1.1.17 release

Fix the issue that proxmox-ve can not boot after install in grub2 mode.
Fix fdisk detection on BusyBox systems (#3614 )
2026-08-07 09:36:11 +00:00 · 2026-07-24 20:56:41 +08:00 · 2026-07-24 20:53:12 +08:00 · 2026-07-24 18:26:25 +08:00 · 2026-07-24 17:31:58 +08:00 · 2026-07-24 17:21:49 +08:00
32 changed files with 1018 additions and 706 deletions
@@ -37,12 +37,70 @@ else
 fi

 if [ -e $VTEFI_PATH ]; then
+
+    objdump -h "$VTEFI_PATH"
+    echo ""
+
    objcopy \
        --add-section .sbat="MdeModulePkg/Application/VtoyShim/sbat.csv" \
        --set-section-flags .sbat=alloc,load,readonly,data \
        "$VTEFI_PATH" "$DST_PATH"
-        
-    objcopy --adjust-section-vma .sbat=0x1000 "$DST_PATH"
+
+    #find the right sbat section VMA
+    tmpfile=$(mktemp)
+    
+    cnt1=$(objdump -h "$DST_PATH" | grep -P '^\s*[0-9][0-9]* \.' | wc -l)
+    cnt2=$(objdump -h "$DST_PATH" | grep -P 'ALLOC' | wc -l)
+    
+    if [ $cnt1 -ne $cnt2 ]; then
+        echo "Section count mismatch $cnt1 $cnt2"
+        objdump -h "$DST_PATH"
+        exit 1
+    fi
+
+    objdump -h "$DST_PATH" | grep -P '^\s*[0-9][0-9]* \.' > $tmpfile    
+    sbat_size=$(stat -c '%s' MdeModulePkg/Application/VtoyShim/sbat.csv)    
+    sbat_size_hex=$(printf '0x%08x' $sbat_size)
+    
+    lmax='0000000000000000'
+    lsize='0000000000000000'
+    while read line; do
+        echo $line        
+        lbase=$(echo $line | awk '{print $4}')        
+        if expr "$lmax" \< "$lbase" > /dev/null; then
+            lmax=$lbase
+            lsize=$(echo $line | awk '{print $3}')
+        fi
+        echo "max=$lmax size=$lsize"
+    done < $tmpfile
+    rm -f $tmpfile
+
+
+    lvma=$((0x${lsize}+0x${lmax}))
+    lvma_align=`printf '0x%08x' $(( (lvma + 4095) / 4096 * 4096 ))`
+    echo "sbat section lvma_align=$lvma_align"    
+    
+    objcopy --adjust-section-vma .sbat=$lvma_align "$DST_PATH"
+
+    img_base=$(objdump -p "$DST_PATH" | grep ImageBase | awk '{print $2}')
+    size_img=0x$(objdump -p "$DST_PATH" | grep SizeOfImage | awk '{print $2}')
+    sbat_end=`printf '0x%08x' $(($lvma_align+$sbat_size_hex))`
+
+    if [ "$img_base" != "0000000000000000" ]; then
+        echo "#### ImageBase is not 0 $img_base"
+        exit 1
+    fi
+    
+    echo "size_img=$size_img  sbat_size=$sbat_size_hex sbat_range $lvma_align - $sbat_end"    
+
+    if expr "$size_img" \< "$sbat_end" > /dev/null; then
+        echo "SizeOfImage $size_img less than sbat section addr $sbat_end"
+        exit 1
+    else
+        echo "SizeOfImage $size_img >= $sbat_end is OK"
+    fi
+
+    objdump -h "$DST_PATH"

    echo -e '\n\n====================== SUCCESS ========================\n\n'    

@@ -1231,32 +1231,6 @@ EFI_STATUS EFIAPI ventoy_boot(IN EFI_HANDLE ImageHandle)
    return EFI_SUCCESS;
 }

-#if defined (MDE_CPU_X64)
-STATIC BOOLEAN EFIAPI CheckVtoyShim(VOID)
-{
-    UINT8 SecureBoot = 0;
-	UINTN DataSize;
-	EFI_STATUS Status;
-    EFI_GUID Guid = VTOY_SHIM_POLICY_GUID;
-    VOID *Prot = NULL;
-
-	DataSize = sizeof(SecureBoot);
-	Status = gST->RuntimeServices->GetVariable(L"SecureBoot", &gEfiGlobalVariableGuid, NULL,
-				     &DataSize, &SecureBoot);
-	if (!EFI_ERROR(Status) && SecureBoot)
-    {
-        Status = gBS->LocateProtocol(&Guid, NULL, (VOID**)&Prot);
-        if (EFI_ERROR(Status))
-        {
-            VtoyDebug("Failed to locate Vtoy Shim Protocol %lx\r\n", Status);
-            return FALSE;
-        }
-    }
-
-    return TRUE;
-}
-#endif
-
 EFI_STATUS EFIAPI VentoyEfiMain
 (
    IN EFI_HANDLE         ImageHandle,
@@ -1266,15 +1240,6 @@ EFI_STATUS EFIAPI VentoyEfiMain
    EFI_STATUS Status = EFI_SUCCESS;
    EFI_SIMPLE_TEXT_INPUT_EX_PROTOCOL *Protocol;

-#if defined (MDE_CPU_X64)
-    /* check that Ventoy Shim must exist */
-    if (!CheckVtoyShim())
-    {
-        sleep(5);
-        return EFI_NOT_FOUND;
-    }
-#endif
-
    g_sector_flag_num = 512; /* initial value */

    g_sector_flag = AllocatePool(g_sector_flag_num * sizeof(ventoy_sector_flag));
@@ -34,15 +34,28 @@

 #define CUR_SBAT_VER    1

-STATIC EFI_GUID gVtoySbatGUID = { 0xf755068a, 0xe04f, 0x452b, { 0x9d, 0x6d, 0x7c, 0x55, 0x96, 0xb3, 0xc0, 0x7d }};
-STATIC EFI_DEVICE_PATH_TO_TEXT_PROTOCOL *gDpToText = NULL;
-STATIC EFI_DEVICE_PATH_FROM_TEXT_PROTOCOL *gTextToDp = NULL;
+STATIC UINT8 gVtoyGrubSha256Hash[32] __attribute__((aligned(32)))  = {
+    0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26,
+    0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26,
+    0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26,
+    0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26
+};
+
+STATIC BOOLEAN gGrubLaunched = FALSE;
+STATIC EFI_GUID gShimLockGUID = SHIM_LOCK_GUID;
 STATIC EFI_SECURITY_FILE_AUTHENTICATION_STATE gSysSecFileAuth = NULL;
 STATIC EFI_SECURITY2_FILE_AUTHENTICATION gSysSec2FileAuth = NULL;
 STATIC BOOLEAN gVtoyByPassSB = FALSE; /* must be FALSE by default for revoke */
 STATIC VTOY_SHIM gVtoyShimProtocol;
 STATIC EFI_HANDLE gVtoyShimProtHandle;
-STATIC SHIM_LOCK *gShimLock = NULL;
+STATIC SHIM_LOCK gShimLock;
+
+STATIC EFI_EXIT_BOOT_SERVICES gSysExitBootServices = NULL;
+STATIC EFI_GET_VARIABLE gSysGetVariable = NULL;
+
+STATIC VOID EFIAPI HookSystemService(VOID);
+STATIC VOID EFIAPI UnHookSystemService(VOID);
+

 STATIC VOID EFIAPI VtoyLog(CONST CHAR16 *Format, ...)
 {
@@ -66,11 +79,15 @@ STATIC VOID EFIAPI DumpDevicePath(const EFI_DEVICE_PATH_PROTOCOL *DevicePath)
 {
    CHAR16 *DPStr = NULL;

-    DPStr = gDpToText->ConvertDevicePathToText(DevicePath, TRUE, TRUE);
+    if (DevicePath)
+    {
+        DPStr = ConvertDevicePathToText(DevicePath, TRUE, TRUE);
+    }
+
    if (DPStr)
    {
        vLog(L"%s", DPStr);
-        gBS->FreePool(DPStr);
+        FreePool(DPStr);
    }
    else
    {
@@ -78,31 +95,19 @@ STATIC VOID EFIAPI DumpDevicePath(const EFI_DEVICE_PATH_PROTOCOL *DevicePath)
    }
 }

-STATIC VOID EFIAPI ShowSBWarning(BOOLEAN Reboot, const EFI_DEVICE_PATH_PROTOCOL *DevicePath)
+STATIC VOID EFIAPI ShowSBWarning(const EFI_DEVICE_PATH_PROTOCOL *DevicePath)
 {
-    UINTN Index = 0;
-
    vLog(L"\r\n=======================================================");
    vLog(L"=======================================================\r\n");

    DumpDevicePath(DevicePath);

-    vLog(L"\r\n####### Security Boot Violation ##########\r\n");
+    vLog(L"\r\n####### Ventoy Security Boot Violation ##########\r\n");

    vLog(L"=======================================================");
    vLog(L"=======================================================");

-    if (Reboot)
-    {
-        vLog(L"\r\n###### Press Enter to reboot... ######");
-        gST->ConIn->Reset(gST->ConIn, FALSE);
-        gBS->WaitForEvent(1, &gST->ConIn->WaitForKey, &Index);
-        gRT->ResetSystem(EfiResetWarm, EFI_SECURITY_VIOLATION, 0, NULL);
-    }
-    else
-    {
-        VtoySleep(5);
-    }
+    VtoySleep(5);
 }


@@ -129,7 +134,6 @@ STATIC VOID * EFIAPI FindShimFuncAddr(UINT64 FuncOffset)
    }
 }

-
 EFI_STATUS EFIAPI LaunchRealGrub(EFI_HANDLE ImageHandle, CONST CHAR16 *FileName)
 {
    EFI_STATUS Status;
@@ -156,7 +160,7 @@ EFI_STATUS EFIAPI LaunchRealGrub(EFI_HANDLE ImageHandle, CONST CHAR16 *FileName)
        goto END;
    }

-    DevDpStr = gDpToText->ConvertDevicePathToText(DeviceDP, FALSE, TRUE);
+    DevDpStr = ConvertDevicePathToText(DeviceDP, FALSE, TRUE);
    if (!DevDpStr)
    {
        vLog(L"Failed to convert device path to text");
@@ -175,7 +179,7 @@ EFI_STATUS EFIAPI LaunchRealGrub(EFI_HANDLE ImageHandle, CONST CHAR16 *FileName)

    UnicodeSPrint(NewDpStr, BufferSize, L"%s/EFI/BOOT/%s", DevDpStr, FileName);

-    TargetDp = gTextToDp->ConvertTextToDevicePath(NewDpStr);
+    TargetDp = ConvertTextToDevicePath(NewDpStr);
    if (!TargetDp)
    {
        vLog(L"Failed to convert new text <%s> to device path", NewDpStr);
@@ -190,7 +194,6 @@ EFI_STATUS EFIAPI LaunchRealGrub(EFI_HANDLE ImageHandle, CONST CHAR16 *FileName)
        goto END;
    }

-
    Status = gBS->StartImage(ChildHandle, NULL, NULL);
    if (EFI_ERROR(Status))
    {
@@ -199,155 +202,41 @@ EFI_STATUS EFIAPI LaunchRealGrub(EFI_HANDLE ImageHandle, CONST CHAR16 *FileName)
        goto END;
    }

-
 END:

-    CheckBSFreePool(DevDpStr);
+    CheckFreePool(DevDpStr);
    CheckFreePool(NewDpStr);
-    CheckBSFreePool(TargetDp);
+    CheckFreePool(TargetDp);

    return Status;
 }


-
-STATIC EFI_STATUS EFIAPI ReadAuthFile
+STATIC EFI_STATUS EFIAPI CheckVtoyGrub
 (
-    const EFI_DEVICE_PATH_PROTOCOL *DevicePathConst,
-    VOID **Buffer,
-    UINT32 *Size
+    VOID *FileBuffer,
+	UINTN FileSize
 )
 {
-    EFI_STATUS Status;
-    UINTN TmpSize = 0;
-    CHAR16 *DpStr = NULL;
-	EFI_HANDLE Handle = NULL;
-    EFI_DEVICE_PATH *DevPath = NULL;
-    EFI_DEVICE_PATH *TmpPath = NULL;
-	EFI_FILE_IO_INTERFACE *FileIO = NULL;
-	EFI_FILE *File = NULL;
-	EFI_FILE *Root = NULL;
-    UINT8 *FileData = NULL;
-    EFI_FILE_INFO *FInfo = NULL;
-    UINT8 Buf[1024];
+    UINT8 Sha256Hash[64];

-	DevPath	= TmpPath = DuplicateDevicePath(DevicePathConst);
-    if (!DevPath)
+    if (!FileBuffer || FileSize < sizeof(EFI_IMAGE_DOS_HEADER))
    {
-        Status = EFI_OUT_OF_RESOURCES;
-        goto END;
+        vErr(L"Invalid FileBuffer:%p or size:%ld", FileBuffer, FileSize);
+        return EFI_SECURITY_VIOLATION;
    }

-	Status = gBS->LocateDevicePath(&gEfiSimpleFileSystemProtocolGuid, &DevPath, &Handle);
-    if (EFI_ERROR(Status))
+    ZeroMem(Sha256Hash, sizeof(Sha256Hash));
+    calc_sha256(FileBuffer, (UINT64)FileSize, Sha256Hash);
+
+    if (CompareMem(Sha256Hash, gVtoyGrubSha256Hash, 32) != 0)
    {
-        vLog(L"Failed to locate simple file protocol %lx", Status);
-        goto END;
+        vErr(L"Ventoy hash check failed.");
+        gRT->ResetSystem(EfiResetWarm, EFI_SECURITY_VIOLATION, 0, NULL);
+        return EFI_SECURITY_VIOLATION;
    }

-    DpStr = gDpToText->ConvertDevicePathToText(DevPath, FALSE, TRUE);
-    if (!DpStr)
-    {
-        Status = EFI_OUT_OF_RESOURCES;
-        goto END;
-    }
-
-    Status = gBS->HandleProtocol(Handle, &gEfiSimpleFileSystemProtocolGuid, (VOID **)&FileIO);
-    if (EFI_ERROR(Status))
-    {
-        vLog(L"Failed to handle simple file protocol %lx", Status);
-        goto END;
-    }
-
-    Status = FileIO->OpenVolume(Handle, &Root);
-	if (EFI_ERROR(Status))
-    {
-		vLog(L"Failed to open drive volume (%lx)\n", Status);
-		goto END;
-	}
-
-    Status = Root->Open(Root, &File, DpStr, EFI_FILE_MODE_READ, 0);
-    if (EFI_ERROR(Status))
-    {
-		vLog(L"Failed to open file (%s) (%lx)\n", DpStr, Status);
-		goto END;
-	}
-
-    FInfo = (EFI_FILE_INFO *)Buf;
-    TmpSize = sizeof(Buf);
-    ZeroMem(FInfo, sizeof(EFI_FILE_INFO));
-
-    Status = File->GetInfo(File, &gEfiFileInfoGuid, &TmpSize, FInfo);
-    if (EFI_ERROR(Status) || FInfo->FileSize == 0 || FInfo->FileSize >= 0xFFFFFFFFUL)
-    {
-		vLog(L"Failed to open file (%s) (%lx) Size(%ld)\n", DpStr, Status, (UINTN)FInfo->FileSize);
-		goto END;
-	}
-
-    FileData = AllocatePool(FInfo->FileSize);
-    if (!FileData)
-    {
-        Status = EFI_OUT_OF_RESOURCES;
-        goto END;
-    }
-
-    TmpSize = FInfo->FileSize;
-    Status = File->Read(File, &TmpSize, FileData);
-    if (EFI_ERROR(Status) || TmpSize != (UINTN)FInfo->FileSize)
-    {
-		vLog(L"Failed to read file (%lx) Read:%ld Size:%ld\n", Status, TmpSize, (UINTN)FInfo->FileSize);
-		goto END;
-	}
-
-
-END:
-
-    if (File)
-    {
-        File->Close(File);
-    }
-
-    if (Root)
-    {
-        Root->Close(Root);
-    }
-
-    CheckFreePool(TmpPath);
-    CheckBSFreePool(DpStr);
-
-    if (EFI_ERROR(Status))
-    {
-        CheckFreePool(FileData);
-    }
-    else
-    {
-        *Buffer = FileData;
-        *Size = (UINT32)FInfo->FileSize;
-    }
-
-    return Status;
-}
-
-
-STATIC BOOLEAN VtoyCheckRevoke(VOID *Buffer, UINTN Size)
-{
-    UINT32 uiVer = 0;
-    EFI_IMAGE_DOS_HEADER *DosHead = (EFI_IMAGE_DOS_HEADER *)Buffer;
-
-    if (Size > sizeof(EFI_IMAGE_DOS_HEADER))
-    {
-        if (CompareMem(DosHead->e_res2, &gVtoySbatGUID, 16) == 0)
-        {
-            CopyMem(&uiVer, DosHead->e_res2 + 8, 4);
-            if (uiVer < CUR_SBAT_VER)
-            {
-                vLog(L"Ventoy EFI file revoke (%u < %u)", uiVer, CUR_SBAT_VER);
-                return FALSE;
-            }
-        }
-    }
-
-    return TRUE;
+    return EFI_SUCCESS;
 }

