The UEFI GRUB2 Menu System
For UEFI-booting direct from .ISO, .EFI and other payload files using grub2
NEW VERSION: The UEFI_GRUB2_PTN2_Beta10.zip download is available in the 'Alternate Downloads' area.
Beta10 now displays a full Secure Boot menu
Note: Beta10 now supports Secure Boot BUT the 2nd partition must be FAT32 for Secure Boot to detect the ISO files. Also, only six specific custom .grub2 menu files are now detected. If you have added your own .grub2 files, you must rename them as custom_menu.grub2, custom1_menu_grub2, custom2_menu.grub2 up to custom5_menu.grub2. You can add more .grub2 files to these six files by using a 'source' command.
- The main purpose of the GRUB2 menu system, is to allow you to UEFI-boot directly to a menu containing multiple linux ISOs and .EFI files (even if some are not officially UEFI-bootable!).
- Some ISOs that do not contain any UEFI boot files (\EFI\boot\bootx64.efi and bootia32.efi) will still UEFI-boot via the grub2 menu system! For instance, the 32-bit Zorin 11 ISO does not contain EFI boot files, yet it can be UEFI-booted direct from the ISO using grub2.
- Once you switch to the grub2 menu .imgPTN file, you can UEFI-boot and MBR-boot to a wide range of payloads all from one grub2 menu system.
- Works best with E2B USB HDDs (fixed-disk type) - but can be used on Removable devices too
- No need to make files contiguous
- Can UEFI-boot some linux payloads that do not contain UEFI boot files and cannot normally UEFI-boot (e.g. can boot in all these additional modes: deftz EFI32, kali EFI64, kali light 32 EFI64&EFI32, nst EFI64&EFI32, ophcrack EFI64&EFI32, weakerthan EFI64&EFI32, debian EFI64, fedora EFI32, knoppix EFI64, systemrescuecd EFI32, zorin32 EFI32, avira EFI32, bitdefender EFI32, pwh32 EFI32, drweb EFI64&EFI32, eset EFI64&EFI32 - see blog)
- You can add your own 'custom' .grub2 menu files and payload files without editing any existing files
- The same payload files can also be booted from within the E2B grub4dos menu system (in MBR-mode)
- Ideal for linux-based users who do not have access to WinContig/MPI Tool Pack
- Comprehensive spreadsheet available of supported (linux) payloads
- Some menus also support persistence
- You can UEFI-boot (most) payload files (ISOs, etc.) from an NTFS partition (for secure boot - use FAT32 for ptn2)
- Drive can be write-protected (after it has been switched to the grub2 .imgPTN file)
- Can also Secure Boot to grub2 but partition 2 must be FAT32 (not NTFS) so ISOs must be <4GB.
- ISO filenames must not contain spaces and are case-sensitive - each ISO must have a specific name and there must be a .grub2 menu file which looks for it.
- Each different payload requires a different and unique .grub2 menu (many menus are already provided).
- Some systems may not allow you to MBR-boot when switched to the 'grub2 menu mode' (no boot option) - this is a BIOS firmware bug. To return to E2B mode, use \e2b\SWITCH_E2B.exe.
- You need to have, or create, a second primary partition on your E2B drive.
- Works best with a FAT32 2nd partition, but FAT32 cannot contain files over 4GB, however if you use an NTFS 2nd partition, then some ISOs will not boot (e.g. Fedora, gentoo, CentOS, BitDefender require FAT32 for 2nd partition). If you want to Secure Boot, the 2nd partition must be FAT32.
- Must give each ISO or payload file a specific unique name that is recognised by the grub2 menu.
- The grub2 .imgPTNLBAa23 partition image file on the E2B partition must be contiguous.
- If an ISO does not support linux cheat codes for ISO-booting, you will need to extract the files from the ISO.
- To boot from the ISOs using the E2B menu, the ISOs need to be contiguous (use WinContig or linux defrag utility).
- You don't get all boot menu options of the ISO's full internal boot menu (e.g. live, install, safe mode, memtest, etc.) unless you make your own menu entries for each option.
- If a linux distro changes it's scripts or kernel, you may need to re-write the .grub2 menu file - i.e. the grub2 menu files may become outdated.
