஸ் 11 ஐ நிறுவும் போது ஆன்லைன் கணக்கின் தேவையை புறக்கணிக்கவும்",
    "VTLANG_LINUX_REMOUNT": "லினக்ஸை துவக்கிய பிறகு Ventoy பகிர்வை ஏற்றவும்",
    "VTLANG_SECONDARY_BOOT_MENU": "இரண்டாம் நிலை துவக்க பட்டியலைக்  காட்டு",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/tr_TR.json
+++ b/INSTALL/grub/menu/tr_TR.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Windows11'i yüklerken, çevrimiçi hesap gereksinimini(OOBE) atla",
    "VTLANG_LINUX_REMOUNT": "Linux sistemi önyükledikten sonra, Ventoy bölümünü bağla",
    "VTLANG_SECONDARY_BOOT_MENU": "İkincil önyükleme menüsünü göster",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/uk_UA.json
+++ b/INSTALL/grub/menu/uk_UA.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Обійти вимогу онлайн-аккаунту під час інсталяції Windows 11",
    "VTLANG_LINUX_REMOUNT": "Монтувати розділ Ventoy після завантаження Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "Показувати вторинне меню завантаження",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/vi_VN.json
+++ b/INSTALL/grub/menu/vi_VN.json
@@ -88,6 +88,12 @@
    "VTLANG_WIN11_BYPASS_NRO": "Bỏ qua yêu cầu tài khoản trực tuyến khi cài đặt Windows 11",
    "VTLANG_LINUX_REMOUNT": "Gắn phân vùng Ventoy sau khi khởi động GNU/Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "Hiện menu khởi động thứ cấp`",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/zh_CN.json
+++ b/INSTALL/grub/menu/zh_CN.json
@@ -88,6 +88,11 @@
    "VTLANG_WIN11_BYPASS_NRO": "安装 Windows 11 时绕过在线账户的要求",
    "VTLANG_LINUX_REMOUNT": "启动 Linux 系统后挂载 Ventoy 分区",
    "VTLANG_SECONDARY_BOOT_MENU": "显示二级启动菜单",
+    "VTLANG_WIN_UEFI_RES_LOCK": "UEFI启动 Windows/WinPE 时锁定分辨率",
+    "VTLANG_UEFI_RES_LOCK_NONE": "不锁定",
+    "VTLANG_UEFI_RES_LOCK_MAX": "锁定最高分辨率",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "锁定 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "锁定 1024 x 768 及以上",
    
    "MENU_STR_XXX": ""
 }
--- a/INSTALL/grub/menu/zh_TW.json
+++ b/INSTALL/grub/menu/zh_TW.json
@@ -88,6 +88,11 @@
    "VTLANG_WIN11_BYPASS_NRO": "安裝 Windows 11 時繞過登入帳戶的需求",
    "VTLANG_LINUX_REMOUNT": "啟動 Linux 系統後掛載 Ventoy 分區",
    "VTLANG_SECONDARY_BOOT_MENU": "顯示次要啟動選單",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
+    "VTLANG_UEFI_RES_LOCK_NONE": "None",
+    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",

    "MENU_STR_XXX": ""
 }
--- a/INSTALL/sign_with_pass.exp
+++ b/INSTALL/sign_with_pass.exp
@@ -0,0 +1,19 @@
+#!/usr/bin/expect -f
+
+set password [lindex $argv 0]
+set key_file  [lindex $argv 1]
+set cert_file [lindex $argv 2]
+set input_file [lindex $argv 3]
+set output_file [lindex $argv 4]
+
+
+spawn bash -c "sbsign --key '$key_file' --cert '$cert_file' --output '$output_file' '$input_file' 2>&1"
+expect -nocase -re "Enter PEM pass phrase:"
+send "$password\r"
+
+
+expect eof
+
+
+set ret [wait]
+exit [lindex $ret 3]
--- a/INSTALL/tool/ENROLL_THIS_KEY_IN_MOKMANAGER.cer
+++ b/INSTALL/tool/ENROLL_THIS_KEY_IN_MOKMANAGER.cer
--- a/INSTALL/ventoy/vtoyjump32.exe
+++ b/INSTALL/ventoy/vtoyjump32.exe
--- a/INSTALL/ventoy/vtoyjump64.exe
+++ b/INSTALL/ventoy/vtoyjump64.exe
--- a/INSTALL/ventoy_pack.sh
+++ b/INSTALL/ventoy_pack.sh
@@ -1,5 +1,64 @@
 #!/bin/sh

+if [ "$VENTOY_CERT_PASS" = "YES" ]; then
+    read -s -p "Enter cert key passphrase: " KEY_PASS   
+    echo
+
+    if openssl pkey -in "$VENTOY_CERT_KEY" -passin pass:"$KEY_PASS" -out /dev/null  > /dev/null 2>&1; then
+        echo "Password check OK"
+    else
+        echo "Incorrect password"
+        exit 1
+    fi
+fi
+
+SBAT_VER=1
+sign_efi() {
+    efi=$1
+    
+    if [ ! -f "$efi" ]; then
+        printf "### %-64s  non-exist\n" "$efi"
+        return
+    fi
+
+    #Don't sign if VENTOY_CERT_KEY is not defined.
+    if [ -z "$VENTOY_CERT_KEY" -o -z "$VENTOY_CERT_PEM" ]; then
+        printf "### %-64s  NO-CA\n" "$efi"
+        return
+    fi    
+
+    if echo $efi | grep -q '\.xz$'; then
+        xzcat $efi > ${efi}.unxz
+        mv ${efi}.unxz  ${efi}
+    fi
+
+    sbstr=$(printf "%08x" $SBAT_VER)
+    echo -en "\x8a\x06\x55\xf7\x4f\xe0\x2b\x45\x9d\x6d\x7c\x55\x96\xb3\xc0\x7d\x${sbstr:6:2}\x${sbstr:4:2}\x${sbstr:2:2}\x${sbstr:0:2}" | \
+        dd bs=1 count=20 of=${efi} seek=40 conv=notrunc status=none
+
+    rm -f "${efi}.signed"
+    if [ "$VENTOY_CERT_PASS" = "YES" ]; then
+        expect -f ./sign_with_pass.exp "$KEY_PASS" "$VENTOY_CERT_KEY" "$VENTOY_CERT_PEM" "${efi}" "${efi}.signed" >/dev/null 2>&1
+    else
+        sbsign --key "$VENTOY_CERT_KEY" --cert "$VENTOY_CERT_PEM" --output "${efi}.signed" "${efi}" >/dev/null 2>&1
+    fi
+
+    if [ -f "${efi}.signed" ]; then
+        if echo $efi | grep -q '\.xz$'; then
+            xz --check=crc32 "${efi}.signed"
+            mv "${efi}.signed.xz" "$efi"
+            rm -f "${efi}.signed"
+        else
+            mv "${efi}.signed" "$efi"
+        fi
+    else
+        echo "### %-64s  failed\n" "$efi"
+        exit 1
+    fi 
+
+    printf "### %-64s  success\n" "$efi"
+}
+
 if [ "$1" = "CI" ]; then
    OPT='-dR'
 else
@@ -132,6 +191,27 @@ cp -a ./tool/create_ventoy_iso_part_dm.sh  $tmpmnt/tool/
 rm -f $tmpmnt/grub/i386-pc/*.img


