My computer currently has two EFI bootNNNN entries for Windows:
Boot0004 Windows Boot Manager HD(1,GPT,[redacted],0x800,0x1ff800)/File(\EFI\MICROSOFT\BOOT\BOOTMGFW.EFI)57494e444f5753000100000088000000780000004200430044004f0042004a004500430054003d007b00390064006500610038003600320063002d0035006300640064002d0034006500370030002d0061006300630031002d006600330032006200330034003400640034003700390035007d00000000120100000010000000040000007fff0400Boot0009 Windows Boot Manager HD(1,GPT,[redacted],0x800,0x1ff800)/File(\EFI\MICROSOFT\BOOT\BOOTMGFW.EFI)0000424f
As you can see, they are identical except for the "optional data" payload -- the hexadecimal string after each path. I am troubleshooting the boot process and would like to understand what each of these payloads means. The EFI spec only says that this data is passed verbatim to the program being booted (BOOTMGFW.EFI in this case), so I presume if this is documented anywhere it'll be in low-level Windows docs. I tried to look through MSDN but found only instructions for how to configure the boot loader, nothing about how that maps to what it writes to EFI variables.
The longer one of the payloads has one ASCII and one UTF-16 string embedded in it. Here's a partially decoded version:
WINDOWS\001 00 00 0088 00 00 0078 00 00 00BCDOBJECT={9dea862c-5cdd-4e70-acc1-f32b344d4795}00 00 00 1201 00 00 0010 00 00 0004 00 00 007f ff 04 00
The last four bytes, 7f ff 04 00
, are an EFI "end entire device path" marker, but the byte sequence in between the BCDOBJECT= string and that marker does not appear to be an EFI device path. (It's possible that the first two bytes of that sequence actually belong to the BCDOBJECT= string, being a U+0000 string terminator, but neither 00 00 nor 00 12 can be the beginning of a valid EFI device path.)
The GUID in the BCDOBJECT= string is not the GUID of the main Windows partition (i.e. the one that stores C:\WINDOWS
).
The shorter "optional data" payload contains two ASCII characters, "BO" in that order, preceded by what I presume are two bytes of NUL padding.