Updating an existing E2B GRUB2 drive
How to add the E2B Grub2 Menu system to your E2B drive
1. First make a 2nd Primary partition on the E2B drive
If a small second partition already exists on the E2B USB drive (which it will if you used the E2B script to make it), you should delete it.If your E2B USB drive does not already contain a second primary partition, then create one using a suitable partition manager (I recommend EaseUS Home Partition Master - free edition, which can add a second primary partition even to a Removable USB drive and can create >32Gb FAT32 volumes).Use RMPrepUSB - Drive Info to check that you only have two Primary partitions.
WARNING: Do NOT use Windows Disk Manager to view partitions - it does not correctly show small partitions!
- Most compatible
- Only allows files below 4GB in size (note a few ISOs are >4GB, e.g. openSUSE-Leap-42.1-DVD-x86_64.iso, blackarchlinux.)
- If you want to also store backups on this 2nd partition, you will be limited to <4GB files
- Allows menu to work if you Secure Boot
- Some linux ISOs will not boot from an NTFS drive under grub2 - e.g. Fedora, CentOS, bitdefender and gentoo (see spreadsheet for more).
- You can have files >4GB on the second partition (and thus place large backup files on it and large .iso files).
- Only Memtest86 can be run if you Secure Boot.
Note: The first partition of an E2B USB drive should contain your E2B files.
1.1 Copy the files from the PTN2 folder to the second partition
Note: Some older Windows versions can only access the first partition on a Removable USB drive. You can swap over PTN1<>PTN2 by using SWITCH_E2B.exe or RMPrepUSB - CTRL+O - 2. Once you have copied over the payload files to partition 2, switch the partitions back again.
2. Add the UEFI_GRUB2_PTN2_Betaxx.imgPTNLBAa23 file
3. Add the 'PTN2' .mnu files to the E2B menu system (optional)
4. Add the payload files to the second partition
- Payload files must be added to the second partition (the E2B partition disappears when you switch in the .imgPTNLBAa23 file!)
- The payload filename must be a specific name for it to be recognised by the grub2 menu system.
For instance, for the AVG ISO, avg_arl_cdi_all_120_150814a10442.iso, you must rename it to avg.iso.
Nearly all payload file names are lowercase (they must match what is used in the .grub2 menu files).
- Payload files must be copied to the correct folder. The \_ISO\MAINMENU folder will recognise all ISO files because it contains all .grub2 menu files. The \_ISO\LINUX folder only recognises payloads specified in the linux.grub2 menu file.
For instance, avg.iso will only be detected if placed in the \_ISO\MAINMENU or \_ISO\MAINMENU\MNU or \_ISO\LINUX or \_ISO\LINUX\MNU folders.
There will be a list of what these filenames need to be in the \readme.txt file and .xls spreadsheet.
For instance, kali.iso can be placed under the MAINMENU folder or the UTILITIES folder, but it will not work if placed under the LINUX folder.
- Payload files placed in a '\MNU' sub-folder will not be enumerated by the E2B menu system unless you add an E2B .mnu file (but will be enumerated by the GRUB2 menu system).
Tip: Double-click the \FIND_A_STRING_IN_A_GRUB2_MENU.cmd script and enter a search string (e.g. kali). This will then list all lines in the grub2 menu files with the string "kali" in them. This allows you to find out what the filename should be and if a menu is present and what .grub2 file the menu entry is in.
Tip: Copy \MAKE_THIS_DRIVE_CONTIGUOUS.cmd to \ on the 2nd grub2 partition, and also copy the whole \_ISO\docs\WINCONTIG folder to the 2nd partitions \_ISO\docs\WINCONTIG folder. Then you can double-click on the \MAKE_THIS_DRIVE_CONTIGUOUS.cmd script on the 2nd partition to make all files contiguous on that partition.
5. Switch in the .imgPTNLBAa23 file
Finally, you must switch partitions so that you can boot to the grub2 menu system.
Use \_ISO\SWITCH_E2B.exe and double-click on the UEFI_GRUB2_PTN2xxxxx.imgPTNLBAa23 file...
OR boot to E2B and use the E2B menu to select the UEFI_GRUB2_PTN2xxxxx.imgPTNLBAa23 file.
The E2B partition will disappear and the new grub2 partition will be seen on the USB drive.