+sign_efi $tmpmnt/EFI/BOOT/fbx64.efi
+sign_efi $tmpmnt/EFI/BOOT/fbia32.efi
+sign_efi $tmpmnt/EFI/BOOT/fbaa64.efi
+sign_efi $tmpmnt/EFI/BOOT/grubx64_real.efi
+sign_efi $tmpmnt/EFI/BOOT/grubia32_real.efi
+sign_efi $tmpmnt/ventoy/iso9660_x64.efi
+sign_efi $tmpmnt/ventoy/iso9660_ia32.efi
+sign_efi $tmpmnt/ventoy/iso9660_aa64.efi
+sign_efi $tmpmnt/ventoy/udf_x64.efi
+sign_efi $tmpmnt/ventoy/udf_ia32.efi
+sign_efi $tmpmnt/ventoy/udf_aa64.efi
+sign_efi $tmpmnt/ventoy/ventoy_x64.efi
+sign_efi $tmpmnt/ventoy/ventoy_ia32.efi
+sign_efi $tmpmnt/ventoy/ventoy_aa64.efi
+sign_efi $tmpmnt/ventoy/vtoyutil_x64.efi
+sign_efi $tmpmnt/ventoy/vtoyutil_ia32.efi
+sign_efi $tmpmnt/ventoy/vtoyutil_aa64.efi
+sign_efi $tmpmnt/ventoy/wimboot.i386.efi.xz
+sign_efi $tmpmnt/ventoy/wimboot.x86_64.xz
+
+
 umount $tmpmnt && rm -rf $tmpmnt


@@ -271,6 +351,13 @@ cd $CurDir
 mv ../LiveCDGUI/ventoy*.iso ./

 if [ -e ventoy-${curver}-windows.zip ] && [ -e ventoy-${curver}-linux.tar.gz ]; then
+
+    if [ -z "$VENTOY_CERT_KEY" -o -z "$VENTOY_CERT_PEM" ]; then
+        echo "[warning]: EFI files are not signed and can only boot when Secure Boot is disabled."
+        echo "[warning]: EFI files are not signed and can only boot when Secure Boot is disabled."
+        echo "[warning]: EFI files are not signed and can only boot when Secure Boot is disabled."
+    fi
+
    echo -e "\n ============= SUCCESS =================\n"
 else
    echo -e "\n ============= FAILED =================\n"
--- a/LANGUAGES/languages.json
+++ b/LANGUAGES/languages.json
@@ -616,10 +616,10 @@
        "STR_BTN_CANCEL":"Anuluj",
        "STR_PRESERVE_SPACE":"Zarezerwuj trochę miejsca na końcu dysku",
        "STR_SPACE_VAL_INVALID":"Nieprawidłowa wartość dla zarezerwowanego miejsca",
-        "STR_MENU_CLEAR":"Wyczyść Ventoy",
+        "STR_MENU_CLEAR":"Usuń Ventoy z urządzenia",
        "STR_CLEAR_SUCCESS":"Ventoy został pomyślnie usunięty z urządzenia.",
        "STR_CLEAR_FAILED":"Wystąpił błąd podczas usuwania Ventoy z dysku. Możesz podłączyć USB i spróbować jeszcze raz. Szczegóły w log.txt.",
-        "STR_MENU_PART_STYLE":"Schemat partycji",
+        "STR_MENU_PART_STYLE":"Schemat partycjonowania",
        "STR_DISK_2TB_MBR_ERROR":"Wybierz GPT dla dysku powyżej 2TB",
        "STR_SHOW_ALL_DEV":"Pokaż wszystkie urządzenia",
        "STR_PART_ALIGN_4KB":"Wyrównaj partycje do 4KB",
@@ -633,11 +633,11 @@
        "STR_VTSI_CREATE_TIP":"Tym razem nie zapisze na urządzeniu, ale tylko wygeneruje plik VTSI#@Kontynuować?",
        "STR_VTSI_CREATE_SUCCESS":"Pomyślnie wygenerowany plik VTSI!#@Możesz teraz użyć Rufus'a(3.15+) aby zapisać go na urządzeniu by dokończyć instalację Ventoy.",
        "STR_VTSI_CREATE_FAILED":"Wygenerowanie pliku VTSI nie powiodło się.",
-        "STR_MENU_PART_RESIZE":"Nieniszcząca instalacja",
-        "STR_PART_RESIZE_TIP":"Ventoy spróbuje nieniszczącej instalacji jeśli jest możliwa. #@Kontynuować?",
-        "STR_PART_RESIZE_SUCCESS":"Gratulacje!#@Nieniszcząca instalacja Ventoy zakończyła się pomyślnie.",
-        "STR_PART_RESIZE_FAILED":"Nieniszcząca instalacja nie powiodła się, sprawdź log.txt po szczegóły.",
-        "STR_PART_RESIZE_UNSUPPORTED":"Nieniszcząca instalacja Ventoy została zatrzymana, ponieważ niektóre wymagania nie zostały spełnione. Sprawdź log.txt po szczegóły.",
+        "STR_MENU_PART_RESIZE":"Instalacja bez utraty danych",
+        "STR_PART_RESIZE_TIP":"Jeśli to możliwe, Ventoy spróbuje przeprowadzić instalację bez utraty danych. #@Kontynuować?",
+        "STR_PART_RESIZE_SUCCESS":"Gratulacje! Instalacja bez utraty danych #@Ventoy zakończona pomyślnie.",
+        "STR_PART_RESIZE_FAILED":"Instalacja bez utraty danych zakończyła się niepowodzeniem. Szczegóły znajdziesz w pliku log.txt.",
+        "STR_PART_RESIZE_UNSUPPORTED":"Instalacja bez utraty danych Ventoy została przerwana, ponieważ nie można spełnić niektórych warunków. Szczegóły znajdziesz w pliku log.txt.",
        "STR_INSTALL_YES_TIP1":"Ostrzeżenie: Dane zostaną utracone!",
        "STR_INSTALL_YES_TIP2":"Wpisz YES w poniższym polu tekstowym, aby potwierdzić, że naprawdę chcesz przeprowadzić nową instalację zamiast aktualizacji.",
        "STR_PART_VENTOY_FS":"System plików dla partycji Ventoy",
--- a/Plugson/src/Web/ventoy_http.c
+++ b/Plugson/src/Web/ventoy_http.c
@@ -559,6 +559,8 @@ void ventoy_data_default_control(data_control *data)
    data->secondary_menu_timeout = 0;
    data->win11_bypass_check = 1;
    data->win11_bypass_nro = 1;
+    data->uefi_res_lock = 3;
+    data->uefi_sb_policy = 0;