 STATIC EFI_STATUS EFIAPI SecurityPolicyAuth
@@ -357,59 +246,17 @@ STATIC EFI_STATUS EFIAPI SecurityPolicyAuth
 	const EFI_DEVICE_PATH_PROTOCOL *DevicePathConst
 )
 {
-    EFI_STATUS Status;
-    BOOLEAN bRevokeChkOK = TRUE;
-    UINT32 Size = 0;
-    VOID *Buffer = NULL;
-
-    /* Just return OK if the user choose to bypass SB */
-    if (gVtoyByPassSB)
-    {
-        return EFI_SUCCESS;
-    }
-
    /*
-     * Step 1:
-     * Use original UEFI firmware auth API.
-     * If it's OK, it may be signed with Microsoft UEFI CA. (e.g. bootmgr/shim/...)
+     * Some old UEFI firmware (without Security2 protocol) will hang when run OpenVolume.
+     * So finally I decide not to support such UEFI firmware.
+     * It means that for UEFI firmware before 2.5 (about 2015) Ventoy only supports Bypass policy.
+     *
     */
-    if (gSysSecFileAuth)
-    {
-        Status = gSysSecFileAuth(This, AuthenticationStatus, DevicePathConst);
-        if (!EFI_ERROR(Status))
-        {
-            return EFI_SUCCESS;
-        }
-    }

-
-    /*
-     * Step 2:
-     * Use shim verify API.
-     * If it's OK, it may be signed with a MOK key. (e.g. Ventoy EFI files)
-     */
-    if (gShimLock && gShimLock->Verify)
-    {
-        Status = ReadAuthFile(DevicePathConst, &Buffer, &Size);
-        if (!EFI_ERROR(Status))
-        {
-            Status = gShimLock->Verify(Buffer, Size);
-            if (!EFI_ERROR(Status))
-            {
-                bRevokeChkOK = VtoyCheckRevoke(Buffer, Size);
-                if (bRevokeChkOK)
-                {
-                    FreePool(Buffer);
-                    return EFI_SUCCESS;
-                }
-            }
-            FreePool(Buffer);
-        }
-    }
-
-    ShowSBWarning(!bRevokeChkOK, DevicePathConst);
-
-    return EFI_SECURITY_VIOLATION;
+    (VOID)This;
+    (VOID)AuthenticationStatus;
+    (VOID)DevicePathConst;
+    return EFI_SUCCESS;
 }

 STATIC EFI_STATUS EFIAPI Security2PolicyAuth
@@ -422,7 +269,6 @@ STATIC EFI_STATUS EFIAPI Security2PolicyAuth
 )
 {
    EFI_STATUS Status;
-    BOOLEAN bRevokeChkOK = TRUE;

    /* Just return OK if the user choose to bypass SB */
    if (gVtoyByPassSB)
@@ -430,6 +276,11 @@ STATIC EFI_STATUS EFIAPI Security2PolicyAuth
        return EFI_SUCCESS;
    }

+    if (!gGrubLaunched)
+    {
+        return CheckVtoyGrub(FileBuffer, FileSize);
+    }
+
    /*
     * Step 1:
     * Use original UEFI firmware auth API.
@@ -450,23 +301,19 @@ STATIC EFI_STATUS EFIAPI Security2PolicyAuth
     * Use shim verify API.
     * If it's OK, it may be signed with a MOK key. (e.g. Ventoy EFI files)
     */
-    if (gShimLock && gShimLock->Verify)
+    if (gShimLock.Verify)
    {
        if (FileBuffer && FileSize > 0 && FileSize < 0xFFFFFFFFUL)
        {
-            Status = gShimLock->Verify(FileBuffer, (UINT32)FileSize);
+            Status = gShimLock.Verify(FileBuffer, (UINT32)FileSize);
            if (!EFI_ERROR(Status))
            {
-                bRevokeChkOK = VtoyCheckRevoke(FileBuffer, FileSize);
-                if (bRevokeChkOK)
-                {
-                    return EFI_SUCCESS;
-                }
+                return EFI_SUCCESS;
            }
        }
    }

-    ShowSBWarning(!bRevokeChkOK, DevicePath);
+    ShowSBWarning(DevicePath);

    return EFI_SECURITY_VIOLATION;
 }
@@ -524,13 +371,13 @@ STATIC VOID EFIAPI UnHookSecurityPolicy(VOID)
        return;
    }

-    if (Security2 && gSysSec2FileAuth)
+    if (Security2 && gSysSec2FileAuth && Security2->FileAuthentication == Security2PolicyAuth)
    {
        Security2->FileAuthentication = gSysSec2FileAuth;
        gSysSec2FileAuth = NULL;
    }

-    if (Security && gSysSecFileAuth)
+    if (Security && gSysSecFileAuth && Security->FileAuthenticationState == SecurityPolicyAuth)
    {
        Security->FileAuthenticationState = gSysSecFileAuth;
        gSysSecFileAuth = NULL;
@@ -547,6 +394,11 @@ STATIC VOID EFIAPI VtoyCheckSB(VOID)
    gVtoyByPassSB = FALSE;
 }

+STATIC VOID EFIAPI VtoyLaunched(VOID)
+{
+    gGrubLaunched = TRUE;
+}
+
 STATIC VOID EFIAPI UnInstallVtoyShimProtocol(VOID)
 {
    EFI_GUID Guid = VTOY_SHIM_POLICY_GUID;
@@ -566,6 +418,7 @@ STATIC EFI_STATUS EFIAPI InstallVtoyShimProtocol(VOID)

    gVtoyShimProtocol.ByPassSB = VtoyByPassSB;
    gVtoyShimProtocol.CheckSB = VtoyCheckSB;
+    gVtoyShimProtocol.Launched = VtoyLaunched;

    Status = gBS->LocateProtocol(&Guid, NULL, (VOID**)&Prot);
    if (!EFI_ERROR(Status))
@@ -601,58 +454,47 @@ STATIC BOOLEAN EFIAPI IsSecureBootEnabled(VOID)
 	return SecureBoot ? TRUE : FALSE;
 }

-STATIC EFI_STATUS EFIAPI EnvInit(VOID)
+STATIC BOOLEAN EFIAPI IsSetupMode(VOID)
 {
-    EFI_STATUS Status;
-    EFI_GUID Guid = SHIM_LOCK_GUID;
+    UINT8 SetupMode = 0;
+	UINTN DataSize;
+	EFI_STATUS Status;

-    Status = gBS->LocateProtocol(&gEfiDevicePathToTextProtocolGuid, NULL, (VOID**)&gDpToText);
-	if (EFI_ERROR(Status) || !gDpToText || !gDpToText->ConvertDevicePathToText)
+	DataSize = sizeof(SetupMode);
+	Status = gST->RuntimeServices->GetVariable(L"SetupMode", &gEfiGlobalVariableGuid, NULL,
+				     &DataSize, &SetupMode);
+	if (EFI_ERROR(Status))
    {
-        vLog(L"Failed to locate PathToText Protocol %lx", Status);
-        return Status;
+        return FALSE;
    }

-    Status = gBS->LocateProtocol(&gEfiDevicePathFromTextProtocolGuid, NULL, (VOID**)&gTextToDp);
-	if (EFI_ERROR(Status) || !gTextToDp || !gTextToDp->ConvertTextToDevicePath)
-    {
-        vLog(L"Failed to locate PathFromText Protocol %lx", Status);
-        return Status;
-    }
-
-    Status = gBS->LocateProtocol(&Guid, NULL, (VOID**)&gShimLock);
-    if (EFI_ERROR(Status) || !gShimLock)
-    {
-        vLog(L"Failed to locate SHIM LOCK Protocol %lx", Status);
-        return Status;
-    }
-
-    return EFI_SUCCESS;
+	return SetupMode ? TRUE : FALSE;
 }

-
-EFI_STATUS EFIAPI VtoyShimEfiMain
+STATIC EFI_STATUS EFIAPI ShimEfiMain
 (
    IN EFI_HANDLE         ImageHandle,
    IN EFI_SYSTEM_TABLE  *SystemTable
 )
 {
    EFI_STATUS Status;
-    unhook_system_services_pf Func = NULL;
+    SHIM_LOCK *ShimLock = NULL;
+    shim_void_func_pf Func1 = NULL;
+    shim_void_func_pf Func2 = NULL;

-    /* If secure boot is not enabled, nothing needed, just launch Ventoy grub */
-    if (!IsSecureBootEnabled())
+    /* We must be launched by shim */
+    Status = gBS->LocateProtocol(&gShimLockGUID, NULL, (VOID**)&ShimLock);
+    if (EFI_ERROR(Status) || !ShimLock)
    {
-        return LaunchRealGrub(ImageHandle, REAL_GRUB_FILE);
-    }
-
-    Status = EnvInit();
-	if (EFI_ERROR(Status))
-    {
-        vErr(L"Failed to prepare env");
+        vErr(L"Failed to locate SHIM LOCK Protocol %lx", Status);
        return Status;
    }

+    /* Backup shim Lock because we will remove it later  */
+    gShimLock.Verify = ShimLock->Verify;
+    gShimLock.Hash = ShimLock->Hash;
+    gShimLock.Context = ShimLock->Context;
+
    Status = InstallVtoyShimProtocol();
    if (EFI_ERROR(Status))
    {
@@ -675,16 +517,19 @@ EFI_STATUS EFIAPI VtoyShimEfiMain
     * It may break in future versions of shim, and a better approach may exist.
     *
     */
-    Func = FindShimFuncAddr(NM_UNHOOK_SYSTEM_SERVICES_OFFSET);
-    if (!Func)
+    Func1 = FindShimFuncAddr(NM_UNHOOK_SYSTEM_SERVICES_OFFSET);
+    Func2 = FindShimFuncAddr(NM_UNINSTALL_SHIM_PROTOCOLS_OFFSET);
+    if (!Func1 || !Func2)
    {
-        vErr(L"Can not find shim unhook_system_services");
+        vErr(L"Can not find shim func %p %p", Func1, Func2);
        Status = EFI_NOT_FOUND;
        goto END;
    }

-    Func(); /* call shim unhook_system_services() */
+    Func1(); /* call shim unhook_system_services() */
+    Func2(); /* call shim uninstall_shim_protocols() */

+    HookSystemService();

    /* Hook the system security policy */
    Status = HookSecurityPolicy();
@@ -694,8 +539,14 @@ EFI_STATUS EFIAPI VtoyShimEfiMain
        goto END;
    }

+
    /* Finally launch Ventoy grub */
    Status = LaunchRealGrub(ImageHandle, REAL_GRUB_FILE);
+    if (EFI_ERROR(Status))
+    {
+        vErr(L"Failed to finally launch real grub %s", REAL_GRUB_FILE);
+        goto END;
+    }

 END:

@@ -704,6 +555,111 @@ END:

    UnInstallVtoyShimProtocol();

+    UnHookSystemService();
+
+    return Status;
+}
+
+EFI_STATUS EFIAPI VtoyGetVariable
+(
+    IN     CHAR16                      *VariableName,
+    IN     EFI_GUID                    *VendorGuid,
+    OUT    UINT32                      *Attributes,    OPTIONAL
+    IN OUT UINTN                       *DataSize,
+    OUT    VOID                        *Data           OPTIONAL
+)
+{
+    BOOLEAN bChk = FALSE;
+    EFI_STATUS Status;
+
+    if (gVtoyByPassSB && VariableName && VendorGuid && DataSize && Data && (*DataSize) > 0)
+    {
+        bChk = TRUE;
+    }
+
+    Status = gSysGetVariable(VariableName, VendorGuid, Attributes, DataSize, Data);
+    if (bChk && (!EFI_ERROR(Status)))
+    {
+        if (CompareMem(&gShimLockGUID, VendorGuid, 16) == 0 &&
+            StrCmp(VariableName, L"MokSBState") == 0)
+        {
+            *(UINT8 *)Data = 1;
+        }
+    }
+
+    return Status;
+}
+
+STATIC VOID EFIAPI UnHookSystemService(VOID)
+{
+    if (gSysExitBootServices)
+    {
+        gBS->ExitBootServices = gSysExitBootServices;
+        gSysExitBootServices = NULL;
+    }
+
+    if (gSysGetVariable)
+    {
+        gST->RuntimeServices->GetVariable = gSysGetVariable;
+        gSysGetVariable = NULL;
+    }
+}
+
+
+STATIC EFI_STATUS EFIAPI VtoyExitBootServices
+(
+    IN  EFI_HANDLE  ImageHandle,
+    IN  UINTN       MapKey
+)
+{
+    EFI_EXIT_BOOT_SERVICES SysExitBS;
+
+    /* UnHookSystemService will set gSysExitBootServices NULL */
+    SysExitBS = gSysExitBootServices;
+
+    UnHookSecurityPolicy();
+    UnInstallVtoyShimProtocol();
+    UnHookSystemService();
+
+    return SysExitBS(ImageHandle, MapKey);
+}
+
+STATIC VOID EFIAPI HookSystemService(VOID)
+{
+    gSysExitBootServices = gBS->ExitBootServices;
+    gBS->ExitBootServices = VtoyExitBootServices;
+
+    gSysGetVariable = gST->RuntimeServices->GetVariable;
+    gST->RuntimeServices->GetVariable = VtoyGetVariable;
+}
+
+EFI_STATUS EFIAPI VtoyShimEfiMain
+(
+    IN EFI_HANDLE         ImageHandle,
+    IN EFI_SYSTEM_TABLE  *SystemTable
+)
+{
+    BOOLEAN IsSetup = FALSE;
+    BOOLEAN IsSecureBoot = FALSE;
+    EFI_STATUS Status;
+
+    IsSetup = IsSetupMode();
+    IsSecureBoot = IsSecureBootEnabled();
+
+    if (!IsSecureBoot || IsSetup)
+    {
+        /* If secure boot is not enabled or in SetupMode, nothing needed, just launch Ventoy grub */
+        Status = LaunchRealGrub(ImageHandle, REAL_GRUB_FILE);
+        if (EFI_ERROR(Status))
+        {
+            vErr(L"Failed to launch %s", REAL_GRUB_FILE);
+        }
+    }
+    else
+    {
+        Status = ShimEfiMain(ImageHandle, SystemTable);
+    }
+
    return Status;
 }

@@ -66,19 +66,21 @@ typedef struct _SHIM_IMAGE_LOADER {
 	EFI_IMAGE_UNLOAD UnloadImage;
 } SHIM_IMAGE_LOADER;

-typedef VOID (*unhook_system_services_pf)(VOID);
+typedef VOID (*shim_void_func_pf)(VOID);


 /*
 * The two offset here are extract from the shim file which used in Ventoy.
 * nm BOOTX64.EFI | grep shim_load_image
 * nm BOOTX64.EFI | grep unhook_system_services
+ * nm BOOTX64.EFI | grep uninstall_shim_protocols
 *
 * It means that they must be updated every time Ventoy update the shim file.
 *
 */
 #define NM_SHIM_LOAD_IMAGE_OFFSET             0x2dc12
 #define NM_UNHOOK_SYSTEM_SERVICES_OFFSET      0x2e278
+#define NM_UNINSTALL_SHIM_PROTOCOLS_OFFSET    0x26264



@@ -86,6 +88,7 @@ typedef VOID (*unhook_system_services_pf)(VOID);
 #define VtoySleep(sec)      gBS->Stall(1000000 * (sec))
 #define vLog(fmt, ...)      VtoyLog(fmt "\r\n", ##__VA_ARGS__)
 #define vErr(fmt, ...)      VtoyLog(fmt "\r\n", ##__VA_ARGS__); VtoySleep(5)
+#define vDbg(fmt, ...)      VtoyLog(fmt "\r\n", ##__VA_ARGS__); VtoySleep(2)

