Re: BIOS_grub GUID signature within an EFI partition?

[Randy Goldenberg]

If after booting Linux a directory "efi" is present in /sys/firmware, the
system booted EFI.  If the directory is not present, it booted legacy BIOS.

I will leave diagnosis of what's going on with your computer and why to its
administrator.

On Tue, Sep 12, 2023 at 11:41 AM Moses Gold <mosesogold@gmail.com> wrote:

> Thought I might have UEFI malware after trying to install an old version
> of Windows. Looks like sector one of the drive is just part of the GPT
> partition table scheme and not an EFI partition itself. Sector 2 looks like
> the beginning of the BIOS boot partition with the grub GUID signature,
> though the partitioning software (gdisk, and gparted) state that partition
> 1 starts at sector 2048. The partition at sector 2048 has an EFI directory
> structure, and includes the grubx64.efi file. I was looking at grub with
> interest because when I went to reset my UEFI firmware (windows key plus
> "B" on power up), I initially booted into a grub command prompt rather than
> a UEFI menu. I was thinking that maybe some malware had loaded grub in
> place of the regular UEFI firmware (could be that the firmware uses grub
> legitimately during the firmware reset?). Anyway, I was able to load
> windows 10 from this grub command line, and ran a BIOS update app
> downloaded from HP; after that I was able to boot into the UEFI menu.
> Here's an image of how gparted sees the linux partitions and boot partition
> as they are currently.
>
> On Tue, Sep 12, 2023 at 11:59 AM Randy Goldenberg <
> randy.goldenberg@gmail.com> wrote:
>
>> A BIOS boot partition would not typically have a file system.  Why both a
>> GUID signature associated with legacy BIOS boot and an efi executable would
>> be on a partition labelled as a BIOS boot partition is a mystery to me.
>>
>> What is your goal?
>>
>> On Tue, Sep 12, 2023 at 7:31 AM Moses Gold <mosesogold@gmail.com> wrote:
>>
>>> Thanks. Does that mean that the grubx64.efi on this partition is
>>> extraneous?
>>>
>>> On Mon, Sep 11, 2023 at 9:55 PM, Randy Goldenberg <
>>> randy.goldenberg@gmail.com> wrote:
>>>
>>>> EF02 is a BIOS boot partition.
>>>>
>>>> On Mon, Sep 11, 2023 at 6:04 PM Moses Gold <mosesogold@gmail.com>
>>>> wrote:
>>>>
>>>>> The BIOS_grub GUID signature:
>>>>> "48 61 68 21 49 64 6F 6E 74 4E 65 65 64 45 46 49 -- Hah!IdontNeedEFI"
>>>>> is contained within my EFI partition after a recent grub install (grub
>>>>> and
>>>>> EFI added during same Linux installation). Specifically, the EFI
>>>>> partition
>>>>> begins at sector 1 of my boot device /dev/nvme0n1 and the BIOS_grub
>>>>> signature appears at sector 2. gdisk says the following:
>>>>>
>>>>> Number  Start (sector)    End (sector)  Size       Code  Name
>>>>>    1            2048         1628159   794.0 MiB   EF02
>>>>>
>>>>> Is this the normal predicted configuration of BIOS_grub with an EFI
>>>>> partition?
>>>>>
>>>>