    strlcpy(data->default_kbd_layout, "QWERTY_USA");
    strlcpy(data->menu_language, "en_US");
@@ -584,6 +586,8 @@ int ventoy_data_cmp_control(data_control *data1, data_control *data2)
        data1->password_asterisk != data2->password_asterisk ||
        data1->secondary_menu != data2->secondary_menu ||
        data1->menu_timeout != data2->menu_timeout ||
+        data1->uefi_res_lock != data2->uefi_res_lock ||
+        data1->uefi_sb_policy != data2->uefi_sb_policy ||
        data1->secondary_menu_timeout != data2->secondary_menu_timeout)
    {
        return 1;
@@ -633,6 +637,8 @@ int ventoy_data_save_control(data_control *data, const char *title, char *buf, i
    VTOY_JSON_FMT_CTRL_INT(L2, "VTOY_SECONDARY_BOOT_MENU",  secondary_menu);
    VTOY_JSON_FMT_CTRL_INT(L2, "VTOY_SHOW_PASSWORD_ASTERISK",  password_asterisk);
    VTOY_JSON_FMT_CTRL_INT(L2, "VTOY_MENU_TIMEOUT",  menu_timeout);
+    VTOY_JSON_FMT_CTRL_INT(L2, "VTOY_WIN_UEFI_RES_LOCK",  uefi_res_lock);
+    VTOY_JSON_FMT_CTRL_INT(L2, "VTOY_SECURE_BOOT_POLICY",  uefi_sb_policy);
    VTOY_JSON_FMT_CTRL_INT(L2, "VTOY_SECONDARY_TIMEOUT",  secondary_menu_timeout);

    VTOY_JSON_FMT_CTRL_STRN(L2, "VTOY_DEFAULT_KBD_LAYOUT", default_kbd_layout);
@@ -682,6 +688,8 @@ int ventoy_data_json_control(data_control *ctrl, char *buf, int buflen)
    VTOY_JSON_FMT_SINT("secondary_menu",  ctrl->secondary_menu);
    VTOY_JSON_FMT_SINT("password_asterisk",  ctrl->password_asterisk);
    VTOY_JSON_FMT_SINT("menu_timeout",  ctrl->menu_timeout);
+    VTOY_JSON_FMT_SINT("uefi_res_lock",  ctrl->uefi_res_lock);
+    VTOY_JSON_FMT_SINT("uefi_sb_policy",  ctrl->uefi_sb_policy);
    VTOY_JSON_FMT_SINT("secondary_menu_timeout",  ctrl->secondary_menu_timeout);
    VTOY_JSON_FMT_STRN("default_kbd_layout",  ctrl->default_kbd_layout);
    VTOY_JSON_FMT_STRN("menu_language",  ctrl->menu_language);
@@ -751,6 +759,8 @@ static int ventoy_api_save_control(struct mg_connection *conn, VTOY_JSON *json)
    VTOY_JSON_INT("secondary_menu", ctrl->secondary_menu);
    VTOY_JSON_INT("password_asterisk", ctrl->password_asterisk);
    VTOY_JSON_INT("menu_timeout", ctrl->menu_timeout);
+    VTOY_JSON_INT("uefi_res_lock", ctrl->uefi_res_lock);
+    VTOY_JSON_INT("uefi_sb_policy", ctrl->uefi_sb_policy);
    VTOY_JSON_INT("secondary_menu_timeout", ctrl->secondary_menu_timeout);

    VTOY_JSON_STR("default_image", ctrl->default_image);
@@ -4164,6 +4174,14 @@ static int ventoy_parse_control(VTOY_JSON *json, void *p)
            {
                CONTROL_PARSE_INT_DEF_0(child, data->sort_casesensitive);
            }
+            else if (strcmp(child->pcName, "VTOY_WIN_UEFI_RES_LOCK") == 0)
+            {
+                CONTROL_PARSE_INT_DEF_3(child, data->uefi_res_lock);
+            }
+            else if (strcmp(child->pcName, "VTOY_SECURE_BOOT_POLICY") == 0)
+            {
+                CONTROL_PARSE_INT_DEF_0(child, data->uefi_sb_policy);
+            }
            else if (strcmp(child->pcName, "VTOY_MAX_SEARCH_LEVEL") == 0)
            {
                if (strcmp(child->unData.pcStrVal, "max") == 0)
--- a/Plugson/src/Web/ventoy_http.h
+++ b/Plugson/src/Web/ventoy_http.h
@@ -81,6 +81,8 @@ typedef struct data_control
    int linux_remount;
    int secondary_menu;
    int password_asterisk;
+    int uefi_res_lock;
+    int uefi_sb_policy;
    char default_search_root[MAX_PATH];
    char default_image[MAX_PATH];
    char default_kbd_layout[32];
@@ -411,6 +413,9 @@ else\
 #define CONTROL_PARSE_INT_DEF_1(node, val) \
    if (node->unData.pcStrVal[0] == '0') val = 0

+#define CONTROL_PARSE_INT_DEF_3(node, val) \
+    if (node->unData.pcStrVal[0] == '3') val = 3
+
 #define VTOY_JSON_INT(key, val) vtoy_json_get_int(json, key, &val)
 #define VTOY_JSON_STR(key, buf) vtoy_json_get_string(json, key, sizeof(buf), buf)
 #define VTOY_JSON_STR_EX(key) vtoy_json_get_string_ex(json, key)
--- a/Plugson/vs/VentoyPlugson/build.bat
+++ b/Plugson/vs/VentoyPlugson/build.bat
@@ -0,0 +1,43 @@
+@echo off
+echo ==============================================
+echo          VS Build Script
+echo ==============================================
+
+set "VS_DEV_CMD=C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\Tools\VsDevCmd.bat"
+set "SLN_FILE=VentoyPlugson.sln"
+
+
+echo Init VS environment ...
+call "%VS_DEV_CMD%" -no_logo
+if %errorlevel% neq 0 (
+    echo Error: VS environment init failed, please check.
+    pause
+    exit /b 1
+)
+
+:: ============== Build Release Win32 (x86) ==============
+echo.
+echo Build: Release  Win32
+MSBuild "%SLN_FILE%" /t:Build /p:Configuration=Release;Platform=Win32 /m
+if %errorlevel% neq 0 (
+    echo Build Release Win32 Failed!
+    pause
+    exit /b 1
+)
+
+
+:: ============== Build Release x64 ==============
+echo.
+echo Build: Release  x64
+MSBuild "%SLN_FILE%" /t:Build /p:Configuration=Release;Platform=x64 /m
+if %errorlevel% neq 0 (
+    echo Build Release x64 Failed!
+    pause
+    exit /b 1
+)
+
+echo.
+echo ==============================================
+echo              Build Success
+echo ==============================================
+pause
--- a/Plugson/www/buildtime
+++ b/Plugson/www/buildtime
@@ -1 +1 @@
-20231014 18:52:12
+20260624 16:39:09
--- a/Plugson/www/helplist
+++ b/Plugson/www/helplist
@@ -1 +1 @@
-ar_ARbn_BNcs_CZde_DEel_GRen_USes_ESfr_FRhi_HIhr_HRhu_HUid_IDit_ITja_JPka_GEko_KRpl_PLpt_BRpt_PTru_RUsr_RSta_INtr_TRuk_UAzh_CNzh_TW
+ar_ARbn_BNcs_CZde_DEel_GRen_USes_ESfa_IRfr_FRhi_HIhr_HRhu_HUid_IDit_ITja_JPka_GEko_KRlg_UGpl_PLpt_BRpt_PTru_RUsl_SIsr_RSta_INtr_TRuk_UAvi_VNzh_CNzh_TW
--- a/Plugson/www/index.html
+++ b/Plugson/www/index.html
@@ -39,6 +39,9 @@
    .treeview-menu a {
        margin-left: 20px;
    }
+    .label-rt {
+        margin-left: 20px !important;
+    }
    </style>
 </head>