 #define CheckFreePool(p) \
 do { \
@@ -95,27 +98,19 @@ do { \
    }\
 } while (0)

-#define CheckBSFreePool(p) \
-do { \
-    if (p) { \
-        gBS->FreePool(p); \
-        (p) = NULL; \
-    }\
-} while (0)
-
-

 #define VTOY_SHIM_POLICY_GUID    {0x90a29d14, 0x3968, 0x48fe, { 0x85, 0x81, 0x6b, 0x7f, 0x7d, 0xc4, 0x70, 0x55 }};

-
 typedef VOID (EFIAPI *VTOY_BYPASS_SB)(VOID);
 typedef VOID (EFIAPI *VTOY_CHECK_SB)(VOID);
+typedef VOID (EFIAPI *VTOY_LAUNCHED)(VOID);
 typedef struct _VTOY_SHIM{
 	VTOY_BYPASS_SB ByPassSB;
 	VTOY_BYPASS_SB CheckSB;
+	VTOY_LAUNCHED Launched;
 } VTOY_SHIM;

-CONST UINT8 * ventoy_get_der_data(UINT32 *Len);
+void calc_sha256(const void *data, UINT64 len, void *output);

 #endif

@@ -31,6 +31,7 @@
 [Sources]
  VtoyShim.h
  VtoyShim.c
+  sha256.c
  
 [Packages]
  MdePkg/MdePkg.dec
@@ -0,0 +1,170 @@
+/******************************************************************************
+ * VtoyShim.c
+ *
+ * Copyright (c) 2017 - 2018, Intel Corporation. All rights reserved.<BR>
+ * SPDX-License-Identifier: BSD-2-Clause-Patent
+ *
+ */
+
+#include <Uefi.h>
+#include <Library/DebugLib.h>
+#include <Library/PrintLib.h>
+#include <Library/UefiLib.h>
+#include <Library/BaseMemoryLib.h>
+
+
+static const UINT32 sha256_initial_h[8]
+    = { 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
+        0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19 };
+
+static const UINT32 sha256_round_k[64]
+    = { 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
+        0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+        0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+        0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+        0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+        0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+        0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+        0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+        0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+        0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+        0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2 };
+
+static void sha256_endian_reverse64(UINT64 input, UINT8 *output) {
+    output[7] = (input >> 0) & 0xff;
+    output[6] = (input >> 8) & 0xff;
+    output[5] = (input >> 16) & 0xff;
+    output[4] = (input >> 24) & 0xff;
+    output[3] = (input >> 32) & 0xff;
+    output[2] = (input >> 40) & 0xff;
+    output[1] = (input >> 48) & 0xff;
+    output[0] = (input >> 56) & 0xff;
+}
+
+static UINT32 sha256_endian_read32(UINT8 *input) {
+    UINT32 output = 0;
+    output |= (input[0] << 24);
+    output |= (input[1] << 16);
+    output |= (input[2] << 8);
+    output |= (input[3] << 0);
+
+    return output;
+}
+
+static void sha256_endian_reverse32(UINT32 input, UINT8 *output) {
+    output[3] = (input >> 0) & 0xff;
+    output[2] = (input >> 8) & 0xff;
+    output[1] = (input >> 16) & 0xff;
+    output[0] = (input >> 24) & 0xff;
+}
+
+static UINT32 sha256_ror(UINT32 input, UINT32 by) {
+    return (input >> by) | (((input & ((1 << by) - 1))) << (32 - by));
+}
+
+void calc_sha256(const void *data, UINT64 len, void *output)
+{
+    int i = 0;
+    int j = 0;
+    UINT8 padding[80];
+    UINT64 current = (len + 1) % 64;
+    // want to be == 56 % 64.
+    UINT64 needed = (64 + 56 - current) % 64;
+    UINT64 extra = needed + 9;
+    UINT64 total = len + extra;
+    UINT32 v[8];
+    UINT64 cursor = 0;
+
+    for(i = 1; i < 80; i++)
+    {
+        padding[i] = 0;
+    }
+    padding[0] = 0x80;
+
+    sha256_endian_reverse64(len * 8, padding + total - len - 8);
+
+    for(i = 0; i < 8; i++)
+    {
+        v[i] = sha256_initial_h[i];
+    }
+
+    for(cursor = 0; cursor * 64 < total; cursor++)
+    {
+        UINT32 t[8];
+        UINT32 w[64];
+
+        for(i = 0; i < 8; i++)
+        {
+            t[i] = v[i];
+        }
+
+
+        if(cursor * 64 + 64 <= len)
+        {
+            for(j = 0; j < 16; j++)
+            {
+                w[j] = sha256_endian_read32((UINT8 *)data + cursor * 64 + j * 4);
+            }
+        }
+        else
+        {
+            if(cursor * 64 < len)
+            {
+                UINT64 size = len - cursor * 64;
+                if(size > 0)
+                {
+                    CopyMem(w, (UINT8 *)data + cursor * 64, size);
+                }
+                CopyMem((UINT8 *)w + size, padding, 64 - size);
+            }
+            else
+            {
+                UINT64 off = (cursor * 64 - len) % 64;
+                CopyMem((UINT8 *)w, padding + off, 64);
+            }
+
+            for(j = 0; j < 16; j++)
+            {
+                w[j] = sha256_endian_read32((UINT8 *)&w[j]);
+            }
+        }
+
+        for(j = 16; j < 64; j++)
+        {
+            UINT32 s1 = sha256_ror(w[j - 2], 17) ^ sha256_ror(w[j - 2], 19) ^ (w[j - 2] >> 10);
+            UINT32 s0 = sha256_ror(w[j - 15], 7) ^ sha256_ror(w[j - 15], 18) ^ (w[j - 15] >> 3);
+            w[j] = s1 + w[j - 7] + s0 + w[j - 16];
+        }
+
+        for(j = 0; j < 64; j++)
+        {
+            UINT32 ch = (t[4] & t[5]) ^ (~t[4] & t[6]);
+            UINT32 maj = (t[0] & t[1]) ^ (t[0] & t[2]) ^ (t[1] & t[2]);
+            UINT32 S0 = sha256_ror(t[0], 2) ^ sha256_ror(t[0], 13) ^ sha256_ror(t[0], 22);
+            UINT32 S1 = sha256_ror(t[4], 6) ^ sha256_ror(t[4], 11) ^ sha256_ror(t[4], 25);
+            UINT32 t1 = t[7] + S1 + ch + sha256_round_k[j] + w[j];
+            UINT32 t2 = S0 + maj;
+
+            t[7] = t[6];
+            t[6] = t[5];
+            t[5] = t[4];
+            t[4] = t[3] + t1;
+            t[3] = t[2];
+            t[2] = t[1];
+            t[1] = t[0];
+            t[0] = t1 + t2;
+        }
+
+        for(i = 0; i < 8; i++)
+        {
+            v[i] += t[i];
+        }
+    }
+
+    for(i = 0; i < 8; i++)
+    {
+        sha256_endian_reverse32(v[i], (UINT8 *)output + i * 4);
+    }
+}
+
+
@@ -145,32 +145,6 @@ STATIC EFI_STATUS ParseCmdline(IN EFI_HANDLE ImageHandle)
    return EFI_SUCCESS;
 }

-#if defined (MDE_CPU_X64)
-STATIC BOOLEAN EFIAPI CheckVtoyShim(VOID)
-{
-    UINT8 SecureBoot = 0;
-	UINTN DataSize;
-	EFI_STATUS Status;
-    EFI_GUID Guid = VTOY_SHIM_POLICY_GUID;
-    VOID *Prot = NULL;
-
-	DataSize = sizeof(SecureBoot);
-	Status = gST->RuntimeServices->GetVariable(L"SecureBoot", &gEfiGlobalVariableGuid, NULL,
-				     &DataSize, &SecureBoot);
-	if (!EFI_ERROR(Status) && SecureBoot)
-    {
-        Status = gBS->LocateProtocol(&Guid, NULL, (VOID**)&Prot);
-        if (EFI_ERROR(Status))
-        {
-            gST->ConOut->OutputString(gST->ConOut, L"Can not locate Vtoy Shim\r\n");
-            return FALSE;
-        }
-    }
-
-    return TRUE;
-}
-#endif
-
 EFI_STATUS EFIAPI VtoyUtilEfiMain
 (
    IN EFI_HANDLE         ImageHandle,
@@ -180,15 +154,6 @@ EFI_STATUS EFIAPI VtoyUtilEfiMain
    UINTN i;
    UINTN Len;

-#if defined (MDE_CPU_X64)
-    /* check that Ventoy Shim must exist */
-    if (!CheckVtoyShim())
-    {
-        gBS->Stall(5 * 1000000);
-        return EFI_NOT_FOUND;
-    }
-#endif
-
    ParseCmdline(ImageHandle);

    for (i = 0; gCurFeature && i < ARRAY_SIZE(gFeatureList); i++)
@@ -314,6 +314,25 @@ static void ventoy_get_uefi_version(char *str, grub_size_t len)
        grub_snprintf(str, len, "%s.%d", str, uefi_minor_2);
 }

+static void ventoy_get_pi_version(char *str, grub_size_t len)
+{
+    grub_uint32_t data = 0;
+    grub_efi_uintn_t i = 0;
+    grub_efi_guid_t dxest =
+        { 0x05ad34ba, 0x6f02, 0x4214, {0x95, 0x2e, 0x4d, 0xa0, 0x39, 0x8e, 0x2b, 0xb9 } };
+
+    for (i = 0; i < grub_efi_system_table->num_table_entries; i++)
+    {
+        if (grub_memcmp(&dxest, &grub_efi_system_table->configuration_table[i].vendor_guid, 16) == 0)
+        {
+            grub_memcpy(&data, (char *)grub_efi_system_table->configuration_table[i].vendor_table + 8, 4);
+            break;
+        }
+    }
+
+    grub_snprintf(str, len, "%d.%d", (data >> 16) & 0xFFFF, (data & 0xFFFF) / 10);
+}
+
 int ventoy_set_sb_policy(void)
 {
    const char *env = NULL;
@@ -359,12 +378,27 @@ int ventoy_set_sb_policy(void)

 static void ventoy_get_uefi_sb(void)
 {
+    grub_uint8_t secure_boot = 0;
+    grub_uint8_t setup_mode = 0;
    grub_uint8_t *var = NULL;
    grub_size_t size = 0;
    grub_efi_guid_t global = GRUB_EFI_GLOBAL_VARIABLE_GUID;

    var = grub_efi_get_variable("SecureBoot", &global, &size);
    if (var && size == 1 && *var == 1)
+    {
+        secure_boot = 1;
+    }
+    grub_check_free(var);
+
+    size = 0;
+    var = grub_efi_get_variable("SetupMode", &global, &size);
+    if (var && size == 1 && *var == 1)
+    {
+        setup_mode = 1;
+    }
+
+    if (secure_boot == 1 && setup_mode == 0)
    {
        g_sys_sb = 1;
    }
@@ -384,24 +418,23 @@ static int ventoy_secure_boot_init(void)
    }


-    /*
-     * When SecureBoot enabled, Ventoy grub must be launched by Ventoy Shim.
-     * Currently only x86_64 support this feature.
-     */
    if (g_ventoy_plat_data == VTOY_PLAT_X86_64_UEFI)
    {
        g_vtoy_shim = grub_efi_locate_protocol(&ProtGuid, NULL);
-        if (g_vtoy_shim == NULL || g_vtoy_shim->ByPassSB == NULL || g_vtoy_shim->CheckSB == NULL)
+        if (g_vtoy_shim == NULL || g_vtoy_shim->ByPassSB == NULL ||
+            g_vtoy_shim->CheckSB == NULL || g_vtoy_shim->Launched == NULL)
        {
-            grub_cls();
-            grub_printf(VTOY_WARNING"\n");
-            grub_printf(VTOY_WARNING"\n");
-            grub_printf(VTOY_WARNING"\n\n\n");
-
-            grub_printf("Ventoy grub is not launched by Ventoy shim.\n\n");
-            grub_refresh();
-
-            ventoy_prompt_end();
+            /*
+             * Generally when SecureBoot enabled, Ventoy grub must be launched by Ventoy Shim.
+             * But there are some exceptions:
+             *   1. Ventoy key was enrolled directly to the UEFI DB
+             *   2. Some UEFI firmware (MSI) has Image Execution Policy as Always Execute which
+             *      means Secure Boot is effectively disabled.
+             */
+        }
+        else
+        {
+            g_vtoy_shim->Launched();
        }
    }

@@ -468,8 +501,12 @@ static int ventoy_hwinfo_init(void)
 #ifdef GRUB_MACHINE_EFI
    ventoy_get_uefi_version(str, sizeof(str));
    ventoy_env_export("grub_uefi_version", str);
+
+    ventoy_get_pi_version(str, sizeof(str));
+    ventoy_env_export("grub_pi_version", str);
 #else
    ventoy_env_export("grub_uefi_version", "NA");
+    ventoy_env_export("grub_pi_version", "NA");
 #endif

    return 0;
@@ -896,6 +896,36 @@ static grub_err_t ventoy_cmd_strstr(grub_extcmd_context_t ctxt, int argc, char *
    return (grub_strstr(args[0], args[1])) ? 0 : 1;
 }

+static grub_err_t ventoy_cmd_istrstr(grub_extcmd_context_t ctxt, int argc, char **args)
+{
+    grub_err_t ret = 1;
+    char *s1 = NULL;
+    char *s2 = NULL;
+
+    (void)ctxt;
+
+    if (argc != 2)
+    {
+        return 1;
+    }
+
+    s1 = grub_strdup(args[0]);
+    s2 = grub_strdup(args[1]);
+    if (s1 == NULL || s2 == NULL)
+    {
+        goto end;
+    }
+
+    ventoy_str_toupper(s1);
+    ventoy_str_toupper(s2);
+    ret = (grub_strstr(s1, s2)) ? 0 : 1;
+
+end:
+    grub_check_free(s1);
+    grub_check_free(s2);
+    return ret;
+}
+
 static grub_err_t ventoy_cmd_strbegin(grub_extcmd_context_t ctxt, int argc, char **args)
 {
    char *c0, *c1;
@@ -4722,23 +4752,10 @@ static grub_err_t ventoy_cmd_img_unhook_root(grub_extcmd_context_t ctxt, int arg
 #ifdef GRUB_MACHINE_EFI
 static grub_err_t ventoy_cmd_check_secureboot_var(grub_extcmd_context_t ctxt, int argc, char **args)
 {
-    int ret = 1;
-    grub_uint8_t *var = NULL;
-    grub_size_t size;
-    grub_efi_guid_t global = GRUB_EFI_GLOBAL_VARIABLE_GUID;
-
    (void)ctxt;
    (void)argc;
    (void)args;
-
-    var = grub_efi_get_variable("SecureBoot", &global, &size);
-    if (var && *var == 1)
-    {
-        grub_free(var);
-        return 0;
-    }
-
-    return ret;
+    return g_sys_sb ? 0 : 1;
 }
 #else
 static grub_err_t ventoy_cmd_check_secureboot_var(grub_extcmd_context_t ctxt, int argc, char **args)
@@ -6413,6 +6430,19 @@ static grub_err_t ventoy_cmd_load_menu_lang(grub_extcmd_context_t ctxt, int argc
    VENTOY_CMD_RETURN(0);
 }

+static grub_err_t ventoy_cmd_update_sb_policy(grub_extcmd_context_t ctxt, int argc, char **args)
+{
+    (void)ctxt;
+    (void)argc;
+    (void)args;
+
+#ifdef GRUB_MACHINE_EFI
+    ventoy_set_sb_policy();
+#endif
+
+    VENTOY_CMD_RETURN(0);
+}
+
 static grub_err_t ventoy_cmd_sb_info(grub_extcmd_context_t ctxt, int argc, char **args)
 {
    (void)ctxt;
@@ -6421,6 +6451,10 @@ static grub_err_t ventoy_cmd_sb_info(grub_extcmd_context_t ctxt, int argc, char

