In-depth Exploration of UEFI Booting: Is the Location of the EFI Bootloader Fixed?

Deep Dive into UEFI Booting: Is the Location of the EFI Bootloader Fixed?

For Windows systems, bootx64.efi and bootmgfw.efi are the same file, just with different names. They are essentially both bootmgfw.efi, used to boot Windows, and cannot boot other systems.

Therefore, even though Windows installation creates a bootx64.efi in the EFI partition, since it’s identical to bootmgfw.efi, it cannot boot other systems (such as Linux).

Booting a Linux system requires a Linux-specific bootx64.efi. Although the name is the same, the file itself is different.

Since Linux systems use the GRUB bootloader to start, a viable boot process for a computer under Linux is UEFI -> bootx64.efi -> GRUB. Essentially, bootx64.efi launches GRUB (which is also an EFI program), and GRUB then boots Linux.

Moreover, due to GRUB’s powerful boot capabilities, it can boot Windows, Linux, macOS, and many other system types. Therefore, computers with dual-boot setups (Linux and Windows) typically use GRUB as the bootloader instead of Windows Boot Manager.

---

The boot entries in the UEFI boot menu are stored in the motherboard’s NVRAM (Non-Volatile Random Access Memory), not on the hard drive. Therefore, they cannot be modified by manipulating the hard drive, but can be changed through settings within the UEFI firmware.

In the UEFI boot menu, each boot entry points to an EFI program.

• Windows Boot Manager points to bootmgfw.efi
• Hard drive boot entry points to bootx64.efi
• If Linux is installed, the UEFI boot menu may contain a Linux boot entry (the author hasn’t used this, so details are unknown).

Thus, Windows computers have two viable boot processes:

1. UEFI -> bootmgfw.efi (Windows Boot Manager) -> Read BCD file -> Boot
2. UEFI -> bootx64.efi (Hard drive boot entry) -> Read BCD file -> Boot

---

Exploring How the Location of EFI Bootloaders Affects System Booting

Does bootx64.efi have to be in the EFI\boot folder? Does bootmgfw.efi have to be in the EFI\Microsoft\boot folder? What happens if you move them?

To understand the basic working principles of EFI bootloaders, the author conducted controlled variable experiments.

---

bootx64.efi

First, the author deleted bootmgfw.efi, leaving only bootx64.efi. Then, the author copied bootx64.efi to various locations within the EFI partition, including:

• EFI partition root (\)
• \EFI\
• \EFI\Microsoft\
• \EFI\Microsoft\Recovery\
• \EFI\Microsoft\Boot\

The author deleted the original location of bootx64.efi to prevent interference.

Using VMware, the author tested booting from each copy of bootx64.efi within the UEFI firmware. The results were as follows:

All copies of bootx64.efi could boot the computer, except for the one in \EFI\Microsoft\Recovery\.

The author then moved all files containing “BCD” in their names from the \EFI\Microsoft\boot\ folder to other locations within the EFI partition. After this, none of the bootx64.efi copies could boot.

So, why couldn’t the bootx64.efi inside \EFI\Microsoft\Recovery\ boot the system?

To investigate, the author deleted all BCD files inside \EFI\Microsoft\Recovery\, leaving only bootx64.efi. Then, booting from this file successfully started Windows.

---

Summary of bootx64.efi

The process of bootx64.efi booting Windows can be summarized as follows:

• bootx64.efi first checks if there is a BCD file in its own folder. If yes, it reads that BCD directly and boots accordingly.
• If there is no BCD file in its own directory, it searches for a BCD file in the EFI partition at the fixed path \EFI\Microsoft\boot\BCD. It then boots using this file.
• If there is no valid BCD file in \EFI\Microsoft\boot\, the system cannot boot.

This explains the earlier issue. The Recovery folder originally contained a BCD file, and bootx64.efi prioritized reading that BCD. However, that BCD file was not the Windows system’s BCD, but rather the Windows Recovery Environment (WindowsRE) BCD. Since the author’s test VM did not have WindowsRE, it could not boot.

---

bootmgfw.efi

The author conducted identical tests on bootmgfw.efi as on bootx64.efi.

The results showed that bootmgfw.efi behaved exactly the same as bootx64.efi, further proving that in Windows systems, bootmgfw.efi and bootx64.efi are the same file.

---

I hope this article deepens your understanding of the Windows boot process.