@@ -757,7 +760,7 @@

        <footer class="main-footer">
            <div class="pull-right hidden-xs">
-                <b id="plugson_build_date">20231014 18:52:12</b>
+                <b id="plugson_build_date">20260624 16:39:09</b>
            </div>
            <strong><a href="https://www.ventoy.net" target="_blank">https://www.ventoy.net</a></strong>
        </footer>
@@ -777,10 +780,10 @@
    <script src="/static/js/jQuery-2.1.4.min.js"></script>
    <!-- jquery validate -->
    <script src="/static/js/jquery.validate.min.js"></script>
-    <script src="/static/js/jquery.validate.vtoymethods.js?v=253"></script>
+    <script src="/static/js/jquery.validate.vtoymethods.js?v=317"></script>

-    <script src="/static/js/jquery.vtoy.alert.js?v=253"></script>
-    <script src="/static/js/vtoy.js?v=253"></script>
+    <script src="/static/js/jquery.vtoy.alert.js?v=317"></script>
+    <script src="/static/js/vtoy.js?v=317"></script>
    <script src="/static/js/md5.min.js"></script>

    <!-- Bootstrap 3.3.5 -->
--- a/Plugson/www/menulist
+++ b/Plugson/www/menulist
@@ -1 +1 @@
-ar_ARbn_BNcs_CZde_DEel_GRen_USes_ESfr_FRhi_HIhr_HRhu_HUid_IDit_ITja_JPka_GEko_KRpl_PLpt_BRpt_PTru_RUsl_sisr_RSta_INtr_TRuk_UAzh_CNzh_TW
+ar_ARbn_BNcs_CZde_DEel_GRen_USes_ESfa_IRfr_FRhi_HIhr_HRhu_HUid_IDit_ITja_JPka_GEko_KRlg_UGpl_PLpt_BRpt_PTru_RUsl_SIsr_RSta_INtr_TRuk_UAvi_VNzh_CNzh_TW
--- a/Plugson/www/plugson_control.html
+++ b/Plugson/www/plugson_control.html
@@ -119,6 +119,79 @@
        </div><!-- /.box -->