 #ifdef GRUB_MACHINE_EFI
    const char *policy = NULL;
+    grub_efi_guid_t security =
+        { 0xA46423E3, 0x4617, 0x49f1, {0xB9, 0xFF, 0xD1, 0xBF, 0xA9, 0x11, 0x58, 0x39 } };
+    grub_efi_guid_t security2 =
+        { 0x94ab2f58, 0x1438, 0x4ef1, {0x91, 0x52, 0x18, 0x94, 0x1a, 0x3a, 0x0e, 0x68 } };

    if (g_sb_policy == VTOY_SB_POLICY_BYPASS)
    {
@@ -6435,8 +6469,10 @@ static grub_err_t ventoy_cmd_sb_info(grub_extcmd_context_t ctxt, int argc, char
        policy = "XXX";
    }

-    grub_printf("UEFI Firmware Secure Boot: %s\n", g_sys_sb ? "Enable" : "Disable");
-    grub_printf("Ventoy Secure Boot Policy: %s\n", policy);
+    grub_printf("UEFI Security           %s\n", grub_efi_locate_protocol(&security, NULL) ? "Yes" : "No");
+    grub_printf("UEFI Security2          %s\n", grub_efi_locate_protocol(&security2, NULL) ? "Yes" : "No");
+    grub_printf("Ventoy Secure Policy    %s\n", policy);
+
 #else
    grub_printf("Non EFI mode!\n");
 #endif
@@ -6931,6 +6967,7 @@ static cmd_para ventoy_cmds[] =
    { "vt_incr",  ventoy_cmd_incr,  0, NULL, "{Var} {INT}",   "Increase integer variable",    NULL },
    { "vt_mod",  ventoy_cmd_mod,  0, NULL, "{Int} {Int} {Var}",   "mod integer variable",    NULL },
    { "vt_strstr",  ventoy_cmd_strstr,  0, NULL, "",   "",    NULL },
+    { "vt_istrstr",  ventoy_cmd_istrstr,  0, NULL, "",   "",    NULL },
    { "vt_str_begin",  ventoy_cmd_strbegin,  0, NULL, "",   "",    NULL },
    { "vt_str_casebegin",  ventoy_cmd_strcasebegin,  0, NULL, "",   "",    NULL },
    { "vt_debug", ventoy_cmd_debug, 0, NULL, "{on|off}",   "turn debug on/off",    NULL },
@@ -7095,6 +7132,7 @@ static cmd_para ventoy_cmds[] =
    { "vt_linux_initrd", ventoy_cmd_linux_initrd, 0, NULL, "", "", NULL },

    { "vt_sbinfo", ventoy_cmd_sb_info, 0, NULL, "", "", NULL },
+    { "vt_update_sb_policy", ventoy_cmd_update_sb_policy, 0, NULL, "", "", NULL },

 };

@@ -199,9 +199,11 @@ typedef struct cpio_newc_header

 typedef void (*VTOY_BYPASS_SB)(void);
 typedef void (*VTOY_CHECK_SB)(void);
+typedef void (*VTOY_LAUNCHED)(void);
 typedef struct _VTOY_SHIM{
 	VTOY_BYPASS_SB ByPassSB;
 	VTOY_CHECK_SB CheckSB;
+	VTOY_LAUNCHED Launched;
 } VTOY_SHIM;


@@ -2556,10 +2556,6 @@ grub_err_t ventoy_cmd_load_plugin(grub_extcmd_context_t ctxt, int argc, char **a
        grub_env_unset("VTOY_MENU_TIP_ENABLE");
    }

-#ifdef GRUB_MACHINE_EFI
-    ventoy_set_sb_policy();
-#endif
-
    VENTOY_CMD_RETURN(GRUB_ERR_NONE);
 }

@@ -1,5 +1,5 @@
 /******************************************************************************
- * ventoy_unix.c 
+ * ventoy_unix.c
 *
 * Copyright (c) 2020, longpanda <admin@ventoy.net>
 *
@@ -7,12 +7,12 @@
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 3 of the
 * License, or (at your option) any later version.
- * 
+ *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
- * 
+ *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see <http://www.gnu.org/licenses/>.
 *
@@ -69,9 +69,9 @@ static int ventoy_get_file_override(const char *filename, grub_uint64_t *offset)
    }

    *offset = grub_iso9660_get_last_file_dirent_pos(file) + 2;
-    
+
    grub_file_close(file);
-    
+
    return 0;
 }

@@ -83,12 +83,12 @@ static grub_uint32_t ventoy_unix_get_override_chunk_count(void)
    {
        count++;
    }
-    
+
    if (g_mod_new_len > 0)
    {
        count++;
    }
-    
+
    if (g_ko_fillmap_len > 0)
    {
        count += (g_ko_fillmap_len / 512);
@@ -109,7 +109,7 @@ static grub_uint32_t ventoy_unix_get_virt_chunk_count(void)
    {
        count++;
    }
-    
+
    if (g_mod_new_len > 0)
    {
        count++;
@@ -127,7 +127,7 @@ static grub_uint32_t ventoy_unix_get_virt_chunk_size(void)
    {
        size += ventoy_align_2k(g_conf_new_len);
    }
-    
+
    if (g_mod_new_len > 0)
    {
        size += ventoy_align_2k(g_mod_new_len);
@@ -141,9 +141,9 @@ static void ventoy_unix_fill_map_data(ventoy_chain_head *chain, struct g_ventoy_
    grub_uint32_t i;
    ventoy_img_chunk *chunk = NULL;

-    debug("Fill unix map data: <%llu> <%u> %p\n", 
+    debug("Fill unix map data: <%llu> <%u> %p\n",
        (unsigned long long)chain->os_param.vtoy_disk_size, g_img_chunk_list.cur_chunk, map);
-    
+
    map->magic1[0] = map->magic2[0] = VENTOY_UNIX_SEG_MAGIC0;
    map->magic1[1] = map->magic2[1] = VENTOY_UNIX_SEG_MAGIC1;
    map->magic1[2] = map->magic2[2] = VENTOY_UNIX_SEG_MAGIC2;
@@ -158,12 +158,12 @@ static void ventoy_unix_fill_map_data(ventoy_chain_head *chain, struct g_ventoy_
        debug("####[FAIL] Too many segments for the ISO file %u\n", g_img_chunk_list.cur_chunk);
        map->segnum = VENTOY_UNIX_MAX_SEGNUM;
    }
-    
+
    for (i = 0; i < (grub_uint32_t)(map->segnum); i++)
    {
        chunk = g_img_chunk_list.chunk + i;
        map->seglist[i].seg_start_bytes = chunk->disk_start_sector * 512ULL;
-        map->seglist[i].seg_end_bytes = (chunk->disk_end_sector + 1) * 512ULL;        
+        map->seglist[i].seg_end_bytes = (chunk->disk_end_sector + 1) * 512ULL;
    }
 }

@@ -176,7 +176,7 @@ static void ventoy_unix_fill_override_data(    grub_uint64_t isosize, ventoy_cha
    grub_uint64_t sector;
    ventoy_override_chunk *cur;
    ventoy_iso9660_override *dirent;
-    
+
    sector = (isosize + 2047) / 2048;

    cur = (ventoy_override_chunk *)((char *)chain + chain->override_chunk_offset);
@@ -215,7 +215,7 @@ static void ventoy_unix_fill_override_data(    grub_uint64_t isosize, ventoy_cha
        offset = g_mod_override_offset;

        ventoy_unix_fill_map_data(chain, (struct g_ventoy_map *)data);
-        
+
        for (i = 0; i < g_ko_fillmap_len / 512; i++)
        {
            cur->img_offset = offset;
@@ -252,7 +252,7 @@ static void ventoy_unix_fill_virt_data(    grub_uint64_t isosize, ventoy_chain_h

    override = (char *)chain + chain->virt_chunk_offset;
    cur = (ventoy_virt_chunk *)override;
-    
+
    sector = (isosize + 2047) / 2048;
    offset = 2 * sizeof(ventoy_virt_chunk);

@@ -267,10 +267,10 @@ static void ventoy_unix_fill_virt_data(    grub_uint64_t isosize, ventoy_chain_h
        {
            ventoy_unix_fill_map_data(chain, (struct g_ventoy_map *)(g_mod_new_data + g_mod_search_magic));
        }
-    
+
        ventoy_unix_fill_virt(g_mod_new_data, g_mod_new_len);
    }
-    
+
    return;
 }

@@ -287,7 +287,7 @@ static int ventoy_freebsd_append_conf(char *buf, const char *isopath, const char
    grub_uint8_t disk_guid[16];

    debug("ventoy_freebsd_append_conf %s\n", isopath);
-    
+
    isofile = ventoy_grub_file_open(VENTOY_FILE_TYPE, "%s", isopath);
    if (!isofile)
    {
@@ -296,7 +296,7 @@ static int ventoy_freebsd_append_conf(char *buf, const char *isopath, const char

    vtoy_ssprintf(buf, pos, "ventoy_load=\"%s\"\n", "YES");
    vtoy_ssprintf(buf, pos, "ventoy_name=\"%s\"\n", g_ko_mod_path);
-    
+
    if (alias)
    {
        vtoy_ssprintf(buf, pos, "hint.ventoy.0.alias=\"%s\"\n", alias);
@@ -320,7 +320,7 @@ static int ventoy_freebsd_append_conf(char *buf, const char *isopath, const char
    }

    debug("Fill hint.ventoy info\n");
-    
+
    disk = isofile->device->disk;

    ventoy_get_disk_guid(isofile->name, disk_guid, disk_sig);
@@ -338,7 +338,7 @@ static int ventoy_freebsd_append_conf(char *buf, const char *isopath, const char
    for (i = 0; i < g_img_chunk_list.cur_chunk; i++)
    {
        chunk = g_img_chunk_list.chunk + i;
-        vtoy_ssprintf(buf, pos, "hint.ventoy.%u.seg=\"0x%llx@0x%llx\"\n", 
+        vtoy_ssprintf(buf, pos, "hint.ventoy.%u.seg=\"0x%llx@0x%llx\"\n",
            i, (ulonglong)(chunk->disk_start_sector * 512),
            (ulonglong)((chunk->disk_end_sector + 1) * 512));
    }
@@ -368,7 +368,7 @@ grub_err_t ventoy_cmd_unix_reset(grub_extcmd_context_t ctxt, int argc, char **ar
    (void)ctxt;
    (void)argc;
    (void)args;
-    
+
    g_unix_vlnk_boot = 0;
    g_mod_search_magic = 0;
    g_conf_new_len = 0;
@@ -411,7 +411,7 @@ grub_err_t ventoy_cmd_parse_freenas_ver(grub_extcmd_context_t ctxt, int argc, ch
    const char *ver = NULL;
    char *buf = NULL;
    VTOY_JSON *json = NULL;
-    
+
    (void)ctxt;
    (void)argc;

@@ -472,7 +472,7 @@ grub_err_t ventoy_cmd_unix_freebsd_ver(grub_extcmd_context_t ctxt, int argc, cha
    char *buf;
    char *start = NULL;
    char *nextline = NULL;
-    
+
    (void)ctxt;
    (void)argc;
    (void)args;
@@ -502,7 +502,7 @@ grub_err_t ventoy_cmd_unix_freebsd_ver(grub_extcmd_context_t ctxt, int argc, cha
                nextline++;
            }

-            *nextline = 0;            
+            *nextline = 0;
            break;
        }
        nextline = ventoy_get_line(start);
@@ -521,25 +521,162 @@ grub_err_t ventoy_cmd_unix_freebsd_ver(grub_extcmd_context_t ctxt, int argc, cha

    grub_free(buf);
    grub_file_close(file);
-    
+
    VENTOY_CMD_RETURN(GRUB_ERR_NONE);
 }

+static int ventoy_freebsd_ver_elf(int bit64, grub_elf_t elf, const char *section, const char *env, char *data)
+{
+    int j = 0;
+    int k = 0;
+    int ret = 1;
+    char *str = NULL;
+    void *hdr = NULL;
+    grub_off_t offset = 0;
+    grub_uint32_t len = 0;
+    char ver[64] = {0};
+
+    if (bit64)
+    {
+        Elf64_Ehdr *e = &(elf->ehdr.ehdr64);
+        Elf64_Shdr *h;
+        Elf64_Shdr *s;
+        Elf64_Shdr *t;
+        Elf64_Half i;
+
+        h = hdr = grub_zalloc(e->e_shnum * e->e_shentsize);
+        if (!h)
+        {
+            goto out;
+        }
+
+        debug("read section header %u %u %u\n", e->e_shnum, e->e_shentsize, e->e_shstrndx);
+        grub_file_seek(elf->file, e->e_shoff);
+        grub_file_read(elf->file, h, e->e_shnum * e->e_shentsize);
+
+        s = (Elf64_Shdr *)((char *)h + e->e_shstrndx * e->e_shentsize);
+        str = grub_malloc(s->sh_size + 1);
+        if (!str)
+        {
+            goto out;
+        }
+        str[s->sh_size] = 0;
+
+        debug("read string table %u %u\n", (grub_uint32_t)s->sh_offset, (grub_uint32_t)s->sh_size);
+        grub_file_seek(elf->file, s->sh_offset);
+        grub_file_read(elf->file, str, s->sh_size);
+
+        for (t = h, i = 0; i < e->e_shnum; i++)
+        {
+            if (grub_strcmp(str + t->sh_name, section) == 0)
+            {
+                offset = t->sh_offset;
+                len = t->sh_size;
+                debug("find %s section at %u %u\n", section, (grub_uint32_t)offset, len);
+                break;
+            }
+            t = (Elf64_Shdr *)((char *)t + e->e_shentsize);
+        }
+    }
+    else
+    {
+        Elf32_Ehdr *e = &(elf->ehdr.ehdr32);
+        Elf32_Shdr *h;
+        Elf32_Shdr *s;
+        Elf32_Shdr *t;
+        Elf32_Half i;
+
+        h = hdr = grub_zalloc(e->e_shnum * e->e_shentsize);
+        if (!h)
+        {
+            goto out;
+        }
+
+        debug("read section header %u %u %u\n", e->e_shnum, e->e_shentsize, e->e_shstrndx);
+        grub_file_seek(elf->file, e->e_shoff);
+        grub_file_read(elf->file, h, e->e_shnum * e->e_shentsize);
+
+        s = (Elf32_Shdr *)((char *)h + e->e_shstrndx * e->e_shentsize);
+        str = grub_malloc(s->sh_size + 1);
+        if (!str)
+        {
+            goto out;
+        }
+        str[s->sh_size] = 0;
+
+        debug("read string table %u %u\n", (grub_uint32_t)s->sh_offset, (grub_uint32_t)s->sh_size);
+        grub_file_seek(elf->file, s->sh_offset);
+        grub_file_read(elf->file, str, s->sh_size);
+
+        for (t = h, i = 0; i < e->e_shnum; i++)
+        {
+            if (grub_strcmp(str + t->sh_name, section) == 0)
+            {
+                offset = t->sh_offset;
+                len = t->sh_size;
+                debug("find %s section at %u %u\n", section, (grub_uint32_t)offset, len);
+                break;
+            }
+            t = (Elf32_Shdr *)((char *)t + e->e_shentsize);
+        }
+    }
+
+    if (offset == 0 || len == 0)
+    {
+        debug("%s section not found\n", section);
+        goto out;
+    }
+
+    grub_file_seek(elf->file, offset + len - 8192);
+    grub_file_read(elf->file, data, 8192);
+
+    for (j = 0; j < 8192 - 12; j++)
+    {
+        if (grub_strncmp(data + j, "@(#)FreeBSD ", 12) == 0)
+        {
+            for (k = j + 12; k < 8192; k++)
+            {
+                if (0 == grub_isdigit(data[k]) && data[k] != '.')
+                {
+                    data[k] = 0;
+                    break;
+                }
+            }
+
+            grub_snprintf(ver, sizeof(ver), "%s", data + j + 12);
+            break;
+        }
+    }
+
+
+    if (ver[0])
+    {
+        k = (int)grub_strtoul(ver, NULL, 10);
+        debug("%s freebsd version:<%s> <%d.x>\n", section, ver, k);
+        grub_snprintf(ver, sizeof(ver), "%d.x", k);
+        ventoy_set_env(env, ver);
+        ret = 0;
+    }
+    else
+    {
+        debug("%s freebsd version:<%s>\n", section, "NOT FOUND");
+        ret = 1;
+    }
+
+out:
+    grub_check_free(str);
+    grub_check_free(hdr);
+    return ret;
+}
+
 grub_err_t ventoy_cmd_unix_freebsd_ver_elf(grub_extcmd_context_t ctxt, int argc, char **args)
 {
-    int j;
-    int k;
-    grub_elf_t elf = NULL;
-    grub_off_t offset = 0;
-    grub_uint32_t len = 0;
-    char *str = NULL;
+    int ret = 0;
+    int bit64 = 0;
    char *data = NULL;
-    void *hdr = NULL;
-    char ver[64] = {0};
-    
+    grub_elf_t elf = NULL;
+
    (void)ctxt;
-    (void)argc;
-    (void)args;

    if (argc != 3)
    {
@@ -560,136 +697,18 @@ grub_err_t ventoy_cmd_unix_freebsd_ver_elf(grub_extcmd_context_t ctxt, int argc,
        goto out;
    }