You should now be able to MBR-boot to the grub4dos CSM menu and select the grub2 menu system, or directly UEFI-boot to the grub2 menu system.
To restore back the E2B menu system, use \e2b\SWITCH_E2B.exe - Restore E2B partitions (under Windows), or use Menu #0 in the CSM Menu.
How it works
Kaspersky AV rescue.iso (extracted)
The Kaspersky rescue.iso must be extracted to the root of partition 2. Then move the \boot folder into the \rescue folder (so you get a \rescue\boot folder). Instructions are in the \rescue\readme.txt on partition 2.
Copy \_ISO\docs\Sample mnu Files\kaspersky_extracted.grub2 to the \_ISO\ANTIVIRUS\grub2 folder and rename to custom_menu.grub2 - a menu entry for Kaspersky will then appear in the AntiVirus grub2 menu system - if the extracted files are detected.
Note that you can UEFI-64 boot to Kaspersky even though there are no EFI boot files inside the ISO (EFI32 should also work).
Note: If you wish to run Kaspersky AntiVirus with persistent updates you will need to make a larger .imgPTNLBAa23 file as follows:
1. 'Switch' to the UEFI_GRUB2_PTN2.imgPTNLBAa23 partition using \_ISO\SWITCH_E2B.exe and copy the entire contents to an empty folder 'GRUB2' on your PC's hard drive (don't copy the System Volume Information folder or Recycle Bin folder) . Then switch back to the E2B partition using SWITCH_E2B.exe - Restore E2B Partition(s).
2. Drag-and-drop the GRUB2 folder onto the MPI_FAT32 Desktop shortcut - choose a size of 400MB (must be at least 300MB). Name the file as something suitable, e.g. UEFI_GRUB2_PTN2_400MB.imgPTNLBAa23. If asked to merge the menu.lst, choose Y or N - it does not matter because we are going to destroy the files in step 4 below!
3. Now copy the new UEFI_GRUB2_PTN2_400MB.imgPTNLBAa23 file to your E2B USB drive's \_ISO\MAINMENU folder and 'switch' to it using \_ISO\SWITCH_E2B.exe. Check that you can now see a 'g2ldr' file in the root of the new partition.
4. IMPORTANT: Now re-copy the entire contents of the original GRUB2 folder to the partition and overwrite all the files (allow enough time for all the files to be copied). This is required because the MPI_FAT32 (MakePartImage) script will have incorrectly modified some of the files. If there is not enough disk space, delete the \boot folder from the new partition (hold down SHIFT+DEL so they are not copied to the Recycle bin on the drive!) and then re-copy all the GRUB2 files again. The contents of the new partition should be identical to the contents of the GRUB2 original folder. Double-check the folder contents carefully and make sure all the files have been copied!5. Copy the \Kaspersky Rescue Disk 10.0 folder to the root of the first partition on the E2B drive, or boot to Kaspersky and ensure that after downloading updates, the \Kaspersky Rescue Disk 10.0 folder is now present on the USB drive.
The \Kaspersky Rescue Disk 10.0 folder will be used to store the updates, but make sure that no other disk in the system you are booting on has a folder of the same name in the root of any drive - if it does, then delete the Kaspersky Rescue Disk 10.0 folder from any of the internal hard drives, otherwise the updates may be stored there instead!
Updating your UEFI GRUB2 files with a newer version
Useful GRUB2 Windows scripts
You can use the \UPDATE_GRUB2_FILES_FROM_MAINMENU.cmd script to do this. It will use the .grub2 files in the \_ISO\MAINMENU\grub2 folder as the 'MASTER SOURCE' and then update any .grub2 files of an identical name in all the other folders. To understand what it does, use T (TEST) so it does not actually alter any files. This means you just need to edit the .grub2 files in \_ISO\MAINMENU\grub2 and the script will update all other instances of the same file in the other seven folders (if it exists in those folders).
Additional .grub2 menu files
How to use the GRUB2 menu system
1. First you must switch to the UEFI_GRUB2_PTN2.imgPTNLBAa23 image (by booting to E2B or using SWITCH_E2B.exe).
Note: You can change the name and add 'AUTO' to the file extension - e.g. 'UEFI Grub2 Menu System.imgPTNLBAa23AUTO'. It will immediately switch to the CSM menu.