+
+        <div class="box box-primary box-solid">
+          <div class="box-header with-border">
+            <h3 class="box-title" style="font-size: 14px;font-weight: bold;">VTOY_SECURE_BOOT_POLICY
+              <span id="id_span_desc_cn"> —— UEFI 安全启动策略</span></h3>
+            <div class="box-tools pull-right">
+              <button class="btn btn-box-tool" data-widget="collapse"><i class="fa fa-minus"></i></button>
+            </div><!-- /.box-tools -->
+          </div><!-- /.box-header -->
+          <div class="box-body no-padding">
+              <table class="table table-bordered  no-padding">
+                  <tr style="font-weight:bold;">
+                    <td class="td_ctrl_col" id="td_title_setting">选项设置</td>
+                    <td>
+                      <label class="radio-inline">
+                          <input type="radio" id="id_ctrl_uefi_sb_policy_radio0" name="id_ctrl_uefi_sb_policy_radio" data-type="0" value="0"/>
+                          <span id="id_span_desc_cn">绕过安全启动检查</span>
+                          <span id="id_span_desc_en">ByPass Secure Boot</span>
+                      </label>
+                      <label class="radio-inline label-rt">
+                          <input type="radio" id="id_ctrl_uefi_sb_policy_radio1" name="id_ctrl_uefi_sb_policy_radio" data-type="1" value="1"/>
+                          <span id="id_span_desc_cn">遵循UEFI安全启动检查规则</span>
+                          <span id="id_span_desc_en">Follow UEFI Secure Boot Check</span>
+                      </label>
+                    </td>
+                  </tr>
+              </table>
+          </div><!-- /.box-body -->
+        </div><!-- /.box -->
+
+
+
+
+        <div class="box box-primary box-solid">
+          <div class="box-header with-border">
+            <h3 class="box-title" style="font-size: 14px;font-weight: bold;">VTOY_WIN_UEFI_RES_LOCK
+              <span id="id_span_desc_cn"> —— UEFI 分辨率锁定</span></h3>
+            <div class="box-tools pull-right">
+              <button class="btn btn-box-tool" data-widget="collapse"><i class="fa fa-minus"></i></button>
+            </div><!-- /.box-tools -->
+          </div><!-- /.box-header -->
+          <div class="box-body no-padding">
+              <table class="table table-bordered  no-padding">
+                  <tr style="font-weight:bold;">
+                    <td class="td_ctrl_col" id="td_title_setting">选项设置</td>
+                    <td>
+                      <label class="radio-inline">
+                          <input type="radio" id="id_ctrl_uefi_res_lock_radio0" name="id_ctrl_uefi_res_lock_radio" data-type="0" value="0"/>
+                          <span id="id_span_desc_cn">不锁定</span>
+                          <span id="id_span_desc_en">None</span>
+                      </label>
+                      <label class="radio-inline label-rt">
+                          <input type="radio" id="id_ctrl_uefi_res_lock_radio1" name="id_ctrl_uefi_res_lock_radio" data-type="1" value="1"/>
+                          <span id="id_span_desc_cn">锁定最高分辨率</span>
+                          <span id="id_span_desc_en">Highest</span>
+                      </label>
+                      <label class="radio-inline label-rt">
+                          <input type="radio" id="id_ctrl_uefi_res_lock_radio2" name="id_ctrl_uefi_res_lock_radio" data-type="1" value="2"/>
+                          <span id="id_span_desc_cn">锁定 1024x768</span>
+                          <span id="id_span_desc_en">Fixed 1024x768</span>
+                      </label>
+                      <label class="radio-inline label-rt">
+                          <input type="radio" id="id_ctrl_uefi_res_lock_radio3" name="id_ctrl_uefi_res_lock_radio" data-type="1" value="3"/>
+                          <span id="id_span_desc_cn">锁定 1024x768及以上</span>
+                          <span id="id_span_desc_en">At least 1024x768</span>
+                      </label>
+                    </td>
+                  </tr>
+              </table>
+          </div><!-- /.box-body -->
+        </div><!-- /.box -->
+
+
        <div class="box box-primary box-solid">
          <div class="box-header with-border">
            <h3 class="box-title" style="font-size: 14px;font-weight: bold;">VTOY_WIN11_BYPASS_CHECK
@@ -133,18 +206,20 @@
                    <td class="td_ctrl_col" id="td_title_setting">选项设置</td>
                    <td>
                      <label class="radio-inline">
-                          <input type="radio" id="id_ctrl_bypass_win11_radio0" name="id_ctrl_bypass_win11_radio" data-type="0" value="0"/> <span style="font-weight:bold;">0</span>
-                      </label>&nbsp;&nbsp;&nbsp;&nbsp;
-                      <label class="radio-inline">
-                          <input type="radio" id="id_ctrl_bypass_win11_radio1" name="id_ctrl_bypass_win11_radio" data-type="1" value="1"/> <span style="font-weight:bold;">1</span>
+                          <input type="radio" id="id_ctrl_bypass_win11_radio0" name="id_ctrl_bypass_win11_radio" data-type="0" value="0"/>
+                          <span id="id_span_desc_cn">不绕过Windows 11安装时的硬件检查</span>
+                          <span id="id_span_desc_en">Do not bypass Windows 11 hardware check</span>
+                      </label>
+                      <label class="radio-inline label-rt">
+                          <input type="radio" id="id_ctrl_bypass_win11_radio1" name="id_ctrl_bypass_win11_radio" data-type="1" value="1"/>
+                          <span id="id_span_desc_cn">绕过Windows 11安装时的硬件检查</span>
+                          <span id="id_span_desc_en">Bypass Windows 11 hardware check</span>
                      </label>
                    </td>
                  </tr>
                  <tr id="tr_title_desc_cn">
                    <td class="td_ctrl_col" id="td_title_desc">选项说明</td>
                    <td>
-                      <code style="font-weight: bold;">0</code> 不绕过Windows 11安装时的硬件检查。<br/>
-                      <code style="font-weight: bold;">1</code> 绕过Windows 11安装时的硬件检查。<br/><br/>
                      该选项只对标准Windows 11 ISO文件有效，对于其他镜像文件无效。
                      当设置为1时，Ventoy 会在安装时创建以下几个注册表项用来绕过 Windows 11 安装程序的硬件检查。<br/>
                      <code>HKEY_LOCAL_MACHINE\SYSTEM\Setup\LabConfig\BypassRAMCheck</code><br/>
@@ -156,8 +231,6 @@
                  <tr id="tr_title_desc_en">
                    <td class="td_ctrl_col" id="td_title_desc">Option Description</td>
                    <td>
-                      <code style="font-weight: bold;">0</code> Do not bypass Windows 11 hardware check.<br/>
-                      <code style="font-weight: bold;">1</code> Bypass Windows 11 hardware check. <br/><br/>
                      This option only avaliable for standard Windows 11 ISO files.
                      When set to 1, Ventoy will create the following registries to bypass Windows 11 hardware check when install. <br/>
                      <code>HKEY_LOCAL_MACHINE\SYSTEM\Setup\LabConfig\BypassRAMCheck</code><br/>
@@ -187,18 +260,20 @@
                    <td class="td_ctrl_col" id="td_title_setting">选项设置</td>
                    <td>
                      <label class="radio-inline">
-                          <input type="radio" id="id_ctrl_bypass_nro_radio0" name="id_ctrl_bypass_nro_radio" data-type="0" value="0"/> <span style="font-weight:bold;">0</span>
-                      </label>&nbsp;&nbsp;&nbsp;&nbsp;
-                      <label class="radio-inline">
-                          <input type="radio" id="id_ctrl_bypass_nro_radio1" name="id_ctrl_bypass_nro_radio" data-type="1" value="1"/> <span style="font-weight:bold;">1</span>
+                          <input type="radio" id="id_ctrl_bypass_nro_radio0" name="id_ctrl_bypass_nro_radio" data-type="0" value="0"/>
+                          <span id="id_span_desc_cn">不绕过Windows 11安装时的在线账户需求</span>
+                          <span id="id_span_desc_en">Do not bypass Windows 11 online account requirement</span>
+                      </label>
+                      <label class="radio-inline label-rt">
+                          <input type="radio" id="id_ctrl_bypass_nro_radio1" name="id_ctrl_bypass_nro_radio" data-type="1" value="1"/>
+                          <span id="id_span_desc_cn">绕过Windows 11安装时的在线账户需求</span>
+                          <span id="id_span_desc_en">Bypass Windows 11 online account requirement</span>
                      </label>
                    </td>
                  </tr>
                  <tr id="tr_title_desc_cn">
                    <td class="td_ctrl_col" id="td_title_desc">选项说明</td>
                    <td>
-                      <code style="font-weight: bold;">0</code> 不绕过Windows 11安装时的在线账户需求。<br/>
-                      <code style="font-weight: bold;">1</code> 绕过Windows 11安装时的在线账户需求。<br/><br/>
                      该选项只对标准Windows 11 ISO文件有效，对于其他镜像文件无效。
                      当设置为1时，Ventoy 会在安装时创建以下注册表项用来绕过 Windows 11 安装时对在线账户的需求。<br/>
                      <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE\BypassNRO</code><br/>
@@ -207,8 +282,6 @@
                  <tr id="tr_title_desc_en">
                    <td class="td_ctrl_col" id="td_title_desc">Option Description</td>
                    <td>
-                      <code style="font-weight: bold;">0</code> Do not bypass Windows 11 online account requirement.<br/>
-                      <code style="font-weight: bold;">1</code> Bypass Windows 11 online account requirement. <br/><br/>
                      This option only avaliable for standard Windows 11 ISO files.
                      When set to 1, Ventoy will create the following registry to bypass Windows 11 online account requirement when install. <br/>
                      <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE\BypassNRO</code>
@@ -237,25 +310,15 @@
                    <td class="td_ctrl_col" id="td_title_setting">选项设置</td>
                    <td>
                      <label class="radio-inline">
-                          <input type="radio" id="id_ctrl_radio_menu_mode0" name="id_ctrl_radio_menu_mode" data-type="0" value="0"> <span style="font-weight:bold;">0</span>
-                      </label>&nbsp;&nbsp;&nbsp;&nbsp;
-                      <label class="radio-inline">
-                          <input type="radio" id="id_ctrl_radio_menu_mode1" name="id_ctrl_radio_menu_mode" data-type="1" value="1"> <span style="font-weight:bold;">1</span>
+                          <input type="radio" id="id_ctrl_radio_menu_mode0" name="id_ctrl_radio_menu_mode" data-type="0" value="0">
+                          <span id="id_span_desc_cn">文件列表模式</span>
+                          <span id="id_span_desc_en">ListView Mode</span>
+                      </label>
+                      <label class="radio-inline label-rt">
+                          <input type="radio" id="id_ctrl_radio_menu_mode1" name="id_ctrl_radio_menu_mode" data-type="1" value="1">
+                          <span id="id_span_desc_cn">目录树模式</span>
+                          <span id="id_span_desc_en">TreeView Mode</span>
                      </label>
-                    </td>
-                  </tr>
-                  <tr id="tr_title_desc_cn">
-                    <td class="td_ctrl_col" id="td_title_desc">选项说明</td>
-                    <td>启动菜单默认显示模式，
-                      <code style="font-weight: bold;">0</code> 列表模式 &nbsp;&nbsp;
-                      <code style="font-weight: bold;">1</code> TreeView（目录树） 模式</td>
-                  </tr>
-                  <tr id="tr_title_desc_en">
-                    <td class="td_ctrl_col">Option Description</td>
-                    <td>
-                      Default boot menu display mode. 
-                      <code style="font-weight: bold;">0</code> ListView Mode &nbsp;&nbsp
-                      <code style="font-weight: bold;">1</code> TreeView Mode
                    </td>
                  </tr>
              </table>
@@ -426,57 +489,6 @@