-    if (args[1][0] == '6')
+    bit64 = (args[1][0] == '6') ? 1 : 0;
+
+    ret = ventoy_freebsd_ver_elf(bit64, elf, ".data", args[2], data);
+    if (ret != 0)
    {
-        Elf64_Ehdr *e = &(elf->ehdr.ehdr64);
-        Elf64_Shdr *h;
-        Elf64_Shdr *s;
-        Elf64_Shdr *t;
-        Elf64_Half i;
-        
-        h = hdr = grub_zalloc(e->e_shnum * e->e_shentsize);
-        if (!h)
-        {
-            goto out;
-        }
-
-        debug("read section header %u %u %u\n", e->e_shnum, e->e_shentsize, e->e_shstrndx);
-        grub_file_seek(elf->file, e->e_shoff);
-        grub_file_read(elf->file, h, e->e_shnum * e->e_shentsize);
-
-        s = (Elf64_Shdr *)((char *)h + e->e_shstrndx * e->e_shentsize);        
-        str = grub_malloc(s->sh_size + 1);
-        if (!str)
-        {
-            goto out;
-        }
-        str[s->sh_size] = 0;
-
-        debug("read string table %u %u\n", (grub_uint32_t)s->sh_offset, (grub_uint32_t)s->sh_size);
-        grub_file_seek(elf->file, s->sh_offset);
-        grub_file_read(elf->file, str, s->sh_size);
-
-        for (t = h, i = 0; i < e->e_shnum; i++)
-        {
-            if (grub_strcmp(str + t->sh_name, ".data") == 0)
-            {
-                offset = t->sh_offset;
-                len = t->sh_size;
-                debug("find .data section at %u %u\n", (grub_uint32_t)offset, len);
-                break;
-            }
-            t = (Elf64_Shdr *)((char *)t + e->e_shentsize);
-        }
-    }
-    else
-    {
-        Elf32_Ehdr *e = &(elf->ehdr.ehdr32);
-        Elf32_Shdr *h;
-        Elf32_Shdr *s;
-        Elf32_Shdr *t;
-        Elf32_Half i;
-        
-        h = hdr = grub_zalloc(e->e_shnum * e->e_shentsize);
-        if (!h)
-        {
-            goto out;
-        }
-
-        debug("read section header %u %u %u\n", e->e_shnum, e->e_shentsize, e->e_shstrndx);
-        grub_file_seek(elf->file, e->e_shoff);
-        grub_file_read(elf->file, h, e->e_shnum * e->e_shentsize);
-
-        s = (Elf32_Shdr *)((char *)h + e->e_shstrndx * e->e_shentsize);        
-        str = grub_malloc(s->sh_size + 1);
-        if (!str)
-        {
-            goto out;
-        }
-        str[s->sh_size] = 0;
-
-        debug("read string table %u %u\n", (grub_uint32_t)s->sh_offset, (grub_uint32_t)s->sh_size);
-        grub_file_seek(elf->file, s->sh_offset);
-        grub_file_read(elf->file, str, s->sh_size);
-
-        for (t = h, i = 0; i < e->e_shnum; i++)
-        {
-            if (grub_strcmp(str + t->sh_name, ".data") == 0)
-            {
-                offset = t->sh_offset;
-                len = t->sh_size;
-                debug("find .data section at %u %u\n", (grub_uint32_t)offset, len);
-                break;
-            }
-            t = (Elf32_Shdr *)((char *)t + e->e_shentsize);
-        }
-    }
-
-    if (offset == 0 || len == 0)
-    {
-        debug(".data section not found %s\n", args[0]);
-        goto out;
-    }
-
-    grub_file_seek(elf->file, offset + len - 8192);
-    grub_file_read(elf->file, data, 8192);
-
-    for (j = 0; j < 8192 - 12; j++)
-    {
-        if (grub_strncmp(data + j, "@(#)FreeBSD ", 12) == 0)
-        {
-            for (k = j + 12; k < 8192; k++)
-            {
-                if (0 == grub_isdigit(data[k]) && data[k] != '.')
-                {
-                    data[k] = 0;
-                    break;
-                }
-            }
-        
-            grub_snprintf(ver, sizeof(ver), "%s", data + j + 12);
-            break;
-        }
-    }
-
-    if (ver[0])
-    {
-        k = (int)grub_strtoul(ver, NULL, 10);
-        debug("freebsd version:<%s> <%d.x>\n", ver, k);
-        grub_snprintf(ver, sizeof(ver), "%d.x", k);
-        ventoy_set_env(args[2], ver);
-    }
-    else
-    {
-        debug("freebsd version:<%s>\n", "NOT FOUND");
+        ret = ventoy_freebsd_ver_elf(bit64, elf, ".rodata", args[2], data);
    }

 out:
-    grub_check_free(str);
-    grub_check_free(hdr);
    grub_check_free(data);
    check_free(elf, grub_elf_close);
-    
+
    VENTOY_CMD_RETURN(GRUB_ERR_NONE);
 }

@@ -704,7 +723,7 @@ grub_err_t ventoy_cmd_unix_replace_grub_conf(grub_extcmd_context_t ctxt, int arg
    grub_file_t file;
    char extcfg[512];
    const char *confile = NULL;
-    const char * loader_conf[] = 
+    const char * loader_conf[] =
    {
        "/boot/grub/grub.cfg",
    };
@@ -716,7 +735,7 @@ grub_err_t ventoy_cmd_unix_replace_grub_conf(grub_extcmd_context_t ctxt, int arg
        debug("Replace conf invalid argc %d\n", argc);
        return 1;
    }
- 
+
    for (i = 0; i < sizeof(loader_conf) / sizeof(loader_conf[0]); i++)
    {
        if (ventoy_get_file_override(loader_conf[i], &offset) == 0)
@@ -728,7 +747,7 @@ grub_err_t ventoy_cmd_unix_replace_grub_conf(grub_extcmd_context_t ctxt, int arg
    }

    if (confile == NULL)
-    {   
+    {
        debug("Can't find grub.cfg file from %u locations\n", i);
        return 1;
    }
@@ -745,13 +764,13 @@ grub_err_t ventoy_cmd_unix_replace_grub_conf(grub_extcmd_context_t ctxt, int arg
    data = grub_malloc(VTOY_MAX_SCRIPT_BUF);
    if (!data)
    {
-        grub_file_close(file);    
+        grub_file_close(file);
        return 1;
    }

    grub_file_read(file, data, file->size);
    grub_file_close(file);
-    
+
    g_conf_new_data = data;
    g_conf_new_len = (int)file->size;

@@ -783,7 +802,7 @@ grub_err_t ventoy_cmd_unix_replace_grub_conf(grub_extcmd_context_t ctxt, int arg
        {
            vtoy_ssprintf(extcfg, len, ";set kFreeBSD.hint.ventoy.0.remount=%d", 1);
        }
-        
+
        grub_memmove(pos + len, pos, (int)(file->size - (pos - data)));
        grub_memcpy(pos, extcfg, len);
        g_conf_new_len += len;
@@ -792,7 +811,7 @@ grub_err_t ventoy_cmd_unix_replace_grub_conf(grub_extcmd_context_t ctxt, int arg
    {
        debug("no kfreebsd found\n");
    }
-    
+
    VENTOY_CMD_RETURN(GRUB_ERR_NONE);
 }

@@ -803,7 +822,7 @@ grub_err_t ventoy_cmd_unix_replace_conf(grub_extcmd_context_t ctxt, int argc, ch
    grub_uint64_t offset;
    grub_file_t file;
    const char *confile = NULL;
-    const char * loader_conf[] = 
+    const char * loader_conf[] =
    {
        "/boot/loader.conf",
        "/boot/defaults/loader.conf",
@@ -816,7 +835,7 @@ grub_err_t ventoy_cmd_unix_replace_conf(grub_extcmd_context_t ctxt, int argc, ch
        debug("Replace conf invalid argc %d\n", argc);
        return 1;
    }
- 
+
    for (i = 0; i < sizeof(loader_conf) / sizeof(loader_conf[0]); i++)
    {
        if (ventoy_get_file_override(loader_conf[i], &offset) == 0)
@@ -828,7 +847,7 @@ grub_err_t ventoy_cmd_unix_replace_conf(grub_extcmd_context_t ctxt, int argc, ch
    }

    if (confile == NULL)
-    {   
+    {
        debug("Can't find loader.conf file from %u locations\n", i);
        return 1;
    }
@@ -845,13 +864,13 @@ grub_err_t ventoy_cmd_unix_replace_conf(grub_extcmd_context_t ctxt, int argc, ch
    data = grub_malloc(VTOY_MAX_SCRIPT_BUF);
    if (!data)
    {
-        grub_file_close(file);    
+        grub_file_close(file);
        return 1;
    }

    grub_file_read(file, data, file->size);
    grub_file_close(file);
-    
+
    g_conf_new_data = data;
    g_conf_new_len = (int)file->size;

@@ -863,19 +882,19 @@ grub_err_t ventoy_cmd_unix_replace_conf(grub_extcmd_context_t ctxt, int argc, ch
    {
        g_conf_new_len += ventoy_dragonfly_append_conf(data + file->size, args[1]);
    }
-    
+
    VENTOY_CMD_RETURN(GRUB_ERR_NONE);
 }

 static int ventoy_unix_search_magic(char *data, int len)
 {
    int i;
-    grub_uint32_t *magic = NULL;    
+    grub_uint32_t *magic = NULL;

    for (i = 0; i < len; i += 4096)
    {
        magic = (grub_uint32_t *)(data + i);
-        if (magic[0] == VENTOY_UNIX_SEG_MAGIC0 && magic[1] == VENTOY_UNIX_SEG_MAGIC1 && 
+        if (magic[0] == VENTOY_UNIX_SEG_MAGIC0 && magic[1] == VENTOY_UNIX_SEG_MAGIC1 &&
            magic[2] == VENTOY_UNIX_SEG_MAGIC2 && magic[3] == VENTOY_UNIX_SEG_MAGIC3)
        {
            debug("unix find search magic at 0x%x loop:%d\n", i, (i >> 12));
@@ -910,7 +929,7 @@ grub_err_t ventoy_cmd_unix_replace_ko(grub_extcmd_context_t ctxt, int argc, char
        g_mod_override_offset = offset;
    }
    else
-    {   
+    {
        debug("Can't find replace ko file from %s\n", args[0]);
        return 1;
    }
@@ -928,18 +947,18 @@ grub_err_t ventoy_cmd_unix_replace_ko(grub_extcmd_context_t ctxt, int argc, char
    if (!data)
    {
        debug("Failed to alloc memory for new ko %d\n", (int)file->size);
-        grub_file_close(file);    
+        grub_file_close(file);
        return 1;
    }

    grub_file_read(file, data, file->size);
    grub_file_close(file);
-    
+
    g_mod_new_data = data;
    g_mod_new_len = (int)file->size;

    ventoy_unix_search_magic(g_mod_new_data, g_mod_new_len);
-    
+
    VENTOY_CMD_RETURN(GRUB_ERR_NONE);
 }

@@ -967,7 +986,7 @@ grub_err_t ventoy_cmd_unix_ko_fillmap(grub_extcmd_context_t ctxt, int argc, char
        g_mod_override_offset = grub_iso9660_get_last_read_pos(file);
    }
    else
-    {   
+    {
        debug("Can't find replace ko file from %s\n", args[0]);
        return 1;
    }
@@ -977,8 +996,8 @@ grub_err_t ventoy_cmd_unix_ko_fillmap(grub_extcmd_context_t ctxt, int argc, char
        magic[0] = 0;
        grub_file_seek(file, i);
        grub_file_read(file, magic, sizeof(magic));
-    
-        if (magic[0] == VENTOY_UNIX_SEG_MAGIC0 && magic[1] == VENTOY_UNIX_SEG_MAGIC1 && 
+
+        if (magic[0] == VENTOY_UNIX_SEG_MAGIC0 && magic[1] == VENTOY_UNIX_SEG_MAGIC1 &&
            magic[2] == VENTOY_UNIX_SEG_MAGIC2 && magic[3] == VENTOY_UNIX_SEG_MAGIC3)
        {
            debug("unix find search magic at 0x%x loop:%d\n", i, (i >> 16));
@@ -987,7 +1006,7 @@ grub_err_t ventoy_cmd_unix_ko_fillmap(grub_extcmd_context_t ctxt, int argc, char
        }
    }

-    len = (grub_uint32_t)OFFSET_OF(struct g_ventoy_map, seglist) + 
+    len = (grub_uint32_t)OFFSET_OF(struct g_ventoy_map, seglist) +
        (sizeof(struct g_ventoy_seg) * g_img_chunk_list.cur_chunk);

    g_ko_fillmap_len = (int)len;
@@ -1034,7 +1053,7 @@ grub_err_t ventoy_cmd_unix_fill_image_desc(grub_extcmd_context_t ctxt, int argc,
            if (grub_memcmp(flag, byte + i, 32) == 0)
            {
                debug("Find position flag at %d(0x%x)\n", i, i);
-                break;                
+                break;
            }
        }
    }
@@ -1118,7 +1137,7 @@ grub_err_t ventoy_cmd_unix_chain_data(grub_extcmd_context_t ctxt, int argc, char
    const char *pLastChain = NULL;
    const char *compatible;
    ventoy_chain_head *chain;
-    
+
    (void)ctxt;
    (void)argc;

@@ -1161,9 +1180,9 @@ grub_err_t ventoy_cmd_unix_chain_data(grub_extcmd_context_t ctxt, int argc, char
            return grub_error(GRUB_ERR_BAD_ARGUMENT, "File %s is not bootable", args[0]);
        }
    }
-    
+
    img_chunk_size = g_img_chunk_list.cur_chunk * sizeof(ventoy_img_chunk);
-    
+
    if (ventoy_compatible)
    {
        size = sizeof(ventoy_chain_head) + img_chunk_size;
@@ -1172,11 +1191,11 @@ grub_err_t ventoy_cmd_unix_chain_data(grub_extcmd_context_t ctxt, int argc, char
    {
        override_count = ventoy_unix_get_override_chunk_count();
        override_size = override_count * sizeof(ventoy_override_chunk);
-        
+
        virt_chunk_size = ventoy_unix_get_virt_chunk_size();
        size = sizeof(ventoy_chain_head) + img_chunk_size + override_size + virt_chunk_size;
    }
-    
+
    pLastChain = grub_env_get("vtoy_chain_mem_addr");
    if (pLastChain)
    {
@@ -1239,7 +1258,7 @@ grub_err_t ventoy_cmd_unix_chain_data(grub_extcmd_context_t ctxt, int argc, char
    ventoy_unix_fill_virt_data(isosize, chain);

    grub_file_close(file);
-    
+
    VENTOY_CMD_RETURN(GRUB_ERR_NONE);
 }

@@ -17,5 +17,10 @@
 # 
 #************************************************************************************

+if $GREP -q 'rdinit=/vtoy/vtoy' /proc/cmdline; then
+    echo "fix rdinit" >> $VTLOG
+    $SED "/switch_root.*\/mnt\/.installer-mp/i\ sh $VTOY_PATH/hook/debian/pve-wa.sh /mnt/.installer-mp/sbin/unconfigured.sh" -i /init
+fi
+
 $SED "/\/sys\/block\/hd\*/i\ $BUSYBOX_PATH/sh $VTOY_PATH/hook/debian/pve-disk.sh"  -i /init
 $SED "s#/sys/block/hd\*#/sys/block/dm* /sys/block/hd*#"  -i /init
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+script=$1
+tmpscript=${script}.tmp
+
+LINE=$(grep -n 'proc.*proc.*proc' $script | awk -F':' '{print $1}')
+
+sed -n "1,${LINE}p" $script >> $tmpscript
+
+echo "if grep -q 'rdinit=/vtoy/vtoy' /proc/cmdline; then"    >> $tmpscript
+echo "    sed 's#rdinit=/vtoy/vtoy##g' /proc/cmdline > /etc/cmdline"    >> $tmpscript
+echo "    mount --bind /etc/cmdline  /proc/cmdline"    >> $tmpscript
+echo "fi"    >> $tmpscript
+
+
+let LINE++
+sed -n "${LINE},\$p" $script >> $tmpscript
+
+cat $tmpscript > $script
+
@@ -17,19 +17,23 @@
 # 
 #************************************************************************************