2. If you MBR-boot, you will see the GRUB2 CSM menu. You can choose the GRUB2 menu entry and boot to the GRUB2 menu in MBR-mode.
Grub2 CSM menu
Default menu (GRUB2 MBR-mode menu)
Theme option with USETHEME set in defaults.txt file (Grub2 MBR-mode menu)
From the CSM menu, you can boot via either Clover 32-bit or 64-bit and then select the only option visible to boot to the GRUB2 menu in UEFI-mode.
UEFI Theme option with USETHEME set in defaults.txt file (Grub2 UEFI-mode menu)
Menu entry order
Alternativley, if you use color_normal=gray/black and a wallpaper with the same grey backround colour, you can hide the menu header and footer text because they will be the same colour as the background. This greyE2B.jpg can be used or modified as you wish.
GRUB2 files and folders explained
Files in the .imgPTN image
Files on the 2nd partition
The .grub2 menu files
You can therefore control what payload files are detected by adding or removing the .grub2 files in these grub2 folders:
About the xxxx_extracted.grub2 files
Tip: You can test load a background image by pressing c in the grub2 menu to get to the grub2 console and type background_image (hd0,msdos2)/_ISO/myimg.png.
Note: showdelay=10 - in Secure Boot mode, 'Press a key to continue' is not supported, so a delay is used instead.
How to add your own payload files
Note: If you don't want freddy.iso to appear in the E2B Utilities PTN2 menu (perhaps you have a .mnu file for it?), then move both files to the MNU sub-folder, i.e.\_ISO\UTILITIES\MNU\grub2\custom_menu.grub2\_ISO\UTILITIES\MNU\freddy.iso
For E2B menu support, you will also need to create a .mnu file which calls QRUN.g4b if you want to run the ISO from the E2B menu system.
Making your own .grub2 menu file
- The first line (if $EFI; then) tests the current environment, you can choose from $MBR $EFI $BIT64 $BIT32 $EFI32 $EFI64 $MBR32 $MBR64 or $FAT (they can be 'true' or 'false'). This prevents the menu entry from being displayed if it is known that it does not work. For instance, if it only works when booted on UEFI 64-bit systems, use $EFI64. If the payload works on both 32-bit MBR and 32-bit UEFI systems, use $BIT32. If the payload works only in MBR mode, use $MBR. Use $FAT if it only works in FAT partitions. Each 'if' statement must be balanced with a corresponding 'fi' statement.
- The 2nd line checks for the existence (-e) of the file. The menu entry will not be shown if this test fails.
- The menuentry line displays the menu entry text, --unrestricted is the security (password) category and should always be used - see here for more details. The --class parameter defines which menu icon to use. You can also add a --hotkey entry to this line if you want a hotkey (e.g. --hotkey f5 or --hotkey ctrl+g or --hotkey G).
- The next line defines the name of the payload file and calls the CHECK_MNU_FOLDER function.
The CHECK_MNU_FOLDER function sets up the following variables with the correct path:
$ip - path to the payload file - e.g. /_ISO/MAINMENU/MNU
$ifp - full path with device name - e.g. (hd0,msdos2)/_ISO.MAINMENU/MNU
$isofilename - the path+filename - e.g /_ISO/MAINMENU/MNU/new.iso
Note: Do NOT use $isofpath inside a menuentry - it may contain the incorrect path!
- The next lines will depend on your payload file:
- set root=$root2 - sets the root to the 2nd partition
- loopback loop $isofilename - mounts the payload as a loop device
- linux (loop)/casper/vmlinuz file=/cdrom/preseed/ubuntu.seed boot=casper iso-scan/filename=$isofilename quiet splash --
- initrd (loop)/casper/initrd.lz
- boot - always end the menu with this command. If you omit it, you may get a 'press a key to continue' message.
Allowing for annoying distro version changes!
For example, Fedora version 25 ISO may use vmlinuz0 and initrd0.img, but the version 26 ISO might use vmlinuz and initrd.img.
loopback --delete loop
Testing your .grub2 menu
- FAT32 - MBR32
- FAT32 - MBR64
- FAT32 - EFI32
- FAT32 - EFI64
- NTFS - MBR32
- NTFS - MBR64
- NTFS - EFI32
- NTFS - EFI64
- FAT32 - EFI64 SECURE BOOT
Depending on the results, you can add in the correct test 'if' line (e.g. if $EFI64; then) to the menu text so that the user is not presented with a menu item that will not work.