-        <div class="box box-primary box-solid">
-          <div class="box-header with-border">
-            <h3 class="box-title" style="font-size: 14px;font-weight: bold;">VTOY_LINUX_REMOUNT
-              <span id="id_span_desc_cn"> —— Linux 启动后继续访问ISO文件所在分区</span></h3>
-            <div class="box-tools pull-right">
-              <button class="btn btn-box-tool" data-widget="collapse"><i class="fa fa-minus"></i></button>
-            </div><!-- /.box-tools -->
-          </div><!-- /.box-header -->
-          <div class="box-body no-padding">
-              <table class="table table-bordered  no-padding">
-                  <tr style="font-weight:bold;">
-                    <td class="td_ctrl_col" id="td_title_setting">选项设置</td>
-                    <td>
-                      <label class="radio-inline">
-                          <input type="radio" id="id_ctrl_linux_remount_radio0" name="id_ctrl_linux_remount_radio" data-type="0" value="0"/> <span style="font-weight:bold;">0</span>
-                      </label>&nbsp;&nbsp;&nbsp;&nbsp;
-                      <label class="radio-inline">
-                          <input type="radio" id="id_ctrl_linux_remount_radio1" name="id_ctrl_linux_remount_radio" data-type="1" value="1"/> <span style="font-weight:bold;">1</span>
-                      </label>
-                    </td>
-                  </tr>
-                  <tr id="tr_title_desc_cn">
-                    <td class="td_ctrl_col" id="td_title_desc">选项说明</td>
-                    <td>
-                      <code style="font-weight: bold;">0</code> Linux启动后不需要继续访问ISO文件所在的分区。<br/>
-                      <code style="font-weight: bold;">1</code> Linux启动后需要继续访问ISO文件所在的分区。<br/><br/>
-                      该选项只对 Linux 系统镜像有效。<br/>
-                      默认情况下，受Linux内核相关功能的限制，对于Linux系统，在启动后无法继续访问ISO文件所在的分区。在mount的时候会提示 device busy。<br/>
-                      如果这里选择 1，则 Ventoy 会尝试通过一些特殊的手段绕过内核的这个限制，但是这个功能是实验性质的，没有经过大规模和长时间的验证。                      
-                    </td>
-                  </tr>
-                  <tr id="tr_title_desc_en">
-                    <td class="td_ctrl_col" id="td_title_desc">Option Description</td>
-                    <td>
-                      <code style="font-weight: bold;">0</code> I don't need to access the image partition after boot.<br/>
-                      <code style="font-weight: bold;">1</code> I need to access the image partition after boot. <br/><br/>
-                      This option is only avaliable for Linux distro image files. <br/>
-
-                      By default, the image partition where the ISO files locate can not be accessed after boot. When you try to mount it you will get device busy error.
-                      This is due to linux kernel restriction (device-mapper module).<br/>
-                      If you select 1 here, Ventoy will try to bypass the restriction with some special mechanism.<br/>
-                      But it should be noted that, this is an experimental feature and is not fully tested.
-                      
-                    </td>
-                  </tr>
-              </table>
-          </div><!-- /.box-body -->
-        </div><!-- /.box -->
-
-
-
        <div class="box box-primary box-solid">
            <div class="box-header with-border">
              <h3 class="box-title" style="font-size: 14px;font-weight: bold;">VTOY_SECONDARY_BOOT_MENU
@@ -491,26 +503,15 @@
                      <td class="td_ctrl_col" id="td_title_setting">选项设置</td>
                      <td>
                        <label class="radio-inline">
-                            <input type="radio" id="id_ctrl_secondary_radio0" name="id_ctrl_secondary_radio" data-type="0" value="0"> <span style="font-weight:bold;">0</span>
-                        </label>&nbsp;&nbsp;&nbsp;&nbsp;
-                        <label class="radio-inline">
-                            <input type="radio" id="id_ctrl_secondary_radio1" name="id_ctrl_secondary_radio" data-type="1" value="1"> <span style="font-weight:bold;">1</span>
+                            <input type="radio" id="id_ctrl_secondary_radio0" name="id_ctrl_secondary_radio" data-type="0" value="0">
+                             <span id="id_span_desc_cn">不显示二级启动菜单</span>
+                             <span id="id_span_desc_en">Don't show secondary boot menu</span>
+                        </label>
+                        <label class="radio-inline label-rt">
+                            <input type="radio" id="id_ctrl_secondary_radio1" name="id_ctrl_secondary_radio" data-type="1" value="1">
+                            <span id="id_span_desc_cn">显示二级启动菜单</span>
+                            <span id="id_span_desc_en">Show show secondary boot menu</span>
                        </label>
-                      </td>
-                    </tr>
-                    <tr id="tr_title_desc_cn">
-                      <td class="td_ctrl_col" id="td_title_desc">选项说明</td>
-                      <td>二级启动菜单控制开关
-                        <code style="font-weight: bold;">0</code> 不显示 &nbsp;&nbsp; 
-                        <code style="font-weight: bold;">1</code> 显示
-                      </td>
-                    </tr>
-                    <tr id="tr_title_desc_en">
-                      <td class="td_ctrl_col" id="td_title_desc">Option Description</td>
-                      <td>
-                      Secondary boot menu display option
-                      <code style="font-weight: bold;">0</code> Don't display &nbsp;&nbsp;&nbsp;
-                      <code style="font-weight: bold;">1</code> Display
                      </td>
                    </tr>
                </table>
@@ -532,26 +533,15 @@
                      <td class="td_ctrl_col" id="td_title_setting">选项设置</td>
                      <td>
                        <label class="radio-inline">
-                            <input type="radio" id="id_ctrl_asterisk_radio0" name="id_ctrl_asterisk_radio" data-type="0" value="0"> <span style="font-weight:bold;">0</span>
-                        </label>&nbsp;&nbsp;&nbsp;&nbsp;
-                        <label class="radio-inline">
-                            <input type="radio" id="id_ctrl_asterisk_radio1" name="id_ctrl_asterisk_radio" data-type="1" value="1"> <span style="font-weight:bold;">1</span>
+                            <input type="radio" id="id_ctrl_asterisk_radio0" name="id_ctrl_asterisk_radio" data-type="0" value="0">
+                            <span id="id_span_desc_cn">隐藏</span>
+                            <span id="id_span_desc_en">Hide</span>
+                        </label>
+                        <label class="radio-inline label-rt">
+                            <input type="radio" id="id_ctrl_asterisk_radio1" name="id_ctrl_asterisk_radio" data-type="1" value="1">
+                            <span id="id_span_desc_cn">显示</span>
+                            <span id="id_span_desc_en">Show</span>
                        </label>
-                      </td>
-                    </tr>
-                    <tr id="tr_title_desc_cn">
-                      <td class="td_ctrl_col" id="td_title_desc">选项说明</td>
-                      <td>输入密码时是否显示星号
-                        <code style="font-weight: bold;">0</code> 不显示 &nbsp;&nbsp; 
-                        <code style="font-weight: bold;">1</code> 显示
-                      </td>
-                    </tr>
-                    <tr id="tr_title_desc_en">
-                      <td class="td_ctrl_col" id="td_title_desc">Option Description</td>
-                      <td>
-                      Display asterisk when typing password
-                      <code style="font-weight: bold;">0</code> Don't display &nbsp;&nbsp;&nbsp;
-                      <code style="font-weight: bold;">1</code> Display
                      </td>
                    </tr>
                </table>
@@ -1107,8 +1097,10 @@