+$CAT /proc/cmdline > /ventoy/cmdline
+$SED 's#live-media=[^ ]*#live-media=/dev/mapper/ventoy#g' -i /ventoy/cmdline

 if [ -e /init ] && $GREP -q '^mountroot$' /init; then
    echo "Here before mountroot ..." >> $VTLOG
    
    $SED  "/^mountroot$/i\\$BUSYBOX_PATH/sh $VTOY_PATH/hook/deepin/disk_mount_hook.sh"  -i /init
    $SED  "/^mountroot$/i\\export LIVEMEDIA=/dev/mapper/ventoy"  -i /init
-    $SED  "/^mountroot$/i\\export LIVE_MEDIA=/dev/mapper/ventoy"  -i /init    
+    $SED  "/^mountroot$/i\\export LIVE_MEDIA=/dev/mapper/ventoy"  -i /init
+
+    $SED "/mount *[-]t *proc/a\\mount --bind /ventoy/cmdline /proc/cmdline" -i /init   

    if $GREP -q 'live-media=' /proc/cmdline; then
        if [ -f /scripts/casper ] && $GREP -q '^  *LIVEMEDIA=' /scripts/casper; then
            $SED "s#^  *LIVEMEDIA=.*#LIVEMEDIA=/dev/mapper/ventoy#" -i /scripts/casper
-        fi
-    fi
+        fi        
+    fi           
 else
    echo "Here use udev hook ..." >> $VTLOG
    ventoy_systemd_udevd_work_around
@@ -0,0 +1,24 @@
+#!/ventoy/busybox/sh
+
+. /ventoy/hook/ventoy-hook-lib.sh
+
+vtlog "######### $0 $* ############"
+
+if is_ventoy_hook_finished; then
+    exit 0
+fi
+
+wait_for_usb_disk_ready
+
+vtdiskname=$(get_ventoy_disk_name)
+if [ "$vtdiskname" = "unknown" ]; then
+    vtlog "ventoy disk not found"
+    exit 0
+fi
+
+vtlog "vtdiskname=$vtdiskname"
+
+ventoy_udev_disk_common_hook "${vtdiskname#/dev/}2" "noreplace"
+
+# OK finish
+set_ventoy_hook_finish
@@ -0,0 +1,7 @@
+
+function ft_mountCdromDir()
+{
+    /ventoy/busybox/sh /ventoy/hook/euleros/disk_mount_hook.sh    
+    ft_mountCdromDirXX "$@"
+}
+
@@ -0,0 +1,42 @@
+#!/ventoy/busybox/sh
+#************************************************************************************
+# Copyright (c) 2020, longpanda <admin@ventoy.net>
+# 
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; either version 3 of the
+# License, or (at your option) any later version.
+# 
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, see <http://www.gnu.org/licenses/>.
+# 
+#************************************************************************************
+
+. $VTOY_PATH/hook/ventoy-os-lib.sh
+
+TRANSFILE=/usr/Euler/project/load/filetransfer.sh
+
+LINE=$($GREP -n 'function ft_mountCdromDir' $TRANSFILE | $AWK -F':' '{print $1}')
+
+echo "LINE=$LINE" >> $VTLOG
+
+$SED 's#FT_SR_DEV=.*#FT_SR_DEV=/dev/mapper/ventoy#g' -i $TRANSFILE
+$SED 's/function ft_mountCdromDir/function ft_mountCdromDirXX/' -i $TRANSFILE
+
+let LINE--
+$SED -n "1,${LINE}p" $TRANSFILE >> /ventoy/filetransfer.sh
+
+$CAT $VTOY_PATH/hook/euleros/hook_func.sh >> /ventoy/filetransfer.sh
+
+let LINE++
+$SED -n "${LINE},\$p" $TRANSFILE >> /ventoy/filetransfer.sh
+
+$BUSYBOX_PATH/mv /ventoy/filetransfer.sh $TRANSFILE
+
+#fix the euler os shell script
+$SED 's/-z ${harddisk_disk_list}/-z "${harddisk_disk_list}"/' -i /usr/Euler/project/disk/disk_tool.sh
@@ -100,7 +100,11 @@ ventoy_get_os_type() {
        echo 'rhel7'; return

    elif $GREP -q 'euleros' /proc/version; then
-        echo 'rhel7'; return
+        if [ -d /usr/Euler/project/init ]; then
+            echo 'euleros'; return
+        else
+            echo 'rhel7'; return
+        fi

    # SUSE
    elif $GREP -q 'SUSE' /proc/version; then
@@ -436,7 +440,11 @@ fi
 #                                                                  #
 ####################################################################
 if [ -f "/live_injection_7ed136ec_7a61_4b54_adc3_ae494d5106ea/hook.sh" ]; then
-    $BUSYBOX_PATH/sh "/live_injection_7ed136ec_7a61_4b54_adc3_ae494d5106ea/hook.sh" $VTOS
+    echo "==== Begin Call live injection hook.sh $VTOS" >> $VTLOG
+    $BUSYBOX_PATH/sh "/live_injection_7ed136ec_7a61_4b54_adc3_ae494d5106ea/hook.sh" $VTOS  >>$VTLOG 2>&1
+    echo "==== Finish Call live injection hook.sh $VTOS" >> $VTLOG
+else
+    echo "No live injection" >> $VTLOG
 fi


@@ -1,7 +1,5 @@
 #!/bin/sh

-OLDDIR=$(pwd)
-
 if ! [ -f ./tool/ventoy_lib.sh ]; then
    if [ -f ${0%Ventoy2Disk.sh}/tool/ventoy_lib.sh ]; then
        cd ${0%Ventoy2Disk.sh}    
@@ -21,7 +19,7 @@ elif uname -m | grep -E -q 'mips64'; then
 else
    export TOOLDIR=i386
 fi
-export PATH="$OLDDIR/tool/$TOOLDIR:$PATH"
+export PATH="$(pwd)/tool/$TOOLDIR:$PATH"


 echo ''
@@ -88,10 +86,3 @@ if [ -f /bin/bash ]; then
 else
    ash ./tool/VentoyWorker.sh $*
 fi
-
-if [ -n "$OLDDIR" ]; then 
-    CURDIR=$(pwd)
-    if [ "$CURDIR" != "$OLDDIR" ]; then
-        cd "$OLDDIR"
-    fi
-fi
@@ -34,20 +34,6 @@ function ventoy_debug_pause {
 }


-function ventoy_max_resolution {
-    #Skip this for VirtualBox
-    smbios -t 1 -s 0x05 --set=system_product;
-    if vt_str_casebegin "$system_product"  "VirtualBox"; then
-        return
-    fi
-
-    vt_enum_video_mode
-    vt_get_video_mode 0 vtCurMode
-    terminal_output console
-    set gfxmode=$vtCurMode
-    terminal_output gfxterm
-}
-
 function ventoy_cli_console {
    if [ -z "$vtoy_display_mode" ]; then
        terminal_output  console
@@ -503,20 +489,20 @@ function ventoy_freebsd_proc {
        ventoy_get_truenas_ver "$1" "${chosen_path}"
    elif vt_strstr "$vt_volume_id" "FURYBSD"; then
        ventoy_get_furybsd_ver "$1" "${chosen_path}"  
-    elif regexp --set 1:vtBsdVerNum "^(15|14|13|12|11|10|9)_[0-9]" "$vt_volume_id"; then
+    elif regexp --set 1:vtBsdVerNum "^(1[0-9]|9)_[0-9]" "$vt_volume_id"; then
        set vt_freebsd_ver=${vtBsdVerNum}.x    
    elif [ -d (loop)/usr/midnightbsd-dist ]; then
        ventoy_get_midnightbsd_ver "$1" "${chosen_path}"
        set vtFreeBsdDistro=MidnightBSD
    elif [ -e (loop)/bin/freebsd-version ]; then
        vt_unix_parse_freebsd_ver (loop)/bin/freebsd-version vt_userland_ver        
-        if regexp --set 1:vtBsdVerNum "\"(15|14|13|12|11|10|9)\.[0-9]-" "$vt_userland_ver"; then
+        if regexp --set 1:vtBsdVerNum "\"(1[0-9]|9)\.[0-9]-" "$vt_userland_ver"; then
            set vt_freebsd_ver=${vtBsdVerNum}.x
-        fi        
+        fi
    elif [ -e (loop)/README.TXT ]; then
        vt_1st_line (loop)/README.TXT vt_freebsd_line1
-        if regexp --set 1:vtBsdVerNum "FreeBSD (15|14|13|12|11|10|9)\.[0-9]-" "$vt_freebsd_line1"; then
-            set vt_freebsd_ver=${vtBsdVerNum}.x        
+        if regexp --set 1:vtBsdVerNum "FreeBSD (1[0-9]|9)\.[0-9]-" "$vt_freebsd_line1"; then
+            set vt_freebsd_ver=${vtBsdVerNum}.x
        fi
    elif vt_strstr "${chosen_path}" "MidnightBSD"; then
        set vt_freebsd_ver=9.x
@@ -545,7 +531,7 @@ function ventoy_freebsd_proc {
        fi
        
        if [ "$vt_freebsd_ver" = "xx" ]; then
-            set vt_freebsd_ver=14.x
+            set vt_freebsd_ver=15.x
        fi
    fi

@@ -662,7 +648,6 @@ function uefi_windows_menu_func {

    if [ -n "$vtoy_chain_mem_addr" ]; then
        ventoy_acpi_param ${vtoy_chain_mem_addr} 2048
-        ventoy_max_resolution
        chainloader ${vtoy_path}/ventoy_${VTOY_EFI_ARCH}.efi  env_param=${env_param} isoefi=${LoadIsoEfiDriver} iso_${ventoy_fs_probe} ${vtdebug_flag} mem:${vtoy_chain_mem_addr}:size:${vtoy_chain_mem_size}
        boot
    else
@@ -747,6 +732,8 @@ function uefi_linux_menu_func {
                    vt_add_replace_file $vtindex "arch\\boot\\x86_64\\initramfs-linux.img"
                elif [ -f (loop)/boot/initramfs_x86_64.img ]; then
                    vt_add_replace_file $vtindex "boot\\initramfs_x86_64.img"
+                elif [ -f (loop)/arch/boot/x86_64/initramfs-linux-aegis-offensive.img ]; then
+                    vt_add_replace_file $vtindex "arch\\boot\\x86_64\\initramfs-linux-aegis-offensive.img"
                fi
            elif [ -d (loop)/blackarch ]; then
                if [ -f (loop)/blackarch/boot/x86_64/archiso.img ]; then
@@ -1457,7 +1444,10 @@ function ventoy_iso_busybox_ver {
            set ventoy_busybox_ver=64
        elif vt_strstr "$vt_volume_id" "x86_64"; then
            set ventoy_busybox_ver=64
-
+        elif vt_istrstr "${vt_chosen_path}" "x86_64"; then
+            set ventoy_busybox_ver=64
+        elif vt_istrstr "${vt_chosen_path}" "amd64"; then
+            set ventoy_busybox_ver=64
        fi
    fi
 }
@@ -2449,7 +2439,7 @@ function mimg_common_menuentry {
 #############################################################
 #############################################################

-set VENTOY_VERSION="1.1.13"
+set VENTOY_VERSION="1.1.17"

 #ACPI not compatible with Window7/8, so disable by default
 set VTOY_PARAM_NO_ACPI=1
@@ -2551,6 +2541,10 @@ else
    vt_check_json_path_case $vtoy_iso_part
 fi

+#Update Secure Boot Policy
+vt_update_sb_policy
+
+
 if [ -n "$VTOY_MENU_LANGUAGE" ]; then
    vt_init_menu_lang "$VTOY_MENU_LANGUAGE"
 else
@@ -1,18 +1,18 @@
- L - Seleccionar lenguaje
+ L - Seleccionar idioma
 F1 - Mostrar información de ayuda
-F2 - Navegar y arranca archivos en el disco local
-F3 - Cambiar modo de menú entre vista de árbol <-> vista de lista
-F4 - arrancar Windows/Linux en el disco local
+F2 - Navegar y arrancar archivos en el disco local
+F3 - Cambiar modo de menú entre Vista de árbol <-> Vista de lista
+F4 - Arrancar Windows/Linux en el disco local
 F5 - Utilidades
 F6 - Cargar menú de Grub2 personalizado
-F7 - Cambiar entre modo grafico <-> modo texto
+F7 - Cambiar entre Modo GUI <-> Modo texto

 m/Ctrl+m - Suma de comprobación de archivos de imagen (md5/sha1/sha256/sha512)
-d/Ctrl+d - Modo Memdisk (solo para WinPE/LiveCD ISO/IMG pequeños)
-w/Ctrl+w - Modo WIMBOOT (Solo para archivos Windows/WinPE ISO)
-r/Ctrl+r - Modo Grub2 (Solo para algunas distribuciones de Linux)
-i/Ctrl+i - Modo compatible (Solo para depuración)
-u/Ctrl+u - Cargar controlador ISO EFI (Solo para depuración, no se puede usar oficialmente)
+d/Ctrl+d - Modo Memdisk (Sólo para WinPE/LiveCD ISO/IMG pequeños)
+w/Ctrl+w - Modo WIMBOOT (Sólo para archivos Windows/WinPE ISO)
+r/Ctrl+r - Modo Grub2 (Sólo para algunas distros de Linux)
+i/Ctrl+i - Modo compatible (Sólo para depuración)
+u/Ctrl+u - Cargar controlador ISO EFI (Sólo para depuración, uso no oficial)



@@ -24,17 +24,20 @@ menuentry "$VTLANG_HWINFO" --class=debug_hwinfo --class=F5tool {
    set bios_size="-";
    smbios -t 0 -b 0x09 --set=bios_size;
    
-    
+
    echo "Platform                $grub_cpu-$grub_platform"    
    if [ "$grub_platform" != "pc" ]; then
        echo "UEFI Version            $grub_uefi_version"
+        echo "PI   Version            $grub_pi_version"
        if vt_check_secureboot_var; then
            echo "Secure Boot             Enabled"
        else
            echo "Secure Boot             Disabled"
        fi
-    fi
-    
+        
+        vt_sbinfo
+    fi    
+
    echo ""    
    echo "CPU Model               $cpu_brand"
    echo "Physical RAM            $grub_total_ram MB"
@@ -1,10 +1,10 @@
 {
    "VTLANG_LANGUAGE_NAME": "Spanish (Español)",
    
-    "VTLANG_STR_HOTKEY_LIST": "L:Lenguaje  F1:Ayuda  F2:Navegar  F3:Vista de lista  F4:Arranque local  F5:Herramientas  F6:Extensión de menú",
-    "VTLANG_STR_HOTKEY_TREE": "L:Lenguaje  F1:Ayuda  F2:Navegar  F3:Vista de árbol  F4:Arranque local  F5:Herramientas  F6:Extensión de menú",
-    "VTLANG_RETURN_PREVIOUS": "Regresar al menú previo [Esc]",
-    "VTLANG_RETURN_PRV_NOESC": "Regresar al menú previo",
+    "VTLANG_STR_HOTKEY_LIST": "L:Idioma  F1:Ayuda  F2:Navegar  F3:Vista de lista  F4:Arranque local  F5:Herramientas  F6:Menú ext.",
+    "VTLANG_STR_HOTKEY_TREE": "L:Idioma  F1:Ayuda  F2:Navegar  F3:Vista de árbol  F4:Arranque local  F5:Herramientas  F6:Menú ext.",
+    "VTLANG_RETURN_PREVIOUS": "Regresar al menú anterior [Esc]",
+    "VTLANG_RETURN_PRV_NOESC": "Regresar al menú anterior",
    
    "VTLANG_MENU_LANG": "Selección de idioma del menú",
    
@@ -28,13 +28,13 @@
    "VTLANG_CHKSUM_SHA256_CALC_CHK": "Calcular y comprobar sha256sum",
    "VTLANG_CHKSUM_SHA512_CALC_CHK": "Calcular y comprobar sha512sum",
    