Changing the theme background or menu layout (USETHEME)
Speeding up the Main grub2 menu
Grub2 keyboard support
Q4. I added a payload file to one of the menu folders, but it does not appear in the menu - why?
A4. First make sure you are using Beta10 or later. Then check the name of your ISO and that it is all lowercase, e.g. if it is an antivirus ISO file, look for a reference to it in the antivirus_menu.grub2 file. When you find the grub2 file it is mentioned in, check that there are no 'if' statements that may prevent the ISO from being listed (for instance, if you have MBR booted but the menu entry will only be enabled on UEFI boots, or if your 2nd partition is an NTFS partition but the ISO only works on FAT32 partitions.
- Disable Secure Boot if the 2nd partiion is an NTFS partition and you are Secure Booting - Ptn2 should be FAT32 for Secure Boot
- Version 10 no longer detects all *.grub2 files, you must use custom_menu.grub2, etc. for your .grub2 menu files
- Check it is on the second Primary partition and in the correct folder (e.g. \_ISO\MAINMENU)
- Check the file name and case is correct - e.g. avg.iso not Avg.iso or AVG.iso or avg.ISO
- Check it works under your environment - e.g. a 64-bit ISO may not be listed on a 32-bit system or it may not be listed on a UEFI system if it is known not to work under UEFI.
- Check that it works on the type of partition (FAT32 or NTFS) that it is on (see FAQ Q3 above).
- Check for syntax errors in the .grub2 menu (see Q2).
Also, there was a bug in Beta3 .grub2 menu file so it is listed in menu when it shouldn't be if on an NTFS volume!
Secure Boot must be disabled in the BIOS\Firmware menu if the 2nd partition is NTFS (use Beta10+).
How it works
Q10. I made a copy of your .grub2 menu for my own linux ISO as custom_menu.grub2, but I get a 'no medium found'\'squashfs' error - why? - Check that there are no spaces in the path or filename of your ISO.
Q11. Why is Eset not supported? - It is now! See blog post here.
Q12. How can I boot to Windows from the grub2 menu? - I would suggest that you use VHDs to hold each Windows OS and copy each VHD file to the 2nd partition. Then place your \bootmgr file, \boot folder (with BCD) and \EFI\Microsoft\boot folders on partition 1 (Primary active). You will need to modify the \boot\BCD and \EFI\Microsoft\boot\BCD files to add boot entries to point to each VHD file (e.g. using BootIce). Then add a .grub2 menu file so that the menu entry to boot to \bootmgr and \EFI\Microsoft\boot\bootmgfw.EFI will be added into grub2 menu system. See he re for more information. I have not yet tried this myself though...
Q13. How can I install multiple Windows 7/8/10 from the grub2 menu? - See this reboot.pro thread. The boot files and \boot\bcd should be on the first partition. Your custom_menu.grub2 menu can use this menu code (case sensitive filenames):
set root = $root if $MBR then ntldr /bootmgr else chainloader /efi/microsoft/bootx64.efi fi
For MBR-booting directly from Windows Install ISOs in MBR-mode only - see here.
Q14. How can I MBR-boot from a range of different WinPE-based ISOs? - Use the winpe_menu.grub2 menu file which you can find in the Alternate Downloads areas in the grub2 folder. The ISO must contain a \sources\boot.wim file. Instructions are inside the .grub2 file. Rename it as customn_menu.grub2 and edit it as required. You will need to download and add wimboot and also add bootmgr and bootmgr.exe to the \wimboot folder on partition 2. Note that All-In-One WinPE ISOs may fail to load the ISO as drive Y: after it boots and so may not be fully functional!
Q15. I pressed the ESC key and now I am in the grub console - how can I return back to the grub2 menu? Type exit or normal and press ENTER. To prevent this from happening again, set a supervisor user and password in the /_ISO/MAINMENU/grub2/defaults.txt file (see above).
Recommended for Easy2Boot (fastest!) - SanDisk Extreme SDCZ880-128G-G46