    data.win11_bypass_check = parseInt($('input:radio[name=id_ctrl_bypass_win11_radio]:checked').val());
    data.win11_bypass_nro = parseInt($('input:radio[name=id_ctrl_bypass_nro_radio]:checked').val());
-    data.linux_remount = parseInt($('input:radio[name=id_ctrl_linux_remount_radio]:checked').val());
+    data.linux_remount = 0;
    data.secondary_menu = parseInt($('input:radio[name=id_ctrl_secondary_radio]:checked').val());
+    data.uefi_res_lock = parseInt($('input:radio[name=id_ctrl_uefi_res_lock_radio]:checked').val());
+    data.uefi_sb_policy = parseInt($('input:radio[name=id_ctrl_uefi_sb_policy_radio]:checked').val());
    data.password_asterisk = parseInt($('input:radio[name=id_ctrl_asterisk_radio]:checked').val());
    data.default_search_root = $('input:text[id=id_ctrl_text_search_root]').val();
    data.menu_timeout = parseInt($('input:text[id=id_ctrl_text_timeout]').val());
@@ -1145,8 +1137,9 @@
    $('input:radio[name=id_ctrl_bypass_win11_radio]')[data.win11_bypass_check].checked = true;
    //VTOY_WIN11_BYPASS_NRO
    $('input:radio[name=id_ctrl_bypass_nro_radio]')[data.win11_bypass_nro].checked = true;
-    $('input:radio[name=id_ctrl_linux_remount_radio]')[data.linux_remount].checked = true;
    $('input:radio[name=id_ctrl_secondary_radio]')[data.secondary_menu].checked = true;
+    $('input:radio[name=id_ctrl_uefi_res_lock_radio]')[data.uefi_res_lock].checked = true;
+    $('input:radio[name=id_ctrl_uefi_sb_policy_radio]')[data.uefi_sb_policy].checked = true;
    $('input:radio[name=id_ctrl_asterisk_radio]')[data.password_asterisk].checked = true;

    //VTOY_DEFAULT_SEARCH_ROOT
@@ -1253,6 +1246,8 @@
      win11_bypass_check: data.win11_bypass_check,
      win11_bypass_nro: data.win11_bypass_nro,
      linux_remount:data.linux_remount,
+      uefi_res_lock:data.uefi_res_lock,
+      uefi_sb_policy:data.uefi_sb_policy,
      secondary_menu:data.secondary_menu,
      password_asterisk:data.password_asterisk,
      default_search_root: data.default_search_root,
--- a/Plugson/www/static/js/vtoy.js
+++ b/Plugson/www/static/js/vtoy.js
@@ -934,6 +934,9 @@ function VtoyCommonChangeLanguage(newlang) {
        $("span[id=id_span_desc_cn]").each(function(){
            $(this).hide();
        });
+        $("span[id=id_span_desc_en]").each(function(){
+            $(this).show();
+        });

    } else {
        g_vtoy_cur_language = g_vtoy_cur_language_cn;
@@ -982,6 +985,10 @@ function VtoyCommonChangeLanguage(newlang) {
        $("span[id=id_span_desc_cn]").each(function(){
            $(this).show();
        });
+
+        $("span[id=id_span_desc_en]").each(function(){
+            $(this).hide();
+        });
    }

    $("span[id=id_span_menu_device]").text(g_vtoy_cur_language.STR_PLUG_DEVICE);
--- a/SecureBoot.md
+++ b/SecureBoot.md
@@ -0,0 +1,41 @@
+
+# Ventoy Secure Boot Policy
+
+## Why shim
+Ventoy is based on grub2 which is in GPL license, so it will not directly get signed with UEFI Certificate.  
+Like most Linux distros, Ventoy grub2 must be launched by shim when Secure Boot is enabled.  
+Different is that, Ventoy does not have its own shim and must make use of a third-part shim.  
+When boot Ventoy with Secure Boot enabled, the shim will not directly boot Ventoy grub because Ventoy grub is not signed with the shim embedded Certificate.
+The shim will open the MokManager and we must enroll Ventoy's Secure Boot Key and reboot, then the shim will accept Ventoy grub and boot it.
+
+## Which shim
+I choose a shim file from Rocky Linux because it was signed with both UEFI CA 2011 and UEFI CA 2023.
+
+## Policy
+Now you can boot into Ventoy after you enroll Ventoy Secure Boot Key.  
+Ventoy provides two secure boot policies.  
+1. Fully bypass secure boot.  
+   This mode will bypass secure boot which means it will boot any EFI files without check.
+   This mode enables all features of Ventoy and is the most convenient to use.
+   However, it also carries certain risks, as the Secure Boot mechanism is effectively bypassed.
+   You must therefore be fully aware of the risks involved and decide whether to use this mode according to your actual circumstances.
+  
+3. Follow UEFI firmware secure boot policy.  
+   This mode will use the original UEFI secure boot policy to check every EFI file before boot it.  
+   This means you can only boot these EFI files which are signed with UEFI CA (e.g. Windows bootmgr, another shim).
+   In this mode, certain features of Ventoy are disabled (such as grub2boot mode, insmod, etc.), but this mode is the most secure.
+
+Policy 1 is the default policy by now.  
+
+If you want to use policy 2, you can set `VTOY_SECURE_BOOT_POLICY` to `1` in Ventoy global control plugin as follows:  
+(PS: `VTOY_SECURE_BOOT_POLICY` value `0` and `1` correspond to Policy 1 and Policy 2 respectively)
+
+```
+{
+    "control":[
+        { "VTOY_SECURE_BOOT_POLICY": "1" }
+    ]
+}
+```
+
+
--- a/vtoyjump/build.bat
+++ b/vtoyjump/build.bat
@@ -0,0 +1,58 @@
+@echo off
+chcp 65001
+echo ==============================================
+echo          VS 命令行双架构编译脚本
+echo ==============================================
+
+:: ====================== 【必须改这里】======================
+:: 1. 你的 VS 版本对应的 VsDevCmd.bat 路径（看下面的路径对照表）
+set "VS_DEV_CMD=%VS120COMNTOOLS%VsDevCmd.bat"
+:: 2. 你的 VS 解决方案文件名（.sln）
+set "SLN_FILE=vtoyjump.sln"
+:: ==========================================================
+
+:: 初始化VS编译环境（必须第一步）
+echo 正在初始化 VS 编译环境...
+call "%VS_DEV_CMD%" -no_logo
+if %errorlevel% neq 0 (
+    echo 错误：VS环境初始化失败！检查路径是否正确
+    pause
+    exit /b 1
+)
+
+:: ============== 编译 Release Win32 (x86) ==============
+echo.
+echo 正在编译：Release  Win32
+MSBuild "%SLN_FILE%" /t:Build /p:Configuration=Release;Platform=Win32 /m
+if %errorlevel% neq 0 (
+    echo 编译 Release Win32 失败！
+    pause
+    exit /b 1
+)
+
+
+:: ============== 编译 Release x64 ==============
+echo.
+echo 正在编译：Release  x64
+MSBuild "%SLN_FILE%" /t:Build /p:Configuration=Release;Platform=x64 /m
+if %errorlevel% neq 0 (
+    echo 编译 Release x64 失败！
+    pause
+    exit /b 1
+)
+
+del ..\INSTALL\ventoy\vtoyjump32.exe
+del ..\INSTALL\ventoy\vtoyjump64.exe
+
+copy Release\vtoyjump32.exe         ..\INSTALL\ventoy\vtoyjump32.exe
+copy x64\Release\vtoyjump64.exe     ..\INSTALL\ventoy\vtoyjump64.exe
+
+
+echo.
+echo ==============================================
+echo              ✅ 2架构编译完成！
+echo ==============================================
+echo.
+pause
+
+
--- a/vtoyjump/vtoyjump/vtoyjump.c
+++ b/vtoyjump/vtoyjump/vtoyjump.c
@@ -2849,7 +2849,7 @@ int VentoyJump(INT argc, CHAR **argv, CHAR *LunchFile)
                goto End;
            }