-    "VTLANG_POWER": "Poder",
+    "VTLANG_POWER": "Energía",
    "VTLANG_POWER_REBOOT": "Reiniciar",
-    "VTLANG_POWER_HALT": "Detener",
-    "VTLANG_POWER_BOOT_EFIFW": "Reiniciar a configuración EFI",
+    "VTLANG_POWER_HALT": "Apagar",
+    "VTLANG_POWER_BOOT_EFIFW": "Reiniciar a la configuración EFI",
    
    "VTLANG_KEYBRD_LAYOUT": "Distribuciones de teclado",
-    "VTLANG_HWINFO": "Información de Hardware",
+    "VTLANG_HWINFO": "Información de hardware",
    
    "VTLANG_RESOLUTION_CFG": "Configuración de resolución",
    "VTLANG_SCREEN_MODE": "Modo de visualización de pantalla",
@@ -45,23 +45,23 @@
    
    "VTLANG_UEFI_UTIL": "Utilidades UEFI de Ventoy",
    "VTLANG_UTIL_SHOW_EFI_DRV": "Mostrar controladores EFI",
-    "VTLANG_UTIL_FIX_BLINIT_FAIL": "Reparar la falla de BinitializeLibrary de Windows",
+    "VTLANG_UTIL_FIX_BLINIT_FAIL": "Reparar error BlinitializeLibrary de Windows",
    
-    "VTLANG_JSON_CHK_JSON": "Comprobar configuración de complemento de json (ventoy.json)",
-    "VTLANG_JSON_CHK_CONTROL": "Comprobar configuración de complemento de control global",
-    "VTLANG_JSON_CHK_THEME": "Comprobar configuración de complemento de tema",
-    "VTLANG_JSON_CHK_AUTOINS": "Comprobar configuración de complemento de auto instalación",
-    "VTLANG_JSON_CHK_PERSIST": "Comprobar configuración de complemento de persistencia",
-    "VTLANG_JSON_CHK_MENU_ALIAS": "Comprobar configuración de complemento de alias de menú",
-    "VTLANG_JSON_CHK_MENU_TIP": "Comprobar configuración de complemento de consejo de menú",
-    "VTLANG_JSON_CHK_MENU_CLASS": "Comprobar configuración de complemento de clase de menú",
-    "VTLANG_JSON_CHK_INJECTION": "Comprobar configuración de complemento de inyección",
-    "VTLANG_JSON_CHK_AUTO_MEMDISK": "Comprobar configuración de complemento de auto memdisk",
-    "VTLANG_JSON_CHK_IMG_LIST": "Comprobar configuración de complemento de lista de imágenes",
-    "VTLANG_JSON_CHK_IMG_BLIST": "Comprobar configuración de complemento de lista negra de imágenes",
-    "VTLANG_JSON_CHK_CONF_REPLACE": "Comprobar configuración de complemento de reemplazo de configuración de arranque",
-    "VTLANG_JSON_CHK_DUD": "Comprobar configuración de complemento de dud",
-    "VTLANG_JSON_CHK_PASSWORD": "Comprobar configuración de complemento de contraseñas",
+    "VTLANG_JSON_CHK_JSON": "Comprobar configuración del complemento de json (ventoy.json)",
+    "VTLANG_JSON_CHK_CONTROL": "Comprobar configuración del complemento de control global",
+    "VTLANG_JSON_CHK_THEME": "Comprobar configuración del complemento de tema",
+    "VTLANG_JSON_CHK_AUTOINS": "Comprobar configuración del complemento de autoinstalación",
+    "VTLANG_JSON_CHK_PERSIST": "Comprobar configuración del complemento de persistencia",
+    "VTLANG_JSON_CHK_MENU_ALIAS": "Comprobar configuración del complemento de alias de menú",
+    "VTLANG_JSON_CHK_MENU_TIP": "Comprobar configuración del complemento de consejo de menú",
+    "VTLANG_JSON_CHK_MENU_CLASS": "Comprobar configuración del complemento de clases de menú",
+    "VTLANG_JSON_CHK_INJECTION": "Comprobar configuración del complemento de inyección",
+    "VTLANG_JSON_CHK_AUTO_MEMDISK": "Comprobar configuración del complemento auto memdisk",
+    "VTLANG_JSON_CHK_IMG_LIST": "Comprobar configuración del complemento de lista de imágenes",
+    "VTLANG_JSON_CHK_IMG_BLIST": "Comprobar configuración del complemento de lista negra de imágenes",
+    "VTLANG_JSON_CHK_CONF_REPLACE": "Comprobar configuración del complemento de reemplazo de configuración de arranque",
+    "VTLANG_JSON_CHK_DUD": "Comprobar configuración del complemento dud",
+    "VTLANG_JSON_CHK_PASSWORD": "Comprobar configuración del complemento de contraseñas",
    
    "VTLANG_NORMAL_MODE": "Arrancar en modo normal",
    "VTLANG_WIMBOOT_MODE": "Arrancar en modo wimboot",
@@ -71,7 +71,7 @@
    "VTLANG_RET_TO_LISTVIEW": "Regresar a vista de lista",
    "VTLANG_RET_TO_TREEVIEW": "regresar a vista de árbol",
    
-    "VTLANG_NO_AUTOINS_SCRIPT": "Arrancar sin plantilla de auto instalación",
+    "VTLANG_NO_AUTOINS_SCRIPT": "Arrancar sin plantilla de autoinstalación",
    "VTLANG_AUTOINS_USE": "Arrancar con",
    
    "VTLANG_NO_PERSIST": "Arrancar sin persistencia",
@@ -79,20 +79,20 @@
    
    "VTLANG_BROWER_RETURN": "Regresar",
    
-    "VTLANG_ENTER_EXIT": "presiona tecla Entrar para salir",
-    "VTLANG_ENTER_REBOOT": "presiona tecla Entrar para reiniciar",
-    "VTLANG_ENTER_CONTINUE": "presiona tecla Entrar para continuar",
+    "VTLANG_ENTER_EXIT": "Presiona la tecla Entrar para salir",
+    "VTLANG_ENTER_REBOOT": "Presiona la tecla Entrar para reiniciar",
+    "VTLANG_ENTER_CONTINUE": "Presiona la tecla Entrar para continuar",
    
    "VTLANG_CTRL_TEMP_SET": "Ajustes de control temporales",
-    "VTLANG_WIN11_BYPASS_CHECK": "Saltar comprobación de CPU/TPM/Arranque Seguro al instalar Windows 11",
-    "VTLANG_WIN11_BYPASS_NRO": "Saltar requerimiento de cuenta en linea al instalar Windows 11",
+    "VTLANG_WIN11_BYPASS_CHECK": "Omitir comprobación de CPU/TPM/SecureBoot al instalar Windows 11",
+    "VTLANG_WIN11_BYPASS_NRO": "Omitir requisito de cuenta en línea al instalar Windows 11",
    "VTLANG_LINUX_REMOUNT": "Montar partición de Ventoy después de arrancar Linux",
    "VTLANG_SECONDARY_BOOT_MENU": "Mostrar menú de arranque secundario",
-    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
-    "VTLANG_UEFI_RES_LOCK_NONE": "None",
-    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
-    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
-    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+    "VTLANG_WIN_UEFI_RES_LOCK": "Bloquear la resolución al arrancar Windows/WinPE en modo UEFI",
+    "VTLANG_UEFI_RES_LOCK_NONE": "Ninguno",
+    "VTLANG_UEFI_RES_LOCK_MAX": "La más alta",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "Fija 1024 x 768",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "Al menos 1024 x 768",


    "MENU_STR_XXX": ""
@@ -88,11 +88,11 @@
    "VTLANG_WIN11_BYPASS_NRO": "Windows 11 설치 시 온라인 계정 요구 사항 무시",
    "VTLANG_LINUX_REMOUNT": "Linux 부팅 후 Ventoy 파티션 마운트",
    "VTLANG_SECONDARY_BOOT_MENU": "보조 부팅 메뉴 표시",
-    "VTLANG_WIN_UEFI_RES_LOCK": "Lock the resolution when UEFI boot Windows/WinPE",
-    "VTLANG_UEFI_RES_LOCK_NONE": "None",
-    "VTLANG_UEFI_RES_LOCK_MAX": "Highest",
-    "VTLANG_UEFI_RES_LOCK_1024_768": "Fixed 1024 x 768",
-    "VTLANG_UEFI_RES_LOCK_BE1024_768": "At least 1024 x 768",
+    "VTLANG_WIN_UEFI_RES_LOCK": "UEFI 부팅 시 Windows/WinPE 해상도 고정",
+    "VTLANG_UEFI_RES_LOCK_NONE": "고정 안 함",
+    "VTLANG_UEFI_RES_LOCK_MAX": "최고 해상도로 고정",
+    "VTLANG_UEFI_RES_LOCK_1024_768": "1024 x 768로 고정",
+    "VTLANG_UEFI_RES_LOCK_BE1024_768": "1024 x 768 이상으로 고정",


    "MENU_STR_XXX": ""
@@ -186,7 +186,7 @@ if [ "$MODE" = "install" -a -z "$NONDESTRUCTIVE" ]; then
    else
        if parted -v > /dev/null 2>&1; then
            PARTTOOL='parted'            
-        elif fdisk -v >/dev/null 2>&1; then
+        elif command -v fdisk > /dev/null 2>&1; then
            PARTTOOL='fdisk'            
        else
            vterr "Both parted and fdisk are not found in the system, Ventoy can't create new partitions."
@@ -12,7 +12,6 @@ if [ "$VENTOY_CERT_PASS" = "YES" ]; then
    fi
 fi

-SBAT_VER=1
 sign_efi() {
    efi=$1
    
@@ -32,10 +31,6 @@ sign_efi() {
        mv ${efi}.unxz  ${efi}
    fi

-    sbstr=$(printf "%08x" $SBAT_VER)
-    echo -en "\x8a\x06\x55\xf7\x4f\xe0\x2b\x45\x9d\x6d\x7c\x55\x96\xb3\xc0\x7d\x${sbstr:6:2}\x${sbstr:4:2}\x${sbstr:2:2}\x${sbstr:0:2}" | \
-        dd bs=1 count=20 of=${efi} seek=40 conv=notrunc status=none
-
    rm -f "${efi}.signed"
    if [ "$VENTOY_CERT_PASS" = "YES" ]; then
        expect -f ./sign_with_pass.exp "$KEY_PASS" "$VENTOY_CERT_KEY" "$VENTOY_CERT_PEM" "${efi}" "${efi}.signed" >/dev/null 2>&1
@@ -52,7 +47,7 @@ sign_efi() {
            mv "${efi}.signed" "$efi"
        fi
    else
-        echo "### %-64s  failed\n" "$efi"
+        printf "### %-64s  failed\n" "$efi"
        exit 1
    fi 

@@ -191,7 +186,6 @@ cp -a ./tool/create_ventoy_iso_part_dm.sh  $tmpmnt/tool/
 rm -f $tmpmnt/grub/i386-pc/*.img


-sign_efi $tmpmnt/EFI/BOOT/fbx64.efi
 sign_efi $tmpmnt/EFI/BOOT/fbia32.efi
 sign_efi $tmpmnt/EFI/BOOT/fbaa64.efi
 sign_efi $tmpmnt/EFI/BOOT/grubx64_real.efi
@@ -211,6 +205,23 @@ sign_efi $tmpmnt/ventoy/vtoyutil_aa64.efi
 sign_efi $tmpmnt/ventoy/wimboot.i386.efi.xz
 sign_efi $tmpmnt/ventoy/wimboot.x86_64.xz

+#inject Ventoy Grub sign sha256 value into VtoyShim
+grub_sha256=$(sha256sum $tmpmnt/EFI/BOOT/grubx64_real.efi | awk '{print $1}')
+magic_cnt=$(hexdump -C $tmpmnt/EFI/BOOT/fbx64.efi | grep '26 26 26 26 26 26 26 26' | wc -l)
+if [ $magic_cnt -ne 1 ]; then
+    echo "hash magic duplicate"
+    exit 1
+fi
+magic_off_hex=$(hexdump -C $tmpmnt/EFI/BOOT/fbx64.efi | grep '26 26 26 26 26 26 26 26' | awk '{print $1}')
+magic_off=$(printf '%u' "0x${magic_off_hex}")
+
+echo_cmd=$(echo $grub_sha256 | sed 's/\(..\)/\\x\1/g')
+
+echo Ventoy Grub hash $grub_sha256
+echo -en "$echo_cmd" | dd bs=1 count=32 of=$tmpmnt/EFI/BOOT/fbx64.efi seek=$magic_off conv=notrunc status=none
+
+sign_efi $tmpmnt/EFI/BOOT/fbx64.efi
+

 umount $tmpmnt && rm -rf $tmpmnt

@@ -198,13 +198,13 @@
        "name":"Korean (한국어)",
        "FontFamily":"Courier New",
        "FontSize":16,
-        "Author":"VenusGirl",
+        "Author":"VenusGirl, HYB1022",
        
        "STR_ERROR":"오류",
        "STR_WARNING":"경고",
        "STR_INFO":"정보",
-        "STR_INCORRECT_DIR":"올바른 디렉터리에서 실행하십시오!",
-        "STR_INCORRECT_TREE_DIR":"여기서 프로그램 (INSTALL 디렉터리)을 실행하지 말고 설치 패키지를 다운로드하여 압축을 푼 후 그곳에서 실행해 주십시오.",
+        "STR_INCORRECT_DIR":"올바른 파일 경로에서 실행하십시오!",
+        "STR_INCORRECT_TREE_DIR":"여기(INSTALL 경로)서 프로그램을 실행하지 말고 설치 패키지를 다운로드하여 압축을 푼 후 그곳에서 실행해 주십시오.",
        "STR_DEVICE":"장치",
        "STR_LOCAL_VER":"패키지의 Ventoy 버전",
        "STR_DISK_VER":"장치 내부의 Ventoy 버전",
@@ -216,10 +216,10 @@
        "STR_INSTALL_TIP2":"디스크가 포맷되고 모든 데이터가 손실됩니다.#@계속하시겠습니까? (다시 확인)",
        "STR_INSTALL_SUCCESS":"축하합니다!#@Ventoy가 장치에 성공적으로 설치되었습니다.",
        "STR_INSTALL_FAILED":"설치 중 오류가 발생했습니다. USB를 다시 삽입하고 다시 시도할 수 있습니다. 자세한 내용은 log.txt를 확인하십시오.",
-        "STR_UPDATE_SUCCESS":"축하합니다!#@Ventoy가 장치에 성공적으로 업데이트되었습니다.",
+        "STR_UPDATE_SUCCESS":"축하합니다! 장치에 설치된#@Ventoy가 성공적으로 업데이트되었습니다.",
        "STR_UPDATE_FAILED":"업데이트 중에 오류가 발생했습니다. USB를 다시 삽입하고 다시 시도할 수 있습니다. 자세한 내용은 log.txt를 확인하십시오.",
        "STR_WAIT_PROCESS":"현재 작업이 실행 중입니다. 기다려 주십시오...",
-        "STR_MENU_OPTION":"옵션",
+        "STR_MENU_OPTION":"설정",
        "STR_MENU_SECURE_BOOT":"보안 부트 (Secure Boot) 지원",
        "STR_MENU_PART_CFG":"파티션 구성",
        "STR_BTN_OK":"확인",
@@ -1172,13 +1172,13 @@
        "name":"Spanish (Latinoamérica)",
        "FontFamily":"Courier New",
        "FontSize":16,
-        "Author":"MELERIX",
+        "Author":"MELERIX, independent-arg",
        
        "STR_ERROR":"Error",
        "STR_WARNING":"Advertencia",
        "STR_INFO":"Información",
-        "STR_INCORRECT_DIR":"¡Por favor, ejecuta bajo el directorio correcto!",
-        "STR_INCORRECT_TREE_DIR":"No me ejecutes aquí, por favor descarga el paquete de instalación lanzado, y ejecútalo allí.",
+        "STR_INCORRECT_DIR":"¡Por favor, ejecuta el programa bajo el directorio correcto!",
+        "STR_INCORRECT_TREE_DIR":"No me ejecutes aquí. Por favor descarga el paquete de instalación oficial y ejecútalo desde allí.",
        "STR_DEVICE":"Dispositivo",
        "STR_LOCAL_VER":"Ventoy En Paquete",
        "STR_DISK_VER":"Ventoy En Dispositivo",
@@ -1189,47 +1189,47 @@
        "STR_INSTALL_TIP":"El dispositivo será formateado y todos los datos se perderán.#@¿Continuar?",
        "STR_INSTALL_TIP2":"El dispositivo será formateado y todos los datos se perderán.#@¿Continuar? (Doble Comprobación)",
        "STR_INSTALL_SUCCESS":"¡Felicitaciones!#@Ventoy ha sido instalado exitosamente en el dispositivo.",
-        "STR_INSTALL_FAILED":"Ocurrió un error durante la instalación. Puedes reinsertar el dispositivo USB e intentar de nuevo. Comprueba log.txt para detalles. Si siempre falla, consulta las PF en el sitio web oficial.",
+        "STR_INSTALL_FAILED":"Ocurrió un error durante la instalación. Puedes reinsertar el dispositivo USB e intentar de nuevo. Comprueba log.txt para más detalles. Si siempre falla, consulta las preguntas frecuentes (FAQ) en el sitio web oficial.",
        "STR_UPDATE_SUCCESS":"¡Felicitaciones!#@Ventoy ha sido actualizado exitosamente en el dispositivo.",
-        "STR_UPDATE_FAILED":"Ocurrió un error durante la actualización. Puedes reinsertar el dispositivo USB e intentar de nuevo. Comprueba log.txt para detalles. Si siempre falla, consulta las PF en el sitio web oficial.",
-        "STR_WAIT_PROCESS":"Un hilo está ejecutándose, por favor espera...",
+        "STR_UPDATE_FAILED":"Ocurrió un error durante la actualización. Puedes reinsertar el dispositivo USB e intentar de nuevo. Comprueba log.txt para más detalles. Si siempre falla, consulta las preguntas frecuentes (FAQ) en el sitio web oficial.",
+        "STR_WAIT_PROCESS":"Un hilo del sistema está ejecutándose, por favor espera...",
        "STR_MENU_OPTION":"Opción",
-        "STR_MENU_SECURE_BOOT":"Soporte De Arranque Seguro",
-        "STR_MENU_PART_CFG":"Configuración De Partición",
+        "STR_MENU_SECURE_BOOT":"Soporte de arranque seguro",
+        "STR_MENU_PART_CFG":"Configuración de partición",
        "STR_BTN_OK":"Aceptar",
        "STR_BTN_CANCEL":"Cancelar",
        "STR_PRESERVE_SPACE":"Preservar algo de espacio al final del dispositivo",
-        "STR_SPACE_VAL_INVALID":"Valor inválido para espacio reservado",
+        "STR_SPACE_VAL_INVALID":"Valor inválido para el espacio reservado",
        "STR_MENU_CLEAR":"Limpiar Ventoy",
-        "STR_CLEAR_SUCCESS":"Ventoy ha sido removido exitosamente desde el dispositivo.",
-        "STR_CLEAR_FAILED":"Ocurrió un error al remover Ventoy del dispositivo. Puedes reinsertar el dispositivo USB e intentar de nuevo. Comprueba log.txt para detalles.",
-        "STR_MENU_PART_STYLE":"Estilo De Partición",
-        "STR_DISK_2TB_MBR_ERROR":"Por favor selecciona GPT para dispositivos sobre 2TB",
-        "STR_SHOW_ALL_DEV":"Mostrar Todos Los Dispositivos",
-        "STR_PART_ALIGN_4KB":"Alinear particiones con 4KB",
+        "STR_CLEAR_SUCCESS":"Ventoy ha sido eliminado exitosamente del dispositivo.",
+        "STR_CLEAR_FAILED":"Ocurrió un error al eliminar Ventoy del dispositivo. Puedes reinsertar el dispositivo USB e intentar de nuevo. Comprueba log.txt para más detalles.",
+        "STR_MENU_PART_STYLE":"Estilo de partición",
+        "STR_DISK_2TB_MBR_ERROR":"Por favor selecciona GPT para dispositivos de más de 2TB",
+        "STR_SHOW_ALL_DEV":"Mostrar todos los dispositivos",
+        "STR_PART_ALIGN_4KB":"Alinear particiones a 4KB",
        "STR_WEB_COMMUNICATION_ERR":"Error de comunicación:",
-        "STR_WEB_REMOTE_ABNORMAL":"Error de comunicación: anormal remoto",
-        "STR_WEB_REQUEST_TIMEOUT":"Error de comunicación: Tiempo de espera agotado",
-        "STR_WEB_SERVICE_UNAVAILABLE":"Error de comunicación: Servicio No Disponible",
+        "STR_WEB_REMOTE_ABNORMAL":"Error de comunicación: anomalía remoto",
+        "STR_WEB_REQUEST_TIMEOUT":"Error de comunicación: tiempo de espera agotado",
+        "STR_WEB_SERVICE_UNAVAILABLE":"Error de comunicación: servicio no disponible",
        "STR_WEB_TOKEN_MISMATCH":" Estado del daemon actualizado, por favor reintenta más tarde.",
        "STR_WEB_SERVICE_BUSY":" El servicio está ocupado, por favor reintenta más tarde.",
-        "STR_MENU_VTSI_CREATE":"Generar Archivo VTSI",
-        "STR_VTSI_CREATE_TIP":"Esta vez no se escribirá al dispositivo, pero solo generará un archivo VTSI#@¿Continuar?",
+        "STR_MENU_VTSI_CREATE":"Generar archivo VTSI",
+        "STR_VTSI_CREATE_TIP":"Esta acción no escribirá en el dispositivo, sólo generará un archivo VTSI.#@¿Continuar?",
        "STR_VTSI_CREATE_SUCCESS":"¡Archivo VTSI creado exitosamente!#@Puedes usar Rufus(3.15+) para escribirlo al dispositivo a fin de completar la instalación de Ventoy.",
-        "STR_VTSI_CREATE_FAILED":"Fallo en el archivo VTSI creado.",
+        "STR_VTSI_CREATE_FAILED":"Error al crear el archivo VTSI.",
        "STR_MENU_PART_RESIZE":"Instalación no destructiva",
        "STR_PART_RESIZE_TIP":"Ventoy intentará una instalación no destructiva si es posible. #@¿Continuar?",
        "STR_PART_RESIZE_SUCCESS":"¡Felicitaciones!#@La instalación no destructiva de Ventoy a finalizado exitosamente.",
        "STR_PART_RESIZE_FAILED":"Instalación no destructiva fallida, Comprueba log.txt para detalles.",
-        "STR_PART_RESIZE_UNSUPPORTED":"Instalación no destructiva de Ventoy detenida porque algunas condiciones no se pueden cumplir. Comprueba log.txt para detalles.",
+        "STR_PART_RESIZE_UNSUPPORTED":"Instalación no destructiva de Ventoy detenida porque algunas condiciones no se pueden cumplir. Comprueba log.txt para más detalles.",
        "STR_INSTALL_YES_TIP1":"Advertencia: ¡Los datos se perderán!",
        "STR_INSTALL_YES_TIP2":"Por favor ingresa YES en el cuadro de texto a continuación para confirmar que realmente quieres realizar una instalación nueva en vez de actualizar.",
        "STR_PART_VENTOY_FS":"Sistema de archivos para partición de Ventoy",
        "STR_PART_FS":"Sistema de archivos",
-        "STR_PART_CLUSTER":"Tamaño de cluster",
+        "STR_PART_CLUSTER":"Tamaño del clúster",
        "STR_PART_CLUSTER_DEFAULT":"Valor predeterminado del sistema",
        "STR_DONATE":"Donar",
-        "STR_4KN_UNSUPPORTED":"Actualmente Ventoy no soporta dispositivos nativos 4K.",
+        "STR_4KN_UNSUPPORTED":"Actualmente Ventoy no es compatible con dispositivos nativos 4K.",
        
        "STRXXX":""
    },
@@ -3043,14 +3043,14 @@
        "STR_PART_RESIZE_SUCCESS":"Onnittelut!#@Ventoyn ei-tuhoisa asennus saapui päätökseen onnistuneesti.",
        "STR_PART_RESIZE_FAILED":"Ei-tuhoisa asennusmuoto epäonnistui, tarkista log.txt nähdäksesi yksityiskohtaiset tiedot.",
        "STR_PART_RESIZE_UNSUPPORTED":"Ventoyn ei-tuhoisa asennus pysähtyi koska jotkut ehdot eivät täyttyneet. Tarkista log.txt nähdäksesi yksityiskohdat.",
-        "STR_INSTALL_YES_TIP1":"Warning: Data will be lost!",
-        "STR_INSTALL_YES_TIP2":"Please enter YES in the text box below to confirm that you indeed want to do a fresh install instead of upgrade.",
-        "STR_PART_VENTOY_FS":"File System For Ventoy Partition",
-        "STR_PART_FS":"File System",
-        "STR_PART_CLUSTER":"Cluster Size",
-        "STR_PART_CLUSTER_DEFAULT":"System Default Value",
+        "STR_INSTALL_YES_TIP1":"Varoitus: Data menetetään!",
+        "STR_INSTALL_YES_TIP2":"Kirjoita YES alla olevaan tekstikenttään vahvistaaksesi että haluat tehdä uuden asennuksen päivityksen sijaan.",
+        "STR_PART_VENTOY_FS":"Ventoy -osion tiedostojärjestelmä",
+        "STR_PART_FS":"Tiedostojärjestelmä",
+        "STR_PART_CLUSTER":"Klusterin koko",
+        "STR_PART_CLUSTER_DEFAULT":"Järjestelmän oletusarvo",
        "STR_DONATE":"Lahjoittaa",
-        "STR_4KN_UNSUPPORTED":"Currently Ventoy does not support 4K native devices.",
+        "STR_4KN_UNSUPPORTED":"Tällä hetkellä Ventoy ei tue 4K laitteita.",
        
        "STRXXX":""
    },
@@ -414,7 +414,7 @@ else\
    if (node->unData.pcStrVal[0] == '0') val = 0

 #define CONTROL_PARSE_INT_DEF_3(node, val) \
-    if (node->unData.pcStrVal[0] == '3') val = 3
+    if (node->unData.pcStrVal[0] >= '0' && node->unData.pcStrVal[0] < '3') val = node->unData.pcStrVal[0] - '0'

 #define VTOY_JSON_INT(key, val) vtoy_json_get_int(json, key, &val)
 #define VTOY_JSON_STR(key, buf) vtoy_json_get_string(json, key, sizeof(buf), buf)
@@ -1 +1 @@
-20260624 16:39:09
+20260625 19:36:29
@@ -760,7 +760,7 @@

        <footer class="main-footer">
            <div class="pull-right hidden-xs">
-                <b id="plugson_build_date">20260624 16:39:09</b>
+                <b id="plugson_build_date">20260625 19:36:29</b>
            </div>
            <strong><a href="https://www.ventoy.net" target="_blank">https://www.ventoy.net</a></strong>
        </footer>
@@ -780,10 +780,10 @@
    <script src="/static/js/jQuery-2.1.4.min.js"></script>
    <!-- jquery validate -->
    <script src="/static/js/jquery.validate.min.js"></script>
-    <script src="/static/js/jquery.validate.vtoymethods.js?v=317"></script>
+    <script src="/static/js/jquery.validate.vtoymethods.js?v=331"></script>

-    <script src="/static/js/jquery.vtoy.alert.js?v=317"></script>
-    <script src="/static/js/vtoy.js?v=317"></script>
+    <script src="/static/js/jquery.vtoy.alert.js?v=331"></script>
+    <script src="/static/js/vtoy.js?v=331"></script>
    <script src="/static/js/md5.min.js"></script>

    <!-- Bootstrap 3.3.5 -->
@@ -228,6 +228,7 @@ DRESULT disk_write (
            return RES_OK;
        }

+        buff += 512;
        sector++;
        count--;
    }
Author	SHA1	Message	Date
longpanda	7cbdc5cf69	1.1.17 release Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-07-24 20:56:41 +08:00
longpanda	5903c8bf52	Fix the issue that proxmox-ve can not boot after install in grub2 mode.	2026-07-24 20:53:12 +08:00
Tiago Augusto PimentaandGitHub	40895a09f6	Fix fdisk detection on BusyBox systems (#3614 ) Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details On BusyBox, fdisk -v exists but returns a non-zero exit code, causing the script to incorrectly conclude fdisk is not available. Use POSIX command -v instead to reliably check for fdisk.	2026-07-24 18:26:25 +08:00
HYB1022andGitHub	ddc8e53156	[ko_KR] Improve Korean translation (natural phrasing & context fixes) (#3694 ) * edit context, Language refinement (korean) * Update languages.json	2026-07-24 17:31:58 +08:00
longpanda	e352b76731	Fix the PATH broken in Ventoy2Disk.sh (#3615 )	2026-07-24 17:21:49 +08:00
longpanda	5ebef5af77	Fix the boot issue for latest GhostBSD (#3664 )	2026-07-24 16:56:59 +08:00
longpanda	9be9c7adb8	Add support for Athena OS (#3689 )	2026-07-24 15:26:59 +08:00
longpanda	3751a47513	Add log for live injection process.	2026-07-24 14:14:12 +08:00
longpanda	6dd3ed3ce3	Fix the disk_write logic error (#3693 ) This is indeed a logic error, but actually it does not take effect so it does not cause any install/update failure.	2026-07-24 12:25:35 +08:00
longpanda	ac300d7464	Add support for some EulerOS release.	2026-07-24 11:52:45 +08:00
longpanda	0963c1d396	Fix the boot issue for some UOS release.	2026-07-24 11:49:59 +08:00
longpanda	a3995a0267	Optimization for secure boot process. Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-06-29 13:46:17 +08:00
longpanda	ba87af540b	Update hwinfo Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-06-28 23:06:50 +08:00
longpanda	3d0d6c3147	Optimization for secure boot process. Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-06-28 21:48:32 +08:00
longpanda	2915e197e9	Optimization for secure boot process. Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-06-28 00:24:59 +08:00
longpanda	9bf8393cdf	Optimization for secure boot process. Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-06-26 18:08:39 +08:00
longpanda	05d10437b0	Remove grub.cfg max resolution script function. Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-06-25 22:37:03 +08:00
longpanda	083e5f72ea	Optimization for Secure Boot process.	2026-06-25 22:36:33 +08:00
longpanda	2f66a309e4	1.1.16 release. Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-06-25 19:46:14 +08:00
longpanda	aa75cdac7d	VtoyShim build script update.	2026-06-25 19:39:15 +08:00
longpanda	ccf4f7234a	Fix the issue that VTOY_WIN_UEFI_RES_LOCK option reset when enter VentoyPlugson.	2026-06-25 19:38:47 +08:00
longpanda	c1cad99584	Merge branch 'master' of https://github.com/Ventoy/Ventoy	2026-06-25 19:31:39 +08:00
VenusGirl❤andGitHub	d9cab1cb33	Update Korean (#3649 )	2026-06-25 19:31:22 +08:00
independent-argandGitHub	18f4c8afcc	i18n: Update and optimize Spanish translation for grub and language JSON (#3648 ) * i18n: Update Spanish translation - Fixed grammatical inconsistencies (unified verbs to infinitive). - Corrected missing accents and typos (árbol, gráfico, depuración). - Standardized UI terminology to match original English text (GUI Mode). * i18n: Update and fix typos in Spanish (Latinoamérica) translation * docs(i18n): comprehensive Spanish localization updates * update Spanish translations for Ventoy strings	2026-06-25 19:31:07 +08:00
Roope YrjöläandGitHub	aeb46cd3c8	modified: LANGUAGES/languages.json (#3645 ) Modified the finnis language translation.	2026-06-25 19:30:54 +08:00
longpanda	475de1dada	Fix the boot issue with old UEFI version firmware when secure boot is disabled.	2026-06-25 19:23:48 +08:00
longpanda	31648a0d4b	Fix the latest Kicksecure boot issue. (#3651 )	2026-06-25 19:16:48 +08:00
longpanda	d51e76daa9	1.1.15 release Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-06-25 08:56:32 +08:00
longpanda	f677d72e8d	Fix the boot issue when Secure Boot is disabled in the UEFI firmware. (#3650 )	2026-06-25 08:52:07 +08:00
longpanda	6418c2a09f	1.1.14 Ventoy CI / build (push) Has been cancelled Details Mirror GitHub to Gitee / Sync-GitHub-to-Gitee (push) Has been cancelled Details	2026-06-24 20:55:20 +08:00
longpanda	c2a3f181c0	Fix the secure boot issue.	2026-06-24 20:52:56 +08:00