-            // convert / to \\   
+            // convert '/'
            for (Pos = 0; Pos < sizeof(g_os_param.vtoy_img_path) && g_os_param.vtoy_img_path[Pos]; Pos++)
            {
                if (g_os_param.vtoy_img_path[Pos] == '/')
@@ -2902,6 +2902,26 @@ End:
    return rc;
 }

+static BOOL is_exe_need_recover(const char *prog_name)
+{
+    if (_stricmp(g_prog_name, "winpeshl.exe") == 0)
+    {
+        // if setup.exe not exist, it's not a standard Windows ISO, maybe PE.
+        if (!IsFileExist("X:\\setup.exe") && IsFileExist("ventoy\\%s", g_prog_name))
+        {
+            return TRUE;
+        }
+    }
+    else
+    {
+        if (IsFileExist("ventoy\\%s", g_prog_name))
+        {
+            return TRUE;
+        }
+    }
+
+    return FALSE;
+}

 int real_main(int argc, char **argv)
 {
@@ -2936,7 +2956,7 @@ int real_main(int argc, char **argv)

    Log("LunchFile=<%s> CallParam=<%s>", LunchFile, CallParam);

-    if (_stricmp(g_prog_name, "winpeshl.exe") != 0 && IsFileExist("ventoy\\%s", g_prog_name))
+    if (is_exe_need_recover(g_prog_name))
    {
        sprintf_s(NewFile, sizeof(NewFile), "%s\\VTOYJUMP.EXE", g_prog_dir);
        MoveFileA(g_prog_full_path, NewFile);
Author	SHA1	Message	Date
longpanda	6418c2a09f	1.1.14 Some checks failed Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-06-24 20:55:20 +08:00
longpanda	c2a3f181c0	Fix the secure boot issue.	2026-06-24 20:52:56 +08:00
longpanda	90e4f9db63	1.1.13 release Some checks failed Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-06-24 18:41:35 +08:00
longpanda	255e84dbab	Update BLOB_List.md	2026-06-24 18:41:24 +08:00
longpanda	213ce02985	add build.bat for VentoyPlugson	2026-06-24 18:41:03 +08:00
longpanda	8c2a3b44da	Update BLOB_List.md	2026-06-24 17:39:31 +08:00
longpanda	536545cd39	VentoyPlugson Update - Add missing option (VTOY_WIN_UEFI_RES_LOCK) - Add new option (VTOY_SECURE_BOOT_POLICY) - Remove deprecated option (VTOY_LINUX_REMOUNT)	2026-06-24 16:43:10 +08:00
longpanda	0f59e92a01	Fix grub i386 build issue. Some checks failed Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-06-23 22:34:10 +08:00
longpanda	4b1e5ce89c	Update SecureBoot.md	2026-06-23 22:11:24 +08:00
longpanda	1ed7bc9596	Ventoy Secure Boot Policy Update - Update Ventoy grub code to match the new policy.	2026-06-23 21:19:46 +08:00
longpanda	71ac855b36	Ventoy Secure Boot Policy Update - Update pack script (add efi file signature process)	2026-06-23 21:10:17 +08:00
longpanda	4302854b8d	Ventoy Secure Boot Policy Update - Update shim and MokManager for x86_64. I choose the shim file from Rocky Linux 9.2 because it was signed with both UEFI CA 2011 and UEFI CA 2023. - Update Ventoy Secure Boot CA.	2026-06-23 21:08:48 +08:00
longpanda	036f7234ad	Ventoy Secure Boot Policy Update - Add SecureBoot.md	2026-06-23 21:04:09 +08:00
longpanda	26a394ce84	Ventoy Secure Boot Policy Update - Add Ventoy Preload module.	2026-06-23 21:02:56 +08:00
longpanda	25369d5884	Merge branch 'master' of https://github.com/Ventoy/Ventoy Some checks failed Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-05-07 11:18:23 +08:00
longpanda	12387fff81	Fix the boot issue for some WinPE iso.	2026-05-07 11:17:57 +08:00
andrewczm	b54a7fe93b	Polish translation - update (#3576 ) Some checks failed Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details * Update pl_PL.json * Update pl_PL.json * Update languages.json	2026-04-24 15:40:01 +08:00
longpanda	dba7530b21	1.1.12 Some checks failed Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-04-23 18:04:05 +08:00
longpanda	e9b4c86082	Fix Oracle Linux 6.9 install issue Some checks failed Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-04-23 00:23:21 +08:00
longpanda	dbcdf51950	Improve for UEFI boot Windows/WinPE resolution issue fix.	2026-04-23 00:00:05 +08:00
longpanda	de3e6c6d1d	rollback dmsetup operation. Some checks failed Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-04-14 19:42:19 +08:00
longpanda	3c0df07b92	Improve for UEFI boot Windows/WinPE resolution issue fix. Some checks failed Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-04-14 15:38:06 +08:00
longpanda	c1c27cd30c	Bugfix for ubuntu24.04.4 install failure. (#3567 )	2026-04-14 11:03:02